sandboxedjs 0.1.34 → 0.1.36

package/dist/rolldown-wasi-worker.js

@@ -0,0 +1,71 @@
+import { createRequire } from 'module';
+import { readFileSync } from 'fs';
+import { workerData, Worker, parentPort } from 'worker_threads';
+
+// src/runtime/rolldown-wasi-worker.ts
+var options = workerData ?? {};
+var require2 = createRequire(options.runtimeAnchor ?? import.meta.url);
+var {
+  instantiateNapiModuleSync,
+  MessageHandler,
+  WASI,
+  createFsProxy,
+  emnapiAsyncWorkPlugin,
+  emnapiTSFNPlugin
+} = require2("@napi-rs/wasm-runtime");
+var { memfsExported } = await import(options.fsModuleUrl);
+Object.assign(globalThis, {
+  self: globalThis,
+  require: require2,
+  Worker,
+  importScripts(file) {
+    (0, eval)(`${readFileSync(file, "utf8")}//# sourceURL=${file}`);
+  },
+  postMessage(message) {
+    parentPort?.postMessage(message);
+  }
+});
+if (parentPort) {
+  parentPort.on("message", (data) => {
+    globalThis.onmessage?.({ data });
+  });
+}
+var errorOutputs = [];
+var handler = new MessageHandler({
+  onLoad({ wasmModule, wasmMemory }) {
+    const wasi = new WASI({
+      /* The proxy is the whole point: every syscall goes to the main thread,
+       * which answers from the volume the container keeps in step. */
+      fs: createFsProxy(memfsExported),
+      preopens: { "/": "/" },
+      print: (...args) => console.log(...args),
+      printErr: (...args) => {
+        console.error(...args);
+        errorOutputs.push(args);
+      }
+    });
+    return instantiateNapiModuleSync(wasmModule, {
+      childThread: true,
+      wasi,
+      /* The wasm links a "basic" emnapi archive with no C implementations of
+       * async work or threadsafe functions, so every thread has to bring the
+       * JavaScript ones. */
+      plugins: [emnapiAsyncWorkPlugin, emnapiTSFNPlugin],
+      overwriteImports(importObject) {
+        importObject.env = {
+          ...importObject.env,
+          ...importObject.napi,
+          ...importObject.emnapi,
+          memory: wasmMemory
+        };
+      }
+    });
+  },
+  onError(error) {
+    globalThis.postMessage({ type: "error", error, errorOutputs: [...errorOutputs] });
+    errorOutputs.length = 0;
+  }
+});
+globalThis.onmessage = (event) => handler.handle(event);
+//# sourceMappingURL=rolldown-wasi-worker.js.map
+//# sourceMappingURL=rolldown-wasi-worker.js.map

package/dist/rolldown-wasi-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/rolldown-wasi-worker.ts"],"names":["require"],"mappings":";;;;;AAiCA,IAAM,OAAA,GAAW,cAAc,EAAC;AAChC,IAAMA,QAAAA,GAAU,aAAA,CAAc,OAAA,CAAQ,aAAA,IAAiB,YAAY,GAAG,CAAA;AAEtE,IAAM;AAAA,EACJ,yBAAA;AAAA,EACA,cAAA;AAAA,EACA,IAAA;AAAA,EACA,aAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF,CAAA,GAAIA,SAAQ,uBAAuB,CAAA;AAInC,IAAM,EAAE,aAAA,EAAc,GAAI,MAAM,OAAO,OAAA,CAAQ,WAAA,CAAA;AAU/C,MAAA,CAAO,OAAO,UAAA,EAAY;AAAA,EACxB,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAAA,QAAAA;AAAA,EACA,MAAA;AAAA,EACA,cAAc,IAAA,EAAc;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,YAAA,CAAa,MAAM,MAAM,CAAC,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAE,CAAA;AAAA,EAChE,CAAA;AAAA,EACA,YAAY,OAAA,EAAkB;AAC5B,IAAA,UAAA,EAAY,YAAY,OAAO,CAAA;AAAA,EACjC;AACF,CAAC,CAAA;AAED,IAAI,UAAA,EAAY;AACd,EAAA,UAAA,CAAW,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACjC,IAAC,UAAA,CAAmB,SAAA,GAAY,EAAE,IAAA,EAAM,CAAA;AAAA,EAC1C,CAAC,CAAA;AACH;AAEA,IAAM,eAA4B,EAAC;AAEnC,IAAM,OAAA,GAAU,IAAI,cAAA,CAAe;AAAA,EACjC,MAAA,CAAO,EAAE,UAAA,EAAY,UAAA,EAAW,EAAuE;AACrG,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA;AAAA;AAAA,MAGpB,EAAA,EAAI,cAAc,aAAa,CAAA;AAAA,MAC/B,QAAA,EAAU,EAAE,GAAA,EAAK,GAAA,EAAI;AAAA,MACrB,OAAO,CAAA,GAAI,IAAA,KAAoB,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAI,CAAA;AAAA,MAClD,QAAA,EAAU,IAAI,IAAA,KAAoB;AAChC,QAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAI,CAAA;AACrB,QAAA,YAAA,CAAa,KAAK,IAAI,CAAA;AAAA,MACxB;AAAA,KACD,CAAA;AAED,IAAA,OAAO,0BAA0B,UAAA,EAAY;AAAA,MAC3C,WAAA,EAAa,IAAA;AAAA,MACb,IAAA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAA,EAAS,CAAC,qBAAA,EAAuB,gBAAgB,CAAA;AAAA,MACjD,iBAAiB,YAAA,EAAmB;AAClC,QAAA,YAAA,CAAa,GAAA,GAAM;AAAA,UACjB,GAAG,YAAA,CAAa,GAAA;AAAA,UAChB,GAAG,YAAA,CAAa,IAAA;AAAA,UAChB,GAAG,YAAA,CAAa,MAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH,CAAA;AAAA,EACA,QAAQ,KAAA,EAAgB;AACtB,IAAC,UAAA,CAAmB,WAAA,CAAY,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,YAAA,EAAc,CAAC,GAAG,YAAY,CAAA,EAAG,CAAA;AACzF,IAAA,YAAA,CAAa,MAAA,GAAS,CAAA;AAAA,EACxB;AACF,CAAC,CAAA;AAEA,UAAA,CAAmB,SAAA,GAAY,CAAC,KAAA,KAAmB,OAAA,CAAQ,OAAO,KAAK,CAAA","file":"rolldown-wasi-worker.js","sourcesContent":["/**\n * A Rolldown WASI worker thread whose filesystem is the container's.\n *\n * Rolldown's npm package ships two of these. The browser one builds its\n * filesystem from an in-memory volume proxied back to the main thread; the\n * Node one calls `node:wasi` with `preopens: { \"/\": \"/\" }` and reads the real\n * disk. Neither is usable as-is here: the browser file wants browser worker\n * globals, and the Node file wants the host's filesystem — which is precisely\n * the thing a container must not hand to the code running inside it.\n *\n * So this is the crossing of the two: Node's worker plumbing around the\n * browser's filesystem. Every path Rolldown opens on this thread is forwarded\n * to the main thread and served out of the memory volume the container mirrors\n * itself into, so the bundler and the rest of the container see one filesystem.\n *\n * Bundled as its own entry point, because a worker is fetched as its own\n * module graph rather than through the main bundle.\n */\n\nimport { createRequire } from \"node:module\";\nimport { readFileSync } from \"node:fs\";\nimport { parentPort, workerData, Worker } from \"node:worker_threads\";\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\n/**\n * Resolved against the binding's own location, not this file's.\n *\n * `@napi-rs/wasm-runtime` arrives as a dependency of the Rolldown binding,\n * which an installer is free to place anywhere — nested, hoisted, in a store\n * behind a symlink. Anchoring the lookup to the package that actually depends\n * on it is what keeps this working under npm, pnpm and Yarn alike.\n */\nconst options = (workerData ?? {}) as { runtimeAnchor?: string; fsModuleUrl?: string };\nconst require = createRequire(options.runtimeAnchor ?? import.meta.url);\n\nconst {\n  instantiateNapiModuleSync,\n  MessageHandler,\n  WASI,\n  createFsProxy,\n  emnapiAsyncWorkPlugin,\n  emnapiTSFNPlugin,\n} = require(\"@napi-rs/wasm-runtime\");\n/* Passed in as a resolved URL: the runtime publishes `./fs` to `import` only,\n * so it cannot be required, and resolving it from here would assume the\n * installer hoisted the package next to this worker. */\nconst { memfsExported } = await import(options.fsModuleUrl!);\n\n/**\n * The browser worker globals `MessageHandler` is written against.\n *\n * emnapi decides how to talk to a thread from the environment it finds, and\n * the handler itself is written for a browser worker: it is handed events and\n * replies with a bare `postMessage`. Node's port is bridged onto those names\n * rather than the handler being rewritten.\n */\nObject.assign(globalThis, {\n  self: globalThis,\n  require,\n  Worker,\n  importScripts(file: string) {\n    (0, eval)(`${readFileSync(file, \"utf8\")}//# sourceURL=${file}`);\n  },\n  postMessage(message: unknown) {\n    parentPort?.postMessage(message);\n  },\n});\n\nif (parentPort) {\n  parentPort.on(\"message\", (data) => {\n    (globalThis as any).onmessage?.({ data });\n  });\n}\n\nconst errorOutputs: unknown[][] = [];\n\nconst handler = new MessageHandler({\n  onLoad({ wasmModule, wasmMemory }: { wasmModule: WebAssembly.Module; wasmMemory: WebAssembly.Memory }) {\n    const wasi = new WASI({\n      /* The proxy is the whole point: every syscall goes to the main thread,\n       * which answers from the volume the container keeps in step. */\n      fs: createFsProxy(memfsExported),\n      preopens: { \"/\": \"/\" },\n      print: (...args: unknown[]) => console.log(...args),\n      printErr: (...args: unknown[]) => {\n        console.error(...args);\n        errorOutputs.push(args);\n      },\n    });\n\n    return instantiateNapiModuleSync(wasmModule, {\n      childThread: true,\n      wasi,\n      /* The wasm links a \"basic\" emnapi archive with no C implementations of\n       * async work or threadsafe functions, so every thread has to bring the\n       * JavaScript ones. */\n      plugins: [emnapiAsyncWorkPlugin, emnapiTSFNPlugin],\n      overwriteImports(importObject: any) {\n        importObject.env = {\n          ...importObject.env,\n          ...importObject.napi,\n          ...importObject.emnapi,\n          memory: wasmMemory,\n        };\n      },\n    });\n  },\n  onError(error: unknown) {\n    (globalThis as any).postMessage({ type: \"error\", error, errorOutputs: [...errorOutputs] });\n    errorOutputs.length = 0;\n  },\n});\n\n(globalThis as any).onmessage = (event: unknown) => handler.handle(event);\n"]}

package/dist/worker-entry.js

@@ -29613,6 +29613,7 @@ function createCoreModules(options) {
     zlib: zlib_module_default
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
+  builtins.net = createNetModule();
   const globals = {
     Buffer: Buffer2,
     console: consoleObject,
@@ -30441,15 +30442,43 @@ function createStreamPromises() {
     })
   };
 }
-function createUnsupportedModule(name) {
+function createUnsupportedModule(name, supported = {}) {
   const unsupported = () => {
     const error = new Error(`${name} is unavailable in the browser runtime`);
     error.code = "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM";
     throw error;
   };
-  return new Proxy({ unsupported }, { get(target, key) {
-    return key in target ? target[key] : unsupported;
-  } });
+  const target = { unsupported, ...supported };
+  const module = new Proxy(target, {
+    get(object, key) {
+      if (key === "default") return module;
+      return key in object ? object[key] : unsupported;
+    }
+  });
+  return module;
+}
+function createNetModule() {
+  const isIPv4 = (value) => {
+    const parts = String(value).split(".");
+    return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+  };
+  const isIPv6 = (value) => {
+    const text = String(value);
+    if (!text.includes(":")) return false;
+    const [head, tail] = [text.slice(0, text.lastIndexOf(":")), text.slice(text.lastIndexOf(":") + 1)];
+    const normalised = isIPv4(tail) ? `${head}:0:0` : text;
+    const halves = normalised.split("::");
+    if (halves.length > 2) return false;
+    const groups = halves.map((half) => half === "" ? [] : half.split(":"));
+    if (groups.some((half) => half.some((group) => !/^[0-9a-fA-F]{1,4}$/.test(group)))) return false;
+    const count = groups.reduce((total, half) => total + half.length, 0);
+    return halves.length === 2 ? count <= 7 : count === 8;
+  };
+  return createUnsupportedModule("net", {
+    isIPv4,
+    isIPv6,
+    isIP: (value) => isIPv4(value) ? 4 : isIPv6(value) ? 6 : 0
+  });
 }
 var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames = [