sandboxedjs 0.1.35 → 0.1.36

package/bin/sandboxedjs.mjs

@@ -203,8 +203,8 @@ async function printReplBanner(box, opts) {
     "  npm create vite@latest app -- --template react && cd app && npm i && npm run dev",
     "  ffmpeg -f lavfi -i testsrc=size=64x64:rate=5:duration=1 out.mp4 && ls -l out.mp4",
     "",
-    `${DIM}Known limits: no native binaries, no raw sockets, and esbuild-based`,
-    `toolchains (Vite 4 and its contemporaries) cannot start. Current Vite works.${RESET}`,
+    `${DIM}Known limits: no raw sockets, and esbuild-based toolchains (Vite 4 and`,
+    `its contemporaries) cannot start. Current Vite works, build and dev server.${RESET}`,
     "",
     `${DIM}Ctrl-D or \`exit\` to leave.${RESET}`,
     "",

package/dist/index.cjs

@@ -21,6 +21,10 @@ var timersModule = require('timers-browserify');
 var legacyUrl = require('url/url.js');
 var legacy$1 = require('@noble/hashes/legacy');
 var hmac = require('@noble/hashes/hmac');
+var module$1 = require('module');
+var fs = require('fs');
+var path = require('path');
+var url = require('url');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -18677,9 +18681,9 @@ async function resolveIndexUrl() {
   if (indexUrl) return indexUrl;
   if (!isNode2) return DEFAULT_BROWSER_INDEX_URL;
   try {
-    const { createRequire } = await nodeBuiltin("module");
+    const { createRequire: createRequire2 } = await nodeBuiltin("module");
     const path = await nodeBuiltin("path");
-    const require2 = createRequire(path.join(process.cwd(), "index.js"));
+    const require2 = createRequire2(path.join(process.cwd(), "index.js"));
     return `${path.dirname(require2.resolve("pyodide/package.json"))}/`;
   } catch {
     return void 0;
@@ -19144,15 +19148,15 @@ function pythonCommands() {
 var INSTALL_HINT = "ffmpeg is not installed in this container.\nThe FFmpeg runtime ships separately because it is a ~31MB WebAssembly build:\n  npm install @ffmpeg/core";
 var compiled = null;
 async function loadFactory() {
-  const { createRequire } = await nodeBuiltin("module");
+  const { createRequire: createRequire2 } = await nodeBuiltin("module");
   const fs = await nodeBuiltin("fs/promises");
   const path = await nodeBuiltin("path");
-  const packageRequire = createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  const packageRequire = createRequire2((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
   let require2 = packageRequire;
   try {
     require2.resolve("@ffmpeg/core/wasm");
   } catch {
-    require2 = createRequire(path.join(process.cwd(), "index.js"));
+    require2 = createRequire2(path.join(process.cwd(), "index.js"));
   }
   const wasmPath = require2.resolve("@ffmpeg/core/wasm");
   const wasm = await fs.readFile(wasmPath);
@@ -25022,6 +25026,7 @@ function createCoreModules(options) {
     zlib: zlib_module_default
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
+  builtins.net = createNetModule();
   const globals = {
     Buffer: Buffer2,
     console: consoleObject,
@@ -25850,15 +25855,43 @@ function createStreamPromises() {
     })
   };
 }
-function createUnsupportedModule(name) {
+function createUnsupportedModule(name, supported = {}) {
   const unsupported = () => {
     const error = new Error(`${name} is unavailable in the browser runtime`);
     error.code = "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM";
     throw error;
   };
-  return new Proxy({ unsupported }, { get(target, key) {
-    return key in target ? target[key] : unsupported;
-  } });
+  const target = { unsupported, ...supported };
+  const module = new Proxy(target, {
+    get(object, key) {
+      if (key === "default") return module;
+      return key in object ? object[key] : unsupported;
+    }
+  });
+  return module;
+}
+function createNetModule() {
+  const isIPv4 = (value) => {
+    const parts = String(value).split(".");
+    return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+  };
+  const isIPv6 = (value) => {
+    const text2 = String(value);
+    if (!text2.includes(":")) return false;
+    const [head2, tail2] = [text2.slice(0, text2.lastIndexOf(":")), text2.slice(text2.lastIndexOf(":") + 1)];
+    const normalised = isIPv4(tail2) ? `${head2}:0:0` : text2;
+    const halves = normalised.split("::");
+    if (halves.length > 2) return false;
+    const groups = halves.map((half) => half === "" ? [] : half.split(":"));
+    if (groups.some((half) => half.some((group) => !/^[0-9a-fA-F]{1,4}$/.test(group)))) return false;
+    const count = groups.reduce((total, half) => total + half.length, 0);
+    return halves.length === 2 ? count <= 7 : count === 8;
+  };
+  return createUnsupportedModule("net", {
+    isIPv4,
+    isIPv6,
+    isIP: (value) => isIPv4(value) ? 4 : isIPv6(value) ? 6 : 0
+  });
 }
 var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames2 = [
@@ -26267,6 +26300,77 @@ var MirroringVolume = class {
     };
     copy(this.root);
   }
+  /**
+   * Bring back what the mirrored engine wrote.
+   *
+   * The mirror exists because Rolldown's resolver reads through WASI rather
+   * than through anything JavaScript can hand it — but Rolldown also *writes*
+   * through WASI, so `vite build` leaves its output in the mirror and the
+   * container sees an empty `dist/`. This is the return leg, and it is why the
+   * mirror is no longer strictly one-way.
+   *
+   * Called when a process ends rather than on a timer: that is the moment a
+   * build's output is complete, and a dev server — which serves from memory
+   * and writes nothing — pays for it only once, at exit.
+   */
+  absorb() {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !mirror.readFileSync || !mirror.lstatSync) return;
+    const visit = (path) => {
+      if (basename(path) === "node_modules") return;
+      let stat2;
+      try {
+        stat2 = mirror.lstatSync(path);
+      } catch {
+        return;
+      }
+      if (stat2.isSymbolicLink()) return;
+      if (stat2.isDirectory()) {
+        let names;
+        try {
+          names = mirror.readdirSync(path);
+        } catch {
+          return;
+        }
+        for (const name of names) visit(join(path, name));
+        return;
+      }
+      let produced;
+      try {
+        produced = mirror.readFileSync(path);
+      } catch {
+        return;
+      }
+      try {
+        const current = this.inner.readFileSync(path);
+        if (sameBytes(current, produced)) return;
+      } catch {
+      }
+      try {
+        this.ensureDirectory(dirname(path));
+        this.inner.writeFileSync(path, produced);
+      } catch {
+      }
+    };
+    visit(this.root);
+  }
+  /** `mkdir -p`, which the volume does not offer directly. */
+  ensureDirectory(path) {
+    const parts = clean(path).split("/").filter(Boolean);
+    let current = "";
+    for (const part of parts) {
+      current += `/${part}`;
+      try {
+        if (this.inner.lstatSync(current).isDirectory()) continue;
+        return;
+      } catch {
+      }
+      try {
+        this.inner.mkdirSync(current);
+      } catch {
+      }
+    }
+  }
   /** Is this path inside the mirrored subtree? */
   mirrored(path) {
     if (!this.mirror) return false;
@@ -26398,6 +26502,11 @@ var MirroringVolume = class {
     this.seed();
   }
 };
+function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  for (let index = 0; index < a.length; index++) if (a[index] !== b[index]) return false;
+  return true;
+}
 
 // src/runtime/host-esbuild.ts
 var ASYNC_API = ["transform", "build", "context", "formatMessages", "analyzeMetafile"];
@@ -26466,12 +26575,142 @@ function ensureProcessGlobal() {
     configurable: true
   });
 }
+var BINDING_PACKAGE = "@rolldown/binding-wasm32-wasi";
+var ASYNC_WORK_POOL_SIZE = 4;
+var WORKER_FILE = "rolldown-wasi-worker.js";
+async function loadNodeRolldownMemfsBinding() {
+  const require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  let packageDir;
+  try {
+    packageDir = path.dirname(require2.resolve(`${BINDING_PACKAGE}/package.json`));
+  } catch {
+    return null;
+  }
+  const fromBinding = module$1.createRequire(path.join(packageDir, "package.json"));
+  let runtime;
+  let fsModuleUrl;
+  let createContext2;
+  try {
+    runtime = fromBinding("@napi-rs/wasm-runtime");
+    fsModuleUrl = resolveSubpath(fromBinding, "@napi-rs/wasm-runtime", "./fs");
+    ({ createContext: createContext2 } = fromBinding("@emnapi/runtime"));
+  } catch {
+    return null;
+  }
+  const { memfs } = await import(fsModuleUrl);
+  const { Worker: Worker2 } = await import('worker_threads');
+  const { fs: memoryFs, vol } = memfs();
+  const wasi2 = new runtime.WASI({
+    version: "preview1",
+    fs: memoryFs,
+    preopens: { "/": "/" }
+  });
+  const wasmFile = fs.readFileSync(path.join(packageDir, "rolldown-binding.wasm32-wasi.wasm"));
+  const sharedMemory = new WebAssembly.Memory({ initial: 16384, maximum: 65536, shared: true });
+  const workerPoolSize = Math.max(2, cpuCount());
+  const context = createContext2({ autoDestroy: false });
+  context.suppressDestroy();
+  const workerPath = resolveWorkerPath();
+  if (!workerPath) return null;
+  const runtimeAnchor = url.pathToFileURL(path.join(packageDir, "package.json")).href;
+  const workers = /* @__PURE__ */ new Set();
+  let started = false;
+  const { napiModule } = await runtime.instantiateNapiModule(wasmFile, {
+    context,
+    asyncWorkPoolSize: ASYNC_WORK_POOL_SIZE,
+    reuseWorker: { size: ASYNC_WORK_POOL_SIZE + workerPoolSize },
+    plugins: [runtime.emnapiAsyncWorkPlugin, runtime.emnapiTSFNPlugin],
+    wasi: wasi2,
+    onCreateWorker() {
+      const worker = new Worker2(workerPath, {
+        env: process.env,
+        workerData: { runtimeAnchor, fsModuleUrl },
+        /*
+         * Deliberately no `execArgv`.
+         *
+         * A worker inherits the parent's flags by default, and this worker is
+         * a plain JavaScript file we ship — it needs none of them. Inheriting
+         * them is actively harmful: under a host started with a module loader
+         * (`tsx`, `ts-node`, `--import`), the worker's module resolution then
+         * needs the main thread, which is at that moment blocked waiting for
+         * this very worker to report itself ready. The result is a deadlock at
+         * startup with no error, and it took a while to find.
+         */
+        execArgv: []
+      });
+      workers.add(worker);
+      const serveFsRequest = runtime.createOnMessage(memoryFs);
+      worker.on("message", (data) => serveFsRequest({ data }));
+      worker.on("exit", () => workers.delete(worker));
+      if (started) unreferenceWorker(worker);
+      return worker;
+    },
+    overwriteImports(importObject) {
+      importObject.env = {
+        ...importObject.env,
+        ...importObject.napi,
+        ...importObject.emnapi,
+        memory: sharedMemory
+      };
+      return importObject;
+    },
+    beforeInit({ instance }) {
+      for (const name of Object.keys(instance.exports)) {
+        if (name.startsWith("__napi_register__")) instance.exports[name]();
+      }
+    }
+  });
+  started = true;
+  for (const worker of workers) unreferenceWorker(worker);
+  return { ...napiModule.exports, __fs: memoryFs, __volume: vol };
+}
+function resolveWorkerPath() {
+  const here = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
+  const candidates = [
+    path.join(here, WORKER_FILE),
+    /* src/runtime → dist, for a checkout that has been built. */
+    path.join(here, "..", "..", "dist", WORKER_FILE)
+  ];
+  return candidates.find((candidate) => fs.existsSync(candidate)) ?? null;
+}
+function resolveSubpath(require2, packageName, subpath) {
+  const packageDir = path.dirname(require2.resolve(packageName));
+  const manifest = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+  const entry = manifest?.exports?.[subpath];
+  const target = typeof entry === "string" ? entry : entry?.import ?? entry?.default;
+  if (typeof target !== "string") {
+    throw new Error(`${packageName} does not export ${subpath}`);
+  }
+  return url.pathToFileURL(path.join(packageDir, target)).href;
+}
+function cpuCount() {
+  try {
+    return process.availableParallelism?.() ?? 4;
+  } catch {
+    return 4;
+  }
+}
+function unreferenceWorker(worker) {
+  for (const key of Object.getOwnPropertySymbols(worker)) {
+    if (key.toString().includes("kPublicPort") || key.toString().includes("kHandle")) {
+      const handle = worker[key];
+      if (handle && typeof handle === "object") handle.ref = () => {
+      };
+    }
+  }
+  worker.unref();
+}
 
 // src/runtime/host-rolldown.ts
 var BUNDLER_HINT = "If this is a bundler pre-bundling the worker away, exclude the binding from dependency optimisation \u2014 in Vite:\n\n  optimizeDeps: { exclude: ['@rolldown/binding-wasm32-wasi'] }";
+var isNodeHost = typeof process !== "undefined" && Boolean(process.versions?.node);
 async function loadHostRolldownBinding() {
   const reason = syncChannelUnavailableReason();
   if (reason) throw new Error(`SandboxedJs threaded WASM unavailable: ${reason}`);
+  if (isNodeHost) {
+    const binding = await loadNodeRolldownMemfsBinding();
+    if (binding) return binding;
+  }
   try {
     const loaded = await import('@rolldown/binding-wasm32-wasi');
     return "__fs" in loaded ? { ...loaded } : loaded.default ?? loaded;
@@ -26871,6 +27110,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
         core.cancelTimers();
         untrack();
         this.router.closeOwner(owner);
+        this.volume.absorb();
       }
     });
     this.running.add(process2);