sandboxedjs 0.1.35 → 0.1.36

package/dist/index.d.cts

@@ -2642,6 +2642,13 @@ interface MirrorFs {
     }): void;
     unlinkSync?(path: string): void;
     rmdirSync?(path: string): void;
+    readdirSync?(path: string): string[];
+    readFileSync?(path: string): Uint8Array;
+    lstatSync?(path: string): {
+        isDirectory(): boolean;
+        isSymbolicLink(): boolean;
+        size?: number;
+    };
 }
 /**
  * A `RuntimeVolume` that forwards every mutation to an optional mirror.
@@ -2665,6 +2672,22 @@ declare class MirroringVolume implements RuntimeVolume {
     detach(): void;
     /** Copy the whole subtree across. The only bulk operation that remains. */
     private seed;
+    /**
+     * Bring back what the mirrored engine wrote.
+     *
+     * The mirror exists because Rolldown's resolver reads through WASI rather
+     * than through anything JavaScript can hand it — but Rolldown also *writes*
+     * through WASI, so `vite build` leaves its output in the mirror and the
+     * container sees an empty `dist/`. This is the return leg, and it is why the
+     * mirror is no longer strictly one-way.
+     *
+     * Called when a process ends rather than on a timer: that is the moment a
+     * build's output is complete, and a dev server — which serves from memory
+     * and writes nothing — pays for it only once, at exit.
+     */
+    absorb(): void;
+    /** `mkdir -p`, which the volume does not offer directly. */
+    private ensureDirectory;
     /** Is this path inside the mirrored subtree? */
     private mirrored;
     /**

package/dist/index.d.ts

@@ -2642,6 +2642,13 @@ interface MirrorFs {
     }): void;
     unlinkSync?(path: string): void;
     rmdirSync?(path: string): void;
+    readdirSync?(path: string): string[];
+    readFileSync?(path: string): Uint8Array;
+    lstatSync?(path: string): {
+        isDirectory(): boolean;
+        isSymbolicLink(): boolean;
+        size?: number;
+    };
 }
 /**
  * A `RuntimeVolume` that forwards every mutation to an optional mirror.
@@ -2665,6 +2672,22 @@ declare class MirroringVolume implements RuntimeVolume {
     detach(): void;
     /** Copy the whole subtree across. The only bulk operation that remains. */
     private seed;
+    /**
+     * Bring back what the mirrored engine wrote.
+     *
+     * The mirror exists because Rolldown's resolver reads through WASI rather
+     * than through anything JavaScript can hand it — but Rolldown also *writes*
+     * through WASI, so `vite build` leaves its output in the mirror and the
+     * container sees an empty `dist/`. This is the return leg, and it is why the
+     * mirror is no longer strictly one-way.
+     *
+     * Called when a process ends rather than on a timer: that is the moment a
+     * build's output is complete, and a dev server — which serves from memory
+     * and writes nothing — pays for it only once, at exit.
+     */
+    absorb(): void;
+    /** `mkdir -p`, which the volume does not offer directly. */
+    private ensureDirectory;
     /** Is this path inside the mirrored subtree? */
     private mirrored;
     /**

package/dist/index.js

@@ -17,6 +17,10 @@ import timersModule from 'timers-browserify';
 import legacyUrl from 'url/url.js';
 import { sha1 as sha1$1, md5 } from '@noble/hashes/legacy';
 import { hmac } from '@noble/hashes/hmac';
+import { createRequire } from 'module';
+import { readFileSync, existsSync } from 'fs';
+import { dirname as dirname$1, join as join$1 } from 'path';
+import { pathToFileURL as pathToFileURL$1, fileURLToPath as fileURLToPath$1 } from 'url';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -18660,9 +18664,9 @@ async function resolveIndexUrl() {
   if (indexUrl) return indexUrl;
   if (!isNode2) return DEFAULT_BROWSER_INDEX_URL;
   try {
-    const { createRequire } = await nodeBuiltin("module");
+    const { createRequire: createRequire2 } = await nodeBuiltin("module");
     const path = await nodeBuiltin("path");
-    const require2 = createRequire(path.join(process.cwd(), "index.js"));
+    const require2 = createRequire2(path.join(process.cwd(), "index.js"));
     return `${path.dirname(require2.resolve("pyodide/package.json"))}/`;
   } catch {
     return void 0;
@@ -19127,15 +19131,15 @@ function pythonCommands() {
 var INSTALL_HINT = "ffmpeg is not installed in this container.\nThe FFmpeg runtime ships separately because it is a ~31MB WebAssembly build:\n  npm install @ffmpeg/core";
 var compiled = null;
 async function loadFactory() {
-  const { createRequire } = await nodeBuiltin("module");
+  const { createRequire: createRequire2 } = await nodeBuiltin("module");
   const fs = await nodeBuiltin("fs/promises");
   const path = await nodeBuiltin("path");
-  const packageRequire = createRequire(import.meta.url);
+  const packageRequire = createRequire2(import.meta.url);
   let require2 = packageRequire;
   try {
     require2.resolve("@ffmpeg/core/wasm");
   } catch {
-    require2 = createRequire(path.join(process.cwd(), "index.js"));
+    require2 = createRequire2(path.join(process.cwd(), "index.js"));
   }
   const wasmPath = require2.resolve("@ffmpeg/core/wasm");
   const wasm = await fs.readFile(wasmPath);
@@ -25005,6 +25009,7 @@ function createCoreModules(options) {
     zlib: zlib_module_default
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
+  builtins.net = createNetModule();
   const globals = {
     Buffer: Buffer2,
     console: consoleObject,
@@ -25833,15 +25838,43 @@ function createStreamPromises() {
     })
   };
 }
-function createUnsupportedModule(name) {
+function createUnsupportedModule(name, supported = {}) {
   const unsupported = () => {
     const error = new Error(`${name} is unavailable in the browser runtime`);
     error.code = "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM";
     throw error;
   };
-  return new Proxy({ unsupported }, { get(target, key) {
-    return key in target ? target[key] : unsupported;
-  } });
+  const target = { unsupported, ...supported };
+  const module = new Proxy(target, {
+    get(object, key) {
+      if (key === "default") return module;
+      return key in object ? object[key] : unsupported;
+    }
+  });
+  return module;
+}
+function createNetModule() {
+  const isIPv4 = (value) => {
+    const parts = String(value).split(".");
+    return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+  };
+  const isIPv6 = (value) => {
+    const text2 = String(value);
+    if (!text2.includes(":")) return false;
+    const [head2, tail2] = [text2.slice(0, text2.lastIndexOf(":")), text2.slice(text2.lastIndexOf(":") + 1)];
+    const normalised = isIPv4(tail2) ? `${head2}:0:0` : text2;
+    const halves = normalised.split("::");
+    if (halves.length > 2) return false;
+    const groups = halves.map((half) => half === "" ? [] : half.split(":"));
+    if (groups.some((half) => half.some((group) => !/^[0-9a-fA-F]{1,4}$/.test(group)))) return false;
+    const count = groups.reduce((total, half) => total + half.length, 0);
+    return halves.length === 2 ? count <= 7 : count === 8;
+  };
+  return createUnsupportedModule("net", {
+    isIPv4,
+    isIPv6,
+    isIP: (value) => isIPv4(value) ? 4 : isIPv6(value) ? 6 : 0
+  });
 }
 var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames2 = [
@@ -26250,6 +26283,77 @@ var MirroringVolume = class {
     };
     copy(this.root);
   }
+  /**
+   * Bring back what the mirrored engine wrote.
+   *
+   * The mirror exists because Rolldown's resolver reads through WASI rather
+   * than through anything JavaScript can hand it — but Rolldown also *writes*
+   * through WASI, so `vite build` leaves its output in the mirror and the
+   * container sees an empty `dist/`. This is the return leg, and it is why the
+   * mirror is no longer strictly one-way.
+   *
+   * Called when a process ends rather than on a timer: that is the moment a
+   * build's output is complete, and a dev server — which serves from memory
+   * and writes nothing — pays for it only once, at exit.
+   */
+  absorb() {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !mirror.readFileSync || !mirror.lstatSync) return;
+    const visit = (path) => {
+      if (basename(path) === "node_modules") return;
+      let stat2;
+      try {
+        stat2 = mirror.lstatSync(path);
+      } catch {
+        return;
+      }
+      if (stat2.isSymbolicLink()) return;
+      if (stat2.isDirectory()) {
+        let names;
+        try {
+          names = mirror.readdirSync(path);
+        } catch {
+          return;
+        }
+        for (const name of names) visit(join(path, name));
+        return;
+      }
+      let produced;
+      try {
+        produced = mirror.readFileSync(path);
+      } catch {
+        return;
+      }
+      try {
+        const current = this.inner.readFileSync(path);
+        if (sameBytes(current, produced)) return;
+      } catch {
+      }
+      try {
+        this.ensureDirectory(dirname(path));
+        this.inner.writeFileSync(path, produced);
+      } catch {
+      }
+    };
+    visit(this.root);
+  }
+  /** `mkdir -p`, which the volume does not offer directly. */
+  ensureDirectory(path) {
+    const parts = clean(path).split("/").filter(Boolean);
+    let current = "";
+    for (const part of parts) {
+      current += `/${part}`;
+      try {
+        if (this.inner.lstatSync(current).isDirectory()) continue;
+        return;
+      } catch {
+      }
+      try {
+        this.inner.mkdirSync(current);
+      } catch {
+      }
+    }
+  }
   /** Is this path inside the mirrored subtree? */
   mirrored(path) {
     if (!this.mirror) return false;
@@ -26381,6 +26485,11 @@ var MirroringVolume = class {
     this.seed();
   }
 };
+function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  for (let index = 0; index < a.length; index++) if (a[index] !== b[index]) return false;
+  return true;
+}
 
 // src/runtime/host-esbuild.ts
 var ASYNC_API = ["transform", "build", "context", "formatMessages", "analyzeMetafile"];
@@ -26449,12 +26558,142 @@ function ensureProcessGlobal() {
     configurable: true
   });
 }
+var BINDING_PACKAGE = "@rolldown/binding-wasm32-wasi";
+var ASYNC_WORK_POOL_SIZE = 4;
+var WORKER_FILE = "rolldown-wasi-worker.js";
+async function loadNodeRolldownMemfsBinding() {
+  const require2 = createRequire(import.meta.url);
+  let packageDir;
+  try {
+    packageDir = dirname$1(require2.resolve(`${BINDING_PACKAGE}/package.json`));
+  } catch {
+    return null;
+  }
+  const fromBinding = createRequire(join$1(packageDir, "package.json"));
+  let runtime;
+  let fsModuleUrl;
+  let createContext2;
+  try {
+    runtime = fromBinding("@napi-rs/wasm-runtime");
+    fsModuleUrl = resolveSubpath(fromBinding, "@napi-rs/wasm-runtime", "./fs");
+    ({ createContext: createContext2 } = fromBinding("@emnapi/runtime"));
+  } catch {
+    return null;
+  }
+  const { memfs } = await import(fsModuleUrl);
+  const { Worker: Worker2 } = await import('worker_threads');
+  const { fs: memoryFs, vol } = memfs();
+  const wasi2 = new runtime.WASI({
+    version: "preview1",
+    fs: memoryFs,
+    preopens: { "/": "/" }
+  });
+  const wasmFile = readFileSync(join$1(packageDir, "rolldown-binding.wasm32-wasi.wasm"));
+  const sharedMemory = new WebAssembly.Memory({ initial: 16384, maximum: 65536, shared: true });
+  const workerPoolSize = Math.max(2, cpuCount());
+  const context = createContext2({ autoDestroy: false });
+  context.suppressDestroy();
+  const workerPath = resolveWorkerPath();
+  if (!workerPath) return null;
+  const runtimeAnchor = pathToFileURL$1(join$1(packageDir, "package.json")).href;
+  const workers = /* @__PURE__ */ new Set();
+  let started = false;
+  const { napiModule } = await runtime.instantiateNapiModule(wasmFile, {
+    context,
+    asyncWorkPoolSize: ASYNC_WORK_POOL_SIZE,
+    reuseWorker: { size: ASYNC_WORK_POOL_SIZE + workerPoolSize },
+    plugins: [runtime.emnapiAsyncWorkPlugin, runtime.emnapiTSFNPlugin],
+    wasi: wasi2,
+    onCreateWorker() {
+      const worker = new Worker2(workerPath, {
+        env: process.env,
+        workerData: { runtimeAnchor, fsModuleUrl },
+        /*
+         * Deliberately no `execArgv`.
+         *
+         * A worker inherits the parent's flags by default, and this worker is
+         * a plain JavaScript file we ship — it needs none of them. Inheriting
+         * them is actively harmful: under a host started with a module loader
+         * (`tsx`, `ts-node`, `--import`), the worker's module resolution then
+         * needs the main thread, which is at that moment blocked waiting for
+         * this very worker to report itself ready. The result is a deadlock at
+         * startup with no error, and it took a while to find.
+         */
+        execArgv: []
+      });
+      workers.add(worker);
+      const serveFsRequest = runtime.createOnMessage(memoryFs);
+      worker.on("message", (data) => serveFsRequest({ data }));
+      worker.on("exit", () => workers.delete(worker));
+      if (started) unreferenceWorker(worker);
+      return worker;
+    },
+    overwriteImports(importObject) {
+      importObject.env = {
+        ...importObject.env,
+        ...importObject.napi,
+        ...importObject.emnapi,
+        memory: sharedMemory
+      };
+      return importObject;
+    },
+    beforeInit({ instance }) {
+      for (const name of Object.keys(instance.exports)) {
+        if (name.startsWith("__napi_register__")) instance.exports[name]();
+      }
+    }
+  });
+  started = true;
+  for (const worker of workers) unreferenceWorker(worker);
+  return { ...napiModule.exports, __fs: memoryFs, __volume: vol };
+}
+function resolveWorkerPath() {
+  const here = dirname$1(fileURLToPath$1(import.meta.url));
+  const candidates = [
+    join$1(here, WORKER_FILE),
+    /* src/runtime → dist, for a checkout that has been built. */
+    join$1(here, "..", "..", "dist", WORKER_FILE)
+  ];
+  return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
+function resolveSubpath(require2, packageName, subpath) {
+  const packageDir = dirname$1(require2.resolve(packageName));
+  const manifest = JSON.parse(readFileSync(join$1(packageDir, "package.json"), "utf8"));
+  const entry = manifest?.exports?.[subpath];
+  const target = typeof entry === "string" ? entry : entry?.import ?? entry?.default;
+  if (typeof target !== "string") {
+    throw new Error(`${packageName} does not export ${subpath}`);
+  }
+  return pathToFileURL$1(join$1(packageDir, target)).href;
+}
+function cpuCount() {
+  try {
+    return process.availableParallelism?.() ?? 4;
+  } catch {
+    return 4;
+  }
+}
+function unreferenceWorker(worker) {
+  for (const key of Object.getOwnPropertySymbols(worker)) {
+    if (key.toString().includes("kPublicPort") || key.toString().includes("kHandle")) {
+      const handle = worker[key];
+      if (handle && typeof handle === "object") handle.ref = () => {
+      };
+    }
+  }
+  worker.unref();
+}
 
 // src/runtime/host-rolldown.ts
 var BUNDLER_HINT = "If this is a bundler pre-bundling the worker away, exclude the binding from dependency optimisation \u2014 in Vite:\n\n  optimizeDeps: { exclude: ['@rolldown/binding-wasm32-wasi'] }";
+var isNodeHost = typeof process !== "undefined" && Boolean(process.versions?.node);
 async function loadHostRolldownBinding() {
   const reason = syncChannelUnavailableReason();
   if (reason) throw new Error(`SandboxedJs threaded WASM unavailable: ${reason}`);
+  if (isNodeHost) {
+    const binding = await loadNodeRolldownMemfsBinding();
+    if (binding) return binding;
+  }
   try {
     const loaded = await import('@rolldown/binding-wasm32-wasi');
     return "__fs" in loaded ? { ...loaded } : loaded.default ?? loaded;
@@ -26854,6 +27093,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
         core.cancelTimers();
         untrack();
         this.router.closeOwner(owner);
+        this.volume.absorb();
       }
     });
     this.running.add(process2);