sandboxedjs 0.1.45 → 0.1.46

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { S as Shell, a as ShellIO, b as Session, V as Vfs, c as Cred, N as Node, d as Command, K as Kernel, R as RuntimeVolume, e as VolumeStat, f as VolumeStats, g as RuntimeHttpResponse, h as SpawnChild, i as SyncSpawn, j as RuntimePod, k as RuntimePackageInstaller, l as ChildSpawnConfig, m as ChildHandle, n as RuntimeProcess, E as ExecContext, O as OutputStream, C as Container, o as createContainer } from './container-CZn9USBQ.cjs';
-export { B as BufferSink, p as CPythonOptions, q as CallbackSink, r as CommandRegistry, s as ContainerFs, t as ContainerOptions, u as ContextInit, D as DirEntry, v as Env, w as ExecOptions, x as ExecResult, F as FileData, y as FileInput, z as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, A as KernelOptions, L as ListeningPort, M as MountEntry, P as NetInterface, Q as NetworkOptions, T as NetworkStack, U as NullInput, W as NullOutput, X as PYTHON_VERSION, Y as PasswdEntry, Z as Pipe, _ as Process, $ as ProcessKind, a0 as ProcessOptions, a1 as ProcessState, a2 as ProcessTable, a3 as PythonOptions, a4 as ROOT_CRED, a5 as ResolvedExecutable, a6 as RunOptions, a7 as RunResult, a8 as RuntimeProcessManager, a9 as RuntimeProcessResult, aa as SessionInit, ab as SessionResult, ac as SessionRunOptions, ad as ShellExit, ae as ShellInit, af as ShellOptions, ag as SpawnHandle, ah as Stats, ai as Stdio, aj as TeeOutput, ak as UserDatabase, al as Variables, am as VirtualNode, an as VirtualProvider, ao as WriteOptions, ap as applyChmod, aq as braceExpand, ar as captureStdio, as as configureCPython, at as configurePython, au as createChildProcessModule, av as createContext, aw as defineCommand, ax as expandWord, ay as expandWords, az as formatMode, aA as isCPythonAvailable, aB as isPythonAvailable, aC as makeCred, aD as octalMode, aE as parseUmask, aF as resetPidCounter, aG as shellQuote } from './container-CZn9USBQ.cjs';
+import { S as Shell, a as ShellIO, b as Session, V as Vfs, c as Cred, N as Node, d as Command, K as Kernel, R as RuntimeVolume, e as VolumeStat, f as VolumeStats, g as RuntimeHttpResponse, h as SpawnChild, i as SyncSpawn, j as RuntimePod, k as RuntimePackageInstaller, l as ChildSpawnConfig, m as ChildHandle, n as RuntimeProcess, o as RuntimeSocketPeer, p as RuntimeConnection, E as ExecContext, O as OutputStream, C as Container, q as createContainer } from './container-DyRF-bY0.cjs';
+export { B as BufferSink, r as CPythonOptions, s as CallbackSink, t as CommandRegistry, u as ContainerFs, v as ContainerOptions, w as ContextInit, D as DirEntry, x as Env, y as ExecOptions, z as ExecResult, F as FileData, A as FileInput, G as FileOutput, H as GroupEntry, I as HttpResponse, J as InputStream, L as Job, M as KernelOptions, P as ListeningPort, Q as MountEntry, T as NetInterface, U as NetworkOptions, W as NetworkStack, X as NullInput, Y as NullOutput, Z as PYTHON_VERSION, _ as PasswdEntry, $ as Pipe, a0 as Process, a1 as ProcessKind, a2 as ProcessOptions, a3 as ProcessState, a4 as ProcessTable, a5 as PythonOptions, a6 as ROOT_CRED, a7 as ResolvedExecutable, a8 as RunOptions, a9 as RunResult, aa as RuntimeProcessManager, ab as RuntimeProcessResult, ac as SessionInit, ad as SessionResult, ae as SessionRunOptions, af as ShellExit, ag as ShellInit, ah as ShellOptions, ai as SpawnHandle, aj as Stats, ak as Stdio, al as TeeOutput, am as UserDatabase, an as Variables, ao as VirtualNode, ap as VirtualProvider, aq as WriteOptions, ar as applyChmod, as as braceExpand, at as captureStdio, au as configureCPython, av as configurePython, aw as createChildProcessModule, ax as createContext, ay as defineCommand, az as expandWord, aA as expandWords, aB as formatMode, aC as isCPythonAvailable, aD as isPythonAvailable, aE as makeCred, aF as octalMode, aG as parseUmask, aH as resetPidCounter, aI as shellQuote } from './container-DyRF-bY0.cjs';
 import EventEmitter from 'events/events.js';
 import streamModule from 'stream-browserify';
 
@@ -648,8 +648,8 @@ declare class VirtualIncomingMessage extends streamModule.Readable {
     readonly httpVersionMajor = 1;
     readonly httpVersionMinor = 1;
     readonly complete = true;
-    readonly socket: Record<string, unknown>;
-    readonly connection: Record<string, unknown>;
+    socket: Record<string, unknown> | VirtualSocket;
+    get connection(): Record<string, unknown> | VirtualSocket;
     constructor(init: VirtualRequestInit);
     _read(): void;
     setTimeout(_milliseconds: number, callback?: () => void): this;
@@ -683,6 +683,60 @@ declare class VirtualServerResponse extends streamModule.Writable {
     addTrailers(_headers: Record<string, string>): void;
     setTimeout(_milliseconds: number, callback?: () => void): this;
 }
+/** Where a {@link VirtualSocket} puts the bytes the server writes. */
+interface VirtualSocketPeer {
+    /** The server sent these. */
+    data(bytes: Uint8Array): void;
+    /** The server hung up. */
+    close(): void;
+}
+/**
+ * The server half of a connection that has stopped being HTTP.
+ *
+ * Everything else in this file models one request and one response, because
+ * that is all a container's servers were ever asked for. A protocol upgrade is
+ * the case that does not fit: after the `101` there is no request and no
+ * response, only two peers writing bytes at each other for as long as they
+ * both stay interested.
+ *
+ * So this is a real `Duplex` rather than another stub. It has to be — the
+ * libraries that speak WebSocket do not merely read `req.headers` and reply,
+ * they take the socket and run a framing protocol over it, and a stub that
+ * accepts `write()` and drops it produces a server that completes its
+ * handshake and is then silent forever, which looks exactly like a network
+ * problem and is the hardest possible thing to attribute.
+ *
+ * Writes go out through {@link VirtualSocketPeer}; {@link deliver} pushes what
+ * comes back. Nothing here knows what the bytes mean, which is the point: `ws`,
+ * `socket.io` and Vite's HMR server all work over it unmodified.
+ */
+declare class VirtualSocket extends streamModule.Duplex {
+    readonly remoteAddress = "127.0.0.1";
+    readonly remotePort = 0;
+    readonly localAddress = "127.0.0.1";
+    readonly localPort = 0;
+    readonly encrypted = false;
+    readonly bufferSize = 0;
+    private peer;
+    /** Set once the peer is told, so `end()` then `destroy()` reports once. */
+    private hungUp;
+    constructor(peer: VirtualSocketPeer);
+    _read(): void;
+    _write(chunk: any, encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    _final(callback: (error?: Error | null) => void): void;
+    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
+    private hangUp;
+    /** Bytes arriving from the far end. */
+    deliver(bytes: Uint8Array): void;
+    /** The far end went away; let the server's stream end cleanly. */
+    peerClosed(): void;
+    setNoDelay(): this;
+    setKeepAlive(): this;
+    setTimeout(_milliseconds: number, callback?: () => void): this;
+    destroySoon(): void;
+    ref(): this;
+    unref(): this;
+}
 declare class VirtualHttpServer extends EventEmitter {
     private readonly router;
     readonly owner: string;
@@ -716,6 +770,28 @@ declare class VirtualHttpRouter {
     closeOwner(owner: string): void;
     closeAll(): void;
     request(port: number, init?: VirtualRequestInit): Promise<RuntimeHttpResponse>;
+    /**
+     * Open a connection that leaves HTTP behind — a WebSocket, in practice.
+     *
+     * The counterpart to {@link request}, and the thing whose absence made a dev
+     * server look broken. Every Node WebSocket library is built the same way: it
+     * hands `http.Server` an `upgrade` listener and waits. Nothing here ever
+     * emitted one, so `ws` sat holding a server that could not receive a single
+     * connection, and Vite lost the channel it uses to tell a page to reload —
+     * which is the only way it can recover after re-optimizing dependencies.
+     *
+     * Null means there is nothing to connect to: no server on the port, or a
+     * server that never asked for upgrades. Both are refusals the caller should
+     * report rather than wait out.
+     */
+    connect(port: number, init: VirtualRequestInit, peer: VirtualSocketPeer): VirtualConnection | null;
+}
+/** A connection handed back by {@link VirtualHttpRouter.connect}. */
+interface VirtualConnection {
+    /** Bytes from the far end, into the container. */
+    send(bytes: Uint8Array): void;
+    /** The far end went away. */
+    close(): void;
 }
 
 interface CoreModulesOptions {
@@ -1029,6 +1105,7 @@ declare class LocalRuntimePod implements RuntimePod {
      */
     private settle;
     request(_port: number, _init?: Record<string, unknown>): Promise<RuntimeHttpResponse>;
+    connect(port: number, init: Record<string, unknown>, peer: RuntimeSocketPeer): RuntimeConnection | null;
     snapshot(): MemoryVolumeSnapshotEntry[];
     restore(snapshot: unknown): Promise<void>;
     teardown(): void;
@@ -1076,6 +1153,8 @@ declare class WorkerRuntimePod extends LocalRuntimePod {
     private runChildToCompletion;
     private readonly proxies;
     private readonly waiting;
+    /** Upgraded connections, by the id the Worker knows them as. */
+    private readonly upgraded;
     private nextRequestId;
     /**
      * Register a stand-in for a server that is actually running in the Worker.
@@ -1085,6 +1164,14 @@ declare class WorkerRuntimePod extends LocalRuntimePod {
      */
     private proxyPort;
     private forward;
+    /**
+     * Tunnel one upgraded connection to the server that actually holds the port.
+     *
+     * Unlike {@link forward} there is no reply to wait for: both ends write
+     * whenever they have something, until one of them stops. The id is what ties
+     * the two directions together across the Worker boundary.
+     */
+    private upgrade;
     private settleProxied;
     private closeProxies;
     teardown(): void;
@@ -1465,6 +1552,19 @@ interface PreviewOptions {
      * the moment, and it can stop after a few attempts rather than looping.
      */
     onStale?: () => void;
+    /**
+     * Let pages inside the preview open WebSockets to the container.
+     *
+     * On by default. A service worker cannot answer a WebSocket handshake, so
+     * previewed documents are given a `WebSocket` that tunnels through this page
+     * instead — which means the HTML they are served is modified on the way
+     * through, one `<script>` at the top of `<head>`.
+     *
+     * Turn it off to serve documents byte for byte. The cost is that a dev
+     * server loses its HMR channel, and with it the `full-reload` it sends after
+     * re-optimizing dependencies; {@link onStale} is the fallback for that.
+     */
+    websocket?: boolean;
 }
 interface Preview {
     /** The URL an iframe should be pointed at to see `port`. */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as Shell, a as ShellIO, b as Session, V as Vfs, c as Cred, N as Node, d as Command, K as Kernel, R as RuntimeVolume, e as VolumeStat, f as VolumeStats, g as RuntimeHttpResponse, h as SpawnChild, i as SyncSpawn, j as RuntimePod, k as RuntimePackageInstaller, l as ChildSpawnConfig, m as ChildHandle, n as RuntimeProcess, E as ExecContext, O as OutputStream, C as Container, o as createContainer } from './container-CZn9USBQ.js';
-export { B as BufferSink, p as CPythonOptions, q as CallbackSink, r as CommandRegistry, s as ContainerFs, t as ContainerOptions, u as ContextInit, D as DirEntry, v as Env, w as ExecOptions, x as ExecResult, F as FileData, y as FileInput, z as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, A as KernelOptions, L as ListeningPort, M as MountEntry, P as NetInterface, Q as NetworkOptions, T as NetworkStack, U as NullInput, W as NullOutput, X as PYTHON_VERSION, Y as PasswdEntry, Z as Pipe, _ as Process, $ as ProcessKind, a0 as ProcessOptions, a1 as ProcessState, a2 as ProcessTable, a3 as PythonOptions, a4 as ROOT_CRED, a5 as ResolvedExecutable, a6 as RunOptions, a7 as RunResult, a8 as RuntimeProcessManager, a9 as RuntimeProcessResult, aa as SessionInit, ab as SessionResult, ac as SessionRunOptions, ad as ShellExit, ae as ShellInit, af as ShellOptions, ag as SpawnHandle, ah as Stats, ai as Stdio, aj as TeeOutput, ak as UserDatabase, al as Variables, am as VirtualNode, an as VirtualProvider, ao as WriteOptions, ap as applyChmod, aq as braceExpand, ar as captureStdio, as as configureCPython, at as configurePython, au as createChildProcessModule, av as createContext, aw as defineCommand, ax as expandWord, ay as expandWords, az as formatMode, aA as isCPythonAvailable, aB as isPythonAvailable, aC as makeCred, aD as octalMode, aE as parseUmask, aF as resetPidCounter, aG as shellQuote } from './container-CZn9USBQ.js';
+import { S as Shell, a as ShellIO, b as Session, V as Vfs, c as Cred, N as Node, d as Command, K as Kernel, R as RuntimeVolume, e as VolumeStat, f as VolumeStats, g as RuntimeHttpResponse, h as SpawnChild, i as SyncSpawn, j as RuntimePod, k as RuntimePackageInstaller, l as ChildSpawnConfig, m as ChildHandle, n as RuntimeProcess, o as RuntimeSocketPeer, p as RuntimeConnection, E as ExecContext, O as OutputStream, C as Container, q as createContainer } from './container-DyRF-bY0.js';
+export { B as BufferSink, r as CPythonOptions, s as CallbackSink, t as CommandRegistry, u as ContainerFs, v as ContainerOptions, w as ContextInit, D as DirEntry, x as Env, y as ExecOptions, z as ExecResult, F as FileData, A as FileInput, G as FileOutput, H as GroupEntry, I as HttpResponse, J as InputStream, L as Job, M as KernelOptions, P as ListeningPort, Q as MountEntry, T as NetInterface, U as NetworkOptions, W as NetworkStack, X as NullInput, Y as NullOutput, Z as PYTHON_VERSION, _ as PasswdEntry, $ as Pipe, a0 as Process, a1 as ProcessKind, a2 as ProcessOptions, a3 as ProcessState, a4 as ProcessTable, a5 as PythonOptions, a6 as ROOT_CRED, a7 as ResolvedExecutable, a8 as RunOptions, a9 as RunResult, aa as RuntimeProcessManager, ab as RuntimeProcessResult, ac as SessionInit, ad as SessionResult, ae as SessionRunOptions, af as ShellExit, ag as ShellInit, ah as ShellOptions, ai as SpawnHandle, aj as Stats, ak as Stdio, al as TeeOutput, am as UserDatabase, an as Variables, ao as VirtualNode, ap as VirtualProvider, aq as WriteOptions, ar as applyChmod, as as braceExpand, at as captureStdio, au as configureCPython, av as configurePython, aw as createChildProcessModule, ax as createContext, ay as defineCommand, az as expandWord, aA as expandWords, aB as formatMode, aC as isCPythonAvailable, aD as isPythonAvailable, aE as makeCred, aF as octalMode, aG as parseUmask, aH as resetPidCounter, aI as shellQuote } from './container-DyRF-bY0.js';
 import EventEmitter from 'events/events.js';
 import streamModule from 'stream-browserify';
 
@@ -648,8 +648,8 @@ declare class VirtualIncomingMessage extends streamModule.Readable {
     readonly httpVersionMajor = 1;
     readonly httpVersionMinor = 1;
     readonly complete = true;
-    readonly socket: Record<string, unknown>;
-    readonly connection: Record<string, unknown>;
+    socket: Record<string, unknown> | VirtualSocket;
+    get connection(): Record<string, unknown> | VirtualSocket;
     constructor(init: VirtualRequestInit);
     _read(): void;
     setTimeout(_milliseconds: number, callback?: () => void): this;
@@ -683,6 +683,60 @@ declare class VirtualServerResponse extends streamModule.Writable {
     addTrailers(_headers: Record<string, string>): void;
     setTimeout(_milliseconds: number, callback?: () => void): this;
 }
+/** Where a {@link VirtualSocket} puts the bytes the server writes. */
+interface VirtualSocketPeer {
+    /** The server sent these. */
+    data(bytes: Uint8Array): void;
+    /** The server hung up. */
+    close(): void;
+}
+/**
+ * The server half of a connection that has stopped being HTTP.
+ *
+ * Everything else in this file models one request and one response, because
+ * that is all a container's servers were ever asked for. A protocol upgrade is
+ * the case that does not fit: after the `101` there is no request and no
+ * response, only two peers writing bytes at each other for as long as they
+ * both stay interested.
+ *
+ * So this is a real `Duplex` rather than another stub. It has to be — the
+ * libraries that speak WebSocket do not merely read `req.headers` and reply,
+ * they take the socket and run a framing protocol over it, and a stub that
+ * accepts `write()` and drops it produces a server that completes its
+ * handshake and is then silent forever, which looks exactly like a network
+ * problem and is the hardest possible thing to attribute.
+ *
+ * Writes go out through {@link VirtualSocketPeer}; {@link deliver} pushes what
+ * comes back. Nothing here knows what the bytes mean, which is the point: `ws`,
+ * `socket.io` and Vite's HMR server all work over it unmodified.
+ */
+declare class VirtualSocket extends streamModule.Duplex {
+    readonly remoteAddress = "127.0.0.1";
+    readonly remotePort = 0;
+    readonly localAddress = "127.0.0.1";
+    readonly localPort = 0;
+    readonly encrypted = false;
+    readonly bufferSize = 0;
+    private peer;
+    /** Set once the peer is told, so `end()` then `destroy()` reports once. */
+    private hungUp;
+    constructor(peer: VirtualSocketPeer);
+    _read(): void;
+    _write(chunk: any, encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    _final(callback: (error?: Error | null) => void): void;
+    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
+    private hangUp;
+    /** Bytes arriving from the far end. */
+    deliver(bytes: Uint8Array): void;
+    /** The far end went away; let the server's stream end cleanly. */
+    peerClosed(): void;
+    setNoDelay(): this;
+    setKeepAlive(): this;
+    setTimeout(_milliseconds: number, callback?: () => void): this;
+    destroySoon(): void;
+    ref(): this;
+    unref(): this;
+}
 declare class VirtualHttpServer extends EventEmitter {
     private readonly router;
     readonly owner: string;
@@ -716,6 +770,28 @@ declare class VirtualHttpRouter {
     closeOwner(owner: string): void;
     closeAll(): void;
     request(port: number, init?: VirtualRequestInit): Promise<RuntimeHttpResponse>;
+    /**
+     * Open a connection that leaves HTTP behind — a WebSocket, in practice.
+     *
+     * The counterpart to {@link request}, and the thing whose absence made a dev
+     * server look broken. Every Node WebSocket library is built the same way: it
+     * hands `http.Server` an `upgrade` listener and waits. Nothing here ever
+     * emitted one, so `ws` sat holding a server that could not receive a single
+     * connection, and Vite lost the channel it uses to tell a page to reload —
+     * which is the only way it can recover after re-optimizing dependencies.
+     *
+     * Null means there is nothing to connect to: no server on the port, or a
+     * server that never asked for upgrades. Both are refusals the caller should
+     * report rather than wait out.
+     */
+    connect(port: number, init: VirtualRequestInit, peer: VirtualSocketPeer): VirtualConnection | null;
+}
+/** A connection handed back by {@link VirtualHttpRouter.connect}. */
+interface VirtualConnection {
+    /** Bytes from the far end, into the container. */
+    send(bytes: Uint8Array): void;
+    /** The far end went away. */
+    close(): void;
 }
 
 interface CoreModulesOptions {
@@ -1029,6 +1105,7 @@ declare class LocalRuntimePod implements RuntimePod {
      */
     private settle;
     request(_port: number, _init?: Record<string, unknown>): Promise<RuntimeHttpResponse>;
+    connect(port: number, init: Record<string, unknown>, peer: RuntimeSocketPeer): RuntimeConnection | null;
     snapshot(): MemoryVolumeSnapshotEntry[];
     restore(snapshot: unknown): Promise<void>;
     teardown(): void;
@@ -1076,6 +1153,8 @@ declare class WorkerRuntimePod extends LocalRuntimePod {
     private runChildToCompletion;
     private readonly proxies;
     private readonly waiting;
+    /** Upgraded connections, by the id the Worker knows them as. */
+    private readonly upgraded;
     private nextRequestId;
     /**
      * Register a stand-in for a server that is actually running in the Worker.
@@ -1085,6 +1164,14 @@ declare class WorkerRuntimePod extends LocalRuntimePod {
      */
     private proxyPort;
     private forward;
+    /**
+     * Tunnel one upgraded connection to the server that actually holds the port.
+     *
+     * Unlike {@link forward} there is no reply to wait for: both ends write
+     * whenever they have something, until one of them stops. The id is what ties
+     * the two directions together across the Worker boundary.
+     */
+    private upgrade;
     private settleProxied;
     private closeProxies;
     teardown(): void;
@@ -1465,6 +1552,19 @@ interface PreviewOptions {
      * the moment, and it can stop after a few attempts rather than looping.
      */
     onStale?: () => void;
+    /**
+     * Let pages inside the preview open WebSockets to the container.
+     *
+     * On by default. A service worker cannot answer a WebSocket handshake, so
+     * previewed documents are given a `WebSocket` that tunnels through this page
+     * instead — which means the HTML they are served is modified on the way
+     * through, one `<script>` at the top of `<head>`.
+     *
+     * Turn it off to serve documents byte for byte. The cost is that a dev
+     * server loses its HMR channel, and with it the `full-reload` it sends after
+     * re-optimizing dependencies; {@link onStale} is the fallback for that.
+     */
+    websocket?: boolean;
 }
 interface Preview {
     /** The URL an iframe should be pointed at to see `port`. */

package/dist/index.js

@@ -23472,8 +23472,17 @@ var VirtualIncomingMessage = class extends streamModule4.Readable {
   httpVersionMajor = 1;
   httpVersionMinor = 1;
   complete = true;
+  /*
+   * Mutable, and `connection` a getter over it, because an upgraded request
+   * carries a real socket rather than the stub. `emit("upgrade", req, socket)`
+   * hands the same object to both places, and a library that reaches it as
+   * `req.socket` — rather than through the argument — has to find the one it
+   * can actually write to.
+   */
   socket = socketStub();
-  connection = this.socket;
+  get connection() {
+    return this.socket;
+  }
   constructor(init) {
     super();
     this.method = (init.method ?? "GET").toUpperCase();
@@ -23579,6 +23588,80 @@ var VirtualServerResponse = class extends streamModule4.Writable {
     return this;
   }
 };
+var VirtualSocket = class extends streamModule4.Duplex {
+  remoteAddress = "127.0.0.1";
+  remotePort = 0;
+  localAddress = "127.0.0.1";
+  localPort = 0;
+  encrypted = false;
+  bufferSize = 0;
+  peer;
+  /** Set once the peer is told, so `end()` then `destroy()` reports once. */
+  hungUp = false;
+  constructor(peer) {
+    super({ allowHalfOpen: false });
+    this.peer = peer;
+  }
+  _read() {
+  }
+  _write(chunk, encoding, callback) {
+    const bytes2 = Buffer2.isBuffer(chunk) ? chunk : Buffer2.from(chunk, encoding);
+    try {
+      this.peer?.data(new Uint8Array(bytes2));
+      callback();
+    } catch (error) {
+      callback(error);
+    }
+  }
+  _final(callback) {
+    this.hangUp();
+    callback();
+  }
+  _destroy(error, callback) {
+    this.hangUp();
+    callback(error);
+  }
+  hangUp() {
+    if (this.hungUp) return;
+    this.hungUp = true;
+    try {
+      this.peer?.close();
+    } catch {
+    }
+    this.peer = null;
+  }
+  /** Bytes arriving from the far end. */
+  deliver(bytes2) {
+    if (this.destroyed || this.hungUp) return;
+    this.push(Buffer2.from(bytes2));
+  }
+  /** The far end went away; let the server's stream end cleanly. */
+  peerClosed() {
+    if (this.destroyed) return;
+    this.push(null);
+  }
+  /* The parts of `net.Socket` a WebSocket library reaches for. None of them
+   * mean anything without a kernel, but every one of them is called. */
+  setNoDelay() {
+    return this;
+  }
+  setKeepAlive() {
+    return this;
+  }
+  setTimeout(_milliseconds, callback) {
+    if (callback) this.once("timeout", callback);
+    return this;
+  }
+  destroySoon() {
+    this.end();
+  }
+  ref() {
+    return this;
+  }
+  unref() {
+    return this;
+  }
+};
 var VirtualHttpServer = class extends EventEmitter4 {
   constructor(router, owner, listener) {
     super();
@@ -23678,6 +23761,33 @@ var VirtualHttpRouter = class {
       return { statusCode: 500, statusMessage: "Internal Server Error", headers: {}, body: error instanceof Error ? error.message : String(error) };
     }
   }
+  /**
+   * Open a connection that leaves HTTP behind — a WebSocket, in practice.
+   *
+   * The counterpart to {@link request}, and the thing whose absence made a dev
+   * server look broken. Every Node WebSocket library is built the same way: it
+   * hands `http.Server` an `upgrade` listener and waits. Nothing here ever
+   * emitted one, so `ws` sat holding a server that could not receive a single
+   * connection, and Vite lost the channel it uses to tell a page to reload —
+   * which is the only way it can recover after re-optimizing dependencies.
+   *
+   * Null means there is nothing to connect to: no server on the port, or a
+   * server that never asked for upgrades. Both are refusals the caller should
+   * report rather than wait out.
+   */
+  connect(port, init, peer) {
+    const item = this.servers.get(port);
+    if (!item) return null;
+    if (item.server.listenerCount("upgrade") === 0) return null;
+    const request = new VirtualIncomingMessage(init);
+    const socket = new VirtualSocket(peer);
+    request.socket = socket;
+    item.server.emit("upgrade", request, socket, Buffer2.alloc(0));
+    return {
+      send: (bytes2) => socket.deliver(bytes2),
+      close: () => socket.peerClosed()
+    };
+  }
 };
 var VirtualClientResponse = class extends streamModule4.Readable {
   constructor(statusCode, statusMessage, headers, body) {
@@ -27194,6 +27304,9 @@ var LocalRuntimePod = class _LocalRuntimePod {
   async request(_port, _init = {}) {
     return this.router.request(_port, _init);
   }
+  connect(port, init, peer) {
+    return this.router.connect(port, init, peer);
+  }
   snapshot() {
     this.assertActive();
     return this.volume.snapshot();
@@ -27629,6 +27742,15 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
         case "http-response":
           this.settleProxied(Number(message.id), message.response);
           return;
+        case "ws-data":
+          this.upgraded.get(Number(message.id))?.write(new Uint8Array(message.data));
+          return;
+        case "ws-close": {
+          const socket = this.upgraded.get(Number(message.id));
+          this.upgraded.delete(Number(message.id));
+          socket?.end();
+          return;
+        }
         case "child-start":
           this.startChild(worker, children, message, ownedChildren);
           return;
@@ -27717,6 +27839,8 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
   // ── HTTP servers living on another thread ─────────────────────────────────
   proxies = /* @__PURE__ */ new Map();
   waiting = /* @__PURE__ */ new Map();
+  /** Upgraded connections, by the id the Worker knows them as. */
+  upgraded = /* @__PURE__ */ new Map();
   nextRequestId = 1;
   /**
    * Register a stand-in for a server that is actually running in the Worker.
@@ -27729,6 +27853,9 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
     const server = new VirtualHttpServer(this.router, owner, (request, response) => {
       void this.forward(worker, port, request, response);
     });
+    server.on("upgrade", (request, socket) => {
+      this.upgrade(worker, port, request, socket);
+    });
     try {
       server.listen(port);
       this.proxies.set(port, server);
@@ -27759,6 +27886,33 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
     response.writeHead(Number(result.statusCode ?? 200), String(result.statusMessage ?? ""), result.headers ?? {});
     response.end(result.body ?? new Uint8Array());
   }
+  /**
+   * Tunnel one upgraded connection to the server that actually holds the port.
+   *
+   * Unlike {@link forward} there is no reply to wait for: both ends write
+   * whenever they have something, until one of them stops. The id is what ties
+   * the two directions together across the Worker boundary.
+   */
+  upgrade(worker, port, request, socket) {
+    const id = this.nextRequestId++;
+    this.upgraded.set(id, socket);
+    socket.on("data", (chunk) => {
+      const bytes2 = new Uint8Array(chunk);
+      worker.postMessage({ type: "ws-data", id, data: bytes2 });
+    });
+    const drop = () => {
+      if (!this.upgraded.delete(id)) return;
+      worker.postMessage({ type: "ws-close", id });
+    };
+    socket.on("close", drop);
+    socket.on("error", drop);
+    worker.postMessage({
+      type: "ws-open",
+      id,
+      port,
+      init: { method: request.method, path: request.url, headers: request.headers }
+    });
+  }
   settleProxied(id, response) {
     const resolve2 = this.waiting.get(id);
     if (!resolve2) return;
@@ -27771,6 +27925,10 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
       server.close();
       this.proxies.delete(port);
     }
+    for (const [id, socket] of [...this.upgraded]) {
+      this.upgraded.delete(id);
+      socket.destroy();
+    }
   }
   teardown() {
     for (const { worker, server } of [...this.live]) {
@@ -28144,6 +28302,29 @@ var Container = class _Container {
       }
     };
   }
+  /**
+   * Open a connection to a server inside the container that upgrades out of
+   * HTTP — in practice, a WebSocket.
+   *
+   * The counterpart to {@link request}, and the thing a dev server needs that
+   * a request cannot provide. Bytes go in with `send`, come back through
+   * `peer.data`, and neither side interprets them: the container runs whatever
+   * WebSocket library the program chose, and the caller is responsible for
+   * speaking the protocol it answers with.
+   *
+   * Null means there is nothing to talk to — no server on the port, or one
+   * that never registered an `upgrade` handler. Both are worth reporting
+   * rather than waiting out, because neither resolves on its own.
+   */
+  connect(port, init = {}, peer) {
+    this.assertActive();
+    if (!this.pod.connect) return null;
+    return this.pod.connect(
+      port,
+      { method: init.method ?? "GET", path: init.path ?? "/", headers: init.headers ?? {} },
+      peer
+    );
+  }
   /**
    * Deliver a request whose body is bytes, without letting them become text.
    *
@@ -28715,6 +28896,12 @@ init_arith();
 init_expand();
 init_builtins();
 
+// src/preview/ws-client.ts
+var WS_OPEN = "sandboxedjs:ws-open";
+var WS_DATA = "sandboxedjs:ws-data";
+var WS_CLOSE = "sandboxedjs:ws-close";
+var WS_ERROR = "sandboxedjs:ws-error";
+
 // src/preview/register.ts
 function serveContainerOn(port, box) {
   port.onmessage = async (event) => {
@@ -28800,7 +28987,7 @@ async function createPreview(box, options = {}) {
     channel = new MessageChannel();
     serveContainerOn(channel.port1, box);
     const target = registration.active ?? worker;
-    target.postMessage({ type: "sandboxedjs:connect" }, [channel.port2]);
+    target.postMessage({ type: "sandboxedjs:connect", injectSockets: options.websocket !== false }, [channel.port2]);
   };
   const onWorkerMessage = (event) => {
     const type = event.data?.type;
@@ -28809,6 +28996,56 @@ async function createPreview(box, options = {}) {
   };
   navigator.serviceWorker.addEventListener("message", onWorkerMessage);
   connect();
+  const sockets = /* @__PURE__ */ new Map();
+  const onFrameMessage = (event) => {
+    if (event.origin !== location.origin || !event.source) return;
+    const data = event.data;
+    if (!data || typeof data !== "object") return;
+    if (data.type !== WS_OPEN && data.type !== WS_DATA && data.type !== WS_CLOSE) return;
+    const source = event.source;
+    const id = Number(data.id);
+    const reply = (message, transfer = []) => source.postMessage(message, location.origin, transfer);
+    if (data.type === WS_OPEN) {
+      let table2 = sockets.get(source);
+      if (!table2) sockets.set(source, table2 = /* @__PURE__ */ new Map());
+      let opened = null;
+      try {
+        opened = box.connect(
+          Number(data.port),
+          { method: "GET", path: data.path ?? "/", headers: data.headers ?? {} },
+          {
+            data: (bytes2) => {
+              const carrier = bytes2.slice().buffer;
+              reply({ type: WS_DATA, id, data: carrier }, [carrier]);
+            },
+            close: () => {
+              table2.delete(id);
+              reply({ type: WS_CLOSE, id });
+            }
+          }
+        );
+      } catch (error) {
+        opened = null;
+        reply({ type: WS_ERROR, id, message: error instanceof Error ? error.message : String(error) });
+        return;
+      }
+      if (!opened) {
+        reply({ type: WS_ERROR, id, message: `Nothing is accepting WebSocket connections on port ${data.port}.` });
+        return;
+      }
+      table2.set(id, opened);
+      return;
+    }
+    const table = sockets.get(source);
+    const socket = table?.get(id);
+    if (!socket) return;
+    if (data.type === WS_DATA) socket.send(new Uint8Array(data.data));
+    else {
+      socket.close();
+      table.delete(id);
+    }
+  };
+  if (typeof window !== "undefined") window.addEventListener("message", onFrameMessage);
   const base2 = registration.scope.replace(/\/$/, "");
   const urlFor = (port) => `${base2}/__sbx__/${port}/`;
   return {
@@ -28822,6 +29059,9 @@ async function createPreview(box, options = {}) {
     },
     dispose: async () => {
       navigator.serviceWorker.removeEventListener("message", onWorkerMessage);
+      if (typeof window !== "undefined") window.removeEventListener("message", onFrameMessage);
+      for (const table of sockets.values()) for (const socket of table.values()) socket.close();
+      sockets.clear();
       channel?.port1.close();
       channel = null;
       await registration.unregister();