sandboxedjs 0.1.46 → 0.1.47

package/dist/index.d.cts

@@ -1214,11 +1214,28 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
     private readonly fetcher;
     private readonly metadata;
     private readonly tarballs;
+    /** Single-version manifests, for the fields the packument omits. */
+    private readonly details;
     constructor(volume: RuntimeVolume, options?: CleanInstallerOptions);
     forCwd(cwd: string): CleanPackageInstaller;
     install(name: string, version?: string, options?: InstallOptions): Promise<RegistryManifest>;
     installFromManifest(path: string, options?: InstallOptions): Promise<void>;
     private installAt;
+    /**
+     * The `libc` and `main` fields, which the abbreviated packument leaves out.
+     *
+     * Fetched per version rather than as a full packument: the single-version
+     * document is a few kilobytes, while the full one for a popular package runs
+     * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+     * so an ordinary install of pure-JavaScript dependencies makes no extra
+     * requests at all — it is the prebuilt binaries, a handful per project, that
+     * need the answer.
+     *
+     * A failure here is not fatal. Being unable to read `libc` puts the check
+     * back where it was before this existed, which is worth strictly less than
+     * being right and strictly more than refusing to install.
+     */
+    private platformDetail;
     private getMetadata;
     private getTarball;
     private createBinLinks;

package/dist/index.d.ts

@@ -1214,11 +1214,28 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
     private readonly fetcher;
     private readonly metadata;
     private readonly tarballs;
+    /** Single-version manifests, for the fields the packument omits. */
+    private readonly details;
     constructor(volume: RuntimeVolume, options?: CleanInstallerOptions);
     forCwd(cwd: string): CleanPackageInstaller;
     install(name: string, version?: string, options?: InstallOptions): Promise<RegistryManifest>;
     installFromManifest(path: string, options?: InstallOptions): Promise<void>;
     private installAt;
+    /**
+     * The `libc` and `main` fields, which the abbreviated packument leaves out.
+     *
+     * Fetched per version rather than as a full packument: the single-version
+     * document is a few kilobytes, while the full one for a popular package runs
+     * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+     * so an ordinary install of pure-JavaScript dependencies makes no extra
+     * requests at all — it is the prebuilt binaries, a handful per project, that
+     * need the answer.
+     *
+     * A failure here is not fatal. Being unable to read `libc` puts the check
+     * back where it was before this existed, which is worth strictly less than
+     * being right and strictly more than refusing to install.
+     */
+    private platformDetail;
     private getMetadata;
     private getTarball;
     private createBinLinks;

package/dist/index.js

@@ -20301,6 +20301,8 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
   fetcher;
   metadata = /* @__PURE__ */ new Map();
   tarballs = /* @__PURE__ */ new Map();
+  /** Single-version manifests, for the fields the packument omits. */
+  details = /* @__PURE__ */ new Map();
   forCwd(cwd) {
     return new _CleanPackageInstaller(this.volume, { ...this.options, cwd });
   }
@@ -20326,10 +20328,17 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     const version = resolveVersion(metadata, range);
     const manifest = metadata.versions[version];
     if (!manifest) throw new Error(`No matching version found for ${name}@${range}`);
-    if (!supportsPlatform(manifest)) {
-      throw new Error(`${name}@${version} is not compatible with linux/x64/glibc`);
-    }
     const identity = `${name}@${version}`;
+    if (!supportsPlatform(manifest)) throw new IncompatiblePlatform(identity, "");
+    if (manifest.os?.length || manifest.cpu?.length) {
+      const detail = await this.platformDetail(name, version);
+      if (!platformListAllows(detail.libc, PLATFORM.libc)) {
+        throw new IncompatiblePlatform(identity, ` (needs ${detail.libc?.join(", ")})`);
+      }
+      if (detail.main?.endsWith(".node")) {
+        throw new IncompatiblePlatform(identity, " (native addon; this runtime cannot dlopen)");
+      }
+    }
     const target = join(modulesRoot, name);
     const installed2 = this.tryReadJson(join(target, "package.json"));
     if (installed2?.version === version) return installed2;
@@ -20351,11 +20360,44 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
       try {
         await this.installAt(dependency, dependencyRange, childRoot, options, nextAncestry);
       } catch (error) {
+        if (error instanceof IncompatiblePlatform) continue;
         options.onProgress?.(`Skipped optional ${dependency}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
     return manifest;
   }
+  /**
+   * The `libc` and `main` fields, which the abbreviated packument leaves out.
+   *
+   * Fetched per version rather than as a full packument: the single-version
+   * document is a few kilobytes, while the full one for a popular package runs
+   * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+   * so an ordinary install of pure-JavaScript dependencies makes no extra
+   * requests at all — it is the prebuilt binaries, a handful per project, that
+   * need the answer.
+   *
+   * A failure here is not fatal. Being unable to read `libc` puts the check
+   * back where it was before this existed, which is worth strictly less than
+   * being right and strictly more than refusing to install.
+   */
+  async platformDetail(name, version) {
+    const key = `${name}@${version}`;
+    let request = this.details.get(key);
+    if (!request) {
+      request = (async () => {
+        try {
+          const encoded = name.startsWith("@") ? name.replace("/", "%2F") : encodeURIComponent(name);
+          const response = await this.fetcher(`${this.registry}/${encoded}/${version}`);
+          if (!response.ok) return {};
+          return await response.json();
+        } catch {
+          return {};
+        }
+      })();
+      this.details.set(key, request);
+    }
+    return request;
+  }
   async getMetadata(name) {
     let request = this.metadata.get(name);
     if (!request) {
@@ -20423,8 +20465,15 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     }
   }
 };
+var PLATFORM = { os: "linux", cpu: "x64", libc: "glibc" };
+var IncompatiblePlatform = class extends Error {
+  constructor(identity, detail) {
+    super(`${identity} is not compatible with ${PLATFORM.os}/${PLATFORM.cpu}/${PLATFORM.libc}${detail}`);
+    this.name = "IncompatiblePlatform";
+  }
+};
 function supportsPlatform(manifest) {
-  return !manifest.main?.endsWith(".node") && platformListAllows(manifest.os, "linux") && platformListAllows(manifest.cpu, "x64") && platformListAllows(manifest.libc, "glibc");
+  return platformListAllows(manifest.os, PLATFORM.os) && platformListAllows(manifest.cpu, PLATFORM.cpu) && platformListAllows(manifest.libc, PLATFORM.libc);
 }
 function platformListAllows(values, current) {
   if (!values?.length) return true;