sandboxedjs 0.1.51 → 0.1.53

package/dist/agent.d.cts

@@ -1,4 +1,4 @@
-import { C as Container } from './container-Dg8NwBc7.cjs';
+import { C as Container } from './container-B--ykWn3.cjs';
 import './vfs-DzEcPbMY.cjs';
 
 /**

package/dist/agent.d.ts

@@ -1,4 +1,4 @@
-import { C as Container } from './container-DBMPLbUu.js';
+import { C as Container } from './container-BSW6jjlq.js';
 import './vfs-DzEcPbMY.js';
 
 /**

package/dist/{container-Dg8NwBc7.d.cts → container-B--ykWn3.d.cts}

@@ -1053,7 +1053,7 @@ declare class Shell {
 declare const MANIFEST_FORMAT = "sandboxedjs-python-runtime";
 declare const MANIFEST_SCHEMA_VERSION = 1;
 /** Build profiles, as defined in docs/python/architecture.md. */
-type PythonProfile = "core" | "threaded-fixed" | "threaded-dynamic";
+type PythonProfile = "core" | "threaded-fixed" | "dynamic";
 interface PythonCapabilities {
     /** Real Python threads. `core` builds have none, and must say so. */
     threads: boolean;
@@ -1101,6 +1101,54 @@ interface PythonRuntimeManifest {
  */
 declare function validateManifest(value: unknown): PythonRuntimeManifest;
 
+/**
+ * Dependency resolution for the owned Python runtime.
+ *
+ * The installer this replaces walked candidate versions and downloaded a whole
+ * wheel for each one just to read its `METADATA`. That is why it needed an
+ * arbitrary cap on how many candidates it would try: without one, discovering
+ * that a package's last forty releases all need the same unavailable native
+ * extension cost forty multi-megabyte downloads, and the install looked hung
+ * rather than failed. The cap made the symptom bearable and the cause worse --
+ * a resolution that hit it reported a limit rather than the conflict, and a
+ * legitimately deep graph failed for no reason.
+ *
+ * Three changes remove the need for it:
+ *
+ *   * Dependency metadata is read from PEP 658 sidecars, so learning what a
+ *     release requires costs a few kilobytes rather than the wheel.
+ *   * Constraints propagate. A version excluded by an already-chosen package's
+ *     requirement is never fetched at all.
+ *   * Conflicts are learned. When a set of constraints proves unsatisfiable,
+ *     the proof is recorded, so the same subtree is not re-derived once per
+ *     parent version.
+ *
+ * What bounds the work now is a deadline and a cancellation signal, which are
+ * honest limits: they say the search ran out of time, not that it ran out of
+ * an arbitrary allowance.
+ */
+
+/**
+ * One prebuilt SandboxedJs wheel, as published in a wheel index.
+ *
+ * `abiId` travels with the entry rather than being implied by the index it
+ * came from. An index served for a different interpreter build would otherwise
+ * look usable, and the wheel would fail at import rather than at resolution.
+ */
+interface PrebuiltWheel {
+    name: string;
+    version: string;
+    filename: string;
+    sha256: string;
+    abiId: string;
+    requires: string[];
+}
+interface WheelIndex {
+    /** Where `filename` is resolved against. */
+    baseUrl: string;
+    wheels: PrebuiltWheel[];
+}
+
 /**
  * Which Python backend a container uses.
  *
@@ -1178,6 +1226,14 @@ interface PythonOptions {
     manifest?: PythonRuntimeManifest;
     /** Where the built process worker is served from, for hosts that must say. */
     workerUrl?: string;
+    /**
+     * Prebuilt wheels for this runtime's native ABI, which PyPI does not carry.
+     *
+     * Either the index itself, or the base URL its `index.json` is served from.
+     * A package with a compiled extension cannot resolve without one, because
+     * no published wheel targets wasm32-emscripten.
+     */
+    wheelIndex?: WheelIndex | string | null;
 }
 declare function configurePython(options?: PythonOptions): void;
 declare const isPythonAvailable: typeof isCPythonAvailable;

package/dist/{container-DBMPLbUu.d.ts → container-BSW6jjlq.d.ts}

@@ -1053,7 +1053,7 @@ declare class Shell {
 declare const MANIFEST_FORMAT = "sandboxedjs-python-runtime";
 declare const MANIFEST_SCHEMA_VERSION = 1;
 /** Build profiles, as defined in docs/python/architecture.md. */
-type PythonProfile = "core" | "threaded-fixed" | "threaded-dynamic";
+type PythonProfile = "core" | "threaded-fixed" | "dynamic";
 interface PythonCapabilities {
     /** Real Python threads. `core` builds have none, and must say so. */
     threads: boolean;
@@ -1101,6 +1101,54 @@ interface PythonRuntimeManifest {
  */
 declare function validateManifest(value: unknown): PythonRuntimeManifest;
 
+/**
+ * Dependency resolution for the owned Python runtime.
+ *
+ * The installer this replaces walked candidate versions and downloaded a whole
+ * wheel for each one just to read its `METADATA`. That is why it needed an
+ * arbitrary cap on how many candidates it would try: without one, discovering
+ * that a package's last forty releases all need the same unavailable native
+ * extension cost forty multi-megabyte downloads, and the install looked hung
+ * rather than failed. The cap made the symptom bearable and the cause worse --
+ * a resolution that hit it reported a limit rather than the conflict, and a
+ * legitimately deep graph failed for no reason.
+ *
+ * Three changes remove the need for it:
+ *
+ *   * Dependency metadata is read from PEP 658 sidecars, so learning what a
+ *     release requires costs a few kilobytes rather than the wheel.
+ *   * Constraints propagate. A version excluded by an already-chosen package's
+ *     requirement is never fetched at all.
+ *   * Conflicts are learned. When a set of constraints proves unsatisfiable,
+ *     the proof is recorded, so the same subtree is not re-derived once per
+ *     parent version.
+ *
+ * What bounds the work now is a deadline and a cancellation signal, which are
+ * honest limits: they say the search ran out of time, not that it ran out of
+ * an arbitrary allowance.
+ */
+
+/**
+ * One prebuilt SandboxedJs wheel, as published in a wheel index.
+ *
+ * `abiId` travels with the entry rather than being implied by the index it
+ * came from. An index served for a different interpreter build would otherwise
+ * look usable, and the wheel would fail at import rather than at resolution.
+ */
+interface PrebuiltWheel {
+    name: string;
+    version: string;
+    filename: string;
+    sha256: string;
+    abiId: string;
+    requires: string[];
+}
+interface WheelIndex {
+    /** Where `filename` is resolved against. */
+    baseUrl: string;
+    wheels: PrebuiltWheel[];
+}
+
 /**
  * Which Python backend a container uses.
  *
@@ -1178,6 +1226,14 @@ interface PythonOptions {
     manifest?: PythonRuntimeManifest;
     /** Where the built process worker is served from, for hosts that must say. */
     workerUrl?: string;
+    /**
+     * Prebuilt wheels for this runtime's native ABI, which PyPI does not carry.
+     *
+     * Either the index itself, or the base URL its `index.json` is served from.
+     * A package with a compiled extension cannot resolve without one, because
+     * no published wheel targets wasm32-emscripten.
+     */
+    wheelIndex?: WheelIndex | string | null;
 }
 declare function configurePython(options?: PythonOptions): void;
 declare const isPythonAvailable: typeof isCPythonAvailable;