sandboxedjs 0.1.55 → 0.1.56

package/README.md

@@ -977,8 +977,11 @@ Honest list of what does not work:
   that `request()` talks to directly, so servers work; raw sockets do not.
 - **Python is source-built CPython/WASM.** Each program gets its own interpreter
   process worker. Pure-Python wheels install normally; native extensions must
-  be linked or published for Emscripten. Pydantic 2's `pydantic-core` is not
-  currently available, so use a Pydantic 1 constraint for FastAPI deployments.
+  be linked or published for Emscripten. The bundled wheel index includes the
+  ABI-matched `pydantic-core` builds required by Pydantic 2, so FastAPI resolves
+  against Pydantic 2 by default. Virtual environments and CPython's real pip
+  are not implemented; the sandbox `pip` installs into one shared site-packages
+  directory, so use a fresh container for dependency isolation.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a
   tight synchronous loop, and `SIGSTOP` only marks state.

package/dist/index.cjs

@@ -17935,7 +17935,15 @@ var bundledManifest = {
     persistence: "memory"
   }
 };
-var config = { backend: "sbx-cpython-wasm", manifest: bundledManifest };
+var bundledWheelIndex = new URL(
+  (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)).includes("/src/runtime/python/") ? "../../../dist/python/wheels/" : "./python/wheels/",
+  (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))
+).href;
+var config = {
+  backend: "sbx-cpython-wasm",
+  manifest: bundledManifest,
+  wheelIndex: bundledWheelIndex
+};
 function setPythonBackend(options) {
   if (options.wheelIndex !== void 0) config.wheelIndex = options.wheelIndex;
   if (options.manifest !== void 0) config.manifest = validateManifest(options.manifest);
@@ -20404,6 +20412,17 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
     }
     const cache = /* @__PURE__ */ new Map();
     const request = async (url, timeoutMs, read) => {
+      if (url.startsWith("file:")) {
+        try {
+          const [{ readFile }, { fileURLToPath: fileURLToPath2 }] = await Promise.all([
+            nodeBuiltin("fs/promises"),
+            nodeBuiltin("url")
+          ]);
+          return await read(new Response(await readFile(fileURLToPath2(url))));
+        } catch (error) {
+          throw new Error(`could not read bundled wheel asset ${url}: ${error.message}`);
+        }
+      }
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       try {