sandboxedjs 0.1.55 → 0.1.57

package/README.md

@@ -729,6 +729,23 @@ await box.exec("python3 -c 'import sqlite3; print(sqlite3.sqlite_version)'");
 Python never falls back to a host interpreter. When selecting the optional
 Pyodide backend, its module and asset directory must use the same version.
 
+### Python wheels with Vite
+
+Vite prebundles JavaScript dependencies into `.vite/deps`, but it does not
+serve binary package assets next to that optimized module. Copy
+`node_modules/sandboxedjs/dist/python/wheels` to your app's public directory
+at build time, then configure the public URL before creating a container:
+
+```ts
+import { configurePython } from "sandboxedjs";
+
+configurePython({ wheelIndex: "/python/wheels" });
+```
+
+The directory must contain `index.json` and every wheel named by it. Once this
+is configured, `pip install fastapi` resolves Pydantic 2 and the bundled
+WASM-compatible `pydantic-core` rather than falling back to Pydantic 1.
+
 ## Uploading files
 
 A file picker in a browser never hands over a path — it hands over the file's bytes. So getting a
@@ -977,8 +994,11 @@ Honest list of what does not work:
   that `request()` talks to directly, so servers work; raw sockets do not.
 - **Python is source-built CPython/WASM.** Each program gets its own interpreter
   process worker. Pure-Python wheels install normally; native extensions must
-  be linked or published for Emscripten. Pydantic 2's `pydantic-core` is not
-  currently available, so use a Pydantic 1 constraint for FastAPI deployments.
+  be linked or published for Emscripten. The bundled wheel index includes the
+  ABI-matched `pydantic-core` builds required by Pydantic 2, so FastAPI resolves
+  against Pydantic 2 by default. Virtual environments and CPython's real pip
+  are not implemented; the sandbox `pip` installs into one shared site-packages
+  directory, so use a fresh container for dependency isolation.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a
   tight synchronous loop, and `SIGSTOP` only marks state.

package/dist/index.cjs

@@ -17935,7 +17935,15 @@ var bundledManifest = {
     persistence: "memory"
   }
 };
-var config = { backend: "sbx-cpython-wasm", manifest: bundledManifest };
+var bundledWheelIndex = (typeof process !== "undefined" && process.versions?.node ? new URL(
+  (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)).includes("/src/runtime/python/") ? "../../../dist/python/wheels/" : "./python/wheels/",
+  (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))
+) : new URL("/python/wheels/", globalThis.location?.href ?? (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)))).href;
+var config = {
+  backend: "sbx-cpython-wasm",
+  manifest: bundledManifest,
+  wheelIndex: bundledWheelIndex
+};
 function setPythonBackend(options) {
   if (options.wheelIndex !== void 0) config.wheelIndex = options.wheelIndex;
   if (options.manifest !== void 0) config.manifest = validateManifest(options.manifest);
@@ -20404,6 +20412,17 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
     }
     const cache = /* @__PURE__ */ new Map();
     const request = async (url, timeoutMs, read) => {
+      if (url.startsWith("file:")) {
+        try {
+          const [{ readFile }, { fileURLToPath: fileURLToPath2 }] = await Promise.all([
+            nodeBuiltin("fs/promises"),
+            nodeBuiltin("url")
+          ]);
+          return await read(new Response(await readFile(fileURLToPath2(url))));
+        } catch (error) {
+          throw new Error(`could not read bundled wheel asset ${url}: ${error.message}`);
+        }
+      }
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       try {
@@ -20440,7 +20459,9 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
         const loaded = await client.json(`${url}/index.json`);
         index = { baseUrl: url, wheels: loaded.wheels ?? [] };
       } catch (error) {
-        return ctx.fail(`could not read the wheel index at ${configured}: ${error.message}`);
+        return ctx.fail(
+          `could not read the wheel index at ${configured}: ${error.message}. When running under a bundler such as Vite, publish dist/python/wheels as a static asset and configurePython({ wheelIndex: '/python/wheels' }) before creating the container.`
+        );
       }
     } else if (configured) {
       index = configured;