sandboxedjs 0.1.71 → 0.1.73

package/dist/index.js

@@ -4060,6 +4060,214 @@ var init_builtins = __esm({
   }
 });
 
+// src/util/binary.ts
+async function nodeBuiltin(name) {
+  const specifier = `node:${name}`;
+  return await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+}
+async function nodeOnlyModule(specifier) {
+  const parts = specifier.split("/");
+  const runtimeSpecifier = parts.join("/");
+  return await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    runtimeSpecifier
+  );
+}
+function nodeZlib() {
+  zlibPromise ??= nodeBuiltin("zlib");
+  return zlibPromise;
+}
+async function throughStream(data, stream) {
+  const source = new Blob([data]).stream();
+  const piped = source.pipeThrough(stream);
+  return new Uint8Array(await new Response(piped).arrayBuffer());
+}
+async function gzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gzipSync(data));
+  return throughStream(data, new CompressionStream("gzip"));
+}
+async function gunzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gunzipSync(data));
+  return throughStream(data, new DecompressionStream("gzip"));
+}
+async function deflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).deflateSync(data));
+  return throughStream(data, new CompressionStream("deflate"));
+}
+async function inflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).inflateSync(data));
+  return throughStream(data, new DecompressionStream("deflate"));
+}
+function nodeCrypto() {
+  cryptoPromise ??= nodeBuiltin("crypto");
+  return cryptoPromise;
+}
+async function digestHex(algorithm, data) {
+  if (isNode) {
+    const { createHash } = await nodeCrypto();
+    return createHash(algorithm).update(data).digest("hex");
+  }
+  if (algorithm === "md5") return md5Hex(data);
+  const name = SUBTLE_NAMES[algorithm];
+  if (!name) throw new UnsupportedAlgorithmError(algorithm);
+  const buffer = await crypto.subtle.digest(name, data);
+  return toHex(new Uint8Array(buffer));
+}
+async function randomUuid() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  const { randomUUID } = await nodeCrypto();
+  return randomUUID();
+}
+function toHex(bytes2) {
+  let out = "";
+  for (const byte of bytes2) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function md5Hex(input) {
+  const S = [
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21
+  ];
+  const K = new Uint32Array(64);
+  for (let i = 0; i < 64; i++) K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
+  const bitLength = input.length * 8;
+  const padded = new Uint8Array(((input.length + 8 >> 6) + 1) * 64);
+  padded.set(input);
+  padded[input.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, bitLength >>> 0, true);
+  view.setUint32(padded.length - 4, Math.floor(bitLength / 2 ** 32), true);
+  let a0 = 1732584193;
+  let b0 = 4023233417;
+  let c0 = 2562383102;
+  let d0 = 271733878;
+  for (let chunk = 0; chunk < padded.length; chunk += 64) {
+    const M = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) M[i] = view.getUint32(chunk + i * 4, true);
+    let [a, b, c, d] = [a0, b0, c0, d0];
+    for (let i = 0; i < 64; i++) {
+      let f;
+      let g;
+      if (i < 16) {
+        f = b & c | ~b & d;
+        g = i;
+      } else if (i < 32) {
+        f = d & b | ~d & c;
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        f = b ^ c ^ d;
+        g = (3 * i + 5) % 16;
+      } else {
+        f = c ^ (b | ~d);
+        g = 7 * i % 16;
+      }
+      const tmp = d;
+      d = c;
+      c = b;
+      const sum = a + f + K[i] + M[g] >>> 0;
+      b = b + (sum << S[i] | sum >>> 32 - S[i]) >>> 0;
+      a = tmp;
+    }
+    a0 = a0 + a >>> 0;
+    b0 = b0 + b >>> 0;
+    c0 = c0 + c >>> 0;
+    d0 = d0 + d >>> 0;
+  }
+  const out = new Uint8Array(16);
+  new DataView(out.buffer).setUint32(0, a0, true);
+  new DataView(out.buffer).setUint32(4, b0, true);
+  new DataView(out.buffer).setUint32(8, c0, true);
+  new DataView(out.buffer).setUint32(12, d0, true);
+  return toHex(out);
+}
+var isNode, zlibPromise, cryptoPromise, SUBTLE_NAMES, UnsupportedAlgorithmError;
+var init_binary = __esm({
+  "src/util/binary.ts"() {
+    isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+    zlibPromise = null;
+    cryptoPromise = null;
+    SUBTLE_NAMES = {
+      sha1: "SHA-1",
+      sha256: "SHA-256",
+      sha384: "SHA-384",
+      sha512: "SHA-512"
+    };
+    UnsupportedAlgorithmError = class extends Error {
+      constructor(algorithm) {
+        super(`${algorithm} is not available in this environment`);
+        this.name = "UnsupportedAlgorithmError";
+      }
+    };
+  }
+});
+
 // src/pkg/zip.ts
 var zip_exports = {};
 __export(zip_exports, {
@@ -4148,6 +4356,122 @@ var init_zip = __esm({
   }
 });
 
+// src/python/local-builder.ts
+var local_builder_exports = {};
+__export(local_builder_exports, {
+  buildFromSource: () => buildFromSource
+});
+async function pipelineRoot() {
+  const [{ existsSync }, { fileURLToPath: fileURLToPath2 }, { dirname: dirname3, resolve: resolve3 }] = await Promise.all([
+    nodeBuiltin("fs"),
+    nodeBuiltin("url"),
+    nodeBuiltin("path")
+  ]);
+  const here = dirname3(fileURLToPath2(import.meta.url));
+  for (const candidate of [
+    resolve3(here, "../python-runtime"),
+    resolve3(here, "../../python-runtime"),
+    resolve3(here, "../../../python-runtime")
+  ]) {
+    if (existsSync(resolve3(candidate, "scripts/build_extension.py"))) return candidate;
+  }
+  return null;
+}
+async function run(command, args, cwd) {
+  const { spawn } = await nodeBuiltin("child_process");
+  return await new Promise((resolveRun) => {
+    const child = spawn(command, args, { cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (error) => resolveRun({ code: -1, stdout, stderr: String(error) }));
+    child.on("close", (code) => resolveRun({ code: code ?? -1, stdout, stderr }));
+  });
+}
+async function readIndex(root) {
+  const [{ readFileSync, existsSync }, { pathToFileURL: pathToFileURL2 }, { resolve: resolve3 }] = await Promise.all([
+    nodeBuiltin("fs"),
+    nodeBuiltin("url"),
+    nodeBuiltin("path")
+  ]);
+  const directory2 = resolve3(root, "out/wheels");
+  const file3 = resolve3(directory2, "index.json");
+  if (!existsSync(file3)) return null;
+  const parsed = JSON.parse(readFileSync(file3, "utf8"));
+  return {
+    ...parsed,
+    baseUrl: pathToFileURL2(directory2).href
+  };
+}
+async function buildFromSource(requirement, log = () => {
+}) {
+  const root = await pipelineRoot();
+  if (root === null) {
+    return {
+      built: false,
+      index: null,
+      classification: "blocked-toolchain",
+      reason: "the build pipeline is not present; wheels can only be built from a checkout"
+    };
+  }
+  log(`Building ${requirement} from source (no wheel for this runtime yet)`);
+  const recipe = await run("python3", ["scripts/auto_recipe.py", requirement], root);
+  if (recipe.code !== 0) {
+    try {
+      const reported = JSON.parse(recipe.stdout.trim().split("\n").at(-1) ?? "{}");
+      if (reported.reason) {
+        return {
+          built: false,
+          index: null,
+          classification: reported.classification ?? "blocked-toolchain",
+          reason: reported.reason
+        };
+      }
+    } catch {
+    }
+    return {
+      built: false,
+      index: null,
+      classification: "blocked-toolchain",
+      reason: `could not describe ${requirement}: ${recipe.stderr.trim().slice(-400)}`
+    };
+  }
+  const recipePath = recipe.stdout.trim().split("\n").at(-1);
+  const build = await run("python3", ["scripts/build_extension.py", recipePath], root);
+  if (build.code !== 0) {
+    const tail2 = `${build.stdout}
+${build.stderr}`.trim().split("\n").slice(-12).join("\n");
+    return {
+      built: false,
+      index: null,
+      classification: "blocked-toolchain",
+      reason: `building ${requirement} failed:
+${tail2}`
+    };
+  }
+  const indexed = await run("python3", ["scripts/build_index.py"], root);
+  if (indexed.code !== 0) {
+    return {
+      built: false,
+      index: null,
+      classification: "blocked-toolchain",
+      reason: `built ${requirement} but could not index it: ${indexed.stderr.trim().slice(-300)}`
+    };
+  }
+  log(`Built ${requirement}`);
+  return { built: true, index: await readIndex(root) };
+}
+var init_local_builder = __esm({
+  "src/python/local-builder.ts"() {
+    init_binary();
+  }
+});
+
 // src/fs/vfs.ts
 init_errno();
 init_path();
@@ -15410,211 +15734,7 @@ var commands5 = [grep, find, xargs, diff, cmp];
 // src/bin/archive.ts
 init_mode();
 init_path();
-
-// src/util/binary.ts
-var isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
-async function nodeBuiltin(name) {
-  const specifier = `node:${name}`;
-  return await import(
-    /* @vite-ignore */
-    /* webpackIgnore: true */
-    specifier
-  );
-}
-async function nodeOnlyModule(specifier) {
-  const parts = specifier.split("/");
-  const runtimeSpecifier = parts.join("/");
-  return await import(
-    /* @vite-ignore */
-    /* webpackIgnore: true */
-    runtimeSpecifier
-  );
-}
-var zlibPromise = null;
-function nodeZlib() {
-  zlibPromise ??= nodeBuiltin("zlib");
-  return zlibPromise;
-}
-async function throughStream(data, stream) {
-  const source = new Blob([data]).stream();
-  const piped = source.pipeThrough(stream);
-  return new Uint8Array(await new Response(piped).arrayBuffer());
-}
-async function gzip(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).gzipSync(data));
-  return throughStream(data, new CompressionStream("gzip"));
-}
-async function gunzip(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).gunzipSync(data));
-  return throughStream(data, new DecompressionStream("gzip"));
-}
-async function deflate(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).deflateSync(data));
-  return throughStream(data, new CompressionStream("deflate"));
-}
-async function inflate(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).inflateSync(data));
-  return throughStream(data, new DecompressionStream("deflate"));
-}
-var cryptoPromise = null;
-function nodeCrypto() {
-  cryptoPromise ??= nodeBuiltin("crypto");
-  return cryptoPromise;
-}
-var SUBTLE_NAMES = {
-  sha1: "SHA-1",
-  sha256: "SHA-256",
-  sha384: "SHA-384",
-  sha512: "SHA-512"
-};
-var UnsupportedAlgorithmError = class extends Error {
-  constructor(algorithm) {
-    super(`${algorithm} is not available in this environment`);
-    this.name = "UnsupportedAlgorithmError";
-  }
-};
-async function digestHex(algorithm, data) {
-  if (isNode) {
-    const { createHash } = await nodeCrypto();
-    return createHash(algorithm).update(data).digest("hex");
-  }
-  if (algorithm === "md5") return md5Hex(data);
-  const name = SUBTLE_NAMES[algorithm];
-  if (!name) throw new UnsupportedAlgorithmError(algorithm);
-  const buffer = await crypto.subtle.digest(name, data);
-  return toHex(new Uint8Array(buffer));
-}
-async function randomUuid() {
-  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
-  const { randomUUID } = await nodeCrypto();
-  return randomUUID();
-}
-function toHex(bytes2) {
-  let out = "";
-  for (const byte of bytes2) out += byte.toString(16).padStart(2, "0");
-  return out;
-}
-function md5Hex(input) {
-  const S = [
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21
-  ];
-  const K = new Uint32Array(64);
-  for (let i = 0; i < 64; i++) K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
-  const bitLength = input.length * 8;
-  const padded = new Uint8Array(((input.length + 8 >> 6) + 1) * 64);
-  padded.set(input);
-  padded[input.length] = 128;
-  const view = new DataView(padded.buffer);
-  view.setUint32(padded.length - 8, bitLength >>> 0, true);
-  view.setUint32(padded.length - 4, Math.floor(bitLength / 2 ** 32), true);
-  let a0 = 1732584193;
-  let b0 = 4023233417;
-  let c0 = 2562383102;
-  let d0 = 271733878;
-  for (let chunk = 0; chunk < padded.length; chunk += 64) {
-    const M = new Uint32Array(16);
-    for (let i = 0; i < 16; i++) M[i] = view.getUint32(chunk + i * 4, true);
-    let [a, b, c, d] = [a0, b0, c0, d0];
-    for (let i = 0; i < 64; i++) {
-      let f;
-      let g;
-      if (i < 16) {
-        f = b & c | ~b & d;
-        g = i;
-      } else if (i < 32) {
-        f = d & b | ~d & c;
-        g = (5 * i + 1) % 16;
-      } else if (i < 48) {
-        f = b ^ c ^ d;
-        g = (3 * i + 5) % 16;
-      } else {
-        f = c ^ (b | ~d);
-        g = 7 * i % 16;
-      }
-      const tmp = d;
-      d = c;
-      c = b;
-      const sum = a + f + K[i] + M[g] >>> 0;
-      b = b + (sum << S[i] | sum >>> 32 - S[i]) >>> 0;
-      a = tmp;
-    }
-    a0 = a0 + a >>> 0;
-    b0 = b0 + b >>> 0;
-    c0 = c0 + c >>> 0;
-    d0 = d0 + d >>> 0;
-  }
-  const out = new Uint8Array(16);
-  new DataView(out.buffer).setUint32(0, a0, true);
-  new DataView(out.buffer).setUint32(4, b0, true);
-  new DataView(out.buffer).setUint32(8, c0, true);
-  new DataView(out.buffer).setUint32(12, d0, true);
-  return toHex(out);
-}
-
-// src/bin/archive.ts
+init_binary();
 var BLOCK = 512;
 var encoder4 = new TextEncoder();
 var decoder6 = new TextDecoder();
@@ -15927,6 +16047,7 @@ var zlibCompress = defineCommand({
 var commands6 = [tar, gzip2, gunzip2, zcat, zlibCompress];
 
 // src/bin/hash.ts
+init_binary();
 function makeSum(name, algorithm, path) {
   return defineCommand({
     name,
@@ -17355,7 +17476,7 @@ var wlPaste = defineCommand({
 });
 var commands11 = [xsel, xclip, pbcopy, pbpaste, wlCopy, wlPaste];
 
-// src/runtime/node.ts
+// src/node/node.ts
 init_path();
 var NODE_VERSION = "v22.12.0";
 new TextEncoder();
@@ -17752,10 +17873,10 @@ function nodeCommands() {
   return [node, nodeVersionFile];
 }
 
-// src/runtime/python.ts
+// src/python/python.ts
 init_path();
 
-// src/runtime/python/host-abi.ts
+// src/python/host-abi.ts
 var SBX_HOST_ABI_VERSION = 1;
 var SBX_REQUEST_HEADER_BYTES = 16;
 var SBX_RESPONSE_HEADER_BYTES = 20;
@@ -17868,7 +17989,7 @@ Object.fromEntries(
   Object.entries(Errno).map(([name, code]) => [code, name])
 );
 
-// src/runtime/python/manifest.ts
+// src/python/manifest.ts
 var MANIFEST_FORMAT = "sandboxedjs-python-runtime";
 var MANIFEST_SCHEMA_VERSION = 1;
 var ManifestError = class extends Error {
@@ -17967,6 +18088,27 @@ var wheels_default = {
         patches: []
       }
     },
+    {
+      name: "numpy",
+      version: "2.2.6",
+      filename: "numpy-2.2.6-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "93ae7230479566b45f715733e92caaeadb1e6fd7b6bfe244e907c2c4eea910bf",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [],
+      provenance: {
+        sourceTreeDigest: "71c23901e3de9adcf52c9e9965279e73f98f45ed7ab9847d7f5f9f1433d4452e",
+        recipeSha256: "b5cde263ce9932472b1c17ee74d80ac194f938ca8e4c3415faedd0abe69c3e09",
+        buildTools: [
+          "setuptools==84.0.0",
+          "meson-python==0.21.0",
+          "meson==1.12.0",
+          "ninja==1.13.2",
+          "Cython==3.1.4"
+        ],
+        nativeDependencies: [],
+        patches: []
+      }
+    },
     {
       name: "pydantic-core",
       version: "2.23.2",
@@ -18044,7 +18186,7 @@ var wheels_default = {
       name: "sbx-meson-probe",
       version: "1.0.0",
       filename: "sbx_meson_probe-1.0.0-cp313-cp313-emscripten_5_0_6_wasm32.whl",
-      sha256: "f3efc427caa9ab45c85af554b19c06f0d227852682972894484f9b024a6cb586",
+      sha256: "3ad378e05668ec190f76605e312a47a12009879a13cc083574b03c8cdbbf5ed5",
       abiId: "sbxabi1-c2637d04695ad927",
       requires: [
         "typing-extensions>=4.0"
@@ -18180,7 +18322,7 @@ var wheels_default = {
       name: "siphash24",
       version: "1.9",
       filename: "siphash24-1.9-cp313-cp313-emscripten_5_0_6_wasm32.whl",
-      sha256: "cf672c37b0f8e4cd198e5fdd4c6c84036d1d4da36f889564385c1eacfb7c3295",
+      sha256: "41e76fde2f7ed45f801e73c7ed65b7f0ea0465966915e5415c96e782f8cbfc48",
       abiId: "sbxabi1-c2637d04695ad927",
       requires: [],
       provenance: {
@@ -18204,9 +18346,17 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.71"};
+  version: "0.1.73"};
 
-// src/runtime/python/config.ts
+// src/python/config.ts
+function runtimeModuleUrl() {
+  const url = new URL(
+    import.meta.url.includes("/src/python/") ? "../../dist/python/python.js" : "./python/python.js",
+    import.meta.url
+  );
+  if (url.protocol !== "file:") url.searchParams.set("sbx-runtime", package_default.version);
+  return url;
+}
 var bundledManifest = {
   format: "sandboxedjs-python-runtime",
   schemaVersion: 1,
@@ -18215,16 +18365,7 @@ var bundledManifest = {
   pythonVersion: "3.13.5",
   profile: "dynamic",
   hostAbi: { name: "sbx_host_v1", version: 1 },
-  artifacts: {
-    moduleUrl: (() => {
-      const url = new URL(
-        import.meta.url.includes("/src/runtime/python/") ? "../../../dist/python/python.js" : "./python/python.js",
-        import.meta.url
-      );
-      if (url.protocol !== "file:") url.searchParams.set("sbx-runtime", package_default.version);
-      return url.href;
-    })()
-  },
+  artifacts: { moduleUrl: runtimeModuleUrl().href },
   capabilities: {
     threads: true,
     nativeExtensions: "dynamic",
@@ -18233,24 +18374,31 @@ var bundledManifest = {
     persistence: "memory"
   }
 };
-var bundledWheelNames = {
+var embeddedWheels = {
   "pydantic_core-2.23.2-cp313-cp313-emscripten_5_0_6_wasm32.whl": pydantic_core_2_23_2_cp313_cp313_emscripten_5_0_6_wasm32_default,
   "pydantic_core-2.46.5-cp313-cp313-emscripten_5_0_6_wasm32.whl": pydantic_core_2_46_5_cp313_cp313_emscripten_5_0_6_wasm32_default
 };
 var bundledWheelIndex = {
-  baseUrl: "sbx-wheel:",
-  wheels: wheels_default.wheels.filter(
-    (wheel) => wheel.filename in bundledWheelNames
-  ),
-  files: bundledWheelNames
+  baseUrl: new URL("./wheels", runtimeModuleUrl()).href,
+  wheels: wheels_default.wheels,
+  files: embeddedWheels
 };
 var config = {
   backend: "sbx-cpython-wasm",
   manifest: bundledManifest,
-  wheelIndex: bundledWheelIndex
+  wheelIndex: bundledWheelIndex,
+  /* On by default only where it can possibly work: a Node process, running
+   * from a checkout that has the build pipeline. A browser has no compiler and
+   * never will, and a published package has no pipeline -- in both, building
+   * would replace a clear "no wheel for this package" with a hang or a
+   * confusing failure, so both keep reporting instead. `local-builder` checks
+   * for the pipeline again before it runs, so this is a cheap hint rather than
+   * a promise. */
+  buildFromSource: typeof process !== "undefined" && Boolean(process.versions?.node) && import.meta.url.startsWith("file:")
 };
 function setPythonBackend(options) {
   if (options.wheelIndex !== void 0) config.wheelIndex = options.wheelIndex;
+  if (options.buildFromSource !== void 0) config.buildFromSource = options.buildFromSource;
   if (options.manifest !== void 0) config.manifest = validateManifest(options.manifest);
   if (options.workerUrl !== void 0) config.workerUrl = options.workerUrl;
   if (options.backend !== void 0) {
@@ -18924,10 +19072,11 @@ var FileService = class {
   }
 };
 
-// src/runtime/python/backend.ts
+// src/python/backend.ts
 init_signals();
+init_binary();
 
-// src/runtime/python/protocol.ts
+// src/python/protocol.ts
 var ProtocolError = class extends Error {
   code = "ERR_SBX_ABI_PROTOCOL";
 };
@@ -19404,7 +19553,7 @@ var VirtualTcpNetwork = class {
   }
 };
 
-// src/runtime/python/syscall-server.ts
+// src/python/syscall-server.ts
 var MAX_TRANSFER = 8 * 1024 * 1024;
 var POLLIN = 1;
 var POLLOUT = 4;
@@ -19853,7 +20002,7 @@ function encodeStat(st) {
   return new Writer().u64(st.ino).u32(st.mode).u64(st.size).u32(st.uid).u32(st.gid).u32(st.nlink).i64(Math.round(st.atimeMs * 1e6)).i64(Math.round(st.mtimeMs * 1e6)).i64(Math.round(st.ctimeMs * 1e6)).finish();
 }
 
-// src/runtime/python/sync-transport.ts
+// src/python/sync-transport.ts
 var STATE = 0;
 var LENGTH = 1;
 var MORE = 2;
@@ -19956,7 +20105,7 @@ function concat3(parts) {
   return joined;
 }
 
-// src/runtime/worker-host.ts
+// src/worker/worker-host.ts
 function defaultWorkerUrl() {
   return new URL("./worker-entry.js", import.meta.url);
 }
@@ -20027,7 +20176,7 @@ async function startNodeWorker(url, workerData) {
   };
 }
 
-// src/runtime/python/supervisor.ts
+// src/python/supervisor.ts
 var nextGeneration = 1;
 async function startPythonProcess(options) {
   const unavailable2 = syncTransportUnavailableReason();
@@ -20142,10 +20291,10 @@ async function startPythonProcess(options) {
   };
 }
 
-// src/runtime/python/install.ts
+// src/python/install.ts
 init_zip();
 
-// src/runtime/python/pypi.ts
+// src/python/pypi.ts
 function parseRequirement(text2) {
   const cleaned = text2.replace(/#.*$/, "").trim();
   if (!cleaned) return null;
@@ -20224,7 +20373,7 @@ function splitOnce(text2, separator) {
   return at < 0 ? [text2] : [text2.slice(0, at), text2.slice(at + 1)];
 }
 
-// src/runtime/python/extension-abi.ts
+// src/python/extension-abi.ts
 var EXTENSION_ABI = {
   "abiId": "sbxabi1-c2637d04695ad927",
   "wheelTag": "cp313-cp313-emscripten_5_0_6_wasm32",
@@ -20238,7 +20387,7 @@ var EXTENSION_ABI = {
 var WHEEL_TAG = EXTENSION_ABI.wheelTag;
 var PURE_PYTHON_TAGS = EXTENSION_ABI.wheel.acceptedPurePythonTags;
 
-// src/runtime/python/resolver.ts
+// src/python/resolver.ts
 var WHEEL_INDEX_SCHEMA_VERSION = 1;
 function assertIndexUsable(index) {
   const declared = index.schemaVersion;
@@ -20548,7 +20697,7 @@ function requiresFromMetadata(text2) {
   return result;
 }
 
-// src/runtime/python/install.ts
+// src/python/install.ts
 var SITE_PACKAGES = "/usr/lib/python3.13/site-packages";
 var SCRIPTS = "/usr/local/bin";
 function markerEnvironment(pythonVersion) {
@@ -20675,7 +20824,7 @@ if __name__ == '__main__':
 `;
 }
 
-// src/runtime/python/backend.ts
+// src/python/backend.ts
 var PENDING_INHERITANCE = /* @__PURE__ */ new Map();
 var INHERIT_TOKEN = "SBX_PYTHON_INHERIT";
 var WNOHANG = 1;
@@ -20828,7 +20977,7 @@ async function resolveWorkerUrl(explicit) {
     nodeBuiltin("url")
   ]);
   if (existsSync(fileURLToPath2(beside))) return beside;
-  const built = new URL("../../../dist/python-worker.js", import.meta.url);
+  const built = new URL("../../dist/python-worker.js", import.meta.url);
   if (existsSync(fileURLToPath2(built))) return pathToFileURL2(fileURLToPath2(built));
   throw new Error(
     "the SandboxedJs Python process worker has not been built; run `npm run build` in the package, or pass configurePython({ workerUrl })."
@@ -20913,7 +21062,76 @@ function containerMounts(ctx) {
   return mounts;
 }
 
-// src/runtime/python/pip-command.ts
+// src/python/pip-command.ts
+init_binary();
+async function requestRemoteBuild(service, requirement, line) {
+  line(`Asking ${new URL(service).host} to build ${requirement}`);
+  try {
+    const deadline = Date.now() + 20 * 6e4;
+    let verdict = {};
+    for (; ; ) {
+      const response = await fetch(service, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ requirement })
+      });
+      if (!response.ok) {
+        return {
+          built: false,
+          index: null,
+          classification: "blocked-toolchain",
+          reason: `${service} answered ${response.status}`
+        };
+      }
+      verdict = await response.json();
+      if (verdict.state !== "building-wheel" && verdict.state !== "queued") break;
+      if (Date.now() > deadline) {
+        return {
+          built: false,
+          index: null,
+          classification: "blocked-toolchain",
+          reason: `${service} is still building ${requirement} after 20 minutes`
+        };
+      }
+      await new Promise((wait) => setTimeout(wait, 3e3));
+    }
+    if (!verdict.built) {
+      return {
+        built: false,
+        index: null,
+        classification: verdict.classification ?? "blocked-toolchain",
+        reason: verdict.reason ?? "the build service reported no wheel"
+      };
+    }
+    const base2 = (verdict.indexUrl ?? service.replace(/\/build\/?$/, "")).replace(/\/$/, "");
+    const fresh = await fetch(`${base2}/index.json`, { cache: "no-store" });
+    if (!fresh.ok) {
+      return {
+        built: false,
+        index: null,
+        classification: "blocked-toolchain",
+        reason: `${base2}/index.json answered ${fresh.status} after the build`
+      };
+    }
+    const loaded = await fresh.json();
+    line(`Built ${requirement}`);
+    return {
+      built: true,
+      index: {
+        baseUrl: base2,
+        wheels: loaded.wheels ?? [],
+        ...loaded.schemaVersion === void 0 ? {} : { schemaVersion: loaded.schemaVersion }
+      }
+    };
+  } catch (error) {
+    return {
+      built: false,
+      index: null,
+      classification: "blocked-toolchain",
+      reason: `could not reach the build service at ${service}: ${error.message}`
+    };
+  }
+}
 var pipCommand = defineCommand({
   name: "pip",
   path: "/usr/bin/pip",
@@ -20966,15 +21184,19 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
     const cache = /* @__PURE__ */ new Map();
     let embeddedFiles = {};
     const request = async (url, timeoutMs, read) => {
-      if (url.startsWith("sbx-wheel:")) {
-        const filename = decodeURIComponent(url.slice("sbx-wheel:".length).replace(/^\/+/, ""));
-        const encoded = embeddedFiles[filename];
-        if (!encoded) throw new Error(`bundled wheel ${filename} is missing`);
-        const binary = atob(encoded);
+      const embedded = embeddedFiles[decodeURIComponent(
+        url.replace(/[?#].*$/, "").split("/").pop() ?? ""
+      )];
+      if (embedded) {
+        const binary = atob(embedded);
         const bytes2 = new Uint8Array(binary.length);
         for (let i = 0; i < binary.length; i += 1) bytes2[i] = binary.charCodeAt(i);
         return await read(new Response(bytes2));
       }
+      if (url.startsWith("sbx-wheel:")) {
+        const filename = decodeURIComponent(url.slice("sbx-wheel:".length).replace(/^\/+/, ""));
+        throw new Error(`bundled wheel ${filename} is missing`);
+      }
       if (url.startsWith("file:")) {
         try {
           const [{ readFile }, { fileURLToPath: fileURLToPath2 }] = await Promise.all([
@@ -21035,29 +21257,48 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
       index = configured;
       embeddedFiles = configured.files ?? {};
     }
-    try {
-      const report = await installRequirements({
-        index,
-        client,
-        vfs: ctx.vfs,
-        cred: ctx.cred,
-        requirements,
-        pythonVersion: pythonBackend().manifest?.pythonVersion ?? "3.13.5",
-        progress: {
-          collecting: (name) => ctx.line(`Collecting ${name}`),
-          downloading: () => {
+    let attemptsLeft = 12;
+    for (; ; ) {
+      try {
+        const report = await installRequirements({
+          index,
+          client,
+          vfs: ctx.vfs,
+          cred: ctx.cred,
+          requirements,
+          pythonVersion: pythonBackend().manifest?.pythonVersion ?? "3.13.5",
+          progress: {
+            collecting: (name) => ctx.line(`Collecting ${name}`),
+            downloading: () => {
+            }
           }
+        });
+        for (const skipped of report.skipped) {
+          ctx.line(`  Skipping ${skipped.name} (marker: ${skipped.marker})`);
         }
-      });
-      for (const skipped of report.skipped) {
-        ctx.line(`  Skipping ${skipped.name} (marker: ${skipped.marker})`);
+        ctx.line(
+          `Successfully installed ${report.installed.map((p) => `${p.name}-${p.version}`).join(" ")}`
+        );
+        return 0;
+      } catch (error) {
+        const failure2 = error.failure;
+        const buildable = failure2?.reason === "no-compatible-distribution" && Boolean(failure2.package) && failure2.sourceAvailable === true;
+        if (!buildable || !pythonBackend().buildFromSource || attemptsLeft <= 0) {
+          return ctx.fail(error.message ?? String(error));
+        }
+        attemptsLeft -= 1;
+        const builder = pythonBackend().buildFromSource;
+        const outcome = typeof builder === "string" ? await requestRemoteBuild(builder, failure2.package, (l) => ctx.line(l)) : await (await Promise.resolve().then(() => (init_local_builder(), local_builder_exports))).buildFromSource(failure2.package, (line) => ctx.line(line));
+        if (!outcome.built) {
+          return ctx.fail(
+            `${error.message}
+  ${outcome.classification}: ${outcome.reason}`
+          );
+        }
+        if (outcome.index) index = outcome.index;
+        embeddedFiles = { ...embeddedFiles, ...outcome.index?.files ?? {} };
+        cache.clear();
       }
-      ctx.line(
-        `Successfully installed ${report.installed.map((p) => `${p.name}-${p.version}`).join(" ")}`
-      );
-      return 0;
-    } catch (error) {
-      return ctx.fail(error.message ?? String(error));
     }
   }
 });
@@ -21075,7 +21316,7 @@ function listInstalled(ctx) {
   return 0;
 }
 
-// src/runtime/emscripten-fs.ts
+// src/fs/emscripten-fs.ts
 init_errno();
 init_path();
 var EM_ERRNO = {
@@ -21330,7 +21571,10 @@ function mountContainerFs(FS, opts) {
   }
 }
 
-// src/runtime/python-syscalls.ts
+// src/python/cpython.ts
+init_binary();
+
+// src/python/python-syscalls.ts
 var EMPTY = new Uint8Array(0);
 function createStdinHost(ctx) {
   let pending = EMPTY;
@@ -22067,7 +22311,7 @@ function bindProgram(py, binding) {
   });
 }
 
-// src/runtime/cpython.ts
+// src/python/cpython.ts
 var RESERVED_FOR_INTERPRETER = /* @__PURE__ */ new Set(["lib", "dev", "proc"]);
 var pyodideModule = null;
 var indexUrl;
@@ -22475,7 +22719,7 @@ var micropip = defineCommand({
   }
 });
 
-// src/runtime/python.ts
+// src/python/python.ts
 var PYTHON_VERSION = "3.13";
 function configurePython(options = {}) {
   configureCPython({ indexURL: options.indexURL, moduleURL: options.pyodideURL });
@@ -22483,7 +22727,8 @@ function configurePython(options = {}) {
     ...options.backend !== void 0 ? { backend: options.backend } : {},
     ...options.manifest !== void 0 ? { manifest: options.manifest } : {},
     ...options.workerUrl !== void 0 ? { workerUrl: options.workerUrl } : {},
-    ...options.wheelIndex !== void 0 ? { wheelIndex: options.wheelIndex } : {}
+    ...options.wheelIndex !== void 0 ? { wheelIndex: options.wheelIndex } : {},
+    ...options.buildFromSource !== void 0 ? { buildFromSource: options.buildFromSource } : {}
   });
 }
 var isPythonAvailable = isCPythonAvailable;
@@ -22587,7 +22832,8 @@ function pythonCommands() {
   return usingOwnedPython() ? [python, pipCommand] : [python, micropip];
 }
 
-// src/runtime/ffmpeg.ts
+// src/tools/ffmpeg.ts
+init_binary();
 var INSTALL_HINT = "ffmpeg is not installed in this container.\nThe FFmpeg runtime ships separately because it is a ~31MB WebAssembly build:\n  npm install @ffmpeg/core";
 var compiled = null;
 async function loadFactory() {
@@ -24662,7 +24908,7 @@ unless the container was created with network: { allowOutbound: true }.`,
     const packageSpec = packages[0] ?? spec;
     const packageName = packages[0] ? splitPackageSpec(packages[0]).name : specName;
     let command = packages.length > 0 ? spec : basename(specName);
-    const run = async (binary) => {
+    const run2 = async (binary) => {
       const env2 = {
         ...ctx.env,
         PATH: `${binDir}:${ctx.env.PATH ?? ""}`,
@@ -24679,8 +24925,8 @@ unless the container was created with network: { allowOutbound: true }.`,
       }).wait();
     };
     if (!version) {
-      if (findLocalBin(ctx, command)) return run(command);
-      if (ctx.kernel.which(command, ctx.cwd, ctx.env, ctx.cred)) return run(command);
+      if (findLocalBin(ctx, command)) return run2(command);
+      if (ctx.kernel.which(command, ctx.cwd, ctx.env, ctx.cred)) return run2(command);
     }
     if (args.has("no-install")) {
       ctx.warn(`command not found: ${command}`);
@@ -24718,7 +24964,7 @@ unless the container was created with network: { allowOutbound: true }.`,
       }
       command = chosen;
     }
-    return run(command);
+    return run2(command);
   }
 });
 function makeNpmAlias(name, path) {
@@ -24912,6 +25158,9 @@ function installUserland(kernel) {
   }
 }
 
+// src/container/container.ts
+init_binary();
+
 // src/container/fs.ts
 init_path();
 async function bytesFor(data) {
@@ -25109,7 +25358,7 @@ var Session = class {
   }
 };
 
-// src/runtime/node-child-process-bridge.ts
+// src/node/node-child-process-bridge.ts
 var KernelChildProcess = class {
   pid;
   command;
@@ -25260,7 +25509,7 @@ function installNodeChildProcessBridge(pod, kernel, cred) {
   };
 }
 
-// src/runtime/host-module-tracker.ts
+// src/node/host-module-tracker.ts
 var HostModuleTracker = class {
   active = 0;
   disposed = false;
@@ -25322,7 +25571,7 @@ var HostModuleTracker = class {
   }
 };
 
-// src/runtime/commonjs-engine.ts
+// src/node/commonjs-engine.ts
 init_path();
 var HELPERS = {
   /** Import a specifier and return an ES-module-shaped namespace. */
@@ -26181,7 +26430,7 @@ function splitSpecifier(specifier) {
   return { name: parts.slice(0, size).join("/"), subpath: parts.slice(size).join("/") };
 }
 
-// src/runtime/readable-from.ts
+// src/node/readable-from.ts
 function createReadableFrom(Readable) {
   return function from(source, options = {}) {
     if (source && typeof source.pipe === "function") return source;
@@ -26230,7 +26479,7 @@ function installReadableFrom(streamModule5) {
   streamModule5.Readable.from = createReadableFrom(streamModule5.Readable);
 }
 
-// src/runtime/util-module.ts
+// src/node/util-module.ts
 var customInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
 var promisifyCustom = /* @__PURE__ */ Symbol.for("nodejs.util.promisify.custom");
 var BREAK_LENGTH = 72;
@@ -26604,7 +26853,7 @@ var utilModule = {
 };
 var util_module_default = utilModule;
 
-// src/runtime/assert-module.ts
+// src/node/assert-module.ts
 var AssertionError = class extends Error {
   actual;
   expected;
@@ -26773,8 +27022,8 @@ var bytes = (data) => {
   if (data instanceof ArrayBuffer) return new Uint8Array(data);
   return data;
 };
-function codec(name, run) {
-  const sync2 = (data, options) => Buffer2.from(run(bytes(data), options));
+function codec(name, run2) {
+  const sync2 = (data, options) => Buffer2.from(run2(bytes(data), options));
   const async_ = (data, options, callback) => {
     const done = typeof options === "function" ? options : callback;
     const settings = typeof options === "function" ? void 0 : options;
@@ -26938,7 +27187,7 @@ var urlModule = {
 };
 var url_module_default = urlModule;
 
-// src/runtime/core-modules.ts
+// src/node/core-modules.ts
 init_path();
 var VirtualIncomingMessage = class extends streamModule4.Readable {
   method;
@@ -27662,7 +27911,7 @@ function toBytes2(data, encoding) {
   return typeof data === "string" ? Buffer2.from(data, encoding) : data;
 }
 
-// src/runtime/sync-channel.ts
+// src/worker/sync-channel.ts
 var STATE2 = 0;
 var LENGTH2 = 1;
 var MORE2 = 2;
@@ -27911,7 +28160,7 @@ function buildSyncFamily(syncSpawn, throughShell, defaultCwd, environmentFor) {
       spawnSync: unavailable("spawnSync")
     };
   }
-  const run = (file3, args, options) => {
+  const run2 = (file3, args, options) => {
     const resolved = options.shell ? throughShell([file3, ...args].join(" "), options) : { file: file3, args };
     const input = options.input === void 0 ? void 0 : typeof options.input === "string" ? options.input : new TextDecoder().decode(options.input);
     const inherit = options.stdio === "inherit" || Array.isArray(options.stdio) && options.stdio[0] === "inherit";
@@ -27945,7 +28194,7 @@ ${result.stderr}`), {
   };
   const spawnSync = (file3, args = [], options = {}) => {
     const [list, opts] = Array.isArray(args) ? [args, options] : [[], args];
-    const result = run(file3, list, opts);
+    const result = run2(file3, list, opts);
     return {
       pid: 0,
       status: result.status,
@@ -27958,9 +28207,9 @@ ${result.stderr}`), {
   };
   const execFileSync = (file3, args = [], options = {}) => {
     const [list, opts] = Array.isArray(args) ? [args, options] : [[], args];
-    return orThrow(run(file3, list, opts), [file3, ...list].join(" "), opts);
+    return orThrow(run2(file3, list, opts), [file3, ...list].join(" "), opts);
   };
-  const execSync = (command, options = {}) => orThrow(run(command, [], { ...options, shell: options.shell ?? true }), command, options);
+  const execSync = (command, options = {}) => orThrow(run2(command, [], { ...options, shell: options.shell ?? true }), command, options);
   return { spawnSync, execFileSync, execSync };
 }
 function normalize3(options, callback) {
@@ -27980,7 +28229,7 @@ function unavailable(name) {
   };
 }
 
-// src/runtime/core-modules.ts
+// src/node/core-modules.ts
 init_signals();
 var CSI_KEYS = {
   "[A": "up",
@@ -28387,7 +28636,7 @@ function createReadlineModule(defaultInput, defaultOutput = () => void 0) {
   return { ...base2, promises: { ...base2, Interface, createInterface } };
 }
 
-// src/runtime/core-modules.ts
+// src/node/core-modules.ts
 installReadableFrom(streamModule4);
 var Dirent = class {
   /** Node 20+ exposes the containing directory, and `fs.glob` consumers read it. */
@@ -29555,7 +29804,7 @@ var builtinNames2 = [
   ...stubNames
 ];
 
-// src/runtime/memory-volume.ts
+// src/fs/memory-volume.ts
 init_path();
 var VolumeError = class extends Error {
   constructor(code, operation, path) {
@@ -29865,7 +30114,7 @@ var MemoryVolume = class {
   }
 };
 
-// src/runtime/mirroring-volume.ts
+// src/fs/mirroring-volume.ts
 init_path();
 var MirroringVolume = class {
   constructor(inner = new MemoryVolume()) {
@@ -30271,7 +30520,8 @@ function sameBytes(a, b) {
   return true;
 }
 
-// src/runtime/host-esbuild.ts
+// src/tools/host-esbuild.ts
+init_binary();
 var ASYNC_API = ["transform", "build", "context", "formatMessages", "analyzeMetafile"];
 function createHostEsbuild() {
   let loading = null;
@@ -30339,7 +30589,8 @@ function ensureProcessGlobal() {
   });
 }
 
-// src/runtime/rolldown-node-binding.ts
+// src/tools/rolldown-node-binding.ts
+init_binary();
 async function loadNodeApi() {
   const [moduleApi, fsApi, pathApi, urlApi] = await Promise.all([
     nodeBuiltin("module"),
@@ -30457,7 +30708,7 @@ function resolveWorkerPath(node2) {
   const here = dirname3(fileURLToPath2(import.meta.url));
   const candidates = [
     join3(here, WORKER_FILE),
-    /* src/runtime → dist, for a checkout that has been built. */
+    /* src/tools → dist, for a checkout that has been built. */
     join3(here, "..", "..", "dist", WORKER_FILE)
   ];
   return candidates.find((candidate) => existsSync(candidate)) ?? null;
@@ -30491,7 +30742,7 @@ function unreferenceWorker(worker) {
   worker.unref();
 }
 
-// src/runtime/host-rolldown.ts
+// src/tools/host-rolldown.ts
 var BUNDLER_HINT = "If this is a bundler pre-bundling the worker away, exclude the binding from dependency optimisation \u2014 in Vite:\n\n  optimizeDeps: { exclude: ['@rolldown/binding-wasm32-wasi'] }";
 var isNodeHost = typeof process !== "undefined" && Boolean(process.versions?.node);
 async function loadHostRolldownBinding() {
@@ -30518,7 +30769,7 @@ ${BUNDLER_HINT}`),
   }
 }
 
-// src/runtime/local-runtime-pod.ts
+// src/worker/local-runtime-pod.ts
 init_path();
 var WASM_ALIASES = {
   esbuild: "esbuild-wasm",
@@ -31157,7 +31408,7 @@ function attachRolldownMirror(binding, volume, root) {
   volume.attach(fs, root);
 }
 
-// src/runtime/remote-volume.ts
+// src/fs/remote-volume.ts
 var encoder8 = new TextEncoder();
 var decoder8 = new TextDecoder();
 function encodeFrame(header, body) {
@@ -31220,7 +31471,7 @@ function serveVolume(volume) {
   };
 }
 
-// src/runtime/sync-syscalls.ts
+// src/worker/sync-syscalls.ts
 var SPAWN_OP = "spawnSync";
 function serveSyncSyscalls(options) {
   const volumeHandler = serveVolume(options.volume);