sandboxedjs 0.1.97 → 0.1.99

package/dist/index.cjs

@@ -4273,7 +4273,8 @@ function md5Hex(input) {
 var isNode, zlibPromise, cryptoPromise, SUBTLE_NAMES, UnsupportedAlgorithmError;
 var init_binary = __esm({
   "src/util/binary.ts"() {
-    isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+    isNode = typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+    process.release?.name === "node";
     zlibPromise = null;
     cryptoPromise = null;
     SUBTLE_NAMES = {
@@ -20958,7 +20959,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.97"};
+  version: "0.1.99"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -38658,6 +38659,22 @@ var WS_DATA = "sandboxedjs:ws-data";
 var WS_CLOSE = "sandboxedjs:ws-close";
 var WS_ERROR = "sandboxedjs:ws-error";
 
+// src/preview/router.ts
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
+
 // src/preview/register.ts
 function serveContainerOn(port, box) {
   port.onmessage = async (event) => {
@@ -38692,20 +38709,6 @@ function serveContainerOn(port, box) {
   };
   port.start?.();
 }
-var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
-function containerTarget(value) {
-  let url;
-  try {
-    url = new URL(value.trim());
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!LOOPBACK_HOST.test(url.hostname)) return null;
-  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
-  return { port, path: `${url.pathname}${url.search}` };
-}
 async function createPreview(box, options = {}) {
   if (typeof navigator === "undefined" || !("serviceWorker" in navigator)) return null;
   const scriptUrl = options.scriptUrl ?? new URL("./service-worker.js?no-inline", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));

package/dist/index.d.cts

@@ -1590,19 +1590,22 @@ declare function startRuntimeWorker(options?: {
 declare function syncChannelSupported(): boolean;
 
 /**
- * Wiring a container's HTTP servers up to real URLs in the page.
+ * The routing a preview service worker does, separated from the worker itself.
  *
- * The service worker does the routing; this is the half that lives in the page
- * and actually knows about the container.
+ * A service worker is awkward to test — it needs a browser, a registration and
+ * a secure context — but almost none of what makes this correct is about being
+ * a service worker. The interesting part is the bookkeeping: which client is
+ * previewing which port, which requests belong to a preview at all, and how a
+ * response is rebuilt on the way back. That lives here, where it can be
+ * exercised directly.
  *
- * **Read the origin note before using this.** A preview served this way runs on
- * *your* origin, so scripts inside it can reach `window.parent`, your cookies
- * and your `localStorage` — the sandbox contains the program's *filesystem and
- * process table*, not the page it serves. For code you did not write, either
- * host the preview on a separate origin, or use {@link renderInto}, which puts
- * the response in an iframe with no origin at all.
+ * The rule this implements, and the reason it exists: requests are routed by
+ * **who is asking**, not by what the path looks like. An iframe navigates once
+ * to `/__sbx__/<port>/`; every later request from that client — however
+ * absolute its path — is recognised by its client id. Nothing has to rewrite
+ * `/src/main.js` or `/@vite/client`, which is what makes a real dev server
+ * work rather than only a single page.
  */
-
 /** A container-local server, named by port rather than by an address. */
 interface ContainerTarget {
     port: number;
@@ -1618,10 +1621,31 @@ interface ContainerTarget {
  * is listening, so a frame pointed at it fails with "refused to connect"
  * rather than failing visibly as a routing mistake.
  *
- * Exported separately from {@link Preview.resolve} because it is pure, and a
- * translation table is worth testing without a service worker in the way.
+ * The same translation serves two callers. A host reading an address out of a
+ * build log needs it to point a frame somewhere (`Preview.resolve`), and the
+ * service worker needs it for the other direction: a page *inside* a preview
+ * asking its own backend for `http://localhost:8000/api` means the container's
+ * port 8000, not the reader's machine.
+ *
+ * Kept pure, and kept here rather than beside the host half, because the
+ * worker bundles this module and not that one.
  */
 declare function containerTarget(value: string): ContainerTarget | null;
+
+/**
+ * Wiring a container's HTTP servers up to real URLs in the page.
+ *
+ * The service worker does the routing; this is the half that lives in the page
+ * and actually knows about the container.
+ *
+ * **Read the origin note before using this.** A preview served this way runs on
+ * *your* origin, so scripts inside it can reach `window.parent`, your cookies
+ * and your `localStorage` — the sandbox contains the program's *filesystem and
+ * process table*, not the page it serves. For code you did not write, either
+ * host the preview on a separate origin, or use {@link renderInto}, which puts
+ * the response in an iframe with no origin at all.
+ */
+
 interface PreviewOptions {
     /** Where the worker script lives; defaults to the copy shipped beside the bundle. */
     scriptUrl?: string | URL;

package/dist/index.d.ts

@@ -1590,19 +1590,22 @@ declare function startRuntimeWorker(options?: {
 declare function syncChannelSupported(): boolean;
 
 /**
- * Wiring a container's HTTP servers up to real URLs in the page.
+ * The routing a preview service worker does, separated from the worker itself.
  *
- * The service worker does the routing; this is the half that lives in the page
- * and actually knows about the container.
+ * A service worker is awkward to test — it needs a browser, a registration and
+ * a secure context — but almost none of what makes this correct is about being
+ * a service worker. The interesting part is the bookkeeping: which client is
+ * previewing which port, which requests belong to a preview at all, and how a
+ * response is rebuilt on the way back. That lives here, where it can be
+ * exercised directly.
  *
- * **Read the origin note before using this.** A preview served this way runs on
- * *your* origin, so scripts inside it can reach `window.parent`, your cookies
- * and your `localStorage` — the sandbox contains the program's *filesystem and
- * process table*, not the page it serves. For code you did not write, either
- * host the preview on a separate origin, or use {@link renderInto}, which puts
- * the response in an iframe with no origin at all.
+ * The rule this implements, and the reason it exists: requests are routed by
+ * **who is asking**, not by what the path looks like. An iframe navigates once
+ * to `/__sbx__/<port>/`; every later request from that client — however
+ * absolute its path — is recognised by its client id. Nothing has to rewrite
+ * `/src/main.js` or `/@vite/client`, which is what makes a real dev server
+ * work rather than only a single page.
  */
-
 /** A container-local server, named by port rather than by an address. */
 interface ContainerTarget {
     port: number;
@@ -1618,10 +1621,31 @@ interface ContainerTarget {
  * is listening, so a frame pointed at it fails with "refused to connect"
  * rather than failing visibly as a routing mistake.
  *
- * Exported separately from {@link Preview.resolve} because it is pure, and a
- * translation table is worth testing without a service worker in the way.
+ * The same translation serves two callers. A host reading an address out of a
+ * build log needs it to point a frame somewhere (`Preview.resolve`), and the
+ * service worker needs it for the other direction: a page *inside* a preview
+ * asking its own backend for `http://localhost:8000/api` means the container's
+ * port 8000, not the reader's machine.
+ *
+ * Kept pure, and kept here rather than beside the host half, because the
+ * worker bundles this module and not that one.
  */
 declare function containerTarget(value: string): ContainerTarget | null;
+
+/**
+ * Wiring a container's HTTP servers up to real URLs in the page.
+ *
+ * The service worker does the routing; this is the half that lives in the page
+ * and actually knows about the container.
+ *
+ * **Read the origin note before using this.** A preview served this way runs on
+ * *your* origin, so scripts inside it can reach `window.parent`, your cookies
+ * and your `localStorage` — the sandbox contains the program's *filesystem and
+ * process table*, not the page it serves. For code you did not write, either
+ * host the preview on a separate origin, or use {@link renderInto}, which puts
+ * the response in an iframe with no origin at all.
+ */
+
 interface PreviewOptions {
     /** Where the worker script lives; defaults to the copy shipped beside the bundle. */
     scriptUrl?: string | URL;

package/dist/index.js

@@ -4256,7 +4256,8 @@ function md5Hex(input) {
 var isNode, zlibPromise, cryptoPromise, SUBTLE_NAMES, UnsupportedAlgorithmError;
 var init_binary = __esm({
   "src/util/binary.ts"() {
-    isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+    isNode = typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+    process.release?.name === "node";
     zlibPromise = null;
     cryptoPromise = null;
     SUBTLE_NAMES = {
@@ -20941,7 +20942,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.97"};
+  version: "0.1.99"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -38641,6 +38642,22 @@ var WS_DATA = "sandboxedjs:ws-data";
 var WS_CLOSE = "sandboxedjs:ws-close";
 var WS_ERROR = "sandboxedjs:ws-error";
 
+// src/preview/router.ts
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
+
 // src/preview/register.ts
 function serveContainerOn(port, box) {
   port.onmessage = async (event) => {
@@ -38675,20 +38692,6 @@ function serveContainerOn(port, box) {
   };
   port.start?.();
 }
-var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
-function containerTarget(value) {
-  let url;
-  try {
-    url = new URL(value.trim());
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!LOOPBACK_HOST.test(url.hostname)) return null;
-  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
-  return { port, path: `${url.pathname}${url.search}` };
-}
 async function createPreview(box, options = {}) {
   if (typeof navigator === "undefined" || !("serviceWorker" in navigator)) return null;
   const scriptUrl = options.scriptUrl ?? new URL("./service-worker.js?no-inline", import.meta.url);

package/dist/python-worker.js

@@ -772,7 +772,8 @@ function createSbxFs(FS, client, errnoCodes) {
 }
 
 // src/util/binary.ts
-typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+process.release?.name === "node";
 async function nodeBuiltin(name) {
   const specifier = `node:${name}`;
   return await import(

package/dist/service-worker.js

@@ -349,6 +349,20 @@ function previewSocketSource() {
 
 // src/preview/router.ts
 var CLAIM = /(?:^|\/)__sbx__\/(\d+)(?:\/|$)/;
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
 var OUTDATED = /outdated optimize dep/i;
 var NOT_CONNECTED = 503;
 var PreviewRouter = class {
@@ -549,7 +563,13 @@ worker.addEventListener("message", (event) => {
 });
 worker.addEventListener("fetch", (event) => {
   const url = new URL(event.request.url);
-  if (url.origin !== worker.location.origin) return;
+  if (url.origin !== worker.location.origin) {
+    const port2 = router.portFor(event.clientId);
+    const target = port2 === void 0 ? null : containerTarget(url.href);
+    if (!target) return;
+    event.respondWith(router.fetch(target.port, target.path, event.request, event.clientId));
+    return;
+  }
   const claimed = router.claimedPort(url.pathname);
   if (claimed !== null && event.request.mode === "navigate") {
     router.bind(event.resultingClientId || event.clientId, claimed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.1.97",
+  "version": "0.1.99",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",