sandboxedjs 0.2.4 → 0.2.5

package/dist/worker-entry.js

@@ -28231,6 +28231,60 @@ var url_module_default = urlModule;
 var import_events = __toESM(require_events());
 var import_stream_browserify3 = __toESM(require_stream_browserify());
 
+// src/net/proxy-fetch.ts
+function toBase64(bytes2) {
+  let text = "";
+  for (let at2 = 0; at2 < bytes2.length; at2 += 32768) {
+    text += String.fromCharCode(...bytes2.subarray(at2, at2 + 32768));
+  }
+  return btoa(text);
+}
+function fromBase64(text) {
+  const binary = atob(text);
+  const bytes2 = new Uint8Array(binary.length);
+  for (let at2 = 0; at2 < binary.length; at2 += 1) bytes2[at2] = binary.charCodeAt(at2);
+  return bytes2;
+}
+async function proxyExchange(proxy, request, fetchImpl = fetch) {
+  let answer2;
+  try {
+    answer2 = await fetchImpl(proxy, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        url: request.url,
+        method: request.method,
+        headers: request.headers,
+        ...request.body?.length ? { body: toBase64(request.body) } : {}
+      })
+    });
+  } catch (error) {
+    throw new Error(
+      `the egress proxy at ${proxy} could not be reached (${error instanceof Error ? error.message : String(error)}). It performs this container's outbound requests, so nothing leaves until it answers.`
+    );
+  }
+  if (!answer2.ok) {
+    throw new Error(
+      `the egress proxy at ${proxy} refused ${request.method} ${request.url} with ${answer2.status} ${answer2.statusText}: ${(await answer2.text()).trim().slice(0, 300)}`
+    );
+  }
+  const payload = await answer2.json();
+  return {
+    status: payload.status ?? 200,
+    statusText: payload.statusText ?? "",
+    headers: payload.headers ?? {},
+    body: payload.body ? fromBase64(payload.body) : new Uint8Array(0)
+  };
+}
+function isBrowser() {
+  return typeof process === "undefined" || process.versions?.node == null;
+}
+function browserBlocked(hostname, message) {
+  return new Error(
+    `${message} \u2014 the request to ${hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
+  );
+}
+
 // src/net/policy.ts
 function isLoopbackHostname(hostname) {
   const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -28273,7 +28327,40 @@ function policedFetch(policy, fetchImpl) {
     if (!outboundAllowed(policy, url)) {
       throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
     }
-    return fetchImpl(input, init);
+    if (policy.proxy) return await fetchThroughProxy(policy.proxy, fetchImpl, input, init);
+    try {
+      return await fetchImpl(input, init);
+    } catch (error) {
+      if (!isBrowser()) throw error;
+      throw Object.assign(new TypeError("fetch failed"), {
+        cause: browserBlocked(new URL(url).hostname, error instanceof Error ? error.message : String(error))
+      });
+    }
+  });
+}
+async function fetchThroughProxy(proxy, fetchImpl, input, init) {
+  const request = new Request(input, init);
+  const headers = {};
+  request.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  const bodyless = request.method === "GET" || request.method === "HEAD";
+  const result = await proxyExchange(
+    proxy,
+    {
+      url: request.url,
+      method: request.method,
+      headers,
+      ...bodyless ? {} : { body: new Uint8Array(await request.arrayBuffer()) }
+    },
+    fetchImpl
+  );
+  const nullBody = result.status === 204 || result.status === 205 || result.status === 304 || request.method === "HEAD";
+  const body = nullBody ? null : result.body.slice().buffer;
+  return new Response(body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: result.headers
   });
 }
 function policedWebSocket(Native, policy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",
@@ -31,6 +31,11 @@
       "import": "./dist/agent.js",
       "require": "./dist/agent.cjs"
     },
+    "./egress": {
+      "types": "./dist/egress.d.ts",
+      "import": "./dist/egress.js",
+      "require": "./dist/egress.cjs"
+    },
     "./browser-host": {
       "types": "./dist/browser-host.d.ts",
       "import": "./dist/browser-host.js",