refactor: make runtime package specs configurable

Preserve main's Sigima 1.1.6 and guidata 3.15.0 defaults while allowing coordinated local wheel testing through Vite.

Assisted-by: GitHub Copilot

Author: PierreRaybaut

doc/shim-registry.md

@@ -33,8 +33,8 @@ DataLab-Web requires guidata 3.15 or later. That release provides `guidata.datas
 
 | Package                  | How the runtime gets it                                  | Fast-audit source                                                                                                    |
 | ------------------------ | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| `guidata`                | `micropip.install("guidata>=3.15.0")`                    | Latest PyPI release from `https://pypi.org/pypi/guidata/json`                                                        |
-| `sigima`                 | `micropip.install("sigima>=1.1.6")`                      | Latest PyPI release from `https://pypi.org/pypi/sigima/json`                                                         |
+| `guidata`                | `VITE_GUIDATA_INSTALL_SPEC` (default: `guidata>=3.15.0`) | Latest PyPI release from `https://pypi.org/pypi/guidata/json`                                                        |
+| `sigima`                 | `VITE_SIGIMA_INSTALL_SPEC` (default: `sigima>=1.1.6`)    | Latest PyPI release from `https://pypi.org/pypi/sigima/json`                                                         |
 | `numpy`, `scipy`, `h5py` | Bundled with the pinned Pyodide build (`py.loadPackage`) | `pyodide-lock.json` of the pinned `PYODIDE_VERSION` (from [src/runtime/workerBase.ts](../src/runtime/workerBase.ts)) |
 
 The fast audit infers these versions **without booting Pyodide**, so it is cheap and useful for routine monitoring. For PyPI packages it does not execute dependency resolution, so the latest release is only an approximation of what `micropip` will select. The live audit instead reads the versions actually resolved inside Pyodide via `DataLabRuntime.getInstalledVersions()` (backed by `importlib.metadata`), which is authoritative but pays the cold-start cost. Both feed the same `classifyShim` logic.

src/runtime/runtime.ts

@@ -107,6 +107,10 @@ export interface PyProxy {
 
 const PYODIDE_VERSION = "v0.26.4";
 const PYODIDE_INDEX = `https://cdn.jsdelivr.net/pyodide/${PYODIDE_VERSION}/full/`;
+const SIGIMA_INSTALL_SPEC =
+  import.meta.env.VITE_SIGIMA_INSTALL_SPEC || "sigima>=1.1.6";
+const GUIDATA_INSTALL_SPEC =
+  import.meta.env.VITE_GUIDATA_INSTALL_SPEC || "guidata>=3.15.0";
 
 export interface PythonDistributionInfo {
   name: string;
@@ -1339,7 +1343,7 @@ os.environ["LANGUAGE"] = ${JSON.stringify(lang)}
     // ``PYODIDE_VERSION`` bumps to a build with numpy>=2.1.
     await py.runPythonAsync(`
 import micropip
-await micropip.install(["sigima>=1.1.6", "guidata>=3.15.0", "tifffile<2025"])
+await micropip.install([${JSON.stringify(SIGIMA_INSTALL_SPEC)}, ${JSON.stringify(GUIDATA_INSTALL_SPEC)}, "tifffile<2025"])
 `);
 
     onProgress?.(t("Initialising Sigima namespace…"));

src/runtime/workerBase.ts

@@ -15,6 +15,10 @@
 
 export const PYODIDE_VERSION = "v0.26.4";
 export const PYODIDE_INDEX = `https://cdn.jsdelivr.net/pyodide/${PYODIDE_VERSION}/full/`;
+const SIGIMA_INSTALL_SPEC =
+  import.meta.env.VITE_SIGIMA_INSTALL_SPEC || "sigima>=1.1.6";
+const GUIDATA_INSTALL_SPEC =
+  import.meta.env.VITE_GUIDATA_INSTALL_SPEC || "guidata>=3.15.0";
 
 /** Minimal slice of the Pyodide API surface used by the workers. */
 export interface PyodideAPI {
@@ -93,7 +97,7 @@ os.environ["LANGUAGE"] = ${JSON.stringify(opts.lang)}
   // Pyodide ships numpy 1.26.4 (lift when Pyodide bumps numpy).
   await py.runPythonAsync(`
 import micropip
-await micropip.install(["sigima>=1.1.6", "guidata>=3.15.0", "tifffile<2025"])
+await micropip.install([${JSON.stringify(SIGIMA_INSTALL_SPEC)}, ${JSON.stringify(GUIDATA_INSTALL_SPEC)}, "tifffile<2025"])
 `);
 
   // Install Sigima's ``PlaceholderTitleFormatter`` so titles produced in

vite.config.ts

@@ -66,6 +66,15 @@ export default defineConfig({
   },
   server: {
     port: 5173,
+    fs: {
+      // Supports VITE_*_INSTALL_SPEC=/@fs/... during coordinated pre-release
+      // development without exposing the rest of the workspace.
+      allow: [
+        __dirname,
+        resolve(__dirname, "../Sigima/dist"),
+        resolve(__dirname, "../guidata/dist"),
+      ],
+    },
     // NOTE: do NOT enable Cross-Origin-Embedder-Policy=require-corp here.
     // It would block the Pyodide CDN <script> tag (loaded without
     // `crossorigin`) and silently break the whole runtime.  Basic Pyodide