veryfront 0.1.73 → 0.1.75

package/esm/src/data/data-fetcher.js

@@ -15,7 +15,7 @@ export class DataFetcher {
         this.staticFetcher = new StaticDataFetcher(this.cacheManager);
         this.pathsFetcher = new StaticPathsFetcher();
     }
-    fetchData(pageModule, context, mode = "development") {
+    fetchData(pageModule, context, mode = "development", options) {
         const preferServerData = mode === "development" || !pageModule.getStaticData;
         const useServer = preferServerData && !!pageModule.getServerData;
         const useStatic = !useServer && !!pageModule.getStaticData;
@@ -24,9 +24,12 @@ export class DataFetcher {
             : useStatic
                 ? "static"
                 : "none";
+        const isolationOptions = options
+            ? { modulePath: options.modulePath, projectDir: options.projectDir }
+            : undefined;
         return withSpan(SpanNames.DATA_FETCH, () => {
             if (useServer)
-                return this.serverFetcher.fetch(pageModule, context);
+                return this.serverFetcher.fetch(pageModule, context, isolationOptions);
             if (useStatic)
                 return this.staticFetcher.fetch(pageModule, context);
             return Promise.resolve({ props: {} });

package/esm/src/data/index.d.ts

@@ -5,6 +5,6 @@
  * @module data
  */
 export type { CacheEntry, DataContext, DataResult, InferGetServerDataProps, PageWithData, StaticPathsResult, } from "./types.js";
-export { DataFetcher } from "./data-fetcher.js";
+export { DataFetcher, type FetchDataOptions } from "./data-fetcher.js";
 export { notFound, redirect } from "./helpers.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/data/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/data/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,UAAU,EACV,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/data/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,UAAU,EACV,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/esm/src/data/server-data-fetcher.d.ts

@@ -1,6 +1,19 @@
 import type { DataContext, DataResult, PageWithData } from "./types.js";
+/**
+ * Options for isolated data fetching through Worker pool.
+ */
+export interface ServerDataFetchOptions {
+    /** Absolute path to the module containing getServerData */
+    modulePath?: string;
+    /** Project directory for worker scoping */
+    projectDir?: string;
+}
 export declare class ServerDataFetcher {
-    fetch(pageModule: PageWithData, context: DataContext): Promise<DataResult>;
+    fetch(pageModule: PageWithData, context: DataContext, options?: ServerDataFetchOptions): Promise<DataResult>;
+    /**
+     * Execute getServerData in a per-project Worker.
+     */
+    private fetchIsolated;
     /**
      * Log errors unconditionally. Production errors should always be logged.
      * @see plans/architecture-audit/010-error-handling.md

package/esm/src/data/server-data-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAOxE,qBAAa,iBAAiB;IAC5B,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAkE1E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}
+{"version":3,"file":"server-data-fetcher.d.ts","sourceRoot":"","sources":["../../../src/src/data/server-data-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AASxE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,iBAAiB;IAC5B,KAAK,CACH,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC;IA8EtB;;OAEG;YACW,aAAa;IA2C3B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/esm/src/data/server-data-fetcher.js

@@ -1,10 +1,12 @@
+import * as dntShim from "../../_dnt.shims.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { CircuitBreakerOpen, getCircuitBreaker } from "../utils/circuit-breaker.js";
+import { getWorkerPool, isDataIsolationEnabled } from "../security/sandbox/worker-pool.js";
 export class ServerDataFetcher {
-    fetch(pageModule, context) {
+    fetch(pageModule, context, options) {
         if (typeof pageModule.getServerData !== "function") {
             return Promise.resolve({ props: {} });
         }
@@ -15,10 +17,16 @@ export class ServerDataFetcher {
             resetTimeoutMs: 30_000,
             successThreshold: 2,
         });
+        // Choose isolated or direct execution
+        const useIsolation = isDataIsolationEnabled() &&
+            !!options?.modulePath &&
+            !!options?.projectDir;
         return withSpan("data.fetch_server", async () => {
             const start = performance.now();
             try {
-                const result = await circuitBreaker.execute(() => withTimeoutThrow(Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`));
+                const result = await circuitBreaker.execute(() => withTimeoutThrow(useIsolation
+                    ? this.fetchIsolated(options.modulePath, options.projectDir, context)
+                    : Promise.resolve(pageModule.getServerData(context)), DATA_FETCH_TIMEOUT_MS, `getServerData for ${pathname}`));
                 if (result.redirect)
                     return { redirect: result.redirect };
                 if (result.notFound)
@@ -43,7 +51,11 @@ export class ServerDataFetcher {
                     });
                     throw error;
                 }
-                this.logError("DATA_FETCH_ERROR getServerData failed", error, { pathname, durationMs });
+                this.logError("DATA_FETCH_ERROR getServerData failed", error, {
+                    pathname,
+                    durationMs,
+                    isolated: useIsolation,
+                });
                 throw error;
             }
         }, {
@@ -51,8 +63,42 @@ export class ServerDataFetcher {
             "data.pathname": pathname,
             "data.timeout_ms": DATA_FETCH_TIMEOUT_MS,
             "data.project_id": projectId,
+            "data.isolated": useIsolation,
         });
     }
+    /**
+     * Execute getServerData in a per-project Worker.
+     */
+    async fetchIsolated(modulePath, projectDir, context) {
+        const pool = getWorkerPool();
+        const body = context.request?.body ? new Uint8Array(await context.request.arrayBuffer()) : null;
+        const workerResponse = await pool.execute(projectDir, [projectDir], {
+            type: "fetch-data",
+            id: dntShim.crypto.randomUUID(),
+            modulePath,
+            context: {
+                params: context.params,
+                query: context.query?.toString() ?? "",
+                request: {
+                    url: context.request?.url ?? context.url?.toString() ?? "http://localhost",
+                    method: context.request?.method ?? "GET",
+                    headers: context.request ? [...context.request.headers.entries()] : [],
+                    body,
+                },
+                url: context.url?.toString() ?? "http://localhost",
+            },
+        });
+        if (workerResponse.type === "error") {
+            const err = new Error(workerResponse.error.message);
+            err.name = workerResponse.error.name;
+            throw err;
+        }
+        if (workerResponse.type === "data-result") {
+            return workerResponse.result;
+        }
+        // Unexpected response type — shouldn't happen but be defensive
+        throw new Error(`Unexpected worker response type: ${workerResponse.type}`);
+    }
     /**
      * Log errors unconditionally. Production errors should always be logged.
      * @see plans/architecture-audit/010-error-handling.md

package/esm/src/rendering/orchestrator/lifecycle.d.ts

@@ -8,6 +8,7 @@ import { PageResolver } from "../page-resolution/index.js";
 import { ElementValidator } from "../element-validator/index.js";
 import { SSRRenderer } from "../ssr-renderer.js";
 import type { ConfigurationManager } from "./config.js";
+import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import type { MdxBundle } from "../../types/index.js";
 import { CompilerService } from "./compiler-service.js";
 export interface LifecycleOptions {
@@ -18,6 +19,8 @@ export interface LifecycleOptions {
     projectId?: string;
     /** Content source identifier for cache isolation (branch or release) */
     contentSourceId?: string;
+    /** Injectable factory for testing — bypasses real service construction */
+    servicesFactory?: (adapter: RuntimeAdapter) => RendererServices;
 }
 export interface RendererServices {
     componentRegistry: ComponentRegistry;
@@ -40,6 +43,7 @@ export declare class RendererLifecycle {
     private contentSourceId?;
     private services?;
     private adapter;
+    private servicesFactory?;
     constructor(options: LifecycleOptions);
     initialize(): Promise<RendererServices>;
     updateCompileMDX(compileMDX: (content: string, frontmatter?: Record<string, unknown>, filePath?: string) => Promise<MdxBundle>): void;

package/esm/src/rendering/orchestrator/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AASrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AASxD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,oBAAoB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,cAAc,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,CAAmB;IACpC,OAAO,CAAC,OAAO,CAAkB;gBAErB,OAAO,EAAE,gBAAgB;IAQ/B,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA8I7C,gBAAgB,CACd,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,QAAQ,CAAC,EAAE,MAAM,KACd,OAAO,CAAC,SAAS,CAAC,GACtB,IAAI;IAcP,WAAW,IAAI,gBAAgB;IAazB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3C,cAAc,IAAI,IAAI;IAWtB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AASrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AASxD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,oBAAoB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,gBAAgB,CAAC;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,cAAc,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,CAAmB;IACpC,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,eAAe,CAAC,CAAgD;gBAE5D,OAAO,EAAE,gBAAgB;IAS/B,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqJ7C,gBAAgB,CACd,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,QAAQ,CAAC,EAAE,MAAM,KACd,OAAO,CAAC,SAAS,CAAC,GACtB,IAAI;IAcP,WAAW,IAAI,gBAAgB;IAazB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3C,cAAc,IAAI,IAAI;IAWtB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/esm/src/rendering/orchestrator/lifecycle.js

@@ -26,12 +26,14 @@ export class RendererLifecycle {
     contentSourceId;
     services;
     adapter;
+    servicesFactory;
     constructor(options) {
         this.configManager = options.configManager;
         this.port = options.port;
         this.moduleServerUrl = options.moduleServerUrl;
         this.projectId = options.projectId;
         this.contentSourceId = options.contentSourceId;
+        this.servicesFactory = options.servicesFactory;
     }
     async initialize() {
         logger.debug("Initializing renderer services", {
@@ -43,6 +45,12 @@ export class RendererLifecycle {
             const { runtime } = await import("../../platform/adapters/detect.js");
             this.adapter = await runtime.get();
         }
+        // Allow tests to bypass the full service graph construction
+        if (this.servicesFactory) {
+            this.services = this.servicesFactory(this.adapter);
+            logger.debug("Renderer services initialized via injected factory");
+            return this.services;
+        }
         const projectDir = this.configManager.getProjectDir();
         const mode = this.configManager.getMode();
         const debugMode = this.configManager.isDebugMode();

package/esm/src/rendering/orchestrator/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6ChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAQD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;gBAEnC,MAAM,EAAE,oBAAoB;IAaxC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,sBAAsB;YAIhB,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAyDnC;;;OAGG;YACW,mBAAmB;IAqH3B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA8P9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6LvF;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAetB"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6ChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAQD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;gBAEnC,MAAM,EAAE,oBAAoB;IAaxC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,sBAAsB;YAIhB,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAyDnC;;;OAGG;YACW,mBAAmB;IA0H3B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA8P9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6LvF;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAetB"}

package/esm/src/rendering/orchestrator/pipeline.js

@@ -183,8 +183,13 @@ export class RenderPipeline {
         }
         const dataResults = await withSpan(SpanNames.RENDER_FETCH_DATA, () => withTimeoutThrow(Promise.all(dataJobs.map(async (job) => {
             try {
+                const jobPath = job.path;
+                const fetchOptions = {
+                    modulePath: jobPath,
+                    projectDir: this.config.projectDir,
+                };
                 const result = await this.dataFetcher
-                    .fetchData(job.mod, dataContext, this.config.mode);
+                    .fetchData(job.mod, dataContext, this.config.mode, fetchOptions);
                 return { ...job, result, error: null };
             }
             catch (error) {

package/esm/src/rendering/orchestrator/ssr-orchestrator.d.ts

@@ -15,10 +15,35 @@ export interface SSRRenderingResult {
     finalStream: ReadableStream | null;
     ssrHash: string;
 }
+/**
+ * Options for isolated SSR rendering through the Worker pool.
+ * When provided and SSR isolation is enabled, the rendering happens
+ * in a per-project Worker instead of the main process.
+ */
+export interface SSRIsolationOptions {
+    /** Temp file path for the page component module */
+    pageModulePath: string;
+    /** Ordered layout module temp paths (innermost → outermost) */
+    layoutModulePaths: string[];
+    /** Page component props */
+    pageProps: Record<string, unknown>;
+    /** Layout props (one entry per layout, matching layoutModulePaths order) */
+    layoutProps: Record<string, unknown>[];
+    /** Project directory for worker scoping */
+    projectDir: string;
+}
 export declare class SSROrchestrator {
     private config;
     constructor(config: SSROrchestratorConfig);
-    performSSRRendering(pageElement: React.ReactElement, generationContext: Omit<HTMLGenerationContext, "html" | "ssrHash">, options?: RenderOptions): Promise<SSRRenderingResult>;
+    performSSRRendering(pageElement: React.ReactElement, generationContext: Omit<HTMLGenerationContext, "html" | "ssrHash">, options?: RenderOptions, isolationOptions?: SSRIsolationOptions): Promise<SSRRenderingResult>;
+    /**
+     * Perform SSR rendering in an isolated per-project Worker.
+     *
+     * The Worker imports user modules from their temp file paths,
+     * constructs the React element tree, and renders to HTML.
+     * For streaming, the Worker sends chunks via postMessage.
+     */
+    private performIsolatedSSR;
     private createStream;
 }
 //# sourceMappingURL=ssr-orchestrator.d.ts.map

package/esm/src/rendering/orchestrator/ssr-orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-orchestrator.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/ssr-orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,KAAK,MAAM,OAAO,CAAC;AAIpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAwB;gBAE1B,MAAM,EAAE,qBAAqB;IAInC,mBAAmB,CACvB,WAAW,EAAE,KAAK,CAAC,YAAY,EAC/B,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC,EAClE,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC;IAuF9B,OAAO,CAAC,YAAY;CAerB"}
+{"version":3,"file":"ssr-orchestrator.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/ssr-orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,KAAK,MAAM,OAAO,CAAC;AAIpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAUD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAwB;gBAE1B,MAAM,EAAE,qBAAqB;IAInC,mBAAmB,CACvB,WAAW,EAAE,KAAK,CAAC,YAAY,EAC/B,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC,EAClE,OAAO,CAAC,EAAE,aAAa,EACvB,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,kBAAkB,CAAC;IAiG9B;;;;;;OAMG;YACW,kBAAkB;IAiFhC,OAAO,CAAC,YAAY;CAerB"}

package/esm/src/rendering/orchestrator/ssr-orchestrator.js

@@ -5,6 +5,7 @@ import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../../observability/tracing/span-names.js";
 import { computeHash } from "../utils/index.js";
 import { runWithHeadCollector } from "../../react/head-collector.js";
+import { getWorkerPool, isSSRIsolationEnabled } from "../../security/sandbox/worker-pool.js";
 const logger = rendererLogger.component("ssr-orchestrator");
 function getElementTypeName(el) {
     if (!el?.type)
@@ -19,7 +20,14 @@ export class SSROrchestrator {
     constructor(config) {
         this.config = config;
     }
-    async performSSRRendering(pageElement, generationContext, options) {
+    async performSSRRendering(pageElement, generationContext, options, isolationOptions) {
+        // Isolated SSR path: render in per-project Worker
+        if (isSSRIsolationEnabled() &&
+            isolationOptions?.pageModulePath &&
+            isolationOptions?.projectDir) {
+            return this.performIsolatedSSR(generationContext, options, isolationOptions);
+        }
+        // Default path: render in main process
         logger.debug("performSSRRendering called", {
             elementType: getElementTypeName(pageElement),
             hasChildren: !!pageElement.props?.children,
@@ -77,6 +85,74 @@ export class SSROrchestrator {
             ssrHash,
         };
     }
+    /**
+     * Perform SSR rendering in an isolated per-project Worker.
+     *
+     * The Worker imports user modules from their temp file paths,
+     * constructs the React element tree, and renders to HTML.
+     * For streaming, the Worker sends chunks via postMessage.
+     */
+    async performIsolatedSSR(generationContext, options, isolation) {
+        const wantsStream = options?.delivery === "stream";
+        const pool = getWorkerPool();
+        const requestId = dntShim.crypto.randomUUID();
+        return withSpan("ssr.isolated_render", async () => {
+            const worker = pool.getOrCreateWorker(isolation.projectDir, [isolation.projectDir]);
+            if (wantsStream) {
+                // Streaming mode: get a ReadableStream of chunks from the Worker
+                const stream = worker.executeStream({
+                    type: "render-ssr",
+                    id: requestId,
+                    pageModulePath: isolation.pageModulePath,
+                    layoutModulePaths: isolation.layoutModulePaths,
+                    pageProps: isolation.pageProps,
+                    layoutProps: isolation.layoutProps,
+                    delivery: "stream",
+                });
+                const ssrHash = `stream-isolated-${Date.now()}`;
+                // Generate HTML stream using the framework's HTML generator
+                const finalStream = await this.config.htmlGenerator.generateHTMLStream(stream, {
+                    ...generationContext,
+                    ssrHash,
+                    options: { ...generationContext.options, ...options },
+                    collectedHead: undefined,
+                });
+                return { fullHtml: "", finalStream, ssrHash };
+            }
+            // String mode: render to HTML in Worker, get result back
+            const workerResponse = await worker.execute({
+                type: "render-ssr",
+                id: requestId,
+                pageModulePath: isolation.pageModulePath,
+                layoutModulePaths: isolation.layoutModulePaths,
+                pageProps: isolation.pageProps,
+                layoutProps: isolation.layoutProps,
+                delivery: "string",
+            });
+            if (workerResponse.type === "error") {
+                const err = new Error(workerResponse.error.message);
+                err.name = workerResponse.error.name;
+                throw err;
+            }
+            if (workerResponse.type !== "ssr-result") {
+                throw new Error(`Unexpected worker response type: ${workerResponse.type}`);
+            }
+            const html = workerResponse.html;
+            const ssrHash = await computeHash(html);
+            const fullHtml = await this.config.htmlGenerator.generateFullHTML({
+                ...generationContext,
+                html,
+                ssrHash,
+                options: { ...generationContext.options, ...options },
+                collectedHead: undefined,
+            });
+            return { fullHtml, finalStream: null, ssrHash };
+        }, {
+            "ssr.isolated": true,
+            "ssr.wants_stream": wantsStream,
+            "ssr.project_dir": isolation.projectDir,
+        });
+    }
     createStream(html) {
         try {
             return new dntShim.Response(html).body ?? null;

package/esm/src/routing/api/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAGlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAO9E,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;AAE3F,qBAAa,eAAe;IAgBxB,OAAO,CAAC,UAAU;IAfpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA4ElE,OAAO,CAAC,WAAW;IAuCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;YAKD,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAGlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAO9E,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAWD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;AAE3F,qBAAa,eAAe;IAgBxB,OAAO,CAAC,UAAU;IAfpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAA6E;IAC/F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAyFlE,OAAO,CAAC,WAAW;IAuCnB,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;YAKD,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}

package/esm/src/routing/api/handler.js

@@ -129,9 +129,13 @@ export class APIRouteHandler {
             // Pages Router routes have descriptive names like articles.ts
             // Note: Cannot use path-based detection (/app/) as projectDir may be '/app' in production
             const isAppRoute = /\/route\.(ts|js|tsx|jsx)$/.test(match.route.page);
+            const isolationOptions = {
+                modulePath: match.route.page,
+                projectDir: this.projectDir,
+            };
             const response = isAppRoute
-                ? await executeAppRoute(handler, request, match, pathname, adapter)
-                : await executePagesRoute(handler, request, match, pathname, adapter, this.projectDir);
+                ? await executeAppRoute(handler, request, match, pathname, adapter, isolationOptions)
+                : await executePagesRoute(handler, request, match, pathname, adapter, this.projectDir, isolationOptions);
             const corsResponse = await applyCORSHeaders({
                 request,
                 response,

package/esm/src/routing/api/route-executor.d.ts

@@ -2,6 +2,12 @@ import * as dntShim from "../../../_dnt.shims.js";
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import type { RouteMatch } from "./api-route-matcher.js";
 import type { APIRoute } from "./module-loader/types.js";
-export declare function executeAppRoute(handler: APIRoute, request: dntShim.Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter): Promise<dntShim.Response>;
-export declare function executePagesRoute(handler: APIRoute, request: dntShim.Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter, projectDir?: string): Promise<dntShim.Response>;
+export interface ExecuteRouteOptions {
+    /** Absolute path to the handler module on disk (for isolated execution) */
+    modulePath?: string;
+    /** Project directory (for isolated execution scope) */
+    projectDir?: string;
+}
+export declare function executeAppRoute(handler: APIRoute, request: dntShim.Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter, options?: ExecuteRouteOptions): Promise<dntShim.Response>;
+export declare function executePagesRoute(handler: APIRoute, request: dntShim.Request, match: RouteMatch, pathname: string, adapter: RuntimeAdapter, projectDir?: string, options?: ExecuteRouteOptions): Promise<dntShim.Response>;
 //# sourceMappingURL=route-executor.d.ts.map

package/esm/src/routing/api/route-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EACV,QAAQ,EAKT,MAAM,0BAA0B,CAAC;AA0GlC,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CA4B3B;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAsB3B"}
+{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EACV,QAAQ,EAKT,MAAM,0BAA0B,CAAC;AA4RlC,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CA6C3B;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAuC3B"}

package/esm/src/routing/api/route-executor.js

@@ -1,5 +1,5 @@
 import * as dntShim from "../../../_dnt.shims.js";
-import { createContext, normalizeParams } from "./context-builder.js";
+import { createContext, normalizeParams, parseCookies } from "./context-builder.js";
 import { createError, toError } from "../../errors/veryfront-error.js";
 import { createAppRouteMethodNotAllowed, createPagesRouteMethodNotAllowed, } from "./method-validator.js";
 import { isAbsolute, join } from "../../platform/compat/path/index.js";
@@ -7,6 +7,8 @@ import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { errorToRFC9457Response } from "../../errors/middleware/http-error-boundary.js";
 import { serverLogger as logger } from "../../utils/index.js";
 import { isDevelopment as isDevelopmentEnv } from "../../build/config/environment.js";
+import { getWorkerPool, isWorkerIsolationEnabled, } from "../../security/sandbox/worker-pool.js";
+import { getProjectEnvSnapshot } from "../../server/project-env/storage.js";
 function isDevelopment(adapter) {
     const env = adapter.env.get("MODE") ??
         adapter.env.get("NODE_ENV") ??
@@ -80,7 +82,126 @@ function validateResponse(response) {
 function toHeadResponse(response) {
     return new dntShim.Response(null, { status: response.status, headers: response.headers });
 }
-export function executeAppRoute(handler, request, match, pathname, adapter) {
+// ---------------------------------------------------------------------------
+// Worker Isolation Helpers
+// ---------------------------------------------------------------------------
+async function serializeRequest(request) {
+    const body = request.body ? new Uint8Array(await request.arrayBuffer()) : null;
+    return {
+        url: request.url,
+        method: request.method,
+        headers: [...request.headers.entries()],
+        body,
+    };
+}
+function deserializeResponse(s) {
+    return new dntShim.Response(s.body, {
+        status: s.status,
+        statusText: s.statusText,
+        headers: s.headers,
+    });
+}
+function workerResponseToResponse(workerResponse, pathname, adapter) {
+    if (workerResponse.type === "error") {
+        const { error } = workerResponse;
+        logger.error(`API route error in ${pathname} (worker):`, error.message);
+        // If the worker serialized RFC 9457 fields, return them directly
+        // to preserve the original status code, type, and detail.
+        if (error.status && error.type) {
+            return dntShim.Response.json({
+                type: error.type,
+                title: error.name,
+                status: error.status,
+                detail: error.detail ?? error.message,
+                instance: pathname,
+            }, { status: error.status });
+        }
+        const ctx = { isLocalProject: isDevelopment(adapter) };
+        const req = new dntShim.Request(`http://localhost${pathname}`);
+        const err = new Error(error.message);
+        err.name = error.name;
+        return errorToRFC9457Response(err, ctx, req);
+    }
+    if (workerResponse.type === "result") {
+        return deserializeResponse(workerResponse.response);
+    }
+    // data-result type is not expected in API route execution
+    throw new Error(`Unexpected worker response type: ${workerResponse.type}`);
+}
+// ---------------------------------------------------------------------------
+// Isolated Execution (Worker Path)
+// ---------------------------------------------------------------------------
+function executeAppRouteIsolated(modulePath, request, match, pathname, adapter, projectDir) {
+    const method = request.method.toUpperCase();
+    return withSpan("api.executeAppRoute.isolated", async () => {
+        try {
+            const pool = getWorkerPool();
+            const serialized = await serializeRequest(request);
+            const workerResponse = await pool.execute(projectDir, [projectDir], {
+                type: "execute-app-route",
+                id: dntShim.crypto.randomUUID(),
+                modulePath,
+                method,
+                request: serialized,
+                params: match.params,
+                projectDir,
+                projectEnv: getProjectEnvSnapshot(),
+            });
+            const response = workerResponseToResponse(workerResponse, pathname, adapter);
+            return method === "HEAD" ? toHeadResponse(response) : response;
+        }
+        catch (error) {
+            return handleAPIError(error, pathname, adapter);
+        }
+    }, {
+        "http.method": method,
+        "http.path": pathname,
+        "api.route.pattern": match.route.pattern,
+        "api.isolated": true,
+    });
+}
+function executePagesRouteIsolated(modulePath, request, match, pathname, adapter, projectDir) {
+    const method = request.method;
+    return withSpan("api.executePagesRoute.isolated", async () => {
+        try {
+            const pool = getWorkerPool();
+            const body = request.body ? new Uint8Array(await request.arrayBuffer()) : null;
+            const workerResponse = await pool.execute(projectDir, [projectDir], {
+                type: "execute-pages-route",
+                id: dntShim.crypto.randomUUID(),
+                modulePath,
+                method,
+                context: {
+                    url: request.url,
+                    method: request.method,
+                    headers: [...request.headers.entries()],
+                    body,
+                    params: match.params,
+                    cookies: parseCookies(request.headers.get("cookie") ?? ""),
+                },
+                projectDir,
+                projectEnv: getProjectEnvSnapshot(),
+            });
+            return workerResponseToResponse(workerResponse, pathname, adapter);
+        }
+        catch (error) {
+            return handleAPIError(error, pathname, adapter);
+        }
+    }, {
+        "http.method": method,
+        "http.path": pathname,
+        "api.route.pattern": match.route.pattern,
+        "api.isolated": true,
+    });
+}
+export function executeAppRoute(handler, request, match, pathname, adapter, options) {
+    // Isolated path: execute in per-project Worker, fall back to main process on error
+    if (isWorkerIsolationEnabled() &&
+        options?.modulePath &&
+        options?.projectDir) {
+        return executeAppRouteIsolated(options.modulePath, request, match, pathname, adapter, options.projectDir);
+    }
+    // Default path: execute in main process (existing behavior)
     const method = request.method.toUpperCase();
     return withSpan("api.executeAppRoute", async () => {
         const handlerModule = handler;
@@ -102,7 +223,14 @@ export function executeAppRoute(handler, request, match, pathname, adapter) {
         }
     }, { "http.method": method, "http.path": pathname, "api.route.pattern": match.route.pattern });
 }
-export function executePagesRoute(handler, request, match, pathname, adapter, projectDir) {
+export function executePagesRoute(handler, request, match, pathname, adapter, projectDir, options) {
+    // Isolated path: execute in per-project Worker, fall back to main process on error
+    if (isWorkerIsolationEnabled() &&
+        options?.modulePath &&
+        (options?.projectDir ?? projectDir)) {
+        return executePagesRouteIsolated(options.modulePath, request, match, pathname, adapter, options.projectDir ?? projectDir);
+    }
+    // Default path: execute in main process (existing behavior)
     const method = request.method;
     return withSpan("api.executePagesRoute", async () => {
         const methodHandler = handler[method] ?? handler.default;

package/esm/src/security/deno-permissions.d.ts

@@ -21,4 +21,10 @@ export declare const WORKFLOW_JOB_PERMISSIONS: readonly ["--allow-read", "--allo
  * Only needs filesystem + env access.
  */
 export declare const BUILD_HELPER_PERMISSIONS: readonly ["--allow-read", "--allow-write", "--allow-env"];
+/**
+ * RENDER_WORKER — Per-project Worker for isolated code execution.
+ * Read-only filesystem (transformed modules), network (data fetchers),
+ * env (API keys and config). No subprocess/ffi/sys.
+ */
+export declare const RENDER_WORKER_PERMISSIONS: readonly ["--allow-read", "--allow-net", "--allow-env"];
 //# sourceMappingURL=deno-permissions.d.ts.map

package/esm/src/security/deno-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deno-permissions.d.ts","sourceRoot":"","sources":["../../../src/src/security/deno-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,uHAQrB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,0EAK3B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,2DAI3B,CAAC"}
+{"version":3,"file":"deno-permissions.d.ts","sourceRoot":"","sources":["../../../src/src/security/deno-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,uHAQrB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,0EAK3B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,2DAI3B,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,yDAI5B,CAAC"}

package/esm/src/security/deno-permissions.js

@@ -38,3 +38,13 @@ export const BUILD_HELPER_PERMISSIONS = [
     "--allow-write",
     "--allow-env",
 ];
+/**
+ * RENDER_WORKER — Per-project Worker for isolated code execution.
+ * Read-only filesystem (transformed modules), network (data fetchers),
+ * env (API keys and config). No subprocess/ffi/sys.
+ */
+export const RENDER_WORKER_PERMISSIONS = [
+    "--allow-read",
+    "--allow-net",
+    "--allow-env",
+];