veryfront 0.1.73 → 0.1.75

package/esm/src/security/sandbox/worker-pool.js

@@ -0,0 +1,356 @@
+/**
+ * Worker Pool Manager
+ *
+ * Manages a pool of per-project Deno Workers for tenant-isolated code execution.
+ * Uses LRU eviction when the pool exceeds its capacity, idle timeout for
+ * cleanup, and health checks for reliability.
+ *
+ * @module security/sandbox/worker-pool
+ */
+import * as dntShim from "../../../_dnt.shims.js";
+import { serverLogger } from "../../utils/index.js";
+import { getEnvBoolean, getEnvNumber, unrefTimer } from "../../platform/compat/process.js";
+import { withSpan } from "../../observability/tracing/otlp-setup.js";
+import { SECURITY_VIOLATION } from "../../errors/index.js";
+import { ProjectWorker } from "./project-worker.js";
+import { buildWorkerPermissions } from "./worker-permissions.js";
+import { DEFAULT_WORKER_POOL_CONFIG } from "./worker-types.js";
+const logger = serverLogger.component("worker-pool");
+export class WorkerPool {
+    pool = new Map();
+    recycling = new Set();
+    config;
+    cleanupInterval;
+    healthCheckInterval;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_WORKER_POOL_CONFIG, ...config };
+        this.startCleanup();
+        this.startHealthChecks();
+    }
+    /**
+     * Get or create a worker for the given project.
+     */
+    getOrCreateWorker(projectId, readPaths) {
+        const existing = this.pool.get(projectId);
+        if (existing && existing.worker.status !== "crashed" && existing.worker.status !== "terminated") {
+            existing.lastAccessedAt = Date.now();
+            return existing.worker;
+        }
+        // If an existing entry is crashed/terminated, clean it up
+        if (existing) {
+            existing.worker.terminate();
+            this.pool.delete(projectId);
+        }
+        // Evict LRU if at capacity
+        this.evictIfNeeded();
+        const permissions = buildWorkerPermissions(readPaths);
+        const worker = new ProjectWorker({
+            projectId,
+            permissions,
+            requestTimeoutMs: this.config.requestTimeoutMs,
+        });
+        worker.start();
+        const now = Date.now();
+        this.pool.set(projectId, {
+            worker,
+            lastAccessedAt: now,
+            createdAt: now,
+        });
+        logger.debug("Worker created", {
+            projectId,
+            poolSize: this.pool.size,
+        });
+        return worker;
+    }
+    /**
+     * Execute a request in a project worker. Convenience method that
+     * combines getOrCreateWorker + execute.
+     */
+    execute(projectId, readPaths, request) {
+        // Validate modulePath is within allowed read paths (defense-in-depth)
+        if ("modulePath" in request && request.modulePath) {
+            const modulePath = request.modulePath;
+            const isAllowed = readPaths.some((p) => modulePath.startsWith(p));
+            if (!isAllowed) {
+                return Promise.reject(SECURITY_VIOLATION.create({
+                    detail: `Module path "${modulePath}" is outside allowed read paths for project "${projectId}"`,
+                }));
+            }
+        }
+        return withSpan("workerPool.execute", async () => {
+            const worker = this.getOrCreateWorker(projectId, readPaths);
+            // Check if worker should be recycled (request count or age)
+            const entry = this.pool.get(projectId);
+            const shouldRecycle = worker.requestCount >= this.config.maxRequestsPerWorker ||
+                (entry && Date.now() - entry.createdAt > this.config.maxWorkerAgeMs);
+            if (shouldRecycle && !this.recycling.has(projectId)) {
+                this.recycling.add(projectId);
+                try {
+                    logger.debug("Recycling worker", {
+                        projectId,
+                        requestCount: worker.requestCount,
+                        ageMs: entry ? Date.now() - entry.createdAt : 0,
+                        reason: worker.requestCount >= this.config.maxRequestsPerWorker
+                            ? "request_count"
+                            : "age",
+                    });
+                    this.evictWorker(projectId);
+                    const fresh = this.getOrCreateWorker(projectId, readPaths);
+                    return fresh.execute(request);
+                }
+                finally {
+                    this.recycling.delete(projectId);
+                }
+            }
+            return worker.execute(request);
+        }, { "workerPool.projectId": projectId });
+    }
+    /**
+     * Evict a specific project's worker.
+     */
+    evictWorker(projectId) {
+        const entry = this.pool.get(projectId);
+        if (!entry)
+            return;
+        entry.worker.terminate();
+        this.pool.delete(projectId);
+        logger.debug("Worker evicted", { projectId, poolSize: this.pool.size });
+    }
+    /**
+     * Get pool statistics for monitoring.
+     */
+    getStats() {
+        const workers = {};
+        const now = Date.now();
+        for (const [id, entry] of this.pool) {
+            workers[id] = {
+                status: entry.worker.status,
+                requestCount: entry.worker.requestCount,
+                hasPending: entry.worker.hasPendingRequests,
+                idleMs: now - entry.lastAccessedAt,
+                ageMs: now - entry.createdAt,
+            };
+        }
+        return {
+            poolSize: this.pool.size,
+            maxPoolSize: this.config.maxPoolSize,
+            memoryBudgetMb: this.config.memoryBudgetMb,
+            workers,
+        };
+    }
+    /**
+     * Get aggregate metrics suitable for Prometheus exposition.
+     */
+    getMetrics() {
+        let totalRequests = 0;
+        let busy = 0;
+        let crashed = 0;
+        for (const [, entry] of this.pool) {
+            totalRequests += entry.worker.requestCount;
+            if (entry.worker.hasPendingRequests)
+                busy++;
+            if (entry.worker.status === "crashed")
+                crashed++;
+        }
+        return {
+            workerPoolSize: this.pool.size,
+            workerPoolCapacity: this.config.maxPoolSize,
+            totalRequestsProcessed: totalRequests,
+            busyWorkers: busy,
+            crashedWorkers: crashed,
+        };
+    }
+    /**
+     * Shutdown the pool. Terminates all workers and stops timers.
+     */
+    shutdown() {
+        if (this.cleanupInterval)
+            clearInterval(this.cleanupInterval);
+        if (this.healthCheckInterval)
+            clearInterval(this.healthCheckInterval);
+        for (const [, entry] of this.pool) {
+            entry.worker.terminate();
+        }
+        this.pool.clear();
+        logger.debug("Worker pool shut down");
+    }
+    // -----------------------------------------------------------------------
+    // Private — Cleanup & Eviction
+    // -----------------------------------------------------------------------
+    startCleanup() {
+        // Run idle eviction every 30 seconds
+        this.cleanupInterval = dntShim.setInterval(() => {
+            this.evictIdleWorkers();
+        }, 30_000);
+        unrefTimer(this.cleanupInterval);
+    }
+    startHealthChecks() {
+        this.healthCheckInterval = dntShim.setInterval(() => {
+            void this.checkHealth();
+        }, this.config.healthCheckIntervalMs);
+        unrefTimer(this.healthCheckInterval);
+    }
+    evictIdleWorkers() {
+        const now = Date.now();
+        for (const [projectId, entry] of this.pool) {
+            const idleTime = now - entry.lastAccessedAt;
+            if (idleTime > this.config.idleTimeoutMs && !entry.worker.hasPendingRequests) {
+                entry.worker.terminate();
+                this.pool.delete(projectId);
+                logger.debug("Evicted idle worker", {
+                    projectId,
+                    idleMs: idleTime,
+                    poolSize: this.pool.size,
+                });
+            }
+        }
+    }
+    evictIfNeeded() {
+        if (this.pool.size < this.config.maxPoolSize)
+            return;
+        // Find the LRU entry that has no pending requests
+        let lruId = null;
+        let lruTime = Infinity;
+        for (const [projectId, entry] of this.pool) {
+            if (!entry.worker.hasPendingRequests && entry.lastAccessedAt < lruTime) {
+                lruTime = entry.lastAccessedAt;
+                lruId = projectId;
+            }
+        }
+        if (lruId) {
+            this.evictWorker(lruId);
+        }
+        else {
+            // All workers have pending requests — force evict the oldest
+            for (const [projectId, entry] of this.pool) {
+                if (entry.lastAccessedAt < lruTime) {
+                    lruTime = entry.lastAccessedAt;
+                    lruId = projectId;
+                }
+            }
+            if (lruId)
+                this.evictWorker(lruId);
+        }
+    }
+    async checkHealth() {
+        for (const [projectId, entry] of this.pool) {
+            if (entry.worker.status === "crashed" || entry.worker.status === "terminated") {
+                this.pool.delete(projectId);
+                continue;
+            }
+            const healthy = await entry.worker.isHealthy();
+            if (!healthy) {
+                logger.warn("Worker failed health check", { projectId });
+                entry.worker.terminate();
+                this.pool.delete(projectId);
+            }
+        }
+        // Evict oldest workers when under memory pressure
+        this.evictUnderMemoryPressure();
+    }
+    /**
+     * Evict workers when the process is under memory pressure.
+     * Uses the global heap stats — if heap usage is above a threshold,
+     * evict idle workers starting with the oldest to free memory.
+     */
+    evictUnderMemoryPressure() {
+        // Lazy import to avoid circular deps — this is only called during health checks
+        try {
+            // deno-lint-ignore no-explicit-any
+            const { getHeapStats } = dntShim.dntGlobalThis.__veryfront_heap_stats ?? {};
+            if (!getHeapStats)
+                return;
+            const { heapUsedPercent } = getHeapStats();
+            if (heapUsedPercent < 70)
+                return; // Only act above 70%
+            // Sort workers by last access time (oldest first)
+            const entries = [...this.pool.entries()]
+                .filter(([, e]) => !e.worker.hasPendingRequests)
+                .sort(([, a], [, b]) => a.lastAccessedAt - b.lastAccessedAt);
+            // Evict up to 25% of idle workers
+            const toEvict = Math.max(1, Math.ceil(entries.length * 0.25));
+            for (let i = 0; i < toEvict && i < entries.length; i++) {
+                const projectId = entries[i][0];
+                this.evictWorker(projectId);
+                logger.debug("Evicted worker due to memory pressure", {
+                    projectId,
+                    heapUsedPercent,
+                    poolSize: this.pool.size,
+                });
+            }
+        }
+        catch {
+            // getHeapStats may not be available in all environments
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Singleton & Feature Flag
+// ---------------------------------------------------------------------------
+// Cache feature flag results to avoid env lookups on every request
+let _flagsResolved = false;
+let _apiIsolation = false;
+let _dataIsolation = false;
+let _ssrIsolation = false;
+function resolveFlags() {
+    if (_flagsResolved)
+        return;
+    const master = getEnvBoolean("WORKER_ISOLATION_ENABLED", false);
+    _apiIsolation = master && getEnvBoolean("WORKER_ISOLATION_API", false);
+    _dataIsolation = master && getEnvBoolean("WORKER_ISOLATION_DATA", false);
+    _ssrIsolation = master && getEnvBoolean("WORKER_ISOLATION_SSR", false);
+    _flagsResolved = true;
+}
+/**
+ * Whether worker isolation is enabled for API routes.
+ * Controlled by WORKER_ISOLATION_API=1 (or WORKER_ISOLATION_ENABLED=1 as master switch).
+ */
+export function isWorkerIsolationEnabled() {
+    resolveFlags();
+    return _apiIsolation;
+}
+/**
+ * Whether worker isolation is enabled for data fetchers (getServerData).
+ * Controlled by WORKER_ISOLATION_DATA=1 (requires WORKER_ISOLATION_ENABLED=1).
+ */
+export function isDataIsolationEnabled() {
+    resolveFlags();
+    return _dataIsolation;
+}
+/**
+ * Whether worker isolation is enabled for SSR rendering.
+ * Controlled by WORKER_ISOLATION_SSR=1 (requires WORKER_ISOLATION_ENABLED=1).
+ */
+export function isSSRIsolationEnabled() {
+    resolveFlags();
+    return _ssrIsolation;
+}
+/** Lazy singleton — created on first use when isolation is enabled */
+let _pool = null;
+export function getWorkerPool() {
+    if (!_pool) {
+        _pool = new WorkerPool({
+            maxPoolSize: getEnvNumber("WORKER_MAX_POOL_SIZE") ?? DEFAULT_WORKER_POOL_CONFIG.maxPoolSize,
+            idleTimeoutMs: getEnvNumber("WORKER_IDLE_TIMEOUT_MS") ??
+                DEFAULT_WORKER_POOL_CONFIG.idleTimeoutMs,
+            requestTimeoutMs: getEnvNumber("WORKER_REQUEST_TIMEOUT_MS") ??
+                DEFAULT_WORKER_POOL_CONFIG.requestTimeoutMs,
+            maxRequestsPerWorker: getEnvNumber("WORKER_MAX_REQUESTS_PER_WORKER") ??
+                DEFAULT_WORKER_POOL_CONFIG.maxRequestsPerWorker,
+            maxWorkerAgeMs: getEnvNumber("WORKER_MAX_AGE_MS") ??
+                DEFAULT_WORKER_POOL_CONFIG.maxWorkerAgeMs,
+            memoryBudgetMb: getEnvNumber("WORKER_MEMORY_BUDGET_MB") ??
+                DEFAULT_WORKER_POOL_CONFIG.memoryBudgetMb,
+        });
+    }
+    return _pool;
+}
+/** Reset the singleton and cached flags — for testing only */
+export function __resetPoolForTests() {
+    _pool?.shutdown();
+    _pool = null;
+    _flagsResolved = false;
+    _apiIsolation = false;
+    _dataIsolation = false;
+    _ssrIsolation = false;
+}

package/esm/src/security/sandbox/worker-types.d.ts

@@ -0,0 +1,165 @@
+/**
+ * Worker Isolation Types
+ *
+ * Shared type definitions for the worker isolation system.
+ * Used by both the main process and worker script.
+ *
+ * @module security/sandbox/worker-types
+ */
+/**
+ * Serialized request data that can cross the Worker boundary via postMessage.
+ * We cannot send a full Request object (it's not structured-cloneable),
+ * so we extract the essential fields.
+ */
+export interface SerializedRequest {
+    url: string;
+    method: string;
+    headers: [string, string][];
+    body: Uint8Array | null;
+}
+/**
+ * Serialized API context for Pages Router routes.
+ */
+export interface SerializedPagesContext {
+    url: string;
+    method: string;
+    headers: [string, string][];
+    body: Uint8Array | null;
+    params: Record<string, string | string[]>;
+    cookies: Record<string, string>;
+}
+/**
+ * Serialized response data that can cross the Worker boundary.
+ */
+export interface SerializedResponse {
+    status: number;
+    statusText: string;
+    headers: [string, string][];
+    body: Uint8Array | null;
+}
+/**
+ * Serialized error for cross-boundary transport.
+ */
+export interface SerializedError {
+    message: string;
+    name: string;
+    stack?: string;
+    /** RFC 9457 fields if the error originated from VFError */
+    type?: string;
+    status?: number;
+    detail?: string;
+}
+/**
+ * Serialized DataContext for data fetcher isolation.
+ * Request and URL are not structured-cloneable, so we serialize them.
+ */
+export interface SerializedDataContext {
+    params: Record<string, string | string[]>;
+    /** URLSearchParams.toString() */
+    query: string;
+    request: SerializedRequest;
+    /** URL.toString() */
+    url: string;
+}
+/**
+ * Serialized DataResult — plain JSON, fully structured-cloneable.
+ */
+export interface SerializedDataResult {
+    props?: unknown;
+    redirect?: {
+        destination: string;
+        permanent?: boolean;
+    };
+    notFound?: boolean;
+    revalidate?: number | false;
+}
+export type WorkerRequest = ExecuteAppRouteRequest | ExecutePagesRouteRequest | FetchDataRequest | RenderSSRRequest;
+export interface ExecuteAppRouteRequest {
+    type: "execute-app-route";
+    id: string;
+    modulePath: string;
+    method: string;
+    request: SerializedRequest;
+    params: Record<string, string | string[]>;
+    projectDir: string;
+    /** Per-project env var overlay for multi-tenant proxy mode */
+    projectEnv?: Record<string, string>;
+}
+export interface ExecutePagesRouteRequest {
+    type: "execute-pages-route";
+    id: string;
+    modulePath: string;
+    method: string;
+    context: SerializedPagesContext;
+    projectDir: string;
+    /** Per-project env var overlay for multi-tenant proxy mode */
+    projectEnv?: Record<string, string>;
+}
+export interface FetchDataRequest {
+    type: "fetch-data";
+    id: string;
+    modulePath: string;
+    context: SerializedDataContext;
+}
+export interface RenderSSRRequest {
+    type: "render-ssr";
+    id: string;
+    /** Temp file path for the page component module */
+    pageModulePath: string;
+    /** Ordered layout module temp paths (innermost → outermost) */
+    layoutModulePaths: string[];
+    /** Page component props (JSON-serializable) */
+    pageProps: Record<string, unknown>;
+    /** Layout props keyed by layout index (matching layoutModulePaths order) */
+    layoutProps: Record<string, unknown>[];
+    /** Rendering delivery mode */
+    delivery: "string" | "stream";
+}
+export interface WorkerStreamChunk {
+    type: "stream-chunk";
+    id: string;
+    chunk: Uint8Array;
+}
+export interface WorkerStreamEnd {
+    type: "stream-end";
+    id: string;
+}
+export type WorkerResponse = WorkerResultResponse | WorkerDataResultResponse | WorkerSSRResultResponse | WorkerErrorResponse;
+export interface WorkerSSRResultResponse {
+    type: "ssr-result";
+    id: string;
+    html: string;
+}
+export interface WorkerResultResponse {
+    type: "result";
+    id: string;
+    response: SerializedResponse;
+}
+export interface WorkerDataResultResponse {
+    type: "data-result";
+    id: string;
+    result: SerializedDataResult;
+}
+export interface WorkerErrorResponse {
+    type: "error";
+    id: string;
+    error: SerializedError;
+}
+export interface WorkerPoolConfig {
+    /** Maximum number of concurrent workers (default: 20) */
+    maxPoolSize: number;
+    /** Idle timeout before evicting a worker (default: 300_000 = 5 minutes) */
+    idleTimeoutMs: number;
+    /** Per-request timeout inside the worker (default: 30_000) */
+    requestTimeoutMs: number;
+    /** Health check interval (default: 30_000) */
+    healthCheckIntervalMs: number;
+    /** Maximum requests before recycling a worker (default: 1000) */
+    maxRequestsPerWorker: number;
+    /** Maximum age of a worker in ms before recycling (default: 600_000 = 10 minutes) */
+    maxWorkerAgeMs: number;
+    /** Per-worker memory budget in MB (default: 64). Workers exceeding this are evicted. */
+    memoryBudgetMb: number;
+}
+export declare const DEFAULT_WORKER_POOL_CONFIG: WorkerPoolConfig;
+//# sourceMappingURL=worker-types.d.ts.map

package/esm/src/security/sandbox/worker-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-types.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC7B;AAMD,MAAM,MAAM,aAAa,GACrB,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,8BAA8B;IAC9B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,wBAAwB,GACxB,uBAAuB,GACvB,mBAAmB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;CACxB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,0BAA0B,EAAE,gBAQxC,CAAC"}

package/esm/src/security/sandbox/worker-types.js

@@ -0,0 +1,17 @@
+/**
+ * Worker Isolation Types
+ *
+ * Shared type definitions for the worker isolation system.
+ * Used by both the main process and worker script.
+ *
+ * @module security/sandbox/worker-types
+ */
+export const DEFAULT_WORKER_POOL_CONFIG = {
+    maxPoolSize: 20,
+    idleTimeoutMs: 300_000,
+    requestTimeoutMs: 30_000,
+    healthCheckIntervalMs: 30_000,
+    maxRequestsPerWorker: 1_000,
+    maxWorkerAgeMs: 600_000,
+    memoryBudgetMb: 64,
+};

package/esm/src/server/handlers/request/ssr/ssr.handler.d.ts

@@ -9,6 +9,7 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import { BaseHandler } from "../../response/base.js";
 import type { HandlerContext, HandlerMetadata, HandlerResult } from "../../types.js";
+import { type SSRServiceLike } from "../../../services/rendering/ssr.service.js";
 /**
  * Determine if request should serve production (released) content.
  * Uses resolvedEnvironment (from domain lookup) with fallback to requestContext.mode.
@@ -29,6 +30,7 @@ export declare function isProductionMode(ctx: HandlerContext, _url?: URL): boole
 export declare class SSRHandler extends BaseHandler {
     metadata: HandlerMetadata;
     private ssrService;
+    constructor(ssrService?: SSRServiceLike);
     handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult>;
     private setupContextAndRender;
     private handleWithContext;

package/esm/src/server/handlers/request/ssr/ssr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,gBAAgB,CAAC;AAiBxB;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,OAAO,CAKzE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,UAAW,SAAQ,WAAW;IACzC,QAAQ,EAAE,eAAe,CAIvB;IAEF,OAAO,CAAC,UAAU,CAAoB;IAEtC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BzE,OAAO,CAAC,qBAAqB;IAgE7B,OAAO,CAAC,iBAAiB;YAuDX,cAAc;YA6Bd,sBAAsB;YAgBtB,aAAa;CAU5B"}
+{"version":3,"file":"ssr.handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,4CAA4C,CAAC;AAMpD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,OAAO,CAKzE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,UAAW,SAAQ,WAAW;IACzC,QAAQ,EAAE,eAAe,CAIvB;IAEF,OAAO,CAAC,UAAU,CAAiB;gBAEvB,UAAU,CAAC,EAAE,cAAc;IAKvC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BzE,OAAO,CAAC,qBAAqB;IAgE7B,OAAO,CAAC,iBAAiB;YAuDX,cAAc;YA6Bd,sBAAsB;YAgBtB,aAAa;CAU5B"}

package/esm/src/server/handlers/request/ssr/ssr.handler.js

@@ -9,7 +9,7 @@ import { serverLogger } from "../../../../utils/index.js";
 import { endRequest, startRequest } from "../../../../utils/index.js";
 import { tryNotFoundFallback } from "./not-found-fallback.js";
 import { tryErrorPageFallback } from "./error-page-fallback.js";
-import { SSRService } from "../../../services/rendering/ssr.service.js";
+import { SSRService, } from "../../../services/rendering/ssr.service.js";
 import { ErrorPages } from "../../../utils/error-html.js";
 import { buildSSRResponse } from "./ssr-response-builder.js";
 const logger = serverLogger.component("ssr");
@@ -41,7 +41,11 @@ export class SSRHandler extends BaseHandler {
         priority: PRIORITY_LOW,
         patterns: [{ pattern: /^(?!\/_).*/, method: ["GET", "HEAD"] }],
     };
-    ssrService = new SSRService();
+    ssrService;
+    constructor(ssrService) {
+        super();
+        this.ssrService = ssrService ?? new SSRService();
+    }
     handle(req, ctx) {
         const url = new URL(req.url);
         const pathname = url.pathname;

package/esm/src/server/project-env/storage.d.ts

@@ -14,4 +14,10 @@ export declare function getProjectEnv(key: string): string | undefined;
  * to prevent remote projects from reading host-level secrets.
  */
 export declare function isProjectEnvActive(): boolean;
+/**
+ * Get a snapshot of the current project env overlay.
+ * Returns undefined if no overlay is active.
+ * Used to forward env vars to isolated workers in proxy mode.
+ */
+export declare function getProjectEnvSnapshot(): Record<string, string> | undefined;
 //# sourceMappingURL=storage.d.ts.map

package/esm/src/server/project-env/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/storage.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/storage.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAE1E"}

package/esm/src/server/project-env/storage.js

@@ -31,6 +31,14 @@ export function getProjectEnv(key) {
 export function isProjectEnvActive() {
     return projectEnvStorage.getStore() !== undefined;
 }
+/**
+ * Get a snapshot of the current project env overlay.
+ * Returns undefined if no overlay is active.
+ * Used to forward env vars to isolated workers in proxy mode.
+ */
+export function getProjectEnvSnapshot() {
+    return projectEnvStorage.getStore();
+}
 // Register on globalThis so process.ts can access without circular imports.
 // process.ts is low-level (platform/compat), project-env is high-level (server/).
 dntShim.dntGlobalThis.__vfProjectEnvGetter = getProjectEnv;

package/esm/src/server/runtime-handler/adapter-factory.d.ts

@@ -8,6 +8,7 @@
  */
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
 import type { VeryfrontConfig } from "../../config/index.js";
+import { type ProjectDiscoveryCache } from "./local-project-discovery.js";
 import type { ParsedDomain } from "../utils/domain-parser.js";
 interface AdapterResolutionResult {
     /** The effective project directory to use */
@@ -46,6 +47,8 @@ interface AdapterResolutionOptions {
     headerProjectPath: string | undefined;
     /** Whether running in proxy mode */
     isProxyMode: boolean;
+    /** Optional injectable cache (defaults to module-level singleton) */
+    cache?: ProjectDiscoveryCache;
 }
 /**
  * Resolve the effective adapter and config for a request.

package/esm/src/server/runtime-handler/adapter-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAM9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAmHlC"}
+{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAM9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAqHlC"}