veryfront 0.1.74 → 0.1.75

package/src/src/security/sandbox/worker-types.ts

@@ -0,0 +1,209 @@
+/**
+ * Worker Isolation Types
+ *
+ * Shared type definitions for the worker isolation system.
+ * Used by both the main process and worker script.
+ *
+ * @module security/sandbox/worker-types
+ */
+
+/**
+ * Serialized request data that can cross the Worker boundary via postMessage.
+ * We cannot send a full Request object (it's not structured-cloneable),
+ * so we extract the essential fields.
+ */
+export interface SerializedRequest {
+  url: string;
+  method: string;
+  headers: [string, string][];
+  body: Uint8Array | null;
+}
+
+/**
+ * Serialized API context for Pages Router routes.
+ */
+export interface SerializedPagesContext {
+  url: string;
+  method: string;
+  headers: [string, string][];
+  body: Uint8Array | null;
+  params: Record<string, string | string[]>;
+  cookies: Record<string, string>;
+}
+
+/**
+ * Serialized response data that can cross the Worker boundary.
+ */
+export interface SerializedResponse {
+  status: number;
+  statusText: string;
+  headers: [string, string][];
+  body: Uint8Array | null;
+}
+
+/**
+ * Serialized error for cross-boundary transport.
+ */
+export interface SerializedError {
+  message: string;
+  name: string;
+  stack?: string;
+  /** RFC 9457 fields if the error originated from VFError */
+  type?: string;
+  status?: number;
+  detail?: string;
+}
+
+/**
+ * Serialized DataContext for data fetcher isolation.
+ * Request and URL are not structured-cloneable, so we serialize them.
+ */
+export interface SerializedDataContext {
+  params: Record<string, string | string[]>;
+  /** URLSearchParams.toString() */
+  query: string;
+  request: SerializedRequest;
+  /** URL.toString() */
+  url: string;
+}
+
+/**
+ * Serialized DataResult — plain JSON, fully structured-cloneable.
+ */
+export interface SerializedDataResult {
+  props?: unknown;
+  redirect?: { destination: string; permanent?: boolean };
+  notFound?: boolean;
+  revalidate?: number | false;
+}
+
+// ---------------------------------------------------------------------------
+// Worker Request / Response Protocol
+// ---------------------------------------------------------------------------
+
+export type WorkerRequest =
+  | ExecuteAppRouteRequest
+  | ExecutePagesRouteRequest
+  | FetchDataRequest
+  | RenderSSRRequest;
+
+export interface ExecuteAppRouteRequest {
+  type: "execute-app-route";
+  id: string;
+  modulePath: string;
+  method: string;
+  request: SerializedRequest;
+  params: Record<string, string | string[]>;
+  projectDir: string;
+  /** Per-project env var overlay for multi-tenant proxy mode */
+  projectEnv?: Record<string, string>;
+}
+
+export interface ExecutePagesRouteRequest {
+  type: "execute-pages-route";
+  id: string;
+  modulePath: string;
+  method: string;
+  context: SerializedPagesContext;
+  projectDir: string;
+  /** Per-project env var overlay for multi-tenant proxy mode */
+  projectEnv?: Record<string, string>;
+}
+
+export interface FetchDataRequest {
+  type: "fetch-data";
+  id: string;
+  modulePath: string;
+  context: SerializedDataContext;
+}
+
+export interface RenderSSRRequest {
+  type: "render-ssr";
+  id: string;
+  /** Temp file path for the page component module */
+  pageModulePath: string;
+  /** Ordered layout module temp paths (innermost → outermost) */
+  layoutModulePaths: string[];
+  /** Page component props (JSON-serializable) */
+  pageProps: Record<string, unknown>;
+  /** Layout props keyed by layout index (matching layoutModulePaths order) */
+  layoutProps: Record<string, unknown>[];
+  /** Rendering delivery mode */
+  delivery: "string" | "stream";
+}
+
+// ---------------------------------------------------------------------------
+// Streaming SSR Protocol
+// ---------------------------------------------------------------------------
+
+export interface WorkerStreamChunk {
+  type: "stream-chunk";
+  id: string;
+  chunk: Uint8Array;
+}
+
+export interface WorkerStreamEnd {
+  type: "stream-end";
+  id: string;
+}
+
+export type WorkerResponse =
+  | WorkerResultResponse
+  | WorkerDataResultResponse
+  | WorkerSSRResultResponse
+  | WorkerErrorResponse;
+
+export interface WorkerSSRResultResponse {
+  type: "ssr-result";
+  id: string;
+  html: string;
+}
+
+export interface WorkerResultResponse {
+  type: "result";
+  id: string;
+  response: SerializedResponse;
+}
+
+export interface WorkerDataResultResponse {
+  type: "data-result";
+  id: string;
+  result: SerializedDataResult;
+}
+
+export interface WorkerErrorResponse {
+  type: "error";
+  id: string;
+  error: SerializedError;
+}
+
+// ---------------------------------------------------------------------------
+// Worker Pool Configuration
+// ---------------------------------------------------------------------------
+
+export interface WorkerPoolConfig {
+  /** Maximum number of concurrent workers (default: 20) */
+  maxPoolSize: number;
+  /** Idle timeout before evicting a worker (default: 300_000 = 5 minutes) */
+  idleTimeoutMs: number;
+  /** Per-request timeout inside the worker (default: 30_000) */
+  requestTimeoutMs: number;
+  /** Health check interval (default: 30_000) */
+  healthCheckIntervalMs: number;
+  /** Maximum requests before recycling a worker (default: 1000) */
+  maxRequestsPerWorker: number;
+  /** Maximum age of a worker in ms before recycling (default: 600_000 = 10 minutes) */
+  maxWorkerAgeMs: number;
+  /** Per-worker memory budget in MB (default: 64). Workers exceeding this are evicted. */
+  memoryBudgetMb: number;
+}
+
+export const DEFAULT_WORKER_POOL_CONFIG: WorkerPoolConfig = {
+  maxPoolSize: 20,
+  idleTimeoutMs: 300_000,
+  requestTimeoutMs: 30_000,
+  healthCheckIntervalMs: 30_000,
+  maxRequestsPerWorker: 1_000,
+  maxWorkerAgeMs: 600_000,
+  memoryBudgetMb: 64,
+};

package/src/src/server/project-env/storage.ts

@@ -38,6 +38,15 @@ export function isProjectEnvActive(): boolean {
   return projectEnvStorage.getStore() !== undefined;
 }
 
+/**
+ * Get a snapshot of the current project env overlay.
+ * Returns undefined if no overlay is active.
+ * Used to forward env vars to isolated workers in proxy mode.
+ */
+export function getProjectEnvSnapshot(): Record<string, string> | undefined {
+  return projectEnvStorage.getStore();
+}
+
 // Register on globalThis so process.ts can access without circular imports.
 // process.ts is low-level (platform/compat), project-env is high-level (server/).
 (dntShim.dntGlobalThis as Record<string, unknown>).__vfProjectEnvGetter = getProjectEnv;

package/src/src/server/runtime-handler/project-isolation.ts

@@ -1,6 +1,10 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { serverLogger } from "../../utils/index.js";
 import { getEnvNumber, unrefTimer } from "../../platform/compat/process.js";
+import {
+  getWorkerPool,
+  isWorkerIsolationEnabled,
+} from "../../security/sandbox/worker-pool.js";
 
 const logger = serverLogger.component("project-isolation");
 
@@ -156,6 +160,46 @@ export class ProjectIsolationManager {
     });
   }
 
+  /**
+   * Record a worker crash for a project. This counts as a failure
+   * toward the circuit breaker threshold and evicts the worker.
+   */
+  recordWorkerCrash(projectSlug: string | undefined): void {
+    if (!projectSlug) return;
+
+    const state = this.getOrCreateState(projectSlug);
+    const now = Date.now();
+    state.failures.push(now);
+
+    state.failures = state.failures.filter(
+      (t) => now - t < this.config.failureWindowMs,
+    );
+
+    logger.warn("Worker crash recorded", {
+      projectSlug,
+      recentFailures: state.failures.length,
+    });
+
+    // Evict the crashed worker from the pool
+    if (isWorkerIsolationEnabled()) {
+      try {
+        getWorkerPool().evictWorker(projectSlug);
+      } catch {
+        // Pool may not be initialized
+      }
+    }
+
+    if (state.failures.length < this.config.circuitBreakerThreshold) return;
+
+    state.circuitOpenedAt = now;
+    logger.error("Circuit opened due to worker crashes", {
+      projectSlug,
+      recentFailures: state.failures.length,
+      threshold: this.config.circuitBreakerThreshold,
+      resetAfterMs: this.config.circuitResetTimeMs,
+    });
+  }
+
   getStats(): Record<
     string,
     {
@@ -193,6 +237,15 @@ export class ProjectIsolationManager {
   shutdown(): void {
     if (this.cleanupInterval) clearInterval(this.cleanupInterval);
     this.projects.clear();
+
+    // Shut down the worker pool if isolation is enabled
+    if (isWorkerIsolationEnabled()) {
+      try {
+        getWorkerPool().shutdown();
+      } catch {
+        // Pool may not be initialized
+      }
+    }
   }
 }
 

package/src/src/server/shared/renderer/memory/pressure.ts

@@ -59,3 +59,11 @@ export function shouldRejectDueToMemory(): boolean {
   rendererLog.warn("Rejecting request - memory critical", { heapUsedPercent });
   return true;
 }
+
+/**
+ * Get current memory pressure level for use by the worker pool
+ * to decide whether to evict idle workers.
+ */
+export function getMemoryPressureLevel(): MemoryPressureLevel {
+  return getMemoryPressure().level;
+}

package/src/src/transforms/pipeline/stages/ssr-vf-modules/path-resolver.ts

@@ -20,6 +20,7 @@ import {
 export async function tryReadWithExtensions(
   fs: ReturnType<typeof createFileSystem>,
   basePath: string,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<{ sourcePath: string; content: string } | null> {
   // Try all extensions, including .src versions for embedded sources
   const allExtensions = [
@@ -30,7 +31,7 @@ export async function tryReadWithExtensions(
   for (const ext of allExtensions) {
     const sourcePath = basePath + ext;
     try {
-      if (await exists(sourcePath)) {
+      if (await existsFn(sourcePath)) {
         const content = await fs.readTextFile(sourcePath);
         return { sourcePath, content };
       }
@@ -47,6 +48,7 @@ export async function tryReadWithExtensions(
 export async function resolveFrameworkFile(
   vfModulePath: string,
   fs: ReturnType<typeof createFileSystem>,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<{ sourcePath: string; content: string } | null> {
   const pathWithoutPrefix = vfModulePath
     .replace(/^\/_vf_modules\//, "")
@@ -78,7 +80,7 @@ export async function resolveFrameworkFile(
       fullPath: pathWithPrefixDir,
     });
 
-    const withPrefix = await tryReadWithExtensions(fs, pathWithPrefixDir);
+    const withPrefix = await tryReadWithExtensions(fs, pathWithPrefixDir, existsFn);
     if (withPrefix) {
       logger.debug(`${LOG_PREFIX} Found with prefix`, { sourcePath: withPrefix.sourcePath });
       return withPrefix;
@@ -93,7 +95,7 @@ export async function resolveFrameworkFile(
       fullPath: pathWithoutPrefixDir,
     });
 
-    const withoutPrefix = await tryReadWithExtensions(fs, pathWithoutPrefixDir);
+    const withoutPrefix = await tryReadWithExtensions(fs, pathWithoutPrefixDir, existsFn);
     if (withoutPrefix) {
       logger.debug(`${LOG_PREFIX} Found without prefix`, { sourcePath: withoutPrefix.sourcePath });
       return withoutPrefix;
@@ -118,7 +120,10 @@ export async function resolveFrameworkFile(
  * then falls back to regular src/. This matches resolveFrameworkFile's behavior
  * and ensures consistent path resolution for cycle detection.
  */
-export async function resolveVeryfrontSourcePath(specifier: string): Promise<string | null> {
+export async function resolveVeryfrontSourcePath(
+  specifier: string,
+  existsFn: (path: string) => Promise<boolean> = exists,
+): Promise<string | null> {
   if (!specifier.startsWith("#veryfront/")) return null;
 
   const mappedTarget = resolveInternalModuleTarget(specifier);
@@ -143,13 +148,13 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
       // Try exact path with .src suffix first (for embedded sources)
       try {
         const srcPath = basePath + ".src";
-        if (await exists(srcPath)) return srcPath;
+        if (await existsFn(srcPath)) return srcPath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
       // Try exact path
       try {
-        if (await exists(basePath)) return basePath;
+        if (await existsFn(basePath)) return basePath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -166,7 +171,7 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
     for (const ext of allExtensions) {
       const pathWithExt = basePath + ext;
       try {
-        if (await exists(pathWithExt)) return pathWithExt;
+        if (await existsFn(pathWithExt)) return pathWithExt;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -176,7 +181,7 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
     for (const ext of allExtensions) {
       const indexPath = join(basePath, "index" + ext);
       try {
-        if (await exists(indexPath)) return indexPath;
+        if (await existsFn(indexPath)) return indexPath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -197,6 +202,7 @@ export async function resolveRelativeFrameworkImport(
   specifier: string,
   fromSourcePath: string,
   _fs: ReturnType<typeof createFileSystem>,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<string | null> {
   const fromDir = fromSourcePath.substring(0, fromSourcePath.lastIndexOf("/"));
   const parts = fromDir.split("/").filter(Boolean);
@@ -219,7 +225,7 @@ export async function resolveRelativeFrameworkImport(
   if (/\.(tsx?|jsx?|mjs)$/.test(specifier)) {
     // Try exact path first
     try {
-      if (await exists(basePath)) return basePath;
+      if (await existsFn(basePath)) return basePath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -227,7 +233,7 @@ export async function resolveRelativeFrameworkImport(
     // Try with .src suffix for embedded sources
     try {
       const srcPath = basePath + ".src";
-      if (await exists(srcPath)) return srcPath;
+      if (await existsFn(srcPath)) return srcPath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -245,7 +251,7 @@ export async function resolveRelativeFrameworkImport(
   for (const ext of allExtensions) {
     const pathWithExt = basePath + ext;
     try {
-      if (await exists(pathWithExt)) return pathWithExt;
+      if (await existsFn(pathWithExt)) return pathWithExt;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -255,7 +261,7 @@ export async function resolveRelativeFrameworkImport(
   for (const ext of allExtensions) {
     const indexPath = join(basePath, "index" + ext);
     try {
-      if (await exists(indexPath)) return indexPath;
+      if (await existsFn(indexPath)) return indexPath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }

package/src/src/utils/index.ts

@@ -3,7 +3,16 @@
  * (breakpoints, timeouts, HTTP codes), hashing, memoization, and feature flags.
  *
  * @module utils
+ *
+ * @example Structured logging
+ * ```ts
+ * import { serverLogger } from "veryfront/utils";
+ *
+ * serverLogger.info("Booting server", { project_id: "proj_123" });
+ * ```
  */
+import "../../_dnt.polyfills.js";
+
 
 export {
   type GlobalWithBun,
@@ -17,11 +26,13 @@ export {
 export {
   agentLogger,
   bundlerLogger,
+  createJobUserLogger,
   logger,
   refreshLoggerConfig,
   rendererLogger,
   serverLogger,
 } from "./logger/index.js";
+export type { Logger } from "./logger/index.js";
 
 export {
   BREAKPOINT_LG,

package/src/src/utils/logger/index.ts

@@ -12,6 +12,7 @@ export {
   agentLogger,
   bundlerLogger,
   cliLogger,
+  createJobUserLogger,
   createRequestLogger,
   getBaseLogger,
   getDefaultLevel,

package/src/src/utils/logger/logger.ts

@@ -60,6 +60,12 @@ export interface LogEntry {
   release_id?: string;
   branch_id?: string;
   branch_name?: string;
+  job_id?: string;
+  batch_id?: string;
+  job_target?: string;
+  task?: string;
+  event_kind?: string;
+  user_visible?: string;
   // Duration for timed operations
   /** @deprecated Use `duration_ms` instead. Kept for Grafana dashboard transition. Planned removal after Grafana dashboard migration is complete. */
   durationMs?: number;
@@ -314,6 +320,12 @@ class ConsoleLogger implements Logger {
     extractToEntryField(entry, mergedContext, "release_id", (v) => String(v));
     extractToEntryField(entry, mergedContext, "branch_id", (v) => String(v));
     extractToEntryField(entry, mergedContext, "branch_name", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "job_id", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "batch_id", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "job_target", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "task", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "event_kind", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "user_visible", (v) => String(v));
     extractToEntryField(entry, mergedContext, "duration_ms", (v) => Number(v));
 
     // Emit snake_case aliases for camelCase fields (transition period)
@@ -568,3 +580,25 @@ export function createRequestLogger(
 ): Logger {
   return baseLogger.child(requestContext);
 }
+
+export function createJobUserLogger(
+  baseLogger: Logger,
+  jobContext: {
+    projectId: string;
+    jobId: string;
+    task: string;
+    batchId?: string | null;
+    jobTarget?: string | null;
+    eventKind?: string;
+  },
+): Logger {
+  return baseLogger.child({
+    project_id: jobContext.projectId,
+    job_id: jobContext.jobId,
+    ...(jobContext.batchId ? { batch_id: jobContext.batchId } : {}),
+    ...(jobContext.jobTarget ? { job_target: jobContext.jobTarget } : {}),
+    task: jobContext.task,
+    event_kind: jobContext.eventKind ?? "job_user_log",
+    user_visible: "true",
+  });
+}