veryfront 0.1.74 → 0.1.76

package/src/src/data/data-fetcher.ts

@@ -1,11 +1,22 @@
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../observability/tracing/span-names.js";
 import { CacheManager } from "./data-fetching-cache.js";
-import { ServerDataFetcher } from "./server-data-fetcher.js";
+import { ServerDataFetcher, type ServerDataFetchOptions } from "./server-data-fetcher.js";
 import { StaticDataFetcher } from "./static-data-fetcher.js";
 import { StaticPathsFetcher } from "./static-paths-fetcher.js";
 import type { DataContext, DataResult, PageWithData, StaticPathsResult } from "./types.js";
 
+/**
+ * Options for isolated data fetching. Passed through to ServerDataFetcher
+ * when worker isolation is enabled.
+ */
+export interface FetchDataOptions {
+  /** Absolute path to the module containing getServerData */
+  modulePath?: string;
+  /** Project directory for worker scoping */
+  projectDir?: string;
+}
+
 export class DataFetcher {
   private cacheManager: CacheManager;
   private serverFetcher: ServerDataFetcher;
@@ -23,6 +34,7 @@ export class DataFetcher {
     pageModule: PageWithData,
     context: DataContext,
     mode: "development" | "production" = "development",
+    options?: FetchDataOptions,
   ): Promise<DataResult> {
     const preferServerData = mode === "development" || !pageModule.getStaticData;
     const useServer = preferServerData && !!pageModule.getServerData;
@@ -34,10 +46,14 @@ export class DataFetcher {
       ? "static"
       : "none";
 
+    const isolationOptions: ServerDataFetchOptions | undefined = options
+      ? { modulePath: options.modulePath, projectDir: options.projectDir }
+      : undefined;
+
     return withSpan(
       SpanNames.DATA_FETCH,
       () => {
-        if (useServer) return this.serverFetcher.fetch(pageModule, context);
+        if (useServer) return this.serverFetcher.fetch(pageModule, context, isolationOptions);
         if (useStatic) return this.staticFetcher.fetch(pageModule, context);
         return Promise.resolve({ props: {} });
       },

package/src/src/data/index.ts

@@ -13,5 +13,5 @@ export type {
   PageWithData,
   StaticPathsResult,
 } from "./types.js";
-export { DataFetcher } from "./data-fetcher.js";
+export { DataFetcher, type FetchDataOptions } from "./data-fetcher.js";
 export { notFound, redirect } from "./helpers.js";

package/src/src/data/server-data-fetcher.ts

@@ -1,12 +1,32 @@
+import * as dntShim from "../../_dnt.shims.js";
 import type { DataContext, DataResult, PageWithData } from "./types.js";
 import { serverLogger } from "../utils/index.js";
 import { DATA_FETCH_TIMEOUT_MS } from "../config/defaults.js";
 import { TimeoutError, withTimeoutThrow } from "../rendering/utils/stream-utils.js";
 import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { CircuitBreakerOpen, getCircuitBreaker } from "../utils/circuit-breaker.js";
+import { getWorkerPool, isDataIsolationEnabled } from "../security/sandbox/worker-pool.js";
+import {
+  MAX_WORKER_BODY_BYTES,
+  type WorkerResponse,
+} from "../security/sandbox/worker-types.js";
+
+/**
+ * Options for isolated data fetching through Worker pool.
+ */
+export interface ServerDataFetchOptions {
+  /** Absolute path to the module containing getServerData */
+  modulePath?: string;
+  /** Project directory for worker scoping */
+  projectDir?: string;
+}
 
 export class ServerDataFetcher {
-  fetch(pageModule: PageWithData, context: DataContext): Promise<DataResult> {
+  fetch(
+    pageModule: PageWithData,
+    context: DataContext,
+    options?: ServerDataFetchOptions,
+  ): Promise<DataResult> {
     if (typeof pageModule.getServerData !== "function") {
       return Promise.resolve({ props: {} });
     }
@@ -20,6 +40,11 @@ export class ServerDataFetcher {
       successThreshold: 2,
     });
 
+    // Choose isolated or direct execution
+    const useIsolation = isDataIsolationEnabled() &&
+      !!options?.modulePath &&
+      !!options?.projectDir;
+
     return withSpan(
       "data.fetch_server",
       async () => {
@@ -28,7 +53,9 @@ export class ServerDataFetcher {
         try {
           const result = await circuitBreaker.execute(() =>
             withTimeoutThrow(
-              Promise.resolve(pageModule.getServerData!(context)),
+              useIsolation
+                ? this.fetchIsolated(options!.modulePath!, options!.projectDir!, context)
+                : Promise.resolve(pageModule.getServerData!(context)),
               DATA_FETCH_TIMEOUT_MS,
               `getServerData for ${pathname}`,
             )
@@ -59,7 +86,11 @@ export class ServerDataFetcher {
             throw error;
           }
 
-          this.logError("DATA_FETCH_ERROR getServerData failed", error, { pathname, durationMs });
+          this.logError("DATA_FETCH_ERROR getServerData failed", error, {
+            pathname,
+            durationMs,
+            isolated: useIsolation,
+          });
           throw error;
         }
       },
@@ -68,10 +99,82 @@ export class ServerDataFetcher {
         "data.pathname": pathname,
         "data.timeout_ms": DATA_FETCH_TIMEOUT_MS,
         "data.project_id": projectId,
+        "data.isolated": useIsolation,
       },
     );
   }
 
+  /**
+   * Execute getServerData in a per-project Worker.
+   */
+  private async fetchIsolated(
+    modulePath: string,
+    projectDir: string,
+    context: DataContext,
+  ): Promise<DataResult> {
+    const pool = getWorkerPool();
+    let body: Uint8Array | null = null;
+    if (context.request?.body) {
+      // Fast path: reject before buffering if Content-Length is known
+      const contentLength = context.request.headers?.get("content-length");
+      if (contentLength) {
+        const bytes = parseInt(contentLength, 10);
+        if (bytes > MAX_WORKER_BODY_BYTES) {
+          throw new Error(
+            `Request body too large for isolated data fetch (${
+              (bytes / 1024 / 1024).toFixed(1)
+            } MB, limit ${MAX_WORKER_BODY_BYTES / 1024 / 1024} MB)`,
+          );
+        }
+      }
+
+      body = new Uint8Array(await context.request.arrayBuffer());
+
+      // Fallback: check actual size for chunked/streaming bodies
+      if (body.byteLength > MAX_WORKER_BODY_BYTES) {
+        throw new Error(
+          `Request body too large for isolated data fetch (${
+            (body.byteLength / 1024 / 1024).toFixed(1)
+          } MB, limit ${MAX_WORKER_BODY_BYTES / 1024 / 1024} MB)`,
+        );
+      }
+    }
+
+    const workerResponse: WorkerResponse = await pool.execute(
+      projectDir,
+      [projectDir],
+      {
+        type: "fetch-data",
+        id: dntShim.crypto.randomUUID(),
+        modulePath,
+        context: {
+          params: context.params,
+          query: context.query?.toString() ?? "",
+          request: {
+            url: context.request?.url ?? context.url?.toString() ?? "http://localhost",
+            method: context.request?.method ?? "GET",
+            headers: context.request ? [...context.request.headers.entries()] : [],
+            body,
+          },
+          url: context.url?.toString() ?? "http://localhost",
+        },
+      },
+    );
+
+    if (workerResponse.type === "error") {
+      const err = new Error(workerResponse.error.message);
+      err.name = workerResponse.error.name;
+      throw err;
+    }
+
+    if (workerResponse.type === "data-result") {
+      return workerResponse.result as DataResult;
+    }
+
+    // Unexpected response type — shouldn't happen but be defensive
+    throw new Error(`Unexpected worker response type: ${workerResponse.type}`);
+  }
+
   /**
    * Log errors unconditionally. Production errors should always be logged.
    * @see plans/architecture-audit/010-error-handling.md

package/src/src/jobs/index.ts

@@ -0,0 +1,85 @@
+/**
+ * Jobs module for durable project-scoped background execution.
+ *
+ * Provides a public SDK surface for one-off jobs, cron jobs, batch summaries,
+ * job target discovery, and the canonical split between user-visible `events`
+ * and raw debugging `logs`.
+ *
+ * @module
+ *
+ * @example
+ * ```ts
+ * import { VeryfrontJobsClient } from "veryfront/jobs";
+ *
+ * const jobs = new VeryfrontJobsClient({
+ *   authToken: process.env.VERYFRONT_API_TOKEN,
+ *   projectReference: "my-project",
+ * });
+ *
+ * const job = await jobs.create({
+ *   name: "Ingest 1 file",
+ *   target: "task:knowledge-ingest",
+ *   config: {
+ *     file_count: 1,
+ *     upload_ids: ["00000000-0000-0000-0000-000000000000"],
+ *   },
+ * });
+ *
+ * const events = await jobs.events(job.id);
+ * ```
+ */
+import "../../_dnt.polyfills.js";
+
+
+export {
+  type CreateCronJobInput,
+  type CreateJobInput,
+  createJobsClient,
+  type ListBatchJobsOptions,
+  type ListCronJobsOptions,
+  type ListJobEventsOptions,
+  type ListJobsOptions,
+  type ProjectScopedOptions,
+  type UpdateCronJobInput,
+  VeryfrontJobsClient,
+  type VeryfrontJobsClientConfig,
+} from "./jobs-client.js";
+export {
+  type CronJob,
+  CronJobSchema,
+  type CronJobStatus,
+  CronJobStatusSchema,
+  type Job,
+  type JobBatch,
+  type JobBatchResult,
+  JobBatchResultSchema,
+  JobBatchSchema,
+  type JobBatchStatusCounts,
+  JobBatchStatusCountsSchema,
+  type JobEvent,
+  JobEventSchema,
+  type JobEventsResponse,
+  JobEventsResponseSchema,
+  type JobLogsResponse,
+  JobLogsResponseSchema,
+  type JobResult,
+  JobResultSchema,
+  JobSchema,
+  type JobStatus,
+  JobStatusSchema,
+  type JobTargetDefinition,
+  JobTargetDefinitionSchema,
+  type JobTargetDefinitionsResponse,
+  JobTargetDefinitionsResponseSchema,
+  type KnowledgeIngestBatchSource,
+  KnowledgeIngestBatchSourceSchema,
+  type KnowledgeIngestFileResult,
+  KnowledgeIngestFileResultSchema,
+  PageInfoSchema,
+  type PaginatedCronJobsResponse,
+  PaginatedCronJobsResponseSchema,
+  type PaginatedJobsResponse,
+  PaginatedJobsResponseSchema,
+  type ReservedJobTargetFamily,
+  ReservedJobTargetFamilySchema,
+} from "./schemas.js";