Function executeInWorker

functions/server.ts:152–248

(code: string, request: Request)

// Execute function in isolated worker
async function executeInWorker(code: string, request: Request): Promise<Response> {
  // Get worker template
  const template = await getWorkerTemplateCode();

  // Fetch all function secrets
  const secrets = await getFunctionSecrets();

  // Create blob for worker
  const workerBlob = new Blob([template], { type: 'application/javascript' });
  const workerUrl = URL.createObjectURL(workerBlob);

  return new Promise(async (resolve) => {
    const worker = new Worker(workerUrl, {
      type: 'module',
      deno: {
        permissions: {
          // RESTRICTED: Native environment access is disabled to shield host secrets.
          // Secrets are passed explicitly via message payload.
          env: false,
          // SDK/External REQUIREMENT: Allow network access for API connectivity and external integrations.
          net: true,
          read: false,
          write: false,
          run: false,
          ffi: false,
          sys: false,
          import: false,
          hrtime: false,
        },
      },
    });

    // Set timeout for worker execution
    const timeout = setTimeout(() => {
      worker.terminate();
      URL.revokeObjectURL(workerUrl);
      resolve(
        new Response(JSON.stringify({ error: 'Function timeout' }), {
          status: 504,
          headers: { 'Content-Type': 'application/json' },
        })
      );
    }, WORKER_TIMEOUT_MS);

    // Handle worker response
    worker.onmessage = (e) => {
      clearTimeout(timeout);
      worker.terminate();
      URL.revokeObjectURL(workerUrl);

      if (e.data.success) {
        const { response } = e.data;
        // The worker now properly sends null for bodyless responses
        resolve(
          new Response(response.body, {
            status: response.status,
            statusText: response.statusText,
            headers: response.headers,