support jurisdiction

Author: Ankcorn

readme.md

@@ -27,6 +27,19 @@ npm run token-setup
 
 This will prompt for your Cloudflare Account ID, open the browser to create an API token with the required permissions, and collect your Datadog API Key. It automatically creates a `.dev.vars` file.
 
+#### Optional: Jurisdiction
+
+To run GraphQL queries from a specific jurisdiction (closer to the data source), set the `JURISDICTION` variable in `wrangler.jsonc`:
+
+```jsonc
+"vars": {
+  "BATCH_SIZE": "5000",
+  "JURISDICTION": "eu" // e.g., "eu", "fedramp"
+}
+```
+
+This uses a Durable Object to proxy requests from the specified jurisdiction.
+
 ### Verify
 
 ```bash

src/api/cloudflare.ts

@@ -8,6 +8,7 @@ import {
 export interface CloudflareApiConfig {
 	accountId: string;
 	apiToken: string;
+	fetcher?: typeof fetch;
 }
 
 const ContainersListResponseSchema = z.object({
@@ -62,8 +63,11 @@ query GetCloudchamberMetrics($accountTag: string!, $datetimeStart: Time, $dateti
 export class CloudflareApi {
 	private readonly baseUrl = "https://api.cloudflare.com/client/v4";
 	private readonly graphqlUrl = "https://api.cloudflare.com/client/v4/graphql";
+	private readonly fetcher: typeof fetch;
 
-	constructor(private readonly config: CloudflareApiConfig) {}
+	constructor(private readonly config: CloudflareApiConfig) {
+		this.fetcher = config.fetcher ?? fetch;
+	}
 
 	private get headers(): HeadersInit {
 		return {
@@ -78,7 +82,7 @@ export class CloudflareApi {
 	async listContainers(): Promise<Container[]> {
 		const url = `${this.baseUrl}/accounts/${this.config.accountId}/containers/applications`;
 
-		const response = await fetch(url, {
+		const response = await this.fetcher(url, {
 			headers: this.headers,
 		});
 
@@ -118,7 +122,7 @@ export class CloudflareApi {
 			applicationId,
 		};
 
-		const response = await fetch(this.graphqlUrl, {
+		const response = await this.fetcher(this.graphqlUrl, {
 			method: "POST",
 			headers: this.headers,
 			body: JSON.stringify({
@@ -171,6 +175,7 @@ export class CloudflareApi {
 export function createCloudflareApi(
 	accountId: string,
 	apiToken: string,
+	fetcher?: typeof fetch,
 ): CloudflareApi {
-	return new CloudflareApi({ accountId, apiToken });
+	return new CloudflareApi({ accountId, apiToken, fetcher });
 }

src/index.ts

@@ -1,4 +1,5 @@
 export { MetricsExporterWorkflow } from "./workflow";
+export { RequestProxy } from "./request-proxy";
 
 const REQUIRED_ENV_VARS = [
 	"CLOUDFLARE_API_TOKEN",

src/request-proxy.ts

@@ -0,0 +1,11 @@
+import { DurableObject } from "cloudflare:workers";
+
+/**
+ * Durable Object that proxies fetch requests from a specific region.
+ * Used to ensure GraphQL queries run in a region close to the data source.
+ */
+export class RequestProxy extends DurableObject<Env> {
+	async fetch(request: Request): Promise<Response> {
+		return fetch(request);
+	}
+}

src/workflow.ts

@@ -38,9 +38,23 @@ const STEP_CONFIG = {
 export class MetricsExporterWorkflow extends WorkflowEntrypoint<Env> {
 	async run(_event: WorkflowEvent<unknown>, step: WorkflowStep) {
 		const batchSize = Number.parseInt(this.env.BATCH_SIZE || "5000", 10);
+
+		// Create a fetcher that proxies requests through a Durable Object in a specific jurisdiction
+		// This ensures GraphQL queries run close to the data source
+		let fetcher: typeof fetch | undefined;
+		if (this.env.JURISDICTION) {
+			const jurisdiction = this.env.REQUEST_PROXY.jurisdiction(
+				this.env.JURISDICTION as DurableObjectJurisdiction,
+			);
+			const id = jurisdiction.idFromName("metrics-proxy");
+			const stub = jurisdiction.get(id);
+			fetcher = stub.fetch.bind(stub);
+		}
+
 		const cloudflare = createCloudflareApi(
 			this.env.CLOUDFLARE_ACCOUNT_ID,
 			this.env.CLOUDFLARE_API_TOKEN,
+			fetcher,
 		);
 
 		const datadog = createDatadogApi(

worker-configuration.d.ts

@@ -1,16 +1,19 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: a2dd970dcb6e3b472df3dd06e13aaecb)
+// Generated by Wrangler by running `wrangler types` (hash: e8b40c011669a45effc49e682978268c)
 // Runtime types generated with workerd@1.20251202.0 2025-11-17 
 declare namespace Cloudflare {
 	interface GlobalProps {
 		mainModule: typeof import("./src/index");
+		durableNamespaces: "RequestProxy";
 	}
 	interface Env {
+		BATCH_SIZE: "5000";
+		JURISDICTION: "fedramp";
 		CLOUDFLARE_ACCOUNT_ID: string;
 		CLOUDFLARE_API_TOKEN: string;
 		DATADOG_API_KEY: string;
 		DATADOG_SITE: string;
-		BATCH_SIZE: string;
+		REQUEST_PROXY: DurableObjectNamespace<import("./src/index").RequestProxy>;
 		METRICS_WORKFLOW: Workflow<Parameters<import("./src/index").MetricsExporterWorkflow['run']>[0]['payload']>;
 	}
 }

wrangler.jsonc

@@ -18,7 +18,22 @@
 			"name": "metrics-exporter-workflow"
 		}
 	],
+	"durable_objects": {
+		"bindings": [
+			{
+				"name": "REQUEST_PROXY",
+				"class_name": "RequestProxy"
+			}
+		]
+	},
+	"migrations": [
+		{
+			"tag": "v1",
+			"new_sqlite_classes": ["RequestProxy"]
+		}
+	],
 	"vars": {
-		"BATCH_SIZE": "5000"
+		"BATCH_SIZE": "5000",
+		"JURISDICTION": ""
 	}
 }