veryfront 0.1.1213 → 0.1.1215

package/esm/src/security/http/derived-csp-origins.js

@@ -0,0 +1,156 @@
+/**
+ * Derive a project's CSP origins from the source it publishes.
+ *
+ * The platform floor lists what the *platform* emits. Anything a project loads
+ * from elsewhere -- a stock-photo host, its own asset CDN, a video origin --
+ * has to be admitted separately, and until now the only way to do that was
+ * `security.csp`. That made a working site depend on configuration the project
+ * had no reason to know it needed: an audit of the hosted fleet found ~100
+ * projects loading blocked assets and two that had declared anything.
+ *
+ * This module closes that gap by reading the origins out of the project's own
+ * released source, so `security.csp` becomes an override for what static
+ * analysis cannot see rather than a prerequisite for a site that works.
+ *
+ * Two properties make that safe rather than merely convenient:
+ *
+ * 1. **Only passive-content directives are derived.** `img-src`, `media-src`
+ *    and `font-src` decide whether a logo renders. `script-src` and
+ *    `connect-src` decide whether a third party can execute code in the page
+ *    or receive data from it. Deriving those would mean anyone able to
+ *    influence source -- a compromised dependency, a merged pull request,
+ *    CMS-authored MDX -- could grant themselves execution or an exfiltration
+ *    endpoint, collapsing two independent barriers into one. Every project in
+ *    the audit was fixed by passive directives alone.
+ *
+ * 2. **Origins come from an immutable release.** Derivation runs over the
+ *    source a release pins, not over live content, so a script injected at
+ *    runtime cannot extend the allowlist it is subject to.
+ *
+ * Derivation is deliberately incomplete. A URL assembled at runtime -- a
+ * template literal, a CMS field, an environment variable -- is invisible here,
+ * and those projects still declare `security.csp`. Under-deriving costs a
+ * broken image; over-deriving costs the policy its meaning.
+ *
+ * @module security/http/derived-csp-origins
+ */
+/** Directives this module is permitted to contribute to. */
+export const DERIVABLE_CSP_DIRECTIVES = Object.freeze(["img-src", "media-src", "font-src"]);
+/**
+ * Cap on how much of one file is scanned. A generated bundle or an inlined
+ * data blob can be megabytes, and scanning it yields nothing a hand-written
+ * source file would not.
+ *
+ * Measured in UTF-16 code units, matching `String.prototype.length`, because
+ * that is the unit the regex engine actually steps through -- 512K code units
+ * is the same amount of scanning whether they are ASCII or CJK. A UTF-8 byte
+ * cap would read as the more natural bound but would not correspond to the
+ * cost being bounded, and computing it means walking the string to decide how
+ * much of the string to walk.
+ */
+const MAX_SCANNED_CHARS_PER_FILE = 512 * 1024;
+/**
+ * Upper bound on distinct origins, so a generated file cannot inflate the
+ * policy. Origins are ranked before the cap applies -- see
+ * {@link deriveCspOriginsFromSource}.
+ */
+const MAX_DERIVED_ORIGINS = 32;
+/**
+ * Every absolute https URL in the source, whatever syntax surrounds it.
+ *
+ * An earlier version of this matched by position -- `<img src>`, `url()`,
+ * `poster` -- on the theory that knowing which element referenced a URL would
+ * let each origin land in exactly the right directive. Measured against real
+ * released content that recovers about a third of the references. The same
+ * project reaches its asset host through `<img src>`, a JSX `imageSrc` prop,
+ * YAML frontmatter, markdown `![](url)`, a bare string in a props array, a
+ * `srcFallback` key, and `href` on a favicon link. Partial derivation is worse
+ * than none: the site still breaks, but now it looks configured.
+ *
+ * Recall is what protects the project here, and precision is not what protects
+ * the visitor -- the passive/active split is. An origin admitted for images
+ * that is never referenced costs nothing; one that is missed costs a broken
+ * page.
+ */
+const HTTPS_URL_PATTERN = /https:\/\/[a-zA-Z0-9.-]+(?::\d{1,5})?(?![a-zA-Z0-9.:-])/g;
+/**
+ * Reduce a URL to the `scheme://host[:port]` form CSP matches on.
+ *
+ * Returns undefined for anything unparseable, which is the same as declining
+ * to derive from it.
+ */
+function toCspOrigin(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== "https:")
+        return undefined;
+    if (!parsed.hostname)
+        return undefined;
+    // A hostname with no dot is a bare label, not a public origin; a wildcard is
+    // an unfilled template. Neither belongs in a served policy.
+    if (!parsed.hostname.includes("."))
+        return undefined;
+    if (parsed.hostname.includes("*"))
+        return undefined;
+    return parsed.port ? `https://${parsed.hostname}:${parsed.port}` : `https://${parsed.hostname}`;
+}
+function scanContent(content, into) {
+    const scanned = content.length > MAX_SCANNED_CHARS_PER_FILE
+        ? content.slice(0, MAX_SCANNED_CHARS_PER_FILE)
+        : content;
+    for (const match of scanned.matchAll(HTTPS_URL_PATTERN)) {
+        const origin = toCspOrigin(match[0]);
+        if (origin)
+            into.set(origin, (into.get(origin) ?? 0) + 1);
+    }
+}
+/**
+ * Collect the passive-content origins a project's source references.
+ *
+ * Pure over its input: callers hand it the file set a release pins, and the
+ * result is stable for that set, which is what lets it be computed once per
+ * release rather than per request.
+ */
+export function deriveCspOriginsFromSource(files) {
+    const counts = new Map();
+    for (const file of files) {
+        if (!file?.content)
+            continue;
+        scanContent(file.content, counts);
+    }
+    if (counts.size === 0)
+        return Object.freeze({});
+    // Rank by how often an origin is referenced before applying the cap.
+    //
+    // Truncating in discovery order looked fine until it was run over a real
+    // project: one article yielded its asset CDN plus five hosts that appear
+    // only as prose links. Across a content site those one-off links vastly
+    // outnumber asset hosts, so an arbitrary cut can drop the very origin the
+    // site depends on and silently reintroduce the breakage this exists to
+    // prevent. An asset host is referenced from every page that uses it; a link
+    // in body copy is referenced once. Frequency separates them cleanly.
+    //
+    // Ties break alphabetically so the result stays deterministic for a given
+    // release, which is what lets the header and anything keyed on it be cached.
+    const ranked = [...counts.entries()]
+        .sort(([originA, countA], [originB, countB]) => countB - countA || originA.localeCompare(originB))
+        .slice(0, MAX_DERIVED_ORIGINS)
+        .map(([origin]) => origin)
+        .sort();
+    // Every retained origin is granted to all three passive directives rather
+    // than routed between them. Splitting by file extension would reintroduce a
+    // failure mode with no compensating benefit: an origin allowed for images
+    // but not media is not a boundary anyone reasons about, while guessing wrong
+    // leaves the asset blocked. The boundary that matters -- passive content
+    // versus script and connect -- is enforced by this list, not by the split.
+    const sorted = Object.freeze(ranked);
+    const derived = {};
+    for (const directive of DERIVABLE_CSP_DIRECTIVES)
+        derived[directive] = sorted;
+    return Object.freeze(derived);
+}

package/esm/src/security/http/response/security-handler.d.ts

@@ -5,8 +5,7 @@ import type { SecurityConfig } from "./types.js";
  * security policy. Server integrations must remove project-provided values
  * before applying policy so development omissions remain authoritative.
  */
-export declare const SECURITY_POLICY_RESPONSE_HEADER_NAMES: readonly ["content-security-policy", "content-security-policy-report-only", "cross-origin-embedder-policy", "cross-origin-opener-policy", "cross-origin-resource-policy", "referrer-policy", "strict-transport-security", "x-content-type-options", "x-frame-options", "x-xss-protection"];
-export declare function isSecurityPolicyResponseHeaderName(name: string): boolean;
+export declare const SECURITY_POLICY_RESPONSE_HEADER_NAMES: readonly ["content-security-policy", "content-security-policy-report-only", "cross-origin-embedder-policy", "cross-origin-opener-policy", "cross-origin-resource-policy", "referrer-policy", "reporting-endpoints", "strict-transport-security", "x-content-type-options", "x-frame-options", "x-xss-protection"];
 export declare function generateNonce(): string;
 /**
  * Build the served policy: the platform floor with project sources merged in.

package/esm/src/security/http/response/security-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAYzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,4RAgBjD,CAAC;AAMF,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAkBD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AA0KD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAWR;AA0CD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA8GN"}
+{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAgBzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,mTAmBjD,CAAC;AAqBF,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAsLD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAgBR;AA0CD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CAoHN"}

package/esm/src/security/http/response/security-handler.js

@@ -3,6 +3,7 @@ import { recordSecurityHeaders } from "../../../observability/index.js";
 import { HOSTED_STUDIO_ORIGINS } from "../studio-origin-policy.js";
 import { isCorsPolicyResponseHeaderName } from "../../../utils/cors-policy-limits.js";
 import { serverLogger } from "../../../utils/logger/logger.js";
+import { CSP_REPORT_ENDPOINT_NAME, CSP_REPORT_PATH, } from "../csp-report-endpoint.js";
 import { PLATFORM_FONT_FILE_ORIGINS, PLATFORM_FONT_STYLE_ORIGINS, PLATFORM_IMAGE_ORIGINS, PLATFORM_SCRIPT_ORIGINS, } from "../platform-asset-origins.js";
 import { toCspDirectiveName } from "../csp-directives.js";
 const logger = serverLogger.component("security-headers");
@@ -26,15 +27,16 @@ export const SECURITY_POLICY_RESPONSE_HEADER_NAMES = Object.freeze([
     "cross-origin-opener-policy",
     "cross-origin-resource-policy",
     "referrer-policy",
+    // Names where violation reports go. A project-provided value would send
+    // them somewhere else, or nowhere, and the policy would look healthy.
+    "reporting-endpoints",
     "strict-transport-security",
     "x-content-type-options",
     "x-frame-options",
     "x-xss-protection",
 ]);
-const SECURITY_POLICY_RESPONSE_HEADER_NAME_SET = new Set(SECURITY_POLICY_RESPONSE_HEADER_NAMES);
-export function isSecurityPolicyResponseHeaderName(name) {
-    return SECURITY_POLICY_RESPONSE_HEADER_NAME_SET.has(name.toLowerCase());
-}
+/** Response header defining the reporting groups the policy refers to. */
+const REPORTING_ENDPOINTS_HEADER = "reporting-endpoints";
 /** The two names the computed policy may be delivered under. */
 const CSP_RESPONSE_HEADER_NAMES = new Set([
     "content-security-policy",
@@ -114,6 +116,10 @@ function requiredDirectives(nonce, isVeryfrontDomain) {
         "frame-ancestors": isVeryfrontDomain ? [...VERYFRONT_FRAME_ANCESTORS] : ["'none'"],
         "base-uri": ["'self'"],
         "form-action": ["'self'"],
+        // Both spellings: `report-to` is the current one, `report-uri` is
+        // deprecated but still the only one several shipping browsers honour.
+        "report-to": [CSP_REPORT_ENDPOINT_NAME],
+        "report-uri": [CSP_REPORT_PATH],
     };
 }
 /**
@@ -149,7 +155,7 @@ function normalizeSources(sources) {
  * directive but never the required class, which is how a project hardens past
  * the floor without being able to break its own site.
  */
-function mergeCspDirectives(required, projectCsp, nonce) {
+function mergeCspDirectives(required, projectCsp, nonce, derived) {
     const project = new Map();
     for (const [key, value] of Object.entries(projectCsp ?? {})) {
         if (value === undefined)
@@ -177,16 +183,23 @@ function mergeCspDirectives(required, projectCsp, nonce) {
     const names = new Set([
         ...requiredByName.keys(),
         ...BASELINE_DIRECTIVES.keys(),
+        ...Object.keys(derived ?? {}),
         ...project.keys(),
     ]);
     const merged = Object.create(null);
     for (const name of names) {
         const configured = project.get(name);
         const baseline = configured === null ? [] : BASELINE_DIRECTIVES.get(name) ?? [];
+        // Derived origins sit above the floor and below project config, and follow
+        // the baseline's `null` semantics: a project that explicitly drops a
+        // directive means it, and static analysis must not put back what the
+        // project just said it does not want.
+        const derivedForName = configured === null ? [] : derived?.[name] ?? [];
         const additions = configured ?? [];
         merged[name] = normalizeSources([
             ...(requiredByName.get(name) ?? []),
             ...baseline,
+            ...derivedForName,
             ...additions,
         ]);
     }
@@ -219,7 +232,7 @@ export function buildCSP(isDev, nonce, config, adapter, isVeryfrontDomain) {
     // development allowance can never widen the production policy.
     if (isDev)
         return "";
-    return serializeDirectives(mergeCspDirectives(requiredDirectives(nonce, isVeryfrontDomain ?? false), config?.csp, nonce));
+    return serializeDirectives(mergeCspDirectives(requiredDirectives(nonce, isVeryfrontDomain ?? false), config?.csp, nonce, config?.derivedCsp));
 }
 /**
  * Whether the built policy is enforced or merely reported.
@@ -290,6 +303,9 @@ export function applySecurityHeaders(headers, isDev, nonce, config, adapter, isV
     if (csp) {
         const hasEnvOverride = Boolean(adapter?.env?.get?.("VERYFRONT_CSP")?.trim());
         headers.set(cspHeaderName(config, adapter, hasEnvOverride), csp);
+        // Names the group the policy's `report-to` refers to. Without this header
+        // the directive names nothing and the browser sends no reports at all.
+        headers.set(REPORTING_ENDPOINTS_HEADER, `${CSP_REPORT_ENDPOINT_NAME}="${CSP_REPORT_PATH}"`);
     }
     if (!isDev) {
         const hstsMaxAge = config?.hsts?.maxAge ?? HSTS_MAX_AGE_SECONDS;
@@ -328,9 +344,9 @@ export function applySecurityHeaders(headers, isDev, nonce, config, adapter, isV
             // `security.headers` would silently replace the merged platform floor --
             // and, now that the floor may be delivered report-only, could also flip
             // which mode is served. Header names are case-insensitive, so match that
-            // way. `isSecurityPolicyResponseHeaderName` is deliberately not reused:
-            // it covers headers this loop is still allowed to override.
-            if (isCspResponseHeaderName(key)) {
+            // way.
+            const headerName = key.toLowerCase();
+            if (isCspResponseHeaderName(headerName) || headerName === REPORTING_ENDPOINTS_HEADER) {
                 ignoredCspHeader = true;
                 continue;
             }

package/esm/src/security/sandbox/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SANDBOX_TIMEOUT_MS = 5000;
+export declare const MAX_SANDBOX_CODE_SIZE = 1000000;
+//# sourceMappingURL=constants.d.ts.map

package/esm/src/security/sandbox/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,qBAAqB,UAAY,CAAC"}

package/esm/src/security/sandbox/constants.js

@@ -0,0 +1,2 @@
+export const DEFAULT_SANDBOX_TIMEOUT_MS = 5000;
+export const MAX_SANDBOX_CODE_SIZE = 1_000_000; // 1 MB

package/esm/src/security/sandbox/deno-sandbox.d.ts

@@ -0,0 +1,71 @@
+export interface SandboxOptions {
+    timeoutMs?: number;
+    memoryLimitMb?: number;
+}
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Node.js
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export declare const NODE_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Node.js sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Node.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export declare function isNodeSandboxAllowedUnsafe(envValue: string | undefined): boolean;
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Bun
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export declare const BUN_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Bun sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Bun.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export declare function isBunSandboxAllowedUnsafe(envValue: string | undefined): boolean;
+/**
+ * Run untrusted JavaScript in an isolated Worker.
+ *
+ * ## Isolation model
+ *
+ * - **Deno (recommended):** the worker is spawned with `permissions: "none"`,
+ *   denying filesystem, network, env, and subprocess access. This is the
+ *   primary safe execution path.
+ * - **Node.js:** Node Workers do not support permission isolation. They
+ *   inherit full access to the filesystem, network, env vars, and built-in
+ *   modules. Only memory limits can be enforced. Because of this, the Node
+ *   path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ * - **Bun:** Bun Workers have the same lack of permission isolation as Node.js.
+ *   The Bun path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ *
+ * Callers SHOULD NOT pass untrusted code to this function on Node.js or Bun
+ * unless they have audited every caller and operator and accept the risk.
+ *
+ * @throws NOT_SUPPORTED on Node.js without the explicit opt-in env var.
+ * @throws NOT_SUPPORTED on Bun without the explicit opt-in env var.
+ */
+export declare function runInWorker<T = unknown>(code: string, options?: SandboxOptions): Promise<T>;
+//# sourceMappingURL=deno-sandbox.d.ts.map

package/esm/src/security/sandbox/deno-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno-sandbox.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/deno-sandbox.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;AAEnF;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,uCAAuC,CAAC;AAEjF;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CA6H/F"}

package/esm/src/security/sandbox/deno-sandbox.js

@@ -0,0 +1,184 @@
+import { DEFAULT_SANDBOX_TIMEOUT_MS, MAX_SANDBOX_CODE_SIZE } from "./constants.js";
+import { isCompiledBinary, serverLogger } from "../../utils/index.js";
+import { isBun, isDeno, isNode } from "../../platform/compat/runtime.js";
+import { getHostEnv } from "../../platform/compat/process/env.js";
+import { withSpan } from "../../observability/tracing/otlp-setup.js";
+import { INVALID_ARGUMENT, NOT_SUPPORTED, TIMEOUT_ERROR, UNKNOWN_ERROR } from "../../errors/index.js";
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Node.js
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export const NODE_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Node.js sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Node.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export function isNodeSandboxAllowedUnsafe(envValue) {
+    return envValue === "1";
+}
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Bun
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export const BUN_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Bun sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Bun.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export function isBunSandboxAllowedUnsafe(envValue) {
+    return envValue === "1";
+}
+/**
+ * Run untrusted JavaScript in an isolated Worker.
+ *
+ * ## Isolation model
+ *
+ * - **Deno (recommended):** the worker is spawned with `permissions: "none"`,
+ *   denying filesystem, network, env, and subprocess access. This is the
+ *   primary safe execution path.
+ * - **Node.js:** Node Workers do not support permission isolation. They
+ *   inherit full access to the filesystem, network, env vars, and built-in
+ *   modules. Only memory limits can be enforced. Because of this, the Node
+ *   path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ * - **Bun:** Bun Workers have the same lack of permission isolation as Node.js.
+ *   The Bun path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ *
+ * Callers SHOULD NOT pass untrusted code to this function on Node.js or Bun
+ * unless they have audited every caller and operator and accept the risk.
+ *
+ * @throws NOT_SUPPORTED on Node.js without the explicit opt-in env var.
+ * @throws NOT_SUPPORTED on Bun without the explicit opt-in env var.
+ */
+export function runInWorker(code, options = {}) {
+    if (typeof code !== "string") {
+        return Promise.reject(INVALID_ARGUMENT.create({ message: "Sandbox code must be a string" }));
+    }
+    if (code.length === 0) {
+        return Promise.reject(INVALID_ARGUMENT.create({ message: "Sandbox code cannot be empty" }));
+    }
+    const codeByteLength = new TextEncoder().encode(code).byteLength;
+    if (codeByteLength > MAX_SANDBOX_CODE_SIZE) {
+        return Promise.reject(INVALID_ARGUMENT.create({
+            message: `Sandbox code exceeds maximum size (${MAX_SANDBOX_CODE_SIZE} bytes)`,
+        }));
+    }
+    // SEC-008: Node Workers have no permission isolation. Refuse execution
+    // unless the operator has explicitly opted in via host env var. Use
+    // getHostEnv so a tenant project env overlay cannot enable this.
+    if (isNode && !isNodeSandboxAllowedUnsafe(getHostEnv(NODE_SANDBOX_ALLOW_UNSAFE_ENV))) {
+        return Promise.reject(NOT_SUPPORTED.create({
+            detail: "Sandbox execution is not safely supported on Node.js. The current " +
+                "implementation provides only memory limits, not permission isolation. " +
+                "Set VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1 to enable execution at your " +
+                "own risk, or run under Deno for full isolation.",
+        }));
+    }
+    // SEC-008: Bun Workers have no permission isolation (same risk as Node.js).
+    // Refuse execution unless the operator has explicitly opted in via host env
+    // var. Use getHostEnv so a tenant project env overlay cannot enable this.
+    if (isBun && !isBunSandboxAllowedUnsafe(getHostEnv(BUN_SANDBOX_ALLOW_UNSAFE_ENV))) {
+        return Promise.reject(NOT_SUPPORTED.create({
+            detail: "Sandbox execution is not safely supported on Bun. The current " +
+                "implementation provides no permission isolation. " +
+                "Set VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1 to enable execution at your " +
+                "own risk, or run under Deno for full isolation.",
+        }));
+    }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SANDBOX_TIMEOUT_MS;
+    return withSpan("security.sandbox.runInWorker", () => {
+        const workerOptions = { type: "module" };
+        if (isDeno)
+            workerOptions.deno = { permissions: "none" };
+        const { memoryLimitMb } = options;
+        if (typeof memoryLimitMb === "number") {
+            if (!Number.isFinite(memoryLimitMb) || memoryLimitMb <= 0) {
+                throw INVALID_ARGUMENT.create({
+                    detail: "Sandbox memoryLimitMb must be a positive, finite number",
+                });
+            }
+            if (!isNode) {
+                throw NOT_SUPPORTED.create({
+                    detail: "Sandbox memory limits are not supported in this runtime",
+                });
+            }
+            workerOptions.resourceLimits = {
+                ...workerOptions.resourceLimits,
+                maxOldGenerationSizeMb: Math.floor(memoryLimitMb),
+            };
+        }
+        const workerCode = `self.onmessage = async (e) => {` +
+            `  const { code } = e.data;` +
+            `  let result;` +
+            `  try { result = await (async () => {` +
+            `    return await (new Function(code))();` +
+            `  })(); } catch (error) {` +
+            `    self.postMessage({ error: String(error && error.message || error) });` +
+            `    return;` +
+            `  }` +
+            `  self.postMessage({ result });` +
+            `};`;
+        // Use data URL for compiled binaries (blob URLs don't work in deno compile)
+        // See: https://github.com/denoland/deno/issues/18327
+        const workerUrl = isCompiledBinary()
+            ? `data:text/javascript;base64,${btoa(workerCode)}`
+            : URL.createObjectURL(new Blob([workerCode], { type: "application/javascript" }));
+        const worker = new Worker(workerUrl, workerOptions);
+        function safeTerminate(logMessage, error) {
+            try {
+                worker.terminate();
+            }
+            catch (e) {
+                serverLogger.debug(logMessage, { error: error ?? e });
+            }
+        }
+        const promise = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                safeTerminate("[sandbox] worker terminate failed");
+                reject(TIMEOUT_ERROR.create({ detail: "Sandbox timeout" }));
+            }, timeoutMs);
+            worker.onmessage = (e) => {
+                clearTimeout(timer);
+                const { result, error } = e.data ?? {};
+                if (error)
+                    reject(UNKNOWN_ERROR.create({ detail: error }));
+                else
+                    resolve(result);
+                safeTerminate("[sandbox] worker terminate failed");
+            };
+            worker.onerror = (e) => {
+                clearTimeout(timer);
+                reject(UNKNOWN_ERROR.create({ detail: String(e.message || e.error || "Worker error") }));
+                safeTerminate("[sandbox] worker terminate failed on error");
+            };
+        });
+        worker.postMessage({ code });
+        return promise;
+    }, {
+        "sandbox.timeoutMs": timeoutMs,
+        "sandbox.memoryLimitMb": options.memoryLimitMb ?? 0,
+    });
+}

package/esm/src/security/sandbox/permission-system.d.ts

@@ -0,0 +1,11 @@
+export type Permission = "net" | "fs" | "env" | "run" | "read" | "write";
+export interface PermissionRequest {
+    name: Permission;
+    host?: string;
+    path?: string;
+}
+export interface PermissionResult {
+    state: "granted" | "denied" | "prompt";
+}
+export declare function requestPermission(request: PermissionRequest): Promise<PermissionResult>;
+//# sourceMappingURL=permission-system.d.ts.map

package/esm/src/security/sandbox/permission-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-system.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/permission-system.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACxC;AAkGD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/esm/src/security/sandbox/permission-system.js

@@ -0,0 +1,85 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import { serverLogger } from "../../utils/index.js";
+import { isDeno } from "../../platform/compat/runtime.js";
+import { withSpan } from "../../observability/tracing/otlp-setup.js";
+const logger = serverLogger.component("permissions");
+/**
+ * Access the Deno permissions API through a narrow, typed view.
+ * Returns null when not running under Deno or the API is unavailable.
+ */
+function getDenoPermissions() {
+    const denoGlobal = dntShim.dntGlobalThis.Deno;
+    const permissions = denoGlobal?.permissions;
+    if (!permissions || typeof permissions.request !== "function")
+        return null;
+    return permissions;
+}
+function createPermissionDescriptor(request) {
+    const { name, host, path } = request;
+    switch (name) {
+        case "net":
+            return host ? { name, host } : { name };
+        case "read":
+        case "write":
+            return path ? { name, path } : { name };
+        case "env":
+        case "run":
+            return { name };
+        case "fs":
+        default:
+            return null;
+    }
+}
+function requestDenoPermission(request) {
+    return withSpan("security.permissions.requestDeno", async () => {
+        const permissions = getDenoPermissions();
+        if (!isDeno || !permissions)
+            return { state: "denied" };
+        if (request.name === "fs") {
+            const path = request.path;
+            const readStatus = await permissions.request({ name: "read", path });
+            if (readStatus.state !== "granted")
+                return { state: readStatus.state };
+            const writeStatus = await permissions.request({ name: "write", path });
+            return { state: writeStatus.state };
+        }
+        const descriptor = createPermissionDescriptor(request);
+        if (!descriptor) {
+            logger.warn("Unsupported permission request", request);
+            return { state: "denied" };
+        }
+        const status = await permissions.request(descriptor);
+        return { state: status.state };
+    }, { "permission.name": request.name });
+}
+let warnedNonDenoAutoGrant = false;
+function warnNonDenoAutoGrantOnce() {
+    if (warnedNonDenoAutoGrant)
+        return;
+    warnedNonDenoAutoGrant = true;
+    logger.warn("Permission sandbox is a no-op on non-Deno runtimes: all permission " +
+        "requests are auto-granted. Do not rely on this guard for isolation " +
+        "when running outside Deno.");
+}
+export function requestPermission(request) {
+    return withSpan("security.permissions.request", async () => {
+        try {
+            if (isDeno)
+                return await requestDenoPermission(request);
+            // On non-Deno runtimes there is no OS-level permission API to consult,
+            // so every request is auto-granted — this guard provides NO isolation
+            // here. Warn loudly (once) so an operator running the runtime outside
+            // Deno cannot mistake this for an enforced sandbox.
+            warnNonDenoAutoGrantOnce();
+            serverLogger.debug("[permissions] Permission auto-granted (non-Deno runtime)", { permission: request.name });
+            return { state: "granted" };
+        }
+        catch (error) {
+            logger.warn("Permission request failed", {
+                permission: request.name,
+                error,
+            });
+            return { state: "denied" };
+        }
+    }, { "permission.name": request.name });
+}