veryfront 0.1.215 → 0.1.217

package/src/src/html/styles-builder/plugin-loader.ts

@@ -21,9 +21,34 @@ import {
   VeryfrontError,
 } from "../../errors/index.js";
 import { getTailwindPluginBundleUrl } from "../../build/binary-plugin-includes.js";
+import {
+  bareName,
+  PACKAGE_SPEC_RE,
+  TAILWIND_PLUGIN_ALLOWLIST,
+} from "./tailwind-plugin-allowlist.js";
 
 const logger = serverLogger.component("tailwind");
 
+/**
+ * Enforce the Tailwind plugin allowlist (VULN-FS-1).
+ *
+ * Called at the top of every entry point that can load third-party plugin
+ * code. Rejects anything that is not a syntactically valid npm package
+ * specifier, and anything whose bare name is not on the allowlist.
+ */
+function assertPluginAllowed(spec: string): void {
+  if (!PACKAGE_SPEC_RE.test(spec)) {
+    throw new Error(`Invalid Tailwind plugin specifier: ${spec}`);
+  }
+  const name = bareName(spec);
+  if (!TAILWIND_PLUGIN_ALLOWLIST.has(name)) {
+    throw new Error(
+      `Package "${name}" is not on the Tailwind plugin allowlist. ` +
+        `See src/html/styles-builder/tailwind-plugin-allowlist.ts.`,
+    );
+  }
+}
+
 // Provide localStorage shim for plugins that use util-deprecate (which checks localStorage)
 // This prevents "LocalStorage is not supported in this context" errors in Deno.
 try {
@@ -109,6 +134,8 @@ async function importBundledModule(code: string): Promise<unknown> {
  * dynamic imports from URLs. Fetches bundled code, rewrites imports, loads via temp file.
  */
 export async function loadModuleFromEsmSh(packageName: string): Promise<unknown> {
+  assertPluginAllowed(packageName);
+
   const stubUrl = getTailwindPluginBundleUrl(packageName);
   logger.debug("Fetching esm.sh stub", { url: stubUrl });
 
@@ -173,6 +200,11 @@ export async function loadPlugin(
   pluginCache: Map<string, unknown>,
   pluginErrors: Map<string, Error>,
 ): Promise<unknown> {
+  // Enforce the allowlist before consulting any caches so a disallowed id can
+  // never be served from a pre-seeded or stale cache entry — defence-in-depth
+  // against future changes that might pre-populate these maps.
+  assertPluginAllowed(id);
+
   const cachedError = pluginErrors.get(id);
   if (cachedError) throw cachedError;
 

package/src/src/html/styles-builder/tailwind-plugin-allowlist.ts

@@ -0,0 +1,51 @@
+/**
+ * Allowlist of Tailwind CSS plugin package names that may be dynamically loaded
+ * via `loadPlugin` / `loadModuleFromEsmSh`.
+ *
+ * Tailwind v4 stylesheets can request plugins through the `@plugin "..."`
+ * directive. Without restriction, this turns arbitrary project CSS into a
+ * remote-code-execution vector because the loader fetches and imports code
+ * from https://esm.sh. Only the packages listed here may be loaded.
+ *
+ * @module html/styles-builder/tailwind-plugin-allowlist
+ */
+
+export const TAILWIND_PLUGIN_ALLOWLIST: ReadonlySet<string> = new Set([
+  // Bundled into the compiled binary (see src/build/binary-plugin-includes.ts).
+  // Must stay in sync with BINARY_TAILWIND_PLUGIN_PACKAGES — an invariant
+  // enforced by tailwind-plugin-allowlist.test.ts.
+  "@tailwindcss/typography",
+  "@tailwindcss/forms",
+  "tailwindcss-animate",
+  "tailwind-scrollbar-hide",
+  "daisyui",
+  // Allowlisted but NOT bundled: loaded from esm.sh on first use. Adding an
+  // entry here is arbitrary-code-exec surface; review each one explicitly.
+  "@tailwindcss/aspect-ratio",
+  "@tailwindcss/container-queries",
+]);
+
+/**
+ * Matches npm package specifiers, optionally scoped and optionally suffixed
+ * with an `@version` range. Deliberately restrictive: ASCII only, no path
+ * separators, no whitespace, no control characters.
+ */
+export const PACKAGE_SPEC_RE = /^(?:@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*(?:@[\w.+-]+)?$/i;
+
+/**
+ * Return the bare package name (without any `@version` suffix) for a spec.
+ *
+ * Examples:
+ *   bareName("pkg")            -> "pkg"
+ *   bareName("pkg@1.0.0")      -> "pkg"
+ *   bareName("@scope/pkg")     -> "@scope/pkg"
+ *   bareName("@scope/pkg@1.0") -> "@scope/pkg"
+ */
+export function bareName(spec: string): string {
+  if (spec.startsWith("@")) {
+    const idx = spec.indexOf("@", 1);
+    return idx === -1 ? spec : spec.slice(0, idx);
+  }
+  const idx = spec.indexOf("@");
+  return idx === -1 ? spec : spec.slice(0, idx);
+}

package/src/src/modules/react-loader/ssr-module-loader/loader-helpers.ts

@@ -0,0 +1,37 @@
+import { createError, toError } from "../../../errors/veryfront-error.js";
+
+const MISSING_HTTP_BUNDLE_PATTERN = /veryfront-http-bundle\/http-([a-f0-9]+)\.mjs/;
+
+export type TransformCapacityErrorMode = "plain" | "build";
+
+export type ImportErrorClassification =
+  | { type: "http-bundle-missing"; hash: string; message: string }
+  | { type: "module-not-found"; message: string }
+  | { type: "unknown"; message: string };
+
+export function classifyImportError(importError: unknown): ImportErrorClassification {
+  const message = importError instanceof Error ? importError.message : String(importError);
+  const bundleMatch = message.match(MISSING_HTTP_BUNDLE_PATTERN);
+  if (bundleMatch?.[1]) {
+    return { type: "http-bundle-missing", hash: bundleMatch[1], message };
+  }
+  if (message.includes("Cannot find module") || message.includes("Module not found")) {
+    return { type: "module-not-found", message };
+  }
+  return { type: "unknown", message };
+}
+
+export function createTransformCapacityError(
+  mode: TransformCapacityErrorMode,
+  message: string,
+  filePath: string,
+): Error {
+  if (mode === "plain") return new Error(message);
+  return toError(
+    createError({
+      type: "build",
+      message,
+      context: { file: filePath, phase: "transform" },
+    }),
+  );
+}

package/src/src/modules/react-loader/ssr-module-loader/loader.ts

@@ -22,6 +22,11 @@ import { rendererLogger } from "../../../utils/index.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { SpanNames } from "../../../observability/tracing/span-names.js";
 import { extractComponent } from "../extract-component.js";
+import {
+  classifyImportError,
+  createTransformCapacityError,
+  type TransformCapacityErrorMode,
+} from "./loader-helpers.js";
 import {
   getMaxConcurrentTransforms,
   IN_PROGRESS_WAIT_TIMEOUT_MS,
@@ -58,15 +63,6 @@ import { ensureMdxModuleDependencies } from "../../../transforms/mdx/esm-module-
 
 const logger = rendererLogger.component("ssr-module-loader");
 
-const MISSING_HTTP_BUNDLE_PATTERN = /veryfront-http-bundle\/http-([a-f0-9]+)\.mjs/;
-
-type TransformCapacityErrorMode = "plain" | "build";
-
-type ImportErrorClassification =
-  | { type: "http-bundle-missing"; hash: string; message: string }
-  | { type: "module-not-found"; message: string }
-  | { type: "unknown"; message: string };
-
 /**
  * SSR Module Loader with Redis Support.
  *
@@ -89,33 +85,6 @@ export class SSRModuleLoader {
     );
   }
 
-  private classifyImportError(importError: unknown): ImportErrorClassification {
-    const message = importError instanceof Error ? importError.message : String(importError);
-    const bundleMatch = message.match(MISSING_HTTP_BUNDLE_PATTERN);
-    if (bundleMatch?.[1]) {
-      return { type: "http-bundle-missing", hash: bundleMatch[1], message };
-    }
-    if (message.includes("Cannot find module") || message.includes("Module not found")) {
-      return { type: "module-not-found", message };
-    }
-    return { type: "unknown", message };
-  }
-
-  private createTransformCapacityError(
-    mode: TransformCapacityErrorMode,
-    message: string,
-    filePath: string,
-  ): Error {
-    if (mode === "plain") return new Error(message);
-    return toError(
-      createError({
-        type: "build",
-        message,
-        context: { file: filePath, phase: "transform" },
-      }),
-    );
-  }
-
   private async withTransformCapacity<T>(
     filePath: string,
     mode: TransformCapacityErrorMode,
@@ -127,7 +96,7 @@ export class SSRModuleLoader {
     let semaphoreAcquired = false;
 
     if (!await tryAcquireTransformSlot(projectId, TRANSFORM_ACQUIRE_TIMEOUT_MS)) {
-      throw this.createTransformCapacityError(
+      throw createTransformCapacityError(
         mode,
         `Project ${projectId} at transform capacity. Consider reducing page complexity or request rate.`,
         filePath,
@@ -138,7 +107,7 @@ export class SSRModuleLoader {
       if (semaphore) {
         semaphoreAcquired = await semaphore.tryAcquire(TRANSFORM_ACQUIRE_TIMEOUT_MS);
         if (!semaphoreAcquired) {
-          throw this.createTransformCapacityError(
+          throw createTransformCapacityError(
             mode,
             `Transform capacity exceeded (${semaphore.waiting} waiting). Service is overloaded.`,
             filePath,
@@ -189,7 +158,7 @@ export class SSRModuleLoader {
         { "ssr.file": fileName },
       )) as Record<string, unknown>;
     } catch (importError) {
-      const classifiedError = this.classifyImportError(importError);
+      const classifiedError = classifyImportError(importError);
 
       if (classifiedError.type === "http-bundle-missing") {
         const hash = classifiedError.hash;

package/src/src/platform/adapters/fs/veryfront/adapter-helpers.ts

@@ -0,0 +1,43 @@
+import type { VeryfrontAPIConfig } from "../../veryfront-api-client/types.js";
+import type { FileCacheOptions } from "../cache/types.js";
+import type { ContentSource, FSAdapterConfig } from "./types.js";
+
+export const DEFAULT_MAX_RETRIES = 3;
+export const DEFAULT_INITIAL_RETRY_DELAY_MS = 1_000;
+export const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
+export const DEFAULT_CACHE_TTL_MS = 60_000;
+export const DEFAULT_CACHE_MAX_ENTRIES = 1_000;
+export const DEFAULT_CACHE_MAX_MEMORY_BYTES = 100 * 1024 * 1024;
+
+type VeryfrontConfigOverrides = NonNullable<FSAdapterConfig["veryfront"]>;
+type RetryOverrides = VeryfrontConfigOverrides["retry"];
+type CacheOverrides = VeryfrontConfigOverrides["cache"];
+
+export function buildRetryConfig(
+  retry?: RetryOverrides,
+): NonNullable<VeryfrontAPIConfig["retry"]> {
+  return {
+    maxRetries: DEFAULT_MAX_RETRIES,
+    initialDelay: DEFAULT_INITIAL_RETRY_DELAY_MS,
+    maxDelay: DEFAULT_MAX_RETRY_DELAY_MS,
+    ...retry,
+  };
+}
+
+export function buildFileCacheOptions(
+  cache?: CacheOverrides,
+): FileCacheOptions {
+  return {
+    enabled: true,
+    ttl: DEFAULT_CACHE_TTL_MS,
+    maxSize: DEFAULT_CACHE_MAX_ENTRIES,
+    maxMemory: DEFAULT_CACHE_MAX_MEMORY_BYTES,
+    ...cache,
+  };
+}
+
+export function shouldBackgroundPregenerateStyles(
+  contentContext: { sourceType: ContentSource["type"] } | null,
+): boolean {
+  return contentContext?.sourceType !== "branch";
+}

package/src/src/platform/adapters/fs/veryfront/adapter.ts

@@ -13,7 +13,6 @@ import type { FileInfo, ResolveFileOptions } from "../../base.js";
 import { VeryfrontApiClient } from "../../veryfront-api-client/index.js";
 import type { Project } from "../../veryfront-api-client/index.js";
 import { FileCache } from "../cache/file-cache.js";
-import type { FileCacheOptions } from "../cache/types.js";
 import { PathNormalizer } from "./path-normalizer.js";
 import { ReadOperations } from "./read-operations.js";
 import { DirectoryOperations } from "./directory-operations.js";
@@ -28,16 +27,14 @@ import {
   summarizeFileList,
   toClientContext,
 } from "./adapter-content-context.js";
+import {
+  buildFileCacheOptions,
+  buildRetryConfig,
+  shouldBackgroundPregenerateStyles,
+} from "./adapter-helpers.js";
 
 const logger = baseLogger.component("veryfront-fs-adapter");
 
-const DEFAULT_MAX_RETRIES = 3;
-const DEFAULT_INITIAL_RETRY_DELAY_MS = 1_000;
-const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
-const DEFAULT_CACHE_TTL_MS = 60_000;
-const DEFAULT_CACHE_MAX_ENTRIES = 1_000;
-const DEFAULT_CACHE_MAX_MEMORY_BYTES = 100 * 1024 * 1024;
-
 export class VeryfrontFSAdapter implements FSAdapter {
   private client: VeryfrontApiClient;
   private cache: FileCache;
@@ -126,12 +123,7 @@ export class VeryfrontFSAdapter implements FSAdapter {
     this.contentSource = vf.contentSource ?? { type: "branch", branch: "main" };
     this.proxyMode = vf.proxyMode ?? false;
 
-    const retryConfig = {
-      maxRetries: DEFAULT_MAX_RETRIES,
-      initialDelay: DEFAULT_INITIAL_RETRY_DELAY_MS,
-      maxDelay: DEFAULT_MAX_RETRY_DELAY_MS,
-      ...vf.retry,
-    };
+    const retryConfig = buildRetryConfig(vf.retry);
 
     this.client = new VeryfrontApiClient({
       apiBaseUrl: this.apiBaseUrl,
@@ -142,13 +134,7 @@ export class VeryfrontFSAdapter implements FSAdapter {
       retry: retryConfig,
     });
 
-    const cacheConfig: FileCacheOptions = {
-      enabled: true,
-      ttl: DEFAULT_CACHE_TTL_MS,
-      maxSize: DEFAULT_CACHE_MAX_ENTRIES,
-      maxMemory: DEFAULT_CACHE_MAX_MEMORY_BYTES,
-      ...vf.cache,
-    };
+    const cacheConfig = buildFileCacheOptions(vf.cache);
 
     this.cache = new FileCache(cacheConfig);
     this.normalizer = new PathNormalizer(config.projectDir);
@@ -396,7 +382,7 @@ export class VeryfrontFSAdapter implements FSAdapter {
     // Branch previews should recover the last registered stylesheet artifact on
     // cold starts before rebuilding CSS locally. Live edit pokes still
     // pregenerate through the WebSocket path after branch content changes.
-    return this.contentContext?.sourceType !== "branch";
+    return shouldBackgroundPregenerateStyles(this.contentContext);
   }
 
   private scheduleFileListWarmup(reason: string, cacheKey?: string): void {

package/src/src/platform/adapters/fs/veryfront/read-operations-helpers.ts

@@ -80,6 +80,10 @@ export function getResolvedCacheKey(
   return `${cacheKeyPrefix}:${normalizedResolvedPath}`;
 }
 
+export function buildContentPreview(content: string, max = 80): string {
+  return content.length > max ? `${content.slice(0, max)}...` : content;
+}
+
 export function buildExtensionCandidatePaths(basePath: string): string[] {
   return READ_OPERATION_EXTENSION_PRIORITY.map((ext) => `${basePath}${ext}`);
 }

package/src/src/platform/adapters/fs/veryfront/read-operations.ts

@@ -10,6 +10,7 @@ import { PathNormalizer } from "./path-normalizer.js";
 import type { ContentContextProvider } from "./file-list-access.js";
 import {
   assertProjectSourcePath,
+  buildContentPreview,
   buildExtensionCandidatePaths,
   buildReadFetchState,
   createNotFoundLikeError,
@@ -33,10 +34,6 @@ const IN_FLIGHT_REQUEST_TIMEOUT_MS = 15_000;
 const MAX_IN_FLIGHT_REQUESTS = 100;
 const IN_FLIGHT_CLEANUP_INTERVAL_MS = 1_000;
 
-function previewText(content: string, max = 80): string {
-  return content.length > max ? `${content.slice(0, max)}...` : content;
-}
-
 export class ReadOperations {
   private readonly inFlightRequests = new InFlightRequestDeduper<string>({
     timeoutMs: IN_FLIGHT_REQUEST_TIMEOUT_MS,
@@ -110,7 +107,7 @@ export class ReadOperations {
       path: normalizedPath,
       cacheKey,
       contentLength: requestCached.length,
-      preview: previewText(requestCached).replace(/\n/g, "\\n"),
+      preview: buildContentPreview(requestCached).replace(/\n/g, "\\n"),
     });
     return requestCached;
   }
@@ -151,7 +148,7 @@ export class ReadOperations {
       path: normalizedPath,
       cacheKey,
       contentLength: cached.length,
-      preview: previewText(cached).replace(/\n/g, "\\n"),
+      preview: buildContentPreview(cached).replace(/\n/g, "\\n"),
     });
     setRequestScopedFile(cacheKey, cached);
     return cached;
@@ -772,7 +769,7 @@ export class ReadOperations {
     logger.debug("API_FETCH_DONE - got content from API", {
       path: normalizedPath,
       contentLength: content.length,
-      preview: previewText(content).replace(/\n/g, "\\n"),
+      preview: buildContentPreview(content).replace(/\n/g, "\\n"),
       willCache: shouldCache,
     });
 

package/src/src/platform/adapters/fs/veryfront/websocket-manager-helpers.ts

@@ -0,0 +1,73 @@
+import type { ContentSource, ResolvedContentContext } from "./types.js";
+import { buildFileCacheKeyPrefix } from "./cache-keys.js";
+
+export const INVALIDATION_DEBOUNCE_MS = 100;
+export const WS_RECONNECT_DELAY_MS = 5000;
+export const WS_RECONNECT_MAX_DELAY_MS = 120000;
+export const WS_RECONNECT_MAX_FAILURES = 10;
+export const WS_HEARTBEAT_INTERVAL_MS = 60000;
+export const WS_HEARTBEAT_TIMEOUT_MS = 300000;
+
+export interface PreviewStyleArtifactInfo {
+  hash: string;
+  assetPath: string;
+}
+
+export function getConnectionLogContext(
+  projectSlug: string | undefined,
+  context: Record<string, unknown> = {},
+): Record<string, unknown> {
+  if (!projectSlug) return context;
+  return { projectSlug, ...context };
+}
+
+export function getPreviewInvalidationPrefixes(
+  contentContext: ResolvedContentContext | null,
+): string[] {
+  if (contentContext?.sourceType !== "branch") return [];
+  return [buildFileCacheKeyPrefix(contentContext)];
+}
+
+export function getReconnectDelay(consecutiveFailures: number): number {
+  const delay = WS_RECONNECT_DELAY_MS * Math.pow(2, consecutiveFailures - 1);
+  return Math.min(delay, WS_RECONNECT_MAX_DELAY_MS);
+}
+
+export function buildReloadProjectContext(
+  contentContext: ResolvedContentContext | null,
+  projectSlug: string,
+  projectId: string,
+  preparedStyleArtifact?: PreviewStyleArtifactInfo,
+): {
+  projectSlug: string;
+  projectId: string;
+  environment: "preview" | "production";
+  branch: string | null;
+  releaseId: string | null;
+  styleArtifactHash: string | undefined;
+  styleAssetPath: string | undefined;
+} {
+  const environment: "preview" | "production" = contentContext?.sourceType === "branch"
+    ? "preview"
+    : "production";
+
+  return {
+    projectSlug,
+    projectId,
+    environment,
+    branch: contentContext?.branch ?? null,
+    releaseId: contentContext?.releaseId ?? null,
+    styleArtifactHash: preparedStyleArtifact?.hash,
+    styleAssetPath: preparedStyleArtifact?.assetPath,
+  };
+}
+
+export function buildContentSourceLabel(
+  getContentSource: () => ContentSource,
+  getContentContext: () => ResolvedContentContext | null,
+): { contentSource: ContentSource; branch: string | null } {
+  return {
+    contentSource: getContentSource(),
+    branch: getContentContext()?.branch ?? null,
+  };
+}

package/src/src/platform/adapters/fs/veryfront/websocket-manager.ts

@@ -14,23 +14,24 @@ import {
   getPendingInvalidationsCount,
   removePendingInvalidation,
 } from "./invalidation-state.js";
+import {
+  buildContentSourceLabel,
+  buildReloadProjectContext,
+  getConnectionLogContext as getConnectionLogContextHelper,
+  getPreviewInvalidationPrefixes as getPreviewInvalidationPrefixesHelper,
+  getReconnectDelay as getReconnectDelayHelper,
+  INVALIDATION_DEBOUNCE_MS,
+  type PreviewStyleArtifactInfo,
+  WS_HEARTBEAT_INTERVAL_MS,
+  WS_HEARTBEAT_TIMEOUT_MS,
+  WS_RECONNECT_MAX_DELAY_MS,
+  WS_RECONNECT_MAX_FAILURES,
+} from "./websocket-manager-helpers.js";
 
 const logger = getBaseLogger("SERVER", { injectTraceContext: false }).component(
   "web-socket-manager",
 );
 
-const INVALIDATION_DEBOUNCE_MS = 100;
-const WS_RECONNECT_DELAY_MS = 5000;
-const WS_RECONNECT_MAX_DELAY_MS = 120000;
-const WS_RECONNECT_MAX_FAILURES = 10;
-const WS_HEARTBEAT_INTERVAL_MS = 60000;
-const WS_HEARTBEAT_TIMEOUT_MS = 300000;
-
-interface PreviewStyleArtifactInfo {
-  hash: string;
-  assetPath: string;
-}
-
 interface WebSocketDeps {
   apiBaseUrl: string;
   apiToken: string;
@@ -77,15 +78,13 @@ export class WebSocketManager {
   constructor(private readonly deps: WebSocketDeps) {}
 
   private getConnectionLogContext(context: Record<string, unknown> = {}): Record<string, unknown> {
-    if (!this.deps.projectSlug) return context;
-    return { projectSlug: this.deps.projectSlug, ...context };
+    return getConnectionLogContextHelper(this.deps.projectSlug, context);
   }
 
   private getPreviewInvalidationPrefixes(
     contentContext: ResolvedContentContext | null,
   ): string[] {
-    if (contentContext?.sourceType !== "branch") return [];
-    return [buildFileCacheKeyPrefix(contentContext)];
+    return getPreviewInvalidationPrefixesHelper(contentContext);
   }
 
   private beginPreviewInvalidation(contentContext: ResolvedContentContext | null): void {
@@ -169,8 +168,7 @@ export class WebSocketManager {
           this.getConnectionLogContext({
             projectId,
             connectionId: this.wsConnectionId,
-            contentSource: this.deps.getContentSource(),
-            branch: this.deps.getContentContext()?.branch,
+            ...buildContentSourceLabel(this.deps.getContentSource, this.deps.getContentContext),
           }),
         );
         this.wsLastPong = Date.now();
@@ -233,8 +231,7 @@ export class WebSocketManager {
 
   private getReconnectDelay(): number {
     // Exponential backoff: 5s, 10s, 20s, 40s, 80s, capped at 120s
-    const delay = WS_RECONNECT_DELAY_MS * Math.pow(2, this.wsConsecutiveFailures - 1);
-    return Math.min(delay, WS_RECONNECT_MAX_DELAY_MS);
+    return getReconnectDelayHelper(this.wsConsecutiveFailures);
   }
 
   dispose(): void {
@@ -664,18 +661,12 @@ export class WebSocketManager {
         },
       );
 
-      const environment: "preview" | "production" = contentContext?.sourceType === "branch"
-        ? "preview"
-        : "production";
-      const projectContext = {
-        projectSlug: this.deps.projectSlug,
-        projectId: this.deps.client.getProjectId(),
-        environment,
-        branch: contentContext?.branch ?? null,
-        releaseId: contentContext?.releaseId ?? null,
-        styleArtifactHash: preparedStyleArtifact?.hash,
-        styleAssetPath: preparedStyleArtifact?.assetPath,
-      };
+      const projectContext = buildReloadProjectContext(
+        contentContext,
+        this.deps.projectSlug,
+        this.deps.client.getProjectId(),
+        preparedStyleArtifact,
+      );
 
       this.deps.invalidationCallbacks.triggerReload?.(changedPaths, projectContext);
 
@@ -806,18 +797,12 @@ export class WebSocketManager {
         hasTriggerReloadCallback: !!this.deps.invalidationCallbacks.triggerReload,
       });
 
-      const environment: "preview" | "production" = contentContext?.sourceType === "branch"
-        ? "preview"
-        : "production";
-      const projectContext = {
-        projectSlug: this.deps.projectSlug,
-        projectId: this.deps.client.getProjectId(),
-        environment,
-        branch: contentContext?.branch ?? null,
-        releaseId: contentContext?.releaseId ?? null,
-        styleArtifactHash: preparedStyleArtifact?.hash,
-        styleAssetPath: preparedStyleArtifact?.assetPath,
-      };
+      const projectContext = buildReloadProjectContext(
+        contentContext,
+        this.deps.projectSlug,
+        this.deps.client.getProjectId(),
+        preparedStyleArtifact,
+      );
 
       this.deps.invalidationCallbacks.triggerReload?.(undefined, projectContext);