veryfront 0.1.75 → 0.1.77

package/esm/src/security/sandbox/worker-permissions.js

@@ -11,6 +11,19 @@
  * See: https://docs.deno.com/runtime/fundamentals/permissions/
  */
 import * as dntShim from "../../../_dnt.shims.js";
+// Cache compiled binary check — Deno.execPath() is a syscall that never changes at runtime
+const _isCompiledBinary = (() => {
+    try {
+        const exec = typeof dntShim.Deno !== "undefined" ? dntShim.Deno.execPath?.() : undefined;
+        if (!exec)
+            return false;
+        const name = exec.split(/[/\\]/).pop()?.toLowerCase() ?? "";
+        return name !== "deno" && name !== "deno.exe";
+    }
+    catch {
+        return false;
+    }
+})();
 /**
  * Build scoped permissions for a project worker.
  *
@@ -27,26 +40,16 @@ export function buildWorkerPermissions(readPaths) {
     // is outside the project directory. Rather than trying to enumerate all
     // read paths, grant full read access — the security boundary is enforced
     // by denying write/run/ffi/sys, not by restricting reads.
-    // Check for compiled binary by testing if execPath is NOT "deno"/"deno.exe"
-    try {
-        const exec = typeof dntShim.Deno !== "undefined" ? dntShim.Deno.execPath?.() : undefined;
-        if (exec) {
-            const name = exec.split(/[/\\]/).pop()?.toLowerCase() ?? "";
-            if (name !== "deno" && name !== "deno.exe") {
-                return {
-                    read: true,
-                    write: false,
-                    net: true,
-                    env: true,
-                    run: false,
-                    ffi: false,
-                    sys: false,
-                };
-            }
-        }
-    }
-    catch {
-        // execPath may not be available
+    if (_isCompiledBinary) {
+        return {
+            read: true,
+            write: false,
+            net: true,
+            env: true,
+            run: false,
+            ffi: false,
+            sys: false,
+        };
     }
     return {
         read: readPaths.length > 0 ? readPaths : false,

package/esm/src/security/sandbox/worker-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-pool.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWzF,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAmB;IAEjC,OAAO,CAAC,eAAe,CAAqD;IAC5E,OAAO,CAAC,mBAAmB,CAAqD;gBAEpE,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAMlD;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa;IA0CxE;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC;IAkD1B;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUpC;;OAEG;IACH,QAAQ,IAAI;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;KACJ;IA4BD;;OAEG;IACH,UAAU,IAAI;QACZ,uCAAuC;QACvC,cAAc,EAAE,MAAM,CAAC;QACvB,oDAAoD;QACpD,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kDAAkD;QAClD,sBAAsB,EAAE,MAAM,CAAC;QAC/B,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,cAAc,EAAE,MAAM,CAAC;KACxB;IAoBD;;OAEG;IACH,QAAQ,IAAI,IAAI;IAgBhB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,aAAa;YA4BP,WAAW;IAmBzB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;CA8BjC;AAqBD;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAKD,wBAAgB,aAAa,IAAI,UAAU,CAiB1C;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C"}
+{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-pool.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWzF,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAmB;IAEjC,OAAO,CAAC,eAAe,CAAqD;IAC5E,OAAO,CAAC,mBAAmB,CAAqD;gBAEpE,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAMlD;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa;IA0CxE;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC;IA0D1B;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUpC;;OAEG;IACH,QAAQ,IAAI;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;KACJ;IA4BD;;OAEG;IACH,UAAU,IAAI;QACZ,uCAAuC;QACvC,cAAc,EAAE,MAAM,CAAC;QACvB,oDAAoD;QACpD,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kDAAkD;QAClD,sBAAsB,EAAE,MAAM,CAAC;QAC/B,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,cAAc,EAAE,MAAM,CAAC;KACxB;IAoBD;;OAEG;IACH,QAAQ,IAAI,IAAI;IAgBhB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,aAAa;YA4BP,WAAW;IAmBzB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;CA8BjC;AAqBD;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAKD,wBAAgB,aAAa,IAAI,UAAU,CAiB1C;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C"}

package/esm/src/security/sandbox/worker-pool.js

@@ -85,22 +85,25 @@ export class WorkerPool {
                 (entry && Date.now() - entry.createdAt > this.config.maxWorkerAgeMs);
             if (shouldRecycle && !this.recycling.has(projectId)) {
                 this.recycling.add(projectId);
-                try {
-                    logger.debug("Recycling worker", {
-                        projectId,
-                        requestCount: worker.requestCount,
-                        ageMs: entry ? Date.now() - entry.createdAt : 0,
-                        reason: worker.requestCount >= this.config.maxRequestsPerWorker
-                            ? "request_count"
-                            : "age",
-                    });
+                logger.debug("Recycling worker", {
+                    projectId,
+                    requestCount: worker.requestCount,
+                    ageMs: entry ? Date.now() - entry.createdAt : 0,
+                    reason: worker.requestCount >= this.config.maxRequestsPerWorker
+                        ? "request_count"
+                        : "age",
+                });
+                // Warm replacement: let the old worker handle this last request,
+                // then evict it and create a replacement after the request settles.
+                // This avoids cold-start latency for the caller AND prevents the
+                // old worker from being terminated while it still has pending work.
+                const result = worker.execute(request);
+                void result.finally(() => {
                     this.evictWorker(projectId);
-                    const fresh = this.getOrCreateWorker(projectId, readPaths);
-                    return fresh.execute(request);
-                }
-                finally {
+                    this.getOrCreateWorker(projectId, readPaths);
                     this.recycling.delete(projectId);
-                }
+                });
+                return result;
             }
             return worker.execute(request);
         }, { "workerPool.projectId": projectId });

package/esm/src/security/sandbox/worker-types.d.ts

@@ -161,5 +161,7 @@ export interface WorkerPoolConfig {
     /** Per-worker memory budget in MB (default: 64). Workers exceeding this are evicted. */
     memoryBudgetMb: number;
 }
+/** Maximum request body size for worker isolation (10 MB) */
+export declare const MAX_WORKER_BODY_BYTES: number;
 export declare const DEFAULT_WORKER_POOL_CONFIG: WorkerPoolConfig;
 //# sourceMappingURL=worker-types.d.ts.map

package/esm/src/security/sandbox/worker-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-types.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC7B;AAMD,MAAM,MAAM,aAAa,GACrB,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,8BAA8B;IAC9B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,wBAAwB,GACxB,uBAAuB,GACvB,mBAAmB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;CACxB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,0BAA0B,EAAE,gBAQxC,CAAC"}
+{"version":3,"file":"worker-types.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC7B;AAMD,MAAM,MAAM,aAAa,GACrB,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,8BAA8B;IAC9B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,wBAAwB,GACxB,uBAAuB,GACvB,mBAAmB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;CACxB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD,eAAO,MAAM,0BAA0B,EAAE,gBAQxC,CAAC"}

package/esm/src/security/sandbox/worker-types.js

@@ -6,6 +6,8 @@
  *
  * @module security/sandbox/worker-types
  */
+/** Maximum request body size for worker isolation (10 MB) */
+export const MAX_WORKER_BODY_BYTES = 10 * 1024 * 1024;
 export const DEFAULT_WORKER_POOL_CONFIG = {
     maxPoolSize: 20,
     idleTimeoutMs: 300_000,

package/esm/src/task/types.d.ts

@@ -24,6 +24,12 @@ export interface TaskDefinition {
     name?: string;
     /** Task description */
     description?: string;
+    /** Optional JSON-schema-like input contract surfaced in APIs/UIs */
+    inputSchema?: Record<string, unknown>;
+    /** Optional JSON-schema-like output contract surfaced in APIs/UIs */
+    outputSchema?: Record<string, unknown>;
+    /** Whether this task can be scheduled via cron jobs */
+    schedulable?: boolean;
     /** The function to execute */
     run: (ctx: TaskContext) => Promise<unknown> | unknown;
 }

package/esm/src/task/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/src/task/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAIxE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/src/task/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAIxE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -76,6 +76,9 @@
     "./resource": {
       "import": "./esm/src/resource/index.js"
     },
+    "./jobs": {
+      "import": "./esm/src/jobs/index.js"
+    },
     "./mcp": {
       "import": "./esm/src/mcp/index.js"
     },
@@ -149,6 +152,7 @@
     "esbuild": "0.20.2",
     "github-slugger": "2.0.0",
     "gray-matter": "4.0.3",
+    "jose": "5.9.6",
     "mdast-util-to-string": "4.0.0",
     "mime-types": "2.1.35",
     "react": "19.1.1",

package/src/cli/commands/pull/command.ts

@@ -159,7 +159,7 @@ export function buildFilesListUrl(projectSlug: string, source: PullSource): stri
     case "release":
       return `/projects/${projectSlug}/releases/${encodeURIComponent(source.version)}/files`;
     case "branch":
-      return `/projects/${projectSlug}/branches/${encodeURIComponent(source.name)}/files`;
+      return `/projects/${projectSlug}/files?branch=${encodeURIComponent(source.name)}`;
     case "main":
       return `/projects/${projectSlug}/files`;
   }
@@ -211,9 +211,9 @@ export function buildFileContentUrl(projectSlug: string, path: string, source: P
         encodeURIComponent(source.version)
       }/files/${encodedPath}`;
     case "branch":
-      return `/projects/${projectSlug}/branches/${
+      return `/projects/${projectSlug}/files/${encodedPath}?branch=${
         encodeURIComponent(source.name)
-      }/files/${encodedPath}`;
+      }`;
     case "main":
       return `/projects/${projectSlug}/files/${encodedPath}`;
   }

package/src/cli/commands/task/command.ts

@@ -9,14 +9,12 @@ import * as dntShim from "../../../_dnt.shims.js";
 
 import { cliLogger } from "../../utils/index.js";
 import { exitProcess } from "../../utils/index.js";
+import { withProjectSourceContext } from "../../shared/project-source-context.js";
 import type { TaskArgs } from "./handler.js";
 
 export interface TaskOptions extends TaskArgs {}
 
 export async function taskCommand(options: TaskOptions): Promise<void> {
-  const { getAdapter } = await import(
-    "../../../src/platform/adapters/detect.js"
-  );
   const { discoverTasks } = await import(
     "../../../src/task/discovery.js"
   );
@@ -32,67 +30,78 @@ export async function taskCommand(options: TaskOptions): Promise<void> {
   }
 
   const projectDir = dntShim.Deno.cwd();
-  const adapter = await getAdapter();
+  await withProjectSourceContext(
+    projectDir,
+    async ({ adapter, config, projectId, proxyContext }) => {
+      const sourceLabel = proxyContext?.branchRef
+        ? `branch ${proxyContext.branchRef}`
+        : proxyContext
+        ? "main"
+        : `${projectDir}/tasks/...`;
 
-  cliLogger.info(`Discovering tasks in ${projectDir}/tasks/...`);
+      cliLogger.info(`Discovering tasks in ${sourceLabel}`);
 
-  const { tasks, errors } = await discoverTasks({
-    projectDir,
-    adapter,
-    debug: options.debug,
-  });
+      const { tasks, errors } = await discoverTasks({
+        projectDir,
+        adapter,
+        config,
+        debug: options.debug,
+      });
 
-  if (errors.length > 0 && options.debug) {
-    for (const err of errors) {
-      cliLogger.warn(`  Warning: ${err.filePath}: ${err.error}`);
-    }
-  }
+      if (errors.length > 0 && options.debug) {
+        for (const err of errors) {
+          cliLogger.warn(`  Warning: ${err.filePath}: ${err.error}`);
+        }
+      }
 
-  const task = tasks.find((t) => t.id === taskName);
-  if (!task) {
-    cliLogger.error(`Task "${taskName}" not found.`);
-    if (tasks.length > 0) {
-      cliLogger.info("Available tasks:");
-      for (const t of tasks) {
-        cliLogger.info(`  - ${t.id}${t.name !== t.id ? ` (${t.name})` : ""}`);
+      const task = tasks.find((t) => t.id === taskName);
+      if (!task) {
+        cliLogger.error(`Task "${taskName}" not found.`);
+        if (tasks.length > 0) {
+          cliLogger.info("Available tasks:");
+          for (const t of tasks) {
+            cliLogger.info(`  - ${t.id}${t.name !== t.id ? ` (${t.name})` : ""}`);
+          }
+        } else {
+          cliLogger.info("No tasks found. Create a task file in tasks/ directory:");
+          cliLogger.info("  tasks/my-task.ts");
+        }
+        exitProcess(1);
+        return;
       }
-    } else {
-      cliLogger.info("No tasks found. Create a task file in tasks/ directory:");
-      cliLogger.info("  tasks/my-task.ts");
-    }
-    exitProcess(1);
-    return;
-  }
 
-  // Parse config JSON if provided
-  let config: Record<string, unknown> = {};
-  if (options.config) {
-    try {
-      config = JSON.parse(options.config);
-    } catch {
-      cliLogger.error("Invalid --config JSON");
-      exitProcess(1);
-      return;
-    }
-  }
+      let taskConfig: Record<string, unknown> = {};
+      if (options.config) {
+        try {
+          taskConfig = JSON.parse(options.config);
+        } catch {
+          cliLogger.error("Invalid --config JSON");
+          exitProcess(1);
+          return;
+        }
+      }
 
-  cliLogger.info(`Running task: ${task.name} (${task.id})`);
-  cliLogger.info("");
+      cliLogger.info(`Running task: ${task.name} (${task.id})`);
+      cliLogger.info("");
 
-  const result = await runTask({
-    task,
-    config,
-    debug: options.debug,
-  });
+      const result = await runTask({
+        task,
+        config: taskConfig,
+        projectId,
+        debug: options.debug,
+      });
 
-  cliLogger.info("");
-  if (result.success) {
-    cliLogger.info(`Task completed in ${result.durationMs}ms`);
-    if (result.result !== undefined) {
-      cliLogger.info(`Result: ${JSON.stringify(result.result, null, 2)}`);
-    }
-  } else {
-    cliLogger.error(`Task failed after ${result.durationMs}ms: ${result.error}`);
-    exitProcess(1);
-  }
+      cliLogger.info("");
+      if (result.success) {
+        cliLogger.info(`Task completed in ${result.durationMs}ms`);
+        if (result.result !== undefined) {
+          cliLogger.info(`Result: ${JSON.stringify(result.result, null, 2)}`);
+        }
+        return;
+      }
+
+      cliLogger.error(`Task failed after ${result.durationMs}ms: ${result.error}`);
+      exitProcess(1);
+    },
+  );
 }

package/src/cli/commands/workflow/command-help.ts

@@ -0,0 +1,21 @@
+import type { CommandHelp } from "../../help/types.js";
+
+export const workflowHelp: CommandHelp = {
+  name: "workflow",
+  description: "Run a workflow from the app/workflows directory",
+  usage: "veryfront workflow run <id> [options]",
+  options: [
+    {
+      flag: "--input <json>",
+      description: "JSON input to pass to the workflow",
+    },
+    {
+      flag: "--debug",
+      description: "Enable debug logging",
+    },
+  ],
+  examples: [
+    "veryfront workflow run publish-site",
+    'veryfront workflow run content-pipeline --input \'{"topic":"AI"}\'',
+  ],
+};

package/src/cli/commands/workflow/command.ts

@@ -0,0 +1,152 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import { cliLogger } from "../../utils/index.js";
+import { exitProcess } from "../../utils/index.js";
+import { withProjectSourceContext } from "../../shared/project-source-context.js";
+import { getEnv } from "../../../src/platform/index.js";
+import type { WorkflowArgs } from "./handler.js";
+
+const WORKFLOW_STATUS_POLL_INTERVAL_MS = 1_000;
+
+export interface WorkflowOptions extends WorkflowArgs {}
+
+async function createWorkflowClient(debug: boolean) {
+  const { createWorkflowClient } = await import(
+    "../../../src/workflow/api/workflow-client.js"
+  );
+
+  const redisUrl = getEnv("REDIS_URL")?.trim();
+  if (!redisUrl) {
+    return createWorkflowClient({ debug });
+  }
+
+  const { RedisBackend } = await import(
+    "../../../src/workflow/backends/redis.js"
+  );
+
+  const backend = new RedisBackend({ url: redisUrl, debug });
+  if (backend.initialize) {
+    await backend.initialize();
+  }
+
+  return createWorkflowClient({ backend, debug });
+}
+
+async function waitForWorkflowExit(
+  client: Awaited<ReturnType<typeof createWorkflowClient>>,
+  runId: string,
+): Promise<void> {
+  while (true) {
+    const run = await client.getRun(runId);
+    if (!run) {
+      throw new Error(`Workflow run not found: ${runId}`);
+    }
+
+    if (run.status === "completed") {
+      cliLogger.info(`Workflow completed: ${runId}`);
+      if (run.output !== undefined) {
+        cliLogger.info(`Result: ${JSON.stringify(run.output, null, 2)}`);
+      }
+      return;
+    }
+
+    if (run.status === "waiting") {
+      cliLogger.info(`Workflow is waiting: ${runId}`);
+      return;
+    }
+
+    if (run.status === "failed") {
+      throw new Error(run.error?.message || `Workflow failed: ${runId}`);
+    }
+
+    if (run.status === "cancelled") {
+      throw new Error(`Workflow was cancelled: ${runId}`);
+    }
+
+    await new Promise((resolve) => dntShim.setTimeout(resolve, WORKFLOW_STATUS_POLL_INTERVAL_MS));
+  }
+}
+
+export async function workflowCommand(options: WorkflowOptions): Promise<void> {
+  if (options.action !== "run") {
+    cliLogger.error(`Unknown workflow action: ${options.action}`);
+    exitProcess(1);
+    return;
+  }
+
+  const workflowId = options.name;
+  if (!workflowId) {
+    cliLogger.error("Workflow ID is required. Usage: veryfront workflow run <id>");
+    exitProcess(1);
+    return;
+  }
+
+  let input: Record<string, unknown> = {};
+  if (options.input) {
+    try {
+      input = JSON.parse(options.input);
+    } catch {
+      cliLogger.error("Invalid --input JSON");
+      exitProcess(1);
+      return;
+    }
+  }
+
+  const { discoverWorkflows } = await import(
+    "../../../src/workflow/discovery/index.js"
+  );
+
+  await withProjectSourceContext(dntShim.Deno.cwd(), async ({ adapter, config, proxyContext }) => {
+    const sourceLabel = proxyContext?.branchRef
+      ? `branch ${proxyContext.branchRef}`
+      : proxyContext
+      ? "main"
+      : `${dntShim.Deno.cwd()}/app/workflows/...`;
+
+    cliLogger.info(`Discovering workflows in ${sourceLabel}`);
+
+    const discovery = await discoverWorkflows({
+      projectDir: dntShim.Deno.cwd(),
+      adapter,
+      config,
+      debug: options.debug,
+    });
+
+    if (discovery.errors.length > 0 && options.debug) {
+      for (const err of discovery.errors) {
+        cliLogger.warn(`  Warning: ${err.filePath}: ${err.error}`);
+      }
+    }
+
+    const workflow = discovery.workflows.find((candidate) => candidate.id === workflowId);
+    if (!workflow) {
+      cliLogger.error(`Workflow "${workflowId}" not found.`);
+      if (discovery.workflows.length > 0) {
+        cliLogger.info("Available workflows:");
+        for (const candidate of discovery.workflows) {
+          cliLogger.info(`  - ${candidate.id}`);
+        }
+      } else {
+        cliLogger.info("No workflows found. Create a workflow file in app/workflows/.");
+      }
+      exitProcess(1);
+      return;
+    }
+
+    const client = await createWorkflowClient(options.debug);
+
+    try {
+      client.register(workflow.definition);
+      cliLogger.info(`Running workflow: ${workflow.id}`);
+      cliLogger.info("");
+
+      const handle = await client.start(workflow.id, input);
+      await waitForWorkflowExit(client, handle.runId);
+    } finally {
+      await client.destroy();
+    }
+  }).catch((error: unknown) => {
+    const message = error instanceof Error ? error.message : String(error);
+    cliLogger.error(message);
+    exitProcess(1);
+  });
+}

package/src/cli/commands/workflow/handler.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { createArgParser, parseArgsOrThrow } from "../../shared/args.js";
+import type { ParsedArgs } from "../../shared/types.js";
+
+const WorkflowArgsSchema = z.object({
+  action: z.enum(["run"]),
+  name: z.string(),
+  input: z.string().optional(),
+  debug: z.boolean().default(false),
+});
+
+export type WorkflowArgs = z.infer<typeof WorkflowArgsSchema>;
+
+export const parseWorkflowArgs = createArgParser(WorkflowArgsSchema, {
+  action: { keys: ["action"], type: "string", positional: 0 },
+  name: { keys: ["name"], type: "string", positional: 1 },
+  input: { keys: ["input"], type: "string" },
+  debug: { keys: ["debug"], type: "boolean" },
+});
+
+export async function handleWorkflowCommand(args: ParsedArgs): Promise<void> {
+  const opts = parseArgsOrThrow(parseWorkflowArgs, "workflow", args);
+  const { workflowCommand } = await import("./command.js");
+  await workflowCommand(opts);
+}

package/src/cli/help/command-definitions.ts

@@ -36,6 +36,7 @@ import { mcpHelp } from "../commands/mcp/command-help.js";
 import { issuesHelp } from "../commands/issues/command-help.js";
 import { startHelp } from "../commands/start/command-help.js";
 import { taskHelp } from "../commands/task/command-help.js";
+import { workflowHelp } from "../commands/workflow/command-help.js";
 
 /**
  * Central registry of all command help definitions.
@@ -71,4 +72,5 @@ export const COMMANDS: CommandRegistry = {
   issues: issuesHelp,
   start: startHelp,
   task: taskHelp,
+  workflow: workflowHelp,
 };

package/src/cli/router.ts

@@ -31,6 +31,7 @@ import { handleStartCommand } from "./commands/start/handler.js";
 import { handleStudioCommand } from "./commands/studio/handler.js";
 import { handleUpCommand } from "./commands/up/index.js";
 import { handleTaskCommand } from "./commands/task/handler.js";
+import { handleWorkflowCommand } from "./commands/workflow/handler.js";
 import { handleWorkerCommand } from "./commands/worker/handler.js";
 import { login, logout, whoami } from "./auth/index.js";
 import { parseLoginMethod } from "./auth/utils.js";
@@ -81,6 +82,7 @@ const commands: Record<string, (args: ParsedArgs) => Promise<void>> = {
   "issues": handleIssuesCommand,
   "start": handleStartCommand,
   "task": handleTaskCommand,
+  "workflow": handleWorkflowCommand,
   "worker": handleWorkerCommand,
 };