veryfront 0.1.75 → 0.1.77

package/src/src/platform/adapters/veryfront-api-client/operations.ts

@@ -154,14 +154,13 @@ export class VeryfrontAPIOperations {
 
   async listBranchFiles(
     projectRef: string,
-    branchName = "main",
+    branchRef = "main",
     options: ListFilesOptions = {},
   ): Promise<FileListResult> {
     const params = buildListParams(options);
-    const url = `/projects/${encodeURIComponent(projectRef)}/branches/${
-      encodeURIComponent(branchName)
-    }/files?${params}`;
-    logger.debug("listBranchFiles", { projectRef, branchName, pattern: options.pattern });
+    params.set("branch", branchRef);
+    const url = `/projects/${encodeURIComponent(projectRef)}/files?${params}`;
+    logger.debug("listBranchFiles", { projectRef, branchRef, pattern: options.pattern });
 
     const raw = await this.request(url);
     const response = ListBranchFilesResponseSchema.parse(raw);
@@ -174,11 +173,11 @@ export class VeryfrontAPIOperations {
 
   async listAllBranchFiles(
     projectRef: string,
-    branchName = "main",
+    branchRef = "main",
     options: Omit<ListFilesOptions, "cursor"> = {},
   ): Promise<ProjectFile[]> {
     const allFiles = await listAllFiles((cursor) =>
-      this.listBranchFiles(projectRef, branchName, {
+      this.listBranchFiles(projectRef, branchRef, {
         ...options,
         cursor,
         limit: DEFAULT_PAGE_LIMIT,
@@ -187,21 +186,22 @@ export class VeryfrontAPIOperations {
 
     logger.debug("listAllBranchFiles DONE", {
       projectRef,
-      branchName,
+      branchRef,
       totalFiles: allFiles.length,
     });
 
     return allFiles;
   }
 
-  getBranchFile(projectRef: string, branchName: string, pathOrId: string): Promise<FileDetail> {
+  getBranchFile(projectRef: string, branchRef: string, pathOrId: string): Promise<FileDetail> {
     return withSpan(
       SpanNames.API_GET_FILE,
       async () => {
-        const url = `/projects/${encodeURIComponent(projectRef)}/branches/${
-          encodeURIComponent(branchName)
-        }/files/${encodeURIComponent(pathOrId)}`;
-        logger.debug("getBranchFile", { projectRef, branchName, pathOrId });
+        const params = new URLSearchParams({ branch: branchRef });
+        const url = `/projects/${encodeURIComponent(projectRef)}/files/${
+          encodeURIComponent(pathOrId)
+        }?${params}`;
+        logger.debug("getBranchFile", { projectRef, branchRef, pathOrId });
 
         const raw = await this.request(url);
         const response = BranchFileDetailSchema.parse(raw);
@@ -217,7 +217,7 @@ export class VeryfrontAPIOperations {
       {
         "api.operation": "getBranchFile",
         "api.project": projectRef,
-        "api.branch": branchName,
+        "api.branch": branchRef,
         "api.path": pathOrId,
       },
     );

package/src/src/platform/adapters/veryfront-api-client/retry-handler.ts

@@ -18,6 +18,9 @@ export interface RequestOptions {
   returnText?: boolean;
   /** Request timeout in milliseconds. Defaults to 30000ms (30 seconds). */
   timeoutMs?: number;
+  method?: string;
+  body?: dntShim.BodyInit | null;
+  headers?: dntShim.HeadersInit;
 }
 
 /** Default timeout for API requests (30 seconds) */
@@ -48,13 +51,19 @@ export async function requestWithRetry(
         async () => {
           const startTime = performance.now();
 
-          const headers = new dntShim.Headers({
-            Authorization: `Bearer ${apiToken}`,
-            "Content-Type": "application/json",
-          });
+          const headers = new dntShim.Headers(options.headers);
+          headers.set("Authorization", `Bearer ${apiToken}`);
+          if (!headers.has("Content-Type")) {
+            headers.set("Content-Type", "application/json");
+          }
           injectContext(headers);
 
-          const response = await dntShim.fetch(url, { headers, signal: controller.signal });
+          const response = await dntShim.fetch(url, {
+            method: options.method ?? "GET",
+            headers,
+            body: options.body,
+            signal: controller.signal,
+          });
           const duration = performance.now() - startTime;
 
           recordApiRequest(response.status);
@@ -89,7 +98,7 @@ export async function requestWithRetry(
           return { data, status: response.status, duration };
         },
         {
-          "http.method": "GET",
+          "http.method": options.method ?? "GET",
           "http.url": url,
           "http.target": urlPath,
           "http.host": urlObj.host,

package/src/src/platform/adapters/veryfront-api-client/schemas/api.schema.ts

@@ -179,13 +179,13 @@ export const API_ENDPOINTS = {
   },
   listBranchFiles: {
     method: "GET" as const,
-    path: "/projects/{projectRef}/branches/{branchName}/files",
-    description: "List files in a branch (draft/working copy)",
+    path: "/projects/{projectRef}/files?branch={branchRef}",
+    description: "List files for a branch ref or name (omit branch for main branch)",
   },
   getBranchFile: {
     method: "GET" as const,
-    path: "/projects/{projectRef}/branches/{branchName}/files/{pathOrId}",
-    description: "Get file from a branch by path or UUID",
+    path: "/projects/{projectRef}/files/{pathOrId}?branch={branchRef}",
+    description: "Get file from a branch ref or name by path or UUID",
   },
   listEnvironmentFiles: {
     method: "GET" as const,

package/src/src/platform/index.ts

@@ -66,6 +66,7 @@ export { isDeno } from "./compat/runtime.js";
 
 // Adapters: filesystem
 export { createFSAdapter, VeryfrontFSAdapter } from "./adapters/fs/index.js";
+export { enhanceAdapterWithFS, isExtendedFSAdapter } from "./adapters/fs/index.js";
 
 // Adapters: API client
 export { VeryfrontApiClient } from "./adapters/veryfront-api-client/index.js";

package/src/src/proxy/handler.ts

@@ -3,10 +3,11 @@ import { TokenManager, type TokenScope } from "./token-manager.js";
 import { type ParsedDomain, parseProjectDomain } from "../server/utils/domain-parser.js";
 import type { TokenCache } from "./cache/types.js";
 import { createFileSystem } from "../platform/compat/fs.js";
-import { cwd } from "../platform/compat/process.js";
+import { cwd, getEnv } from "../platform/compat/process.js";
 import { join } from "../platform/compat/path/index.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
+import { jwtVerify } from "jose";
 
 export const INTERNAL_PROXY_HEADERS = [
   "x-token",
@@ -151,19 +152,27 @@ function extractUserToken(cookieHeader: string): string | undefined {
   return match?.[1] ? decodeURIComponent(match[1]) : undefined;
 }
 
-function extractUserIdFromToken(token: string): string | undefined {
+async function extractUserIdFromToken(
+  token: string,
+  log?: ProxyLogger,
+): Promise<string | undefined> {
+  const jwtSecret = getEnv("JWT_SECRET");
+
+  if (!jwtSecret) {
+    log?.warn("JWT_SECRET not configured — cannot verify user token");
+    return undefined;
+  }
+
   try {
-    const payload = token.split(".")[1];
-    if (!payload) return undefined;
-    // JWT payloads are base64url-encoded: normalize to standard base64 before decoding
-    let base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-    const remainder = base64.length % 4;
-    if (remainder === 2) base64 += "==";
-    else if (remainder === 3) base64 += "=";
-    const decoded = JSON.parse(atob(base64));
-    return decoded?.userId;
-  } catch (_) {
-    /* expected: malformed JWT token */
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"],
+    });
+    return (payload as { userId?: string }).userId;
+  } catch (error) {
+    log?.debug("JWT verification failed", {
+      error: error instanceof Error ? error.message : String(error),
+    });
     return undefined;
   }
 }
@@ -276,13 +285,13 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
     return `https://veryfront.com/sign-in?from=${encodeURIComponent(returnPath)}`;
   }
 
-  function checkProtectedAccess(
+  async function checkProtectedAccess(
     req: dntShim.Request,
     matchingEnv: NonNullable<DomainLookupResult["environments"]>[number] | undefined,
     userToken: string | undefined,
     users: DomainLookupResult["users"],
     logContext: Record<string, unknown>,
-  ): { status: number; message: string; redirectUrl?: string } | null {
+  ): Promise<{ status: number; message: string; redirectUrl?: string } | null> {
     if (!matchingEnv?.protected) return null;
 
     if (!userToken) {
@@ -295,9 +304,8 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
       return { status: 302, message: "Authentication required", redirectUrl };
     }
 
-    const userId = extractUserIdFromToken(userToken);
+    const userId = await extractUserIdFromToken(userToken, logger);
     if (!userId) {
-      // Malformed token — treat as unauthenticated so user can re-sign-in
       const redirectUrl = makeAuthRedirectUrl(req);
       logger?.info("Could not extract userId from token", {
         ...logContext,
@@ -334,7 +342,7 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
 
     const matchingEnv = lookupResult.environments?.find(envMatcher);
 
-    const protectionError = checkProtectedAccess(
+    const protectionError = await checkProtectedAccess(
       req,
       matchingEnv,
       userToken,
@@ -442,7 +450,7 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
         releaseId = matchingEnv?.active_release_id ?? undefined;
         environmentId = matchingEnv?.id;
 
-        const protectionError = checkProtectedAccess(
+        const protectionError = await checkProtectedAccess(
           req,
           matchingEnv,
           userToken,

package/src/src/routing/api/route-executor.ts

@@ -24,10 +24,11 @@ import {
   getWorkerPool,
   isWorkerIsolationEnabled,
 } from "../../security/sandbox/worker-pool.js";
-import type {
-  SerializedRequest,
-  SerializedResponse,
-  WorkerResponse,
+import {
+  MAX_WORKER_BODY_BYTES,
+  type SerializedRequest,
+  type SerializedResponse,
+  type WorkerResponse,
 } from "../../security/sandbox/worker-types.js";
 import { getProjectEnvSnapshot } from "../../server/project-env/storage.js";
 
@@ -129,13 +130,48 @@ function toHeadResponse(response: dntShim.Response): dntShim.Response {
 // Worker Isolation Helpers
 // ---------------------------------------------------------------------------
 
+function checkContentLengthLimit(request: dntShim.Request): void {
+  const contentLength = request.headers.get("content-length");
+  if (!contentLength) return;
+
+  const bytes = parseInt(contentLength, 10);
+  if (bytes > MAX_WORKER_BODY_BYTES) {
+    throw createError({
+      type: "api",
+      message: `Request body too large for isolated execution (${
+        (bytes / 1024 / 1024).toFixed(1)
+      } MB, limit ${MAX_WORKER_BODY_BYTES / 1024 / 1024} MB)`,
+    });
+  }
+}
+
+async function readBodyWithSizeGuard(request: dntShim.Request): Promise<Uint8Array | null> {
+  if (!request.body) return null;
+
+  // Fast path: reject before buffering if Content-Length is known
+  checkContentLengthLimit(request);
+
+  const body = new Uint8Array(await request.arrayBuffer());
+
+  // Fallback: check actual size for chunked/streaming bodies
+  if (body.byteLength > MAX_WORKER_BODY_BYTES) {
+    throw createError({
+      type: "api",
+      message: `Request body too large for isolated execution (${
+        (body.byteLength / 1024 / 1024).toFixed(1)
+      } MB, limit ${MAX_WORKER_BODY_BYTES / 1024 / 1024} MB)`,
+    });
+  }
+
+  return body;
+}
+
 async function serializeRequest(request: dntShim.Request): Promise<SerializedRequest> {
-  const body = request.body ? new Uint8Array(await request.arrayBuffer()) : null;
   return {
     url: request.url,
     method: request.method,
     headers: [...request.headers.entries()],
-    body,
+    body: await readBodyWithSizeGuard(request),
   };
 }
 
@@ -252,7 +288,7 @@ function executePagesRouteIsolated(
     async () => {
       try {
         const pool = getWorkerPool();
-        const body = request.body ? new Uint8Array(await request.arrayBuffer()) : null;
+        const body = await readBodyWithSizeGuard(request);
 
         const workerResponse = await pool.execute(
           projectDir,

package/src/src/security/deno-permissions.ts

@@ -17,8 +17,9 @@ export const SERVER_PERMISSIONS = [
   "--allow-net",
   "--allow-env",
   "--allow-run",
-  "--allow-ffi",
   "--allow-sys",
+  "--unstable-worker-options",
+  "--unstable-net",
 ] as const;
 
 /**

package/src/src/security/sandbox/project-worker.ts

@@ -23,6 +23,7 @@ import type {
 } from "./worker-types.js";
 
 const logger = serverLogger.component("project-worker");
+const textEncoder = new TextEncoder();
 
 type ExtendedWorkerOptions = {
   type: "module";
@@ -179,7 +180,6 @@ export class ProjectWorker {
     this._status = "busy";
 
     const requestId = request.id;
-    const encoder = new TextEncoder();
 
     return new ReadableStream<Uint8Array>({
       start: (controller) => {
@@ -240,7 +240,7 @@ export class ProjectWorker {
 
             // If we get an ssr-result, emit it as a single chunk
             if (response.type === "ssr-result") {
-              controller.enqueue(encoder.encode(response.html));
+              controller.enqueue(textEncoder.encode(response.html));
               controller.close();
             } else if (response.type === "error") {
               const err = new Error(response.error.message);

package/src/src/security/sandbox/worker-permissions.ts

@@ -23,6 +23,18 @@ export interface WorkerPermissions {
   sys: boolean;
 }
 
+// Cache compiled binary check — Deno.execPath() is a syscall that never changes at runtime
+const _isCompiledBinary = (() => {
+  try {
+    const exec = typeof dntShim.Deno !== "undefined" ? dntShim.Deno.execPath?.() : undefined;
+    if (!exec) return false;
+    const name = exec.split(/[/\\]/).pop()?.toLowerCase() ?? "";
+    return name !== "deno" && name !== "deno.exe";
+  } catch {
+    return false;
+  }
+})();
+
 /**
  * Build scoped permissions for a project worker.
  *
@@ -41,25 +53,16 @@ export function buildWorkerPermissions(
   // is outside the project directory. Rather than trying to enumerate all
   // read paths, grant full read access — the security boundary is enforced
   // by denying write/run/ffi/sys, not by restricting reads.
-  // Check for compiled binary by testing if execPath is NOT "deno"/"deno.exe"
-  try {
-    const exec = typeof dntShim.Deno !== "undefined" ? dntShim.Deno.execPath?.() : undefined;
-    if (exec) {
-      const name = exec.split(/[/\\]/).pop()?.toLowerCase() ?? "";
-      if (name !== "deno" && name !== "deno.exe") {
-        return {
-          read: true,
-          write: false,
-          net: true,
-          env: true,
-          run: false,
-          ffi: false,
-          sys: false,
-        };
-      }
-    }
-  } catch {
-    // execPath may not be available
+  if (_isCompiledBinary) {
+    return {
+      read: true,
+      write: false,
+      net: true,
+      env: true,
+      run: false,
+      ffi: false,
+      sys: false,
+    };
   }
 
   return {

package/src/src/security/sandbox/worker-pool.ts

@@ -121,21 +121,29 @@ export class WorkerPool {
 
         if (shouldRecycle && !this.recycling.has(projectId)) {
           this.recycling.add(projectId);
-          try {
-            logger.debug("Recycling worker", {
-              projectId,
-              requestCount: worker.requestCount,
-              ageMs: entry ? Date.now() - entry.createdAt : 0,
-              reason: worker.requestCount >= this.config.maxRequestsPerWorker
-                ? "request_count"
-                : "age",
-            });
+
+          logger.debug("Recycling worker", {
+            projectId,
+            requestCount: worker.requestCount,
+            ageMs: entry ? Date.now() - entry.createdAt : 0,
+            reason: worker.requestCount >= this.config.maxRequestsPerWorker
+              ? "request_count"
+              : "age",
+          });
+
+          // Warm replacement: let the old worker handle this last request,
+          // then evict it and create a replacement after the request settles.
+          // This avoids cold-start latency for the caller AND prevents the
+          // old worker from being terminated while it still has pending work.
+          const result = worker.execute(request);
+
+          void result.finally(() => {
             this.evictWorker(projectId);
-            const fresh = this.getOrCreateWorker(projectId, readPaths);
-            return fresh.execute(request);
-          } finally {
+            this.getOrCreateWorker(projectId, readPaths);
             this.recycling.delete(projectId);
-          }
+          });
+
+          return result;
         }
 
         return worker.execute(request);

package/src/src/security/sandbox/worker-types.ts

@@ -198,6 +198,9 @@ export interface WorkerPoolConfig {
   memoryBudgetMb: number;
 }
 
+/** Maximum request body size for worker isolation (10 MB) */
+export const MAX_WORKER_BODY_BYTES = 10 * 1024 * 1024;
+
 export const DEFAULT_WORKER_POOL_CONFIG: WorkerPoolConfig = {
   maxPoolSize: 20,
   idleTimeoutMs: 300_000,

package/src/src/task/types.ts

@@ -26,6 +26,12 @@ export interface TaskDefinition {
   name?: string;
   /** Task description */
   description?: string;
+  /** Optional JSON-schema-like input contract surfaced in APIs/UIs */
+  inputSchema?: Record<string, unknown>;
+  /** Optional JSON-schema-like output contract surfaced in APIs/UIs */
+  outputSchema?: Record<string, unknown>;
+  /** Whether this task can be scheduled via cron jobs */
+  schedulable?: boolean;
   /** The function to execute */
   run: (ctx: TaskContext) => Promise<unknown> | unknown;
 }