nzip v0.9.0 — stable app origins and vault TTL defaults

I added stable lofi application origins, lifecycle-aware vault defaults, and agent-readable TTL policy in nzip 0.9.0.

App hosting

• I added nzip app init <alias|vault:alias> to reserve an app URL before the first deployment. Repeating init for the same target returns the same reservation.
• I added a tracked, credential-free nzip.app.json with the app framework, target, address, origin, build task, and output directory.
• I added nzip app deploy to run the configured build, validate lofi root hosting and production-origin settings, verify required output files, and deploy to the reserved address.
• I propagate the lofi content security policy through nzip so the hosted response uses the application policy.
• I serve a placeholder at reserved, undeployed app origins. App reservations remain allocated after content deletion or expiry, so an application origin is never reassigned.

Vault retention policy

• I added temporary and permanent default-vault roles. A vault may hold either or both roles.
• I bootstrap personal in slot 0 as the temporary default with a 14-day TTL.
• I bootstrap public in slot f as the permanent default with a forever TTL.
• I preserve existing occupied and customized vault slots during bootstrap.
• I added per-vault default TTLs and CLI commands for setting vault TTLs and lifecycle defaults.
• I resolve TTLs in this order: explicit request → existing site → vault default → global default. Site pushes report both ttl and ttlSource.

Agent and API output

• I expose defaultVaults and globalDefaultTtl in status JSON.
• I expose defaultTtl, effectiveDefaultTtl, and defaultFor for every vault in status and vault-list JSON.
• I updated CLI help and the nzip skill so agents can discover the app workflow and retention policy without inferring behavior from vault names.

Server and storage

• I added normalized vault lifecycle defaults and persistent app reservations.
• I added vault default-TTL and site content-security-policy fields.
• I made address allocation account for app reservations, including reserved addresses whose deployed content has been removed.
• I included migration 0007_vault_defaults_and_app_origins.sql.
• I updated the architecture, security, package, and Worker setup documentation to match the shipped behavior.

Verification

I completed 22 CLI/shared tests, 55 Worker unit tests, 15 Worker runtime tests, Deno publish validation, Worker deployment validation, production migration and deployment, and a post-release smoke test using the JSR-installed 0.9.0 CLI. The smoke artifact was removed afterward, leaving no test site or app reservation.

Full changelog: v0.8.0...v0.9.0

nzip v0.8.0

nzip v0.8.0

This release moves hosted artifacts from shared paths to isolated site origins while preserving old links.

Highlights

• Sites now serve from https://<address>.<SITE_DOMAIN>/.
• Legacy https://<control-origin>/<address>/... links permanently redirect to the isolated hostname while preserving the path and query.
• New builds use / as their asset base, eliminating the reserve, rebuild, and repush cycle. Existing /<address>/ builds remain compatible during migration.
• Repushing an existing target now preserves omitted TTL and password settings. Policy changes require explicit flags.

Security

• Owner APIs and notification enrollment dispatch only on the exact control origin.
• Wildcard hosts are accepted only when the hostname is exactly four lowercase hexadecimal characters.
• Password unlock cookies are __Host-, host-only, and cryptographically bound to the site address and authentication version.
• Artifact responses disable document.domain relaxation.
• Cloudflare shared-edge caching is disabled for every Worker response after live testing found that the exact custom domain and wildcard route could reuse one hostname-agnostic cache entry. Browser caching and ETag revalidation remain enabled.
• Canonical redirects are constructed from the configured public HTTPS base instead of the Worker's internal request scheme.

Deployment changes

Existing deployments must configure:

1. SITE_DOMAIN for artifact hostnames.
2. A proxied wildcard DNS record such as * CNAME <control-host>.
3. A wildcard Worker route such as *.example.com/*, alongside the exact control Custom Domain.
4. Root-based application builds with service-worker scope /.

The deployment guide includes a Cloudflare Free-compatible WAF expression, HSTS rollout guidance, wildcard certificate checks, and the expected request-cost tradeoff while edge caching is disabled.

Credential boundary

Site origins isolate origin storage, service workers, and nzip host-only unlock cookies. Until SITE_DOMAIN is registered in the Public Suffix List and that change reaches target browsers, an arbitrary hosted application can still set a parent-domain cookie or request the parent as its WebAuthn RP ID. Applications should use host-only cookies and rp.id = location.hostname.

Validation

• 20 Deno CLI/shared tests
• 54 Worker unit tests
• 13 workerd runtime tests
• Deno format, lint, documentation, type, and JSR publish dry-runs
• Worker type generation check and Wrangler deployment dry-run
• Live redirect, TLS, HSTS, WAF, CORS, storage, service-worker, cookie, passkey, and cross-host cache-isolation probes

Full changelog: v0.7.1...v0.8.0

nzip v0.7.1

Full Changelog: v0.7.0...v0.7.1

nzip v0.7.0

Version visibility

• Add nzip version with human-readable and agent-friendly JSON output.
• Expose the same release version from the authenticated Worker status endpoint.
• Add tests that keep the CLI, shared package, and runtime version surfaces synchronized.

Locked-site navigation

• Preserve nested paths and query strings when returning from password unlock.
• Reject crafted return targets that point outside the locked site.

Documentation and operations

• Split architecture, security, and contribution guidance into dedicated documents.
• Refresh the README, CLI guide, Worker setup, and repo-local nzip skill.
• Align examples and configuration with the current share.demo.dev deployment.

Validation

• Deno formatting, lint, typecheck, documentation lint, 18 tests, and JSR publication dry-run.
• Worker type/config check, 45 unit tests, 11 runtime tests, and Wrangler deployment dry-run.

Full changelog: v0.6.0...v0.7.0

nzip v0.6.0

Pairing security

• Require the authenticated owner to run nzip notify pair before a device can enroll.
• Limit pairing availability to a fixed 10-minute server-side window and hide the public action when closed.
• Reject enrollment outside the window even when the UI is bypassed.
• Rate-limit pairing-state reads, prevent duplicate attempts from a pending page, and block framing of the root pairing UI.

Breaking CLI changes

• Group the complete site lifecycle under nzip site: push, cp, show, update, ls, where, rm, and revert.
• Require nzip notify send <body> for notification delivery.
• Remove the former root-level site commands and compatibility aliases.

Operations and documentation

• Add D1 migration 0006_notification_pairing_window.sql for the owner-controlled pairing deadline.
• Update the README, CLI guide, Worker setup, shared contracts, and repo-local nzip skill.
• Remove the completed NOTIFY_PLAN.md implementation plan.

Validation

• Deno formatting, lint, typecheck, documentation lint, tests, and JSR publication dry-run.
• Worker typecheck, 43 unit tests, 11 runtime tests, and Wrangler deployment dry-run.

Full changelog: v0.5.0...v0.6.0

nzip v0.5.0

Full Changelog: v0.4.0...v0.5.0

nzip v0.4.0

Vaults can now carry a human-readable description, and vault metadata is editable after creation.

Features

• nzip vault add <name> --description TEXT stores a purpose note with the vault (new D1 description column, migration 0004_vault_descriptions.sql).
• New nzip vault update <name> [--name NEW_NAME] [--description TEXT | --no-description] renames and/or re-describes a vault through the new PATCH /api/vaults/:name endpoint.
• Descriptions are shown by vault ls and status (last table column) and included in their --json output.
• A rename updates the invoking client's default vault, allowVaults guard, and local push records, so nzip where keeps resolving renamed targets.

Hardening

• Renaming a vault to a name outside allowVaults is refused.
• Clearing a description requires an explicit --no-description; a bare or empty --description is a usage error instead of a silent clear.
• The API accepts description: null as the JSON clear idiom, rejects control characters and descriptions over 500 characters, and returns 400 instead of 500 for malformed percent-encoding in vault paths.

Also included

• Agent skill (agent/skills/nzip) covering setup, diagnosis, and safe publishing defaults.
• Runtime tests for vault create/rename/clear and the new validation paths; docs updated across the README, CLI README, and setup notes.

Full diff: v0.3.1...v0.4.0

nzip v0.3.1

Full Changelog: v0.3.0...v0.3.1

nzip v0.3.0

This release hardens nzip for Free-tier operation, adds durable enumeration alerts, improves caching, and substantially expands runtime validation.

Security and observability

• Bounded, privacy-preserving enumeration telemetry with HMAC scanner identities and no stored raw IPs.
• Separate persistence quotas for normal probes and 429 confirmations.
• Five-minute incident evaluation with warning/confirmed severity, escalation suppression, hourly summaries, and quiet-window resolution.
• Durable D1 notification outbox: alert state and payload are committed before email delivery, then retried with stable notification IDs.
• Verified-destination email alerts and daily activity summaries without adding a paid runtime service.

Free-tier and performance safeguards

• Public Worker responses use cacheable headers and mutation-aware cache purging; production validation confirmed MISS to HIT behavior.
• Manifests are capped at 900 unique blobs with at most six concurrent R2 checks.
• Blob uploads are limited to 50 MiB and require a valid Content-Length before buffering.
• Unlock bodies and password lengths are bounded before PBKDF2 work.
• PBKDF2 hashing measured 6 ms in local workerd validation.

Maintainability and release safety

• The former Worker API godfile is split into focused push, site, vault, status, common, and typed-error modules.
• Security policy and email-delivery concerns are separated from cron orchestration.
• Added Deno tests, Worker unit tests, and real workerd integration tests covering D1 migrations, cron evaluation, routing, email, and crypto.
• GitHub publication now gates JSR publishing on formatting, linting, type checks, tests, package dry-runs, and a Wrangler deployment dry-run.
• README architecture is organized into Program flow, Security lens, and Observability lens, with detailed operational sections collapsed by default.

Install

deno install -g -A -f -n nzip jsr:@nzip/cli@0.3.0

Full changelog

nzip v0.2.0

This release makes password policy part of the atomic push operation and clarifies the site-management interface.

Included

• nzip push can set, preserve, or explicitly clear password protection while committing content.
• nzip site becomes the primary TTL/password management command; nzip share remains a compatibility alias.
• Worker commit handling applies content, TTL, alias, and password policy together.
• Status reporting and package manifests move to version 0.2.0.
• Release publication uses an atomic main-and-tag push policy.

Install

deno install -g -A -f -n nzip jsr:@nzip/cli@0.2.0

Full changelog