@3sln/trove 0.0.11 → 0.0.13

package/packages/web/src/dispatch.js

@@ -0,0 +1,26 @@
+// Waiting for a dispatched action to actually finish.
+//
+// `dispatch(action)` answers an event FEED — `DispatchFeed extends EventTarget`, with no
+// `then` — and ngin schedules the body on a `setTimeout`. So `await engine.dispatch(x)`
+// resolves immediately and is *guaranteed* to return before the action has started. It
+// reads as sequencing and is the opposite of it.
+//
+// Six sites did it, one of them eighty lines below the comment in the same class explaining
+// why it cannot work, and at least one was visible: creating a collection navigated to it
+// before the collections list had loaded, so the status bar showed a raw `col_…` id where
+// the name belongs.
+//
+// The completion signal is the terminal event. It RESOLVES with whichever of
+// complete/error/abort fired rather than rejecting, so a failing action does not throw at
+// the call site — the caller decides whether the next step still makes sense.
+//
+// Takes anything with a `dispatch`, so the engine and CommandService (which dispatches
+// through its own seam) share one implementation instead of two spellings of it.
+
+/**
+ * @param {{dispatch: (action: object) => {next: (types: string[]) => Promise<object>}}} dispatcher
+ * @param {object} action
+ * @returns {Promise<{type: 'complete'|'error'|'abort'}>}
+ */
+export const runAction = (dispatcher, action) =>
+  dispatcher.dispatch(action).next(['complete', 'error', 'abort']);

package/packages/web/src/platform/api.js

@@ -371,6 +371,38 @@ export class TroveApiClient {
     return new TextDecoder().decode(await this.readBytes(id, opts));
   }
 
+  /**
+   * Read `[start, end)` of a file.
+   *
+   * HALF-OPEN, like every other range in JavaScript — `slice`, `subarray`, `TypedArray`.
+   * HTTP's is inclusive, and the conversion happens at this one boundary rather than in
+   * every caller, because an off-by-one that only shows up as a missing final byte of a
+   * container header is the kind of bug that reads as a corrupt file.
+   *
+   * `etag` comes back with the bytes, and callers are expected to care: a file overwritten
+   * in place keeps its id, so anything cached off these bytes — a chunk store, a parsed
+   * atom layout — has to notice that the head of the old file and the tail of the new one
+   * are not the same file. `total` is parsed from `content-range`, which is the only place
+   * a ranged read learns how big the whole thing is.
+   *
+   * @returns {Promise<{bytes: Uint8Array, etag: string|null, total: number|null}>}
+   */
+  async readRange(id, { start = 0, end, signal } = {}) {
+    const range = end == null ? `bytes=${start}-` : `bytes=${start}-${end - 1}`;
+    const res = await this._fetch(this.downloadUrl(id), {
+      signal,
+      headers: { ...this.authHeaders(), range },
+    });
+    // A zero-length file has no satisfiable range, and asking for one is not an error the
+    // caller can do anything with — it is an empty file, which is a legitimate answer.
+    if (res.status === 416) return { bytes: new Uint8Array(0), etag: res.headers.get('etag'), total: 0 };
+    if (!res.ok && res.status !== 206) throw new TroveError('internal', `Read failed (${res.status})`);
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    const total = Number(/\/(\d+)$/.exec(res.headers.get('content-range') || '')?.[1])
+      || (res.status === 200 ? bytes.length : null);
+    return { bytes, etag: res.headers.get('etag'), total };
+  }
+
   /**
    * Read at most `maxBytes` of a file as text.
    *

package/packages/web/src/platform/commands.js

@@ -5,6 +5,8 @@
 // plain functions, plugin handlers proxy over RPC). Errors surface as a
 // notification instead of a silent console log — failure is always visible.
 
+import { runAction } from '../dispatch.js';
+
 export class CommandService {
   /**
    * @param {import('./contributions.js').ContributionRegistry} contributions
@@ -56,10 +58,6 @@ export class CommandService {
     };
   }
 
-  has(id) {
-    return this.handlers.has(id);
-  }
-
   isEnabled(id) {
     const cmd = this.contributions.get(id);
     if (cmd?.when && !this.context.evaluate(cmd.when)) return false;
@@ -91,25 +89,26 @@ export class CommandService {
     }
     const cmd = this.contributions.get(id);
     if (!this.isAvailable(cmd)) {
-      this.notifications.warn(`“${cmd?.title || id}” isn’t available${this.availability ? ' offline' : ''} right now.`);
+      // Not "…isn't available OFFLINE": that word was printed whenever an availability
+      // hook was installed, which platform/index.js makes unconditionally true, and
+      // `#availableSpec` answers false for a plugin frame that is inactive or has stopped
+      // answering its heartbeat BEFORE it ever consults `this.online`. So a crashed iframe
+      // on a perfectly connected machine told the user to check their network.
+      this.notifications.warn(`“${cmd?.title || id}” isn’t available right now.`);
       return;
     }
     if (!this.isEnabled(id)) return; // gated by when-clause
     try {
       const actions = actionsFor(...args);
       if (!actions) return;
-      // One at a time, each genuinely finished before the next begins.
-      //
-      // `dispatch` answers an event FEED, not a promise for the work — awaiting it resolves
-      // immediately and the action runs afterwards, so a bare `await dispatch(a)` in a loop
-      // would start all of them at once while looking like it sequenced them. `next` on the
-      // terminal events is the actual completion signal.
+      // One at a time, each genuinely finished before the next begins — see
+      // src/dispatch.js for why a bare `await dispatch(a)` in this loop would start them
+      // all at once while looking like it sequenced them.
       //
-      // It resolves with whichever of complete/error/abort fired rather than rejecting, so
-      // a failing action does not throw here — but it does stop the rest, because a command
-      // whose first step failed rarely wants its second.
+      // A failing action does not throw here, but it does stop the rest: a command whose
+      // first step failed rarely wants its second.
       for (const action of [].concat(actions)) {
-        const settled = await this.dispatch(action).next(['complete', 'error', 'abort']);
+        const settled = await runAction(this, action);
         if (settled?.type !== 'complete') break;
       }
     } catch (err) {

package/packages/web/src/platform/context.js

@@ -21,8 +21,8 @@
 //
 // Nothing sets a built-in key now. They are derived — see bl/context.js.
 
-import { cell, derive } from '../runtime.js';
-import { evaluateWhen, compileWhen } from './whenclause.js';
+import { cell } from '../runtime.js';
+import { evaluateWhen } from './whenclause.js';
 
 /** A cell whose value never changes — for facts about the machine rather than the drive. */
 const constant = (value) => ({ onDirty: () => () => {}, getValue: () => value });
@@ -30,7 +30,6 @@ const constant = (value) => ({ onDirty: () => () => {}, getValue: () => value })
 export class ContextRegistry {
   #cells = new Map(); // key -> a Cell its owner holds
   #offs = new Map(); // key -> unsubscribe
-  #slots = new Map(); // key -> a stable cell that outlives any one owner
   #snapshot = cell({});
 
   constructor(initial = {}) {
@@ -73,59 +72,8 @@ export class ContextRegistry {
     this.#changed(key); // and so is losing one
   }
 
-  /**
-   * A cell for one key, whether or not anything owns it yet.
-   *
-   * The indirection is the point. A keymap naming a plugin's register is parsed long before
-   * that plugin installs, and the plugin may later be uninstalled — so a watcher cannot
-   * hold the OWNER's cell, which does not exist at either end. It holds this slot, which
-   * reads through to whoever currently owns the key and goes dirty when ownership changes
-   * as well as when the value does. Unowned reads as `undefined`, which every clause
-   * already treats as falsy.
-   *
-   * Slots are kept once created. They are bounded by the number of distinct keys any
-   * when-clause has ever named, which is small and does not grow with use.
-   */
-  cellFor(key) {
-    let slot = this.#slots.get(key);
-    if (!slot) {
-      const listeners = new Set();
-      slot = {
-        listeners,
-        onDirty: (fn) => { listeners.add(fn); return () => listeners.delete(fn); },
-        getValue: () => this.#cells.get(key)?.getValue(),
-      };
-      this.#slots.set(key, slot);
-    }
-    return slot;
-  }
-
-  /**
-   * A when-clause as a live boolean.
-   *
-   * Derived over exactly the keys the expression NAMES (the parser collects them — see
-   * whenclause.js), so a clause about `view.active` does not recompute when the selection
-   * changes. That is the difference from `evaluate`, which reads the whole snapshot: a
-   * consumer holding many clauses — the palette holds one per registered command — stops
-   * re-running all of them on every unrelated change.
-   *
-   * A clause naming nothing derives over nothing and is computed once, which is right: a
-   * constant cannot become false.
-   */
-  watch(expr) {
-    const predicate = compileWhen(expr);
-    const keys = predicate.keys ?? [];
-    return derive(keys.map((key) => this.cellFor(key)), (...values) => {
-      const ctx = {};
-      for (let i = 0; i < keys.length; i++) ctx[keys[i]] = values[i];
-      return predicate(ctx);
-    });
-  }
-
-  #changed(key) {
+  #changed() {
     this.#recompute();
-    const slot = this.#slots.get(key);
-    if (slot) for (const fn of [...slot.listeners]) fn();
   }
 
   /**
@@ -154,9 +102,6 @@ export class ContextRegistry {
   get(key) {
     return this.#cells.get(key)?.getValue();
   }
-  has(key) {
-    return this.#cells.has(key);
-  }
   observe() {
     return this.#snapshot;
   }

package/packages/web/src/platform/contributions.js

@@ -23,7 +23,7 @@
 //   keymap      { bindings:[{key, command, when?, args?}] }
 //   view        { title, icon?, match?, priority?, render, move? }
 
-import { cell, derive } from '../runtime.js';
+import { cell } from '../runtime.js';
 import { selectorMatches } from '@3sln/trove/core/util.js';
 import { parseContribUri, coreUri, CONTRIB_SCHEME } from '@3sln/trove/core/plugins/identity.js';
 import { CONTRIBUTION_TYPES as PACKAGE_TYPES } from '@3sln/trove/core/plugins/contributions.js';
@@ -47,7 +47,6 @@ export class ContributionRegistry {
   constructor() {
     this.items = new Map(); // uri -> { uri, type, id, name, pluginId, ...options }
     this.cell = cell([]);
-    this.byType = new Map(); // type -> derived cell (lazily created)
   }
 
   #emit() {
@@ -94,13 +93,6 @@ export class ContributionRegistry {
   unregister(nameOrUri) {
     if (this.items.delete(toUri(nameOrUri))) this.#emit();
   }
-  /** Drop everything a plugin contributed (uninstall / reload). */
-  unregisterPlugin(pluginId) {
-    let changed = false;
-    for (const [uri, c] of this.items) if (c.pluginId === pluginId) { this.items.delete(uri); changed = true; }
-    if (changed) this.#emit();
-  }
-
   get(nameOrUri) {
     return nameOrUri ? this.items.get(toUri(nameOrUri)) || null : null;
   }
@@ -110,29 +102,9 @@ export class ContributionRegistry {
   ofType(type) {
     return this.all().filter((c) => c.type === type);
   }
-  /** One plugin's contributions, optionally of a single type. */
-  ofPlugin(pluginId, type) {
-    return this.all().filter((c) => c.pluginId === pluginId && (!type || c.type === type));
-  }
   observe() {
     return this.cell;
   }
-  /**
-   * A reactive view of one type (status items, openers, …).
-   *
-   * Derived rather than a second subject fanned out to by hand: `derive` recomputes
-   * from the one list, and a watcher of the result is only re-rendered when its own
-   * slice actually differs — so registering an opener no longer redraws the status bar.
-   */
-  observeType(type) {
-    let view = this.byType.get(type);
-    if (!view) {
-      view = derive([this.cell], (all) => all.filter((c) => c.type === type));
-      this.byType.set(type, view);
-    }
-    return view;
-  }
-
   // --- typed lookups ---------------------------------------------------------
 
   /** Every opener whose selector matches `node`, best (highest priority) first. */
@@ -142,12 +114,6 @@ export class ContributionRegistry {
       .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
   }
 
-  /** Pick the best opener for a node, honouring `when` and availability. */
-  openerFor(node, evaluate, isAvailable) {
-    return this.openersFor(node)
-      .find((o) => (!o.when || evaluate(o.when)) && (!isAvailable || isAvailable(o))) || null;
-  }
-
   /** Every keybinding from every registered keymap, in registration order. */
   keybindings() {
     return this.ofType('keymap').flatMap((k) =>

package/packages/web/src/platform/fileChunks.js

@@ -0,0 +1,281 @@
+// Where a file's bytes come from, and which of them are worth keeping.
+//
+// A viewer reading a range asks here rather than asking the network, and the answer comes
+// from the first of three places that has it:
+//
+//   1. A PINNED whole-file copy. bl/offline.js already puts the whole Response into Cache
+//      Storage under `mediaUrls.cacheKey(id)` — a deliberately stable key, so `unpin` can
+//      find what `pin` stored. Slicing that cached blob is disk-backed and costs nothing,
+//      so a pinned book plays with the network off and this tier comes almost free.
+//   2. CHUNKS of a download in progress. Playing from the middle fetches the middle, and
+//      if that file is also being taken offline those bytes are worth keeping — so the
+//      read contributes them and the background filler skips them later.
+//   3. The network, keeping NOTHING.
+//
+// THE THIRD CASE IS THE DEFAULT, and it is the rule the whole design hangs off: a plugin
+// ranging over a file nobody asked to keep must not quietly fill the disk with it. Bytes
+// are retained only for an item someone has actually asked to have offline, and `start(id)`
+// is that asking. Until it is called this is a plain ranged reader with a cache lookup in
+// front of it.
+//
+// THE ETAG IS IN THE KEY. A file overwritten in place keeps its id, so an id-keyed chunk
+// cache would hand a reader the head of the old file and the tail of the new one. For a
+// container format that is a parse failure, and a confusing one — the bytes are all valid,
+// they are just from two different files. A changed etag makes every old chunk stop
+// matching, and the sweep reclaims them.
+
+const CHUNKS_CACHE = 'trove-chunks-v1';
+
+/**
+ * 4 MiB.
+ *
+ * A long audiobook is a few hundred entries at this size rather than a few thousand, and
+ * Cache Storage is a real database — the per-entry overhead is what makes a small chunk
+ * size expensive, not the bytes. Big enough that one chunk usually covers a seek, small
+ * enough that the first one arrives quickly.
+ */
+export const CHUNK_SIZE = 4 * 1024 * 1024;
+
+const chunkOf = (offset) => Math.floor(offset / CHUNK_SIZE);
+const concat = (parts, total) => {
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const p of parts) { out.set(p, at); at += p.length; }
+  return out;
+};
+
+export class FileChunks {
+  /** @param {{api: object, mediaUrls: object}} deps */
+  constructor({ api, mediaUrls }) {
+    this.api = api;
+    this.mediaUrls = mediaUrls;
+    // What someone asked to keep: id -> { etag, total, cancel, filling, done, failed }.
+    // In memory because it is about THIS session's background work; what survives a reload
+    // is the chunks themselves, which is the durable half.
+    this.kept = new Map();
+    this.listeners = new Set();
+  }
+
+  /** Progress, for a viewer drawing a bar. `off()` to stop listening. */
+  onProgress(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  #emit(id) {
+    const s = this.status(id);
+    for (const fn of [...this.listeners]) { try { fn(id, s); } catch { /* a listener is not our problem */ } }
+  }
+
+  #key(id, etag, index) {
+    // The stable download URL, plus a QUERY parameter. Not a fragment: the Cache API keys
+    // on a Request, and a Request's url excludes its fragment — so `…#chunk=0` and
+    // `…#chunk=1` are the same key, and every chunk of every file would collide on the
+    // first one. It reads as "part of this file" in devtools either way.
+    return `${this.mediaUrls.cacheKey(id)}&chunk=${etag || 'none'}:${CHUNK_SIZE}:${index}`;
+  }
+
+  async #cache(name) {
+    if (!('caches' in globalThis)) return null;
+    return caches.open(name).catch(() => null);
+  }
+
+  /**
+   * The pinned whole-file copy, if there is one.
+   *
+   * Tier 1, and the reason it is first: it needs no chunking, no etag bookkeeping and no
+   * network, because `bl/offline.js` already put the entire Response there.
+   */
+  async #pinned(id) {
+    const cache = await this.#cache('trove-files-v1');
+    if (!cache) return null;
+    return cache.match(this.mediaUrls.cacheKey(id), { ignoreVary: true }).catch(() => null);
+  }
+
+  /**
+   * Read `[start, end)`.
+   *
+   * @param {string} id
+   * @param {{start?: number, end?: number, signal?: AbortSignal}} range
+   * @returns {Promise<{bytes: Uint8Array, etag: string|null, total: number|null}>}
+   */
+  async read(id, { start = 0, end, signal } = {}) {
+    const whole = await this.#pinned(id);
+    if (whole) {
+      const blob = await whole.blob();
+      const stop = end == null ? blob.size : Math.min(end, blob.size);
+      const bytes = new Uint8Array(await blob.slice(start, stop).arrayBuffer());
+      return { bytes, etag: whole.headers.get('etag'), total: blob.size };
+    }
+
+    const keep = this.kept.get(id);
+    // Not kept: a plain ranged read, and nothing is written anywhere. This is the branch
+    // that runs for every file nobody asked to keep, which is almost all of them.
+    if (!keep) return this.api.readRange(id, { start, end, signal });
+
+    return this.#readChunked(id, keep, start, end, signal);
+  }
+
+  /** The kept path: whole chunks, from the cache where possible, contributed on a miss. */
+  async #readChunked(id, keep, start, end, signal) {
+    const cache = await this.#cache(CHUNKS_CACHE);
+    if (!cache) return this.api.readRange(id, { start, end, signal });
+
+    // The total has to be known before the last chunk can be sized, and the cheapest way
+    // to learn it is the first read — which we were doing anyway.
+    if (keep.total == null) {
+      const head = await this.api.readRange(id, { start: 0, end: 1, signal });
+      keep.total = head.total;
+      keep.etag = head.etag;
+    }
+    const stop = Math.min(end == null ? keep.total : end, keep.total);
+    if (stop <= start) return { bytes: new Uint8Array(0), etag: keep.etag, total: keep.total };
+
+    const parts = [];
+    let got = 0;
+    for (let i = chunkOf(start); i <= chunkOf(stop - 1); i++) {
+      const chunk = await this.#chunk(id, keep, i, cache, signal);
+      // The window this chunk contributes, in the chunk's own coordinates.
+      const from = Math.max(0, start - i * CHUNK_SIZE);
+      const to = Math.min(chunk.length, stop - i * CHUNK_SIZE);
+      const piece = chunk.subarray(from, to);
+      parts.push(piece);
+      got += piece.length;
+    }
+    return { bytes: concat(parts, got), etag: keep.etag, total: keep.total };
+  }
+
+  /** One chunk: cached if it is there, fetched and KEPT if it is not. */
+  async #chunk(id, keep, index, cache, signal) {
+    const key = this.#key(id, keep.etag, index);
+    const hit = await cache.match(key).catch(() => null);
+    if (hit) {
+      keep.have.add(index);
+      return new Uint8Array(await hit.arrayBuffer());
+    }
+
+    const start = index * CHUNK_SIZE;
+    const end = Math.min(start + CHUNK_SIZE, keep.total);
+    const res = await this.api.readRange(id, { start, end, signal });
+    // The etag can change under us mid-download — someone replaced the file. Everything
+    // already stored is from a file that no longer exists, so it is dropped rather than
+    // mixed with what is arriving.
+    if (res.etag && keep.etag && res.etag !== keep.etag) {
+      await this.#dropChunks(id);
+      keep.have.clear();
+      keep.etag = res.etag;
+      keep.total = res.total ?? keep.total;
+    }
+    await cache.put(key, new Response(res.bytes)).catch(() => {});
+    keep.have.add(index);
+    this.#emit(id);
+    return res.bytes;
+  }
+
+  /**
+   * Keep this item offline, and fill in what is missing in the background.
+   *
+   * IDEMPOTENT: starting a download that is already running returns its status rather than
+   * racing a second filler over the same chunks — two fillers would each fetch every chunk
+   * the other had not written yet, which is the whole file twice.
+   */
+  async start(id) {
+    const running = this.kept.get(id);
+    if (running) return this.status(id);
+
+    const head = await this.api.readRange(id, { start: 0, end: 1 });
+    const controller = new AbortController();
+    const keep = {
+      etag: head.etag, total: head.total, filling: true, done: false, failed: null,
+      // Which chunk indices are stored. `loaded` is DERIVED from this rather than counted
+      // up as bytes arrive, so a chunk written by a viewer's seek and a chunk written by
+      // the background filler are the same fact and neither double-counts the other.
+      have: new Set(),
+      controller,
+    };
+    this.kept.set(id, keep);
+    this.#emit(id);
+    // Not awaited: `start` answers immediately so a viewer can begin playing while the
+    // rest arrives. Failures land on the status, which is what a progress bar reads.
+    this.#fill(id, keep, controller.signal).catch((err) => {
+      keep.filling = false;
+      keep.failed = err?.message || String(err);
+      this.#emit(id);
+    });
+    return this.status(id);
+  }
+
+  /** In order, skipping what is already there — which is what makes a seek pay for itself. */
+  async #fill(id, keep, signal) {
+    const cache = await this.#cache(CHUNKS_CACHE);
+    if (!cache) throw new Error('This browser has no Cache Storage, so nothing can be kept offline');
+    const count = Math.max(1, Math.ceil((keep.total || 0) / CHUNK_SIZE));
+    for (let i = 0; i < count; i++) {
+      if (signal.aborted) return;
+      await this.#chunk(id, keep, i, cache, signal);
+    }
+    keep.filling = false;
+    keep.done = true;
+    this.#emit(id);
+  }
+
+  /**
+   * How much of it is here.
+   *
+   * `loaded` counts what has been WRITTEN, not what has been asked for, so a bar built on
+   * it never runs ahead of the bytes.
+   */
+  status(id) {
+    const keep = this.kept.get(id);
+    if (!keep) return { kept: false, loaded: 0, total: null, ratio: 0, filling: false, done: false, error: null };
+    const total = keep.total ?? null;
+    // The last chunk is short, so counting every stored chunk as a whole one would report
+    // more bytes than the file has.
+    const last = total ? Math.ceil(total / CHUNK_SIZE) - 1 : -1;
+    let loaded = 0;
+    for (const i of keep.have) loaded += i === last ? total - last * CHUNK_SIZE : CHUNK_SIZE;
+    return {
+      kept: true,
+      total,
+      loaded,
+      ratio: total ? Math.min(1, loaded / total) : 0,
+      filling: keep.filling,
+      done: keep.done,
+      error: keep.failed,
+    };
+  }
+
+  /** Stop filling. What is already stored stays — a resumed download starts from it. */
+  cancel(id) {
+    const keep = this.kept.get(id);
+    if (!keep) return;
+    keep.controller?.abort();
+    keep.filling = false;
+    this.#emit(id);
+  }
+
+  /** Stop keeping it, and reclaim the bytes. */
+  async remove(id) {
+    const keep = this.kept.get(id);
+    this.cancel(id);
+    this.kept.delete(id);
+    keep?.have?.clear();
+    await this.#dropChunks(id);
+    this.#emit(id);
+  }
+
+  /**
+   * Drop every chunk for this file, whatever etag they were stored under.
+   *
+   * Prefix-matched rather than index-counted: after an etag change we no longer know how
+   * many chunks the old file had, and leaving them would be a leak nothing ever reclaims.
+   */
+  async #dropChunks(id) {
+    const cache = await this.#cache(CHUNKS_CACHE);
+    if (!cache) return;
+    const prefix = `${this.mediaUrls.cacheKey(id)}&chunk=`;
+    const keys = await cache.keys().catch(() => []);
+    for (const req of keys) {
+      if (req.url.startsWith(prefix)) await cache.delete(req).catch(() => {});
+    }
+  }
+}

package/packages/web/src/platform/index.js

@@ -20,6 +20,7 @@ import { ViewportService } from './viewport.js';
 import { SpatialNavigationService } from './spatialNav.js';
 import { VoiceSearchService } from './voiceSearch.js';
 import { MediaUrlService } from './mediaUrls.js';
+import { FileChunks } from './fileChunks.js';
 
 /**
  * The bearer token for this browser, if any.
@@ -33,14 +34,9 @@ import { MediaUrlService } from './mediaUrls.js';
 export function readToken() {
   try { return localStorage.getItem('trove.token') || null; } catch { return null; }
 }
-/** Store (or clear, with null) the bearer token this browser presents. */
-export function writeToken(token) {
-  try {
-    if (token) localStorage.setItem('trove.token', token);
-    else localStorage.removeItem('trove.token');
-  } catch { /* storage unavailable; the session is simply not persisted */ }
-}
-
+// Read only, deliberately: nothing in the workbench signs in. The key is written by the
+// page that EMBEDS the workbench — see test/multiuser.e2e.mjs, which is the arrangement
+// this is built for — so a writer here would be a second owner of somebody else's fact.
 export function createPlatform({ baseUrl = '' } = {}) {
   const contributions = new ContributionRegistry();
   // Only the fixed facts are seeded. Everything else is registered by whoever owns it —
@@ -79,9 +75,12 @@ export function createPlatform({ baseUrl = '' } = {}) {
     viewport, spatialNav, voice,
     // The shell's own state is the engine's, not the platform's — createApp builds it and
     // hands back what the few imperative edges below still need.
-    openPluginPanel: null,
   };
   platform.mediaUrls = new MediaUrlService({ api: platform.api, settings });
+  // Where a viewer's ranged reads go: a pinned copy, chunks of a download someone asked
+  // for, or the network keeping nothing. See fileChunks.js — the retention rule is the
+  // whole point of it having a name of its own.
+  platform.fileChunks = new FileChunks({ api: platform.api, mediaUrls: platform.mediaUrls });
   platform.plugins = new PluginHost(platform);
   // Commands consult the plugin host to hide/disable plugin commands that aren't
   // available right now (offline, or the plugin isn't responding).

package/packages/web/src/platform/mediaUrls.js

@@ -117,6 +117,16 @@ export class MediaUrlService {
       try {
         const res = await this.api.mintUrls(ids, op);
         const now = Date.now();
+        // Sweep before inserting. An expired entry can never be served again — `#fresh`
+        // only decides whether a HIT is usable — and nothing else ever removed one: the
+        // sole `invalidate` caller is a media element's error handler. Browsing a large
+        // collection mints per pictorial tile, so the map grew an entry per image, none
+        // reachable and none collectable for the life of the page. Two lines, and unlike
+        // the interning table in bl/intern.js, evicting here costs a re-mint rather than a
+        // duplicate realization.
+        for (const [key, entry] of this.cache) {
+          if (entry.expiresAt && entry.expiresAt < now) this.cache.delete(key);
+        }
         for (const [id, w] of waiting) {
           const got = res.urls?.[id];
           if (got) {