@abide/abide 0.114.1 → 0.116.0

package/src/compiler/classifyTemplate.ts

@@ -84,10 +84,10 @@ export type ClassifiedAttribute = {
     // 32.11 — a spread's attributes, less the ones the element names itself, kept written by a
     // binding of its own.
     | { kind: 'spread'; explicit: string[] }
-    // 32.5, 32.7, 32.8 — the property and the value, kept in step both ways. `reflects` is the
-    // attribute the property's value stands at in the tag, and `undefined` where it is not an
+    // 32.5, 32.7, 32.8, 32.73 — the property and the value, kept in step both ways. `reflects` is
+    // the attribute the property's value stands at in the tag, and `undefined` where it is not an
     // attribute: a `<textarea>`'s value is its text and a `<select>`'s is its options' `selected`,
-    // which the markup writes inside the tag (32.61).
+    // which the markup writes inside the tag (32.61), and a file input's files are no markup at all.
     | {
           kind: 'bound'
           bind: ValueBind
@@ -135,7 +135,7 @@ export function classifyAttributes(
         readsAnItem(holder: object): boolean
     },
 ): ClassifiedAttribute[] {
-    refuseTwoOwners(node)
+    refuseBinds(node)
     const groups = mergeGroupsOf(node)
     const sharing: ReturnType<typeof sharingOf>[] = []
     for (const group of groups) sharing.push(sharingOf(group, lowering))
@@ -210,7 +210,8 @@ export function classifyAttributes(
                 kind: 'bound',
                 bind,
                 reflects:
-                    bind === 'value' && node.lowerTag !== 'input'
+                    bind === 'files' ||
+                    (bind === 'value' && node.lowerTag !== 'input')
                         ? undefined
                         : bind === 'group'
                           ? 'checked'
@@ -354,15 +355,22 @@ function heldClasses(groups: MergeGroup[]): string[] {
 }
 
 /**
+ * 32.74 — A `bind:` AN ELEMENT HAS NO PROPERTY FOR IS REFUSED: `bind:vlaue` would otherwise be an
+ * attribute of that name, binding nothing and saying nothing.
+ *
  * 32.72 — WHAT A `bind:` WRITES IS THE BIND'S ALONE: `checked` beside `bind:checked` or
  * `bind:group`, `value` beside `bind:value`, any `bind:name` beside `name` — and an
  * `<option selected>` inside a `<select bind:value>`, and a `<textarea bind:value>`'s text. Two
  * owners of one value render whichever the browser keeps and move with whichever wrote last.
  */
-function refuseTwoOwners(node: ElementNode): void {
+function refuseBinds(node: ElementNode): void {
     for (const attribute of node.attributes) {
         const lower = attribute.lowerName
         if (!lower.startsWith('bind:') || lower === 'bind:element') continue
+        if (valueBindOf(lower) === undefined)
+            throw new Error(
+                `abide: <${node.tag}> has ${attribute.name}, which binds nothing — an element binds ${VALUE_BINDS.join(', ')} or element. RULEBOOK 32.74.`,
+            )
         const owned =
             lower === 'bind:group' ? 'checked' : lower.slice('bind:'.length)
         const beside = attributeOf(node, owned)
@@ -468,18 +476,17 @@ function isElementBind(lowerName: string): boolean {
 /**
  * The binds that keep a property and a value in step.
  *
- * 32.5, 32.7, 32.8 — both emitters ask: the server writes the value into the tag and the client
- * binds the property.
+ * 32.5, 32.7, 32.8, 32.73 — both emitters ask: the server writes the value into the tag, where it
+ * has one, and the client binds the property.
  */
-type ValueBind = 'value' | 'checked' | 'open' | 'group'
+const VALUE_BINDS = ['value', 'checked', 'open', 'group', 'files'] as const
+type ValueBind = (typeof VALUE_BINDS)[number]
 
 /** The value bind a folded attribute name is, or `undefined` for any other attribute. */
 function valueBindOf(lowerName: string): ValueBind | undefined {
-    if (lowerName === 'bind:value') return 'value'
-    if (lowerName === 'bind:checked') return 'checked'
-    if (lowerName === 'bind:open') return 'open'
-    if (lowerName === 'bind:group') return 'group'
-    return undefined
+    if (!lowerName.startsWith('bind:')) return undefined
+    const bind = lowerName.slice('bind:'.length) as ValueBind
+    return VALUE_BINDS.includes(bind) ? bind : undefined
 }
 
 /**

package/src/compiler/emitClient.ts

@@ -769,7 +769,7 @@ function elementUnits(
             handlers.push(
                 `${element}.addEventListener(${JSON.stringify(one.event)}, ${lowering.listener(one.attribute)})`,
             )
-        // 32.5, 32.7, 32.8 — THE PROPERTY AND THE VALUE, IN STEP BOTH WAYS: a watch on this
+        // 32.5, 32.7, 32.8, 32.73 — THE PROPERTY AND THE VALUE, IN STEP BOTH WAYS: a watch on this
         // region's scope writes the property, and a listener writes it back.
         // 32.8 — a group compares against the input's own value, read where the value is.
         else if (one.kind === 'bound' && one.bind === 'group')
@@ -782,6 +782,10 @@ function elementUnits(
                           : JSON.stringify(one.own.value)
                 }), ${SCOPE})`,
             )
+        else if (one.kind === 'bound' && one.bind === 'files')
+            binds.push(
+                `${lowering.use('bindFiles')}(${element}, ${lowering.reference(one.attribute)}, ${SCOPE})`,
+            )
         else if (one.kind === 'bound')
             binds.push(
                 `${lowering.use('bindProperty')}(${element}, ${JSON.stringify(one.bind)}, ${lowering.reference(one.attribute)}, ${SCOPE})`,

package/src/server/BRIDGE_VERSION.ts

@@ -1,3 +1,3 @@
 // The `abide-bridge` release a pairing command names, so a visitor's `bunx` runs the relay this
 // server speaks. `packages/abide/tests/claudeCode.test.ts` holds it to the bridge package's own.
-export const BRIDGE_VERSION = '0.3.3'
+export const BRIDGE_VERSION = '0.3.4'

package/src/server/IMAGE_TYPES.ts

@@ -0,0 +1,10 @@
+/**
+ * The image types a model is shown (44.36). A leaf, because `assistant` refuses a transcript image of
+ * any other and `/__abide/mcp` answers one of any other as its text (20.21).
+ */
+export const IMAGE_TYPES = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/gif',
+    'image/webp',
+])

package/src/server/OFFLINE_STALE.ts

@@ -0,0 +1,10 @@
+// 21.22, 21.23 — HOW LONG A COPY KEPT ON THE DEVICE STAYS SERVABLE once stale, where `ABIDE_OFFLINE`
+// registers its worker: a week, while the network answers or fails to — as long as Safari keeps an
+// unvisited site's storage.
+//
+// NO `max-age` BESIDE IT on a page or a `GET`: a copy reads `max-age` as its own life (18.14), and
+// a followed copy stale from the moment it landed would reload on every read. With no lifetime and
+// no `Last-Modified`, a cache holds the answer stale at once, which is all the two windows need.
+
+export const OFFLINE_STALE =
+    'stale-while-revalidate=604800, stale-if-error=604800'

package/src/server/answerRequest.ts

@@ -26,6 +26,8 @@ import { ERROR_META } from '#shared/ERROR_META.ts'
 import { escapeAttribute } from '#shared/escapeText.ts'
 import { type Failed, isFailed } from '#shared/Failed.ts'
 import { HandlerRoute } from '#shared/HandlerRoute.ts'
+import { KEEP_HEADER } from '#shared/KEEP_HEADER.ts'
+import { KEEP_OPENED } from '#shared/KEEP_OPENED.ts'
 import { health } from '#shared/health.ts'
 import { appName } from '#shared/log.ts'
 import { compose } from '#shared/Middleware.ts'
@@ -59,6 +61,7 @@ import { callerOrMint } from './callerOf.ts'
 import { settingOn } from './config.ts'
 import { compressAnswer } from './compressAnswer.ts'
 import { DOCUMENT_HEADERS } from './DOCUMENT_HEADERS.ts'
+import { OFFLINE_STALE } from './OFFLINE_STALE.ts'
 import { noteCallInRender } from './deferredBuilds.ts'
 import { answerMcp, openApi } from './generatedSurfaces.ts'
 import { type AppRung, failureOf, rungsOver } from './hooks.ts'
@@ -84,7 +87,7 @@ import {
     within,
     writtenStatus,
 } from './requestScope.ts'
-import { seedFor } from './seedBuffer.ts'
+import { callsOnly, seedFor } from './seedBuffer.ts'
 
 // One row of the server's table the compiler writes (`SERVER_TABLE`). The loader is a dynamic import
 // so a page's markup is off the boot path until an address asks for it, which is the same reason
@@ -159,6 +162,8 @@ export type AppSources = {
     errors: RankedError[]
     /** The document the error pages are painted into. */
     errorDocument: string
+    /** 21.22, 21.23 — whether a page registers the worker `ABIDE_OFFLINE` turns on (45.1). */
+    offline: boolean
     /** Every handler, keyed by its method and address (`handlerKey`), to what answers it. 16.2. */
     handlers: Map<string, Mounted>
     /**
@@ -186,11 +191,11 @@ export async function answerRequest(
     const method = request.method === 'HEAD' ? 'GET' : request.method
 
     // 25.1, 25.3, 26.17 — the principal and the account of the app are handlers abide mounts,
-    // answered as the app's are.
+    // answered as the app's are — 21.4, save that neither is the app's to keep on the device.
     const own = OWN_HANDLERS.get(asked)
     if (own !== undefined)
         return own.method === method
-            ? answerRpc(own, {}, url, request, app)
+            ? answerRpc(own, {}, url, request, app, false)
             : methodRefused(app, asked, [own.method])
     // 20.5, 20.9, 36.7 — a surface of abide's own, or a 404 where it answers nothing.
     const surface = SURFACES.get(asked)
@@ -229,7 +234,7 @@ export async function answerRequest(
     const file = app.published.get(decodedOrKept(asked))
     if (file !== undefined)
         return readsOnly(request)
-            ? publicResponse(request, file)
+            ? publicResponse(request, file, app.offline)
             : methodRefused(app, asked, READS)
 
     // 15.16 — an address that will not percent-decode names nothing, and is the caller's fault.
@@ -312,7 +317,8 @@ async function answerMatched(
     const url = new URL(request.url)
     const asked = url.pathname
     const params = (currentRequestScope() as RequestScope).params as Params
-    if ('handler' in found) return answerRpc(found, params, url, request, app)
+    if ('handler' in found)
+        return answerRpc(found, params, url, request, app, app.offline)
     const page = found
 
     // 30.16 — THE CLIENT ROUTER ASKING, not a reader loading the page. `middleware` has already run
@@ -333,6 +339,7 @@ async function answerMatched(
     // that stored the identity answer for a reader who sent no `accept-encoding` must not hand it
     // to one who did, nor the reverse.
     const headers = new Headers(DOCUMENT_HEADERS)
+    if (app.offline) headers.set('cache-control', `private, ${OFFLINE_STALE}`)
     // THE HEADERS A `GET` WOULD CARRY, and no render for a body nobody is sent — nor a caller
     // minted for a request that never becomes a page.
     if (request.method === 'HEAD')
@@ -350,9 +357,21 @@ async function answerMatched(
     // 11.32 — the page renders in a scope of its own, so what its values hold is this request's —
     // and 41.13, every call it makes is left for the browser's own call to be answered from.
     // 41.29 — BUT NOT A PAGE A SCRIPT FETCHED, which nothing hydrates: its entries would answer the
-    // next call this caller makes with what the render saw, a sign-in since included.
-    const hydrated = request.headers.get('sec-fetch-dest') !== 'empty'
-    beginRender({ seed: hydrated ? seedFor(caller) : SEEDS_NOTHING, calls: [] })
+    // next call this caller makes with what the render saw, a sign-in since included — save the one
+    // the worker fetched for the navigation it answers, which is the page that hydrates (45.23).
+    const keep = request.headers.get(KEEP_HEADER)
+    const hydrated =
+        keep === KEEP_OPENED ||
+        request.headers.get('sec-fetch-dest') !== 'empty'
+    // 41.30 — SAVE ONE THE WORKER KEEPS, whose early calls are what a later open of it starts.
+    beginRender({
+        seed: hydrated
+            ? seedFor(caller)
+            : keep !== null
+              ? callsOnly()
+              : SEEDS_NOTHING,
+        calls: [],
+    })
     // 41.1, 35.2 — THE DOCUMENT IS THE BUILT PAGE, read whole before there is a `Response` to commit a
     // status to: a refusal the page read, or a throw, is answered by the nearest error page at its own
     // status rather than as a 200 the stream then abandons.
@@ -561,6 +580,7 @@ export async function appSources(parts: SourceParts): Promise<AppSources> {
         },
         published,
         explained: parts.explained,
+        offline: client.offline,
         ...mounted,
     }
     for (const row of sources.routes) {
@@ -738,14 +758,23 @@ function laneFailure(
  * authored, and the content-type off the extension, which is what `Bun.file` already derives
  * rather than a table kept here.
  */
-function publicResponse(request: Request, file: PublicFile): Response {
+function publicResponse(
+    request: Request,
+    file: PublicFile,
+    offline: boolean,
+): Response {
     return answerBlobTagged(
         Bun.file(file.path, { type: file.type }),
         file.etag,
         request,
         // 21.12. Revalidated every time and cached in between, which is what an unhashed name
         // earns — the etag is what makes that one conditional request rather than one transfer.
-        new Headers({ 'cache-control': 'public, max-age=0, must-revalidate' }),
+        // 21.23 — and served stale where the device keeps it, while that request is made.
+        new Headers({
+            'cache-control': offline
+                ? `public, max-age=0, ${OFFLINE_STALE}`
+                : 'public, max-age=0, must-revalidate',
+        }),
         200,
     )
 }

package/src/server/answerRpc.ts

@@ -29,6 +29,7 @@ import {
 import { followAsEvents } from './answerSocket.ts'
 import { answerValue, namesEtag, sseHeaders } from './answerValue.ts'
 import { argsFor } from './argsFor.ts'
+import { OFFLINE_STALE } from './OFFLINE_STALE.ts'
 import { callerOf } from './callerOf.ts'
 import {
     argsDocumentOf,
@@ -233,6 +234,8 @@ export async function answerRpc(
     request: Request,
     // 16.38 — what paints a refusal for a request that came as a navigation.
     pages: ErrorPages,
+    // 21.22 — whether the device keeps what is answered.
+    offline: boolean,
 ): Promise<Response> {
     const pathname = url.pathname
     const origin = request.headers.get('origin')
@@ -300,6 +303,7 @@ export async function answerRpc(
         args,
         key,
         entry,
+        offline,
     )
     // A `Response` the handler built is its own — but the origin answer below is laid over it, so it
     // varies on `Origin` too (21.7), which `handlerHeaders` never reached.
@@ -350,6 +354,7 @@ async function answerOutcome(
     args: unknown,
     key: string | undefined,
     entry: unknown,
+    offline: boolean,
 ): Promise<Response> {
     const handler = found.handler
     if (!outcome.settled) return answered(failureOf(outcome.error))
@@ -380,13 +385,28 @@ async function answerOutcome(
         headers.set(VERSION_HEADER, etag)
         RPC_SERVER.served?.(handler, serving, key as string)
     }
-    // 21.8, 21.9, 21.11 — WHAT IS LEFT OF THE LIFE OF THE PRODUCTION ANSWERED, in place of `no-store`
-    // and nothing else. A `ttl` of Infinity is bounded by `invalidate` alone (11.35), which no cache
-    // downstream hears, so it keeps `no-store`.
-    if (Number.isFinite(deadline))
+    // 21.22 — A `GET` THE DEVICE KEEPS, where the worker is there to keep it: a value, not a
+    // refusal (16.40) nor a stream with no end to keep (16.32) — a generator's, or the lines a
+    // `jsonl` or an `sse` fixed.
+    const framing = currentRequestScope()?.framing
+    const kept =
+        offline &&
+        found.method === 'GET' &&
+        !isFailed(value) &&
+        !streams(value) &&
+        framing !== 'jsonl' &&
+        framing !== 'sse' &&
+        writtenStatus() < 300
+    // 21.8, 21.9, 21.11 — WHAT IS LEFT OF THE LIFE OF THE PRODUCTION ANSWERED, in place of
+    // `no-store` or ahead of 21.22's directives, and nothing else. 21.17 — a `ttl` of Infinity is
+    // bounded by `invalidate` alone (11.35), which no cache downstream hears, so it keeps the default.
+    const life = Number.isFinite(deadline)
+        ? `, max-age=${Math.max(0, Math.floor((deadline - Date.now()) / 1000))}`
+        : ''
+    if (life !== '' || kept)
         headers.set(
             'cache-control',
-            `private, max-age=${Math.max(0, Math.floor((deadline - Date.now()) / 1000))}`,
+            `private${life}${kept ? `, ${OFFLINE_STALE}` : ''}`,
         )
     // 18.19 — A READER HOLDING THIS VERSION IS TOLD SO, and sent no body.
     if (

package/src/server/answerWorker.ts

@@ -6,6 +6,9 @@
 // as bytecode (38.93), where a function has no source to read back.
 
 import { CLIENT_ADDRESS } from '#shared/ADDRESSES.ts'
+import { KEEP_HEADER } from '#shared/KEEP_HEADER.ts'
+import { KEEP_OPENED } from '#shared/KEEP_OPENED.ts'
+import { KEPT_HEADER } from '#shared/KEPT_HEADER.ts'
 import { MOUNT, mounted } from '#shared/mount.ts'
 import { NAVIGATION_HEADER } from '#shared/NAVIGATION_HEADER.ts'
 import {
@@ -14,6 +17,7 @@ import {
     OFFLINE_SAVED,
 } from '#shared/OFFLINE_CACHES.ts'
 import { PRINCIPAL_HEADER } from '#shared/PRINCIPAL_HEADER.ts'
+import { REACHED_MESSAGE } from '#shared/REACHED_MESSAGE.ts'
 import type { Manifest } from './manifestOf.ts'
 
 // What `framingOf` reads as a framed stream (16.32), and a binary's bytes (16.34), which may be one —
@@ -35,7 +39,7 @@ async function dropOurs(keeping) {
 }
 `
 
-// 45.3 through 45.8, and 45.13.
+// 45.3 through 45.8, 45.13, 45.17 through 45.21, and 45.24.
 const SAVING = `
 self.addEventListener('install', (event) => {
     event.waitUntil(
@@ -53,29 +57,27 @@ self.addEventListener('activate', (event) => {
             const cache = await caches.open(BUNDLE)
             for (const request of await cache.keys())
                 if (!FILES.has(request.url)) await cache.delete(request)
-            await self.registration.navigationPreload?.enable()
+            // A preload would ask the network for every navigation, a kept copy answered or not.
+            await self.registration.navigationPreload?.disable()
             await self.clients.claim()
             for (const client of await self.clients.matchAll({ type: 'window' }))
-                await fetch(client.url).then(
-                    (response) =>
-                        kept(response)
-                            ? keep(new Request(client.url), response)
-                            : response.body?.cancel(),
-                    () => {},
-                )
+                await keepPage(client.url)
         })(),
     )
 })
 
 self.addEventListener('message', (event) => {
-    if (event.data === 'rotated') event.waitUntil(caches.delete(SAVED))
+    if (event.data === 'rotated') event.waitUntil(dropSaved())
+    const reached = event.data?.[REACHED]
+    if (typeof reached === 'string' && reached.startsWith(\`\${self.location.origin}/\`))
+        event.waitUntil(keepReached(reached))
 })
 
 self.addEventListener('fetch', (event) => {
     const request = event.request
     if (request.mode === 'navigate') {
         if (request.method === 'GET') event.respondWith(answer(event, true))
-        else event.waitUntil(caches.delete(SAVED))
+        else event.waitUntil(dropSaved())
         return
     }
     if (request.method !== 'GET') return
@@ -94,39 +96,178 @@ self.addEventListener('fetch', (event) => {
     event.respondWith(answer(event, false))
 })
 
+// 45.17 through 45.20 — THE COPY KEPT, BY ITS OWN cache-control: fresh is answered and the network
+// not asked, stale within stale-while-revalidate is answered while the network is asked for the next
+// one — save by a request asking force-cache, a call whose wire asks again itself once it reads the
+// copy (RULEBOOK 16.80, 16.85), so asking here too would ask twice — and stale within stale-if-error
+// stands in where the network gives nothing. A request asking past every cache (a refresh, a load
+// after invalidate) is the network's alone; a navigation never is, since a reload offline would
+// otherwise be the page saying nothing was saved.
 async function answer(event, page) {
-    let response
+    const request = event.request
+    const bypass =
+        !page &&
+        (request.cache === 'no-cache' ||
+            request.cache === 'reload' ||
+            request.cache === 'no-store')
+    const saved = bypass
+        ? undefined
+        : await caches.match(request, { cacheName: SAVED, ignoreVary: true })
+    const life = saved === undefined ? undefined : lifeOf(saved)
+    if (life !== undefined) {
+        if (life.age < life.fresh) return marked(saved)
+        if (life.age < life.fresh + life.revalidate) {
+            if (request.cache !== 'force-cache')
+                event.waitUntil(
+                    fromNetwork(event, page, false).then(
+                        (response) => response.body?.cancel(),
+                        () => {},
+                    ),
+                )
+            return marked(saved)
+        }
+    }
     try {
-        response =
-            (page ? await event.preloadResponse : undefined) ??
-            (await fetch(event.request))
+        return await fromNetwork(event, page, page)
     } catch {
-        const saved = await caches.match(event.request, {
-            cacheName: SAVED,
-            ignoreVary: true,
-        })
-        return saved ?? (page ? offline() : Response.error())
+        if (life !== undefined && standsIn(life)) return marked(saved)
+        return page ? offline() : Response.error()
     }
+}
+
+// 45.22 — A COPY KEPT SAYS SO, and when the server answered it, so a page tells it from the network's.
+function marked(saved) {
+    const headers = new Headers(saved.headers)
+    headers.set(KEPT, saved.headers.get('date') ?? '')
+    return new Response(saved.body, {
+        status: saved.status,
+        statusText: saved.statusText,
+        headers,
+    })
+}
+
+// A page as the worker asks for it, whether a navigation or the worker keeping an open window's:
+// past the browser's cache, as a page kept, and with its redirects left to the page — one followed
+// would be saved under the address it was asked at, holding where it led (RULEBOOK 45.4, 45.21,
+// 45.23).
+function pageRequest(url, headers, keep) {
+    const asking = new Headers(headers)
+    asking.set(KEEP, keep)
+    return new Request(url, { headers: asking, redirect: 'manual', cache: 'no-cache' })
+}
+
+// 45.21 — PAST THE BROWSER'S OWN CACHE, which holds the same answers under the same headers and would
+// hand a revalidation the copy it is replacing. A navigation's request takes no init of its own, so it
+// is asked again by address, its redirects left to the page as a navigation's are — and 45.23, as a
+// page kept, which a script's fetch is not otherwise told from (RULEBOOK 41.29, 41.30), and as the
+// page the navigation opens where opened says it is, which then hydrates from what it seeded.
+async function fromNetwork(event, page, opened) {
+    const request = event.request
+    const asked = page
+        ? pageRequest(request.url, request.headers, opened ? OPENED : '1')
+        : new Request(request, { cache: 'no-cache' })
+    const since = drops
+    const response = await fetch(asked)
     // A copy nothing reads is a tee holding every chunk, so one is cloned only to be saved.
     const copy = kept(response) ? response.clone() : undefined
-    const rotated = response.headers.has(PRINCIPAL)
-    event.waitUntil(
-        (rotated ? caches.delete(SAVED) : Promise.resolve()).then(() =>
-            copy === undefined ? undefined : keep(event.request, copy),
-        ),
-    )
+    event.waitUntil(keep(request, copy, since, response.headers.has(PRINCIPAL)))
     return response
 }
 
+// 45.13, 45.24 — A PAGE NO NAVIGATION ASKED FOR, kept as a page behind the one opened is: an open
+// window's as the worker activates, and an address the router reached.
+function keepPage(url) {
+    const since = drops
+    return fetch(pageRequest(url, undefined, '1')).then((response) => {
+        // Nothing reads this answer, so one 45.3 or 45.4 turns away is let go here.
+        const copy = kept(response) ? response : undefined
+        if (copy === undefined) response.body?.cancel()
+        return keep(new Request(url), copy, since, response.headers.has(PRINCIPAL))
+    }, () => {})
+}
+
+// The addresses being kept, so one reached twice before its copy lands is asked for once.
+const reaching = new Set()
+
+// 45.24 — AN ADDRESS THE ROUTER REACHED, whose page no navigation asked for, so none is saved unless
+// this asks — and only where no copy saved would stand in offline: one that would is refreshed by the
+// page's own next load, and asking on every step renders each page twice. A page kept holds no seed
+// (RULEBOOK 41.29), so what a reload paints stale is markup its calls then answer over.
+async function keepReached(url) {
+    if (reaching.has(url)) return
+    reaching.add(url)
+    try {
+        const saved = await caches.match(url, { cacheName: SAVED, ignoreVary: true })
+        if (saved === undefined || !standsIn(lifeOf(saved))) await keepPage(url)
+    } finally {
+        reaching.delete(url)
+    }
+}
+
+// 45.19 — whether a copy kept still stands in where the network gives nothing.
+function standsIn(life) {
+    return life.age < life.fresh + life.error
+}
+
+// How old a kept copy is and how long each of its windows runs, in seconds; a copy with no date is
+// as old as it can be.
+function lifeOf(response) {
+    const directives = directivesOf(response)
+    const date = Date.parse(response.headers.get('date') ?? '')
+    // no-cache is never fresh; it and must-revalidate are never served stale.
+    const unfresh = directives.has('no-cache')
+    const unstale = unfresh || directives.has('must-revalidate')
+    const seconds = (name, closed) => {
+        const value = Number(directives.get(name))
+        return closed || !Number.isFinite(value) ? 0 : value
+    }
+    return {
+        age: Number.isNaN(date) ? Infinity : (Date.now() - date) / 1000,
+        fresh: seconds('max-age', unfresh),
+        revalidate: seconds('stale-while-revalidate', unstale),
+        error: seconds('stale-if-error', unstale),
+    }
+}
+
+// An answer's cache-control, by directive.
+function directivesOf(response) {
+    const directives = new Map()
+    for (const part of (response.headers.get('cache-control') ?? '').split(',')) {
+        const [name, value] = part.trim().toLowerCase().split('=')
+        directives.set(name, value)
+    }
+    return directives
+}
+
+// 45.3, 45.4 — a 200 whose cache-control lets a private cache store it, and no stream.
 function kept(response) {
     if (response.status !== 200) return false
+    if (directivesOf(response).has('no-store')) return false
     const type = response.headers.get('content-type') ?? ''
     return !STREAMED.some((streamed) => type.startsWith(streamed))
 }
 
-async function keep(request, response) {
+// 45.7 — EVERY PAGE SAVED DROPPED, and with them every copy asked for before the drop: one asked under
+// the cookies of then would land after it holding the caller signed out since. The drop an answer's
+// own abide-principal makes is the exception, since that answer is the new caller's.
+let drops = 0
+
+function dropSaved() {
+    drops += 1
+    return caches.delete(SAVED)
+}
+
+// Saves a copy 45.3 and 45.4 let through where no drop has come since its request was asked — after
+// the drop its own answer makes where that answer rotated the principal — and cancels one where one has.
+async function keep(request, copy, since, rotated) {
+    if (rotated) {
+        await dropSaved()
+        since = drops
+    }
+    if (copy === undefined) return
+    if (since !== drops) return copy.body?.cancel()
     const cache = await caches.open(SAVED)
-    await cache.put(request, response)
+    await cache.put(request, copy)
 }
 
 function offline() {
@@ -178,7 +319,11 @@ export function answerWorker(manifest: Manifest | undefined): Response {
         for (const name of bundleFiles(manifest))
             paths.push(mounted(`${CLIENT_ADDRESS}/${name}`))
         script = `${CACHES}const PRINCIPAL = ${JSON.stringify(PRINCIPAL_HEADER)}
+const KEPT = ${JSON.stringify(KEPT_HEADER)}
+const KEEP = ${JSON.stringify(KEEP_HEADER)}
+const OPENED = ${JSON.stringify(KEEP_OPENED)}
 const NAVIGATION = ${JSON.stringify(NAVIGATION_HEADER)}
+const REACHED = ${JSON.stringify(REACHED_MESSAGE)}
 // 45.4 — the types a stream 16.32 frames, which has no end to save.
 const STREAMED = ${JSON.stringify(STREAMED_TYPES)}
 const OFFLINE = ${JSON.stringify(OFFLINE)}