@christianirack/brainllm-runtime 0.1.0 → 0.4.0

package/server/templates/gcs-adapter.mjs

@@ -0,0 +1,99 @@
+// Private server worker for @google-cloud/storage 8.4.0. ADC only; stdout is a bounded machine result.
+import { constants } from 'node:fs'
+import { open, realpath, lstat, unlink } from 'node:fs/promises'
+import { join, sep } from 'node:path'
+import { createHash } from 'node:crypto'
+import { pipeline } from 'node:stream/promises'
+import { Transform } from 'node:stream'
+import { pathToFileURL } from 'node:url'
+const MAX = 20 * 1024 * 1024
+const fail = () => { throw Error('GCS_OPERATION_FAILED') }
+const safe = key => typeof key === 'string' && key.length <= 512 && key.split('/').every(part => /^[a-zA-Z0-9_.-]+$/.test(part) && part !== '.' && part !== '..')
+export async function validate(input) {
+  if (input?.schemaVersion !== 1 || !/^[a-z0-9][a-z0-9._-]{1,61}[a-z0-9]$/.test(input.bucket || '') || !/^[a-zA-Z0-9_-]{1,80}$/.test(input.prefix || '') || !['write', 'read', 'delete'].includes(input.request?.op) || !Array.isArray(input.request.objects) || !input.request.objects.length || input.request.objects.length > 9 || typeof input.root !== 'string') fail()
+  const root = await realpath(input.root)
+  if ((await lstat(input.root)).isSymbolicLink()) fail()
+  const paths = new Set()
+  for (const object of input.request.objects) {
+    if (!safe(object.key) || !object.key.startsWith(input.bucket + '/' + input.prefix + '/') || paths.has(object.key)) fail()
+    paths.add(object.key)
+    if (!object.key.split('/').some(part => /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(part))) fail()
+    if (input.request.op !== 'delete') {
+      if (!Number.isSafeInteger(object.bytes) || object.bytes < 1 || object.bytes > MAX || !/^[a-f0-9]{64}$/.test(object.sha256 || '')) fail()
+      if (input.request.op === 'write' && (!safe(object.source) || object.source !== object.key || !['image/png', 'image/jpeg', 'image/webp'].includes(object.contentType) || !object.key.endsWith('-' + object.sha256 + '.' + object.contentType.slice(6)))) fail()
+      if (input.request.op === 'read' && (!object.generation || !/^gcs-read\/[a-f0-9]{32}\.bin$/.test(object.target || ''))) fail()
+    }
+    if (object.generation != null && (typeof object.generation !== 'string' || !/^[0-9]{0,32}$/.test(object.generation))) fail()
+  }
+  return root
+}
+async function localPath(root, key, existing) {
+  if (!safe(key)) fail()
+  let current = root
+  for (const part of key.split('/')) {
+    current = join(current, part)
+    let entry
+    try { entry = await lstat(current) } catch (error) { if (!existing && error.code === 'ENOENT') continue; fail() }
+    if (entry.isSymbolicLink()) fail()
+  }
+  if (!current.startsWith(root + sep)) fail()
+  return current
+}
+function checkedStream(expected) {
+  let bytes = 0; const digest = createHash('sha256')
+  return new Transform({ transform(chunk, encoding, callback) {
+    bytes += chunk.length
+    if (bytes > MAX || bytes > expected.bytes) return callback(Error('GCS_OPERATION_FAILED'))
+    digest.update(chunk); callback(null, chunk)
+  }, flush(callback) { callback(bytes === expected.bytes && digest.digest('hex') === expected.sha256 ? null : Error('GCS_OPERATION_FAILED')) } })
+}
+export async function execute(input, createStorage) {
+  const root = await validate(input)
+  const storage = await createStorage(), bucket = storage.bucket(input.bucket)
+  const [policy] = await bucket.getMetadata()
+  if (policy.iamConfiguration?.publicAccessPrevention !== 'enforced' || policy.iamConfiguration?.uniformBucketLevelAccess?.enabled !== true) fail()
+  const output = []
+  for (const object of input.request.objects) {
+    const remoteKey = object.key.slice(input.bucket.length + 1), file = bucket.file(remoteKey)
+    if (input.request.op === 'write') {
+      const source = await localPath(root, object.source, true), sourceHandle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0))
+      try {
+        const stat = await sourceHandle.stat(); if (!stat.isFile() || stat.size !== object.bytes) fail()
+        try {
+          await pipeline(sourceHandle.createReadStream({ autoClose: true }), checkedStream(object), file.createWriteStream({ resumable: false, validation: 'crc32c', preconditionOpts: { ifGenerationMatch: 0 }, metadata: { contentType: object.contentType, cacheControl: 'private, no-store', metadata: { sha256: object.sha256 } } }))
+        } catch (error) { if (![412, '412'].includes(error.code)) fail() }
+      } finally { await sourceHandle.close().catch(() => {}) }
+      const [metadata] = await file.getMetadata()
+      if (String(metadata.size) !== String(object.bytes) || metadata.metadata?.sha256 !== object.sha256 || metadata.contentType !== object.contentType || !/^[0-9]{1,32}$/.test(metadata.generation || '')) fail()
+      output.push({ key: object.key, generation: metadata.generation })
+    } else if (input.request.op === 'read') {
+      if (!object.generation) fail()
+      const target = await localPath(root, object.target, false), handle = await open(target, constants.O_WRONLY | (constants.O_NOFOLLOW || 0))
+      const stat = await handle.stat(); if (!stat.isFile() || stat.size !== 0) { await handle.close(); fail() }
+      let completed = false
+      try { await pipeline(bucket.file(remoteKey, { generation: object.generation }).createReadStream({ validation: 'crc32c' }), checkedStream(object), handle.createWriteStream({ autoClose: true, flush: true })); completed = true } finally { await handle.close().catch(() => {}); if (!completed) await unlink(target).catch(() => {}) }
+      output.push({ key: object.key, generation: object.generation })
+    } else {
+      let generation = object.generation
+      if (!generation) {
+        let metadata
+        try { [metadata] = await file.getMetadata() } catch (error) { if ([404, '404'].includes(error.code)) { output.push({ key: object.key, deleted: true }); continue } fail() }
+        const expected = /-([a-f0-9]{64})\.(?:png|jpeg|webp)$/.exec(object.key)?.[1]
+        if (!expected || metadata.metadata?.sha256 !== expected || !/^[0-9]{1,32}$/.test(metadata.generation || '')) fail()
+        generation = metadata.generation
+      }
+      try { await file.delete({ ifGenerationMatch: generation, ignoreNotFound: true }) } catch (error) { if (![404, '404'].includes(error.code)) fail() }
+      output.push({ key: object.key, deleted: true })
+    }
+  }
+  return { ok: true, objects: output }
+}
+async function main() {
+  const chunks = []; let bytes = 0
+  for await (const chunk of process.stdin) { bytes += chunk.length; if (bytes > 32768) fail();chunks.push(chunk) }
+  const input = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  if (process.argv.includes('--validate')) { await validate(input); return { ok: true } }
+  if (process.env.STORAGE_EMULATOR_HOST || process.env.GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES) fail()
+  return execute(input, async () => { const { Storage } = await import('@google-cloud/storage'); return new Storage({ retryOptions: { autoRetry: false, maxRetries: 0 } }) })
+}
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) main().then(result => process.stdout.write(JSON.stringify(result)), () => { process.stdout.write('{"ok":false,"error":"GCS_OPERATION_FAILED"}'); process.exitCode = 1 })

package/templates/google-signin.js

@@ -0,0 +1,102 @@
+// Application-owned GIS adapter. No credentials, tokens, private errors or session data are logged or stored.
+const SDK = 'https://accounts.google.com/gsi/client'
+let loading = null, active = null
+const sdk = () => {
+  if (globalThis.google?.accounts?.id) return Promise.resolve(globalThis.google.accounts.id)
+  if (loading) return loading
+  loading = new Promise((resolve, reject) => {
+    const doc = globalThis.document, existing = doc.querySelector(`script[src="${SDK}"]`)
+    const script = existing || doc.createElement('script')
+    const done = error => {
+      clearTimeout(timer); script.removeEventListener('load', loaded); script.removeEventListener('error', failed)
+      if (error) { if (!existing) script.remove(); reject(Error('Google sign-in is unavailable')) }
+      else resolve(globalThis.google.accounts.id)
+    }
+    const loaded = () => globalThis.google?.accounts?.id ? done(false) : done(true), failed = () => done(true)
+    const timer = setTimeout(failed, 6000)
+    script.addEventListener('load', loaded); script.addEventListener('error', failed)
+    if (!existing) { script.src = SDK; script.async = true; script.defer = true; doc.head.appendChild(script) }
+  }).catch(error => { loading = null; throw error })
+  return loading
+}
+export default {
+  mount(element, initial = {}) {
+    if (active) throw Error('Only one Google sign-in widget may be active')
+    let props = initial, alive = true, busy = false, pending = null
+    const owner = {}; active = owner
+    const notify = (message, waiting, signedIn = false) => {
+      if (!alive) return
+      busy = waiting; element.setAttribute('aria-busy', String(waiting))
+      if ('inert' in element) element.inert = waiting
+      if (typeof props.onState === 'function') props.onState({ message, busy: waiting, signedIn })
+    }
+    const request = async (path, body, method = 'POST') => {
+      const controller = new AbortController(); pending = controller
+      const timer = setTimeout(() => controller.abort(), 8000)
+      try {
+        const base = globalThis.document?.querySelector('meta[name=brain-base]')?.getAttribute('content') || ''
+        if (base && (!base.startsWith('/') || base.startsWith('//') || /[\\?#\x00-\x20]/.test(base))) throw Error('Invalid application base')
+        const response = await fetch(base.replace(/\/$/, '') + path, { method, credentials: 'same-origin', headers: body == null ? {} : { 'content-type': 'application/json' }, ...(body == null ? {} : { body: JSON.stringify(body) }), signal: controller.signal })
+        if (!response.ok) return { $status: response.status }
+        return await response.json()
+      } finally { clearTimeout(timer); if (pending === controller) pending = null }
+    }
+    const failed = () => notify('Sign-in could not be completed. Retry or use email sign-in.', false)
+    const start = async () => {
+      if (!alive || busy) return
+      notify('Preparing secure sign-in.', true)
+      try {
+        const current = await request('/_brain/auth/me', null, 'GET')
+        if (!alive) return
+        if (current?.user) { element.replaceChildren(); return notify('You are signed in.', false, true) }
+        if (current?.$status !== 401) return failed()
+        const renewed = await request('/_brain/auth/refresh')
+        if (!alive) return
+        if (renewed?.user) { notify('You are signed in.', false, true); globalThis.location?.reload(); return }
+        if (renewed?.$status !== 401) return failed()
+        const challenge = await request('/_brain/auth/google/challenge')
+        if (!alive) return
+        if (!challenge || !/^[a-zA-Z0-9._-]{1,255}\.apps\.googleusercontent\.com$/.test(challenge.client_id) || !/^[a-f0-9]{64}$/.test(challenge.nonce)) return failed()
+        const api = await sdk()
+        if (!alive) return
+        api.initialize({ client_id: challenge.client_id, nonce: challenge.nonce, callback: async result => {
+          if (!alive || busy) return
+          notify('Completing secure sign-in.', true)
+          try {
+            if (typeof result?.credential !== 'string' || result.credential.length > 16384) return failed()
+            const session = await request('/_brain/auth/google', { credential: result.credential })
+            if (!alive) return
+            if (!session?.user) return failed()
+            notify('You are signed in.', false, true)
+            // A full auth-boundary reload forgets all prior user-specific in-memory application state.
+            globalThis.location?.reload()
+          } catch { if (alive) failed() }
+        } })
+        element.replaceChildren()
+        api.renderButton(element, { type: 'standard', theme: 'outline', size: 'large', text: 'signin_with', width: 280 })
+        notify('Choose Google sign-in or use email sign-in.', false)
+      } catch { if (alive) failed() }
+    }
+    void start()
+    return {
+      update(next) {
+        props = next || {}
+        if (!alive || busy) return
+        if (props.action === 'logout') {
+          notify('Signing out.', true)
+          void request('/_brain/auth/logout').then(result => {
+            if (!alive) return
+            if (!result?.ok) return failed()
+            notify('You are signed out.', false); globalThis.location?.reload()
+          }, () => { if (alive) failed() })
+        } else void start()
+      },
+      destroy() {
+        if (!alive) return
+        alive = false; pending?.abort(); element.replaceChildren(); element.removeAttribute('aria-busy')
+        if ('inert' in element) element.inert = false
+        if (active === owner) active = null
+      },
+    }
+  },
+}

package/ui/button.brain

@@ -14,7 +14,7 @@
 <style>
   button {
     display: inline-flex; align-items: center; gap: var(--space-2);
-    padding: var(--space-2) var(--space-4); min-height: 40px;
+    padding: var(--space-2) var(--space-4); min-height: 44px;
     font: 600 15px/1.2 var(--font); border-radius: var(--radius-sm); cursor: pointer;
     color: var(--on-accent); background: var(--accent); border: 1px solid var(--accent);
     box-shadow: var(--shadow);

package/ui/checkbox.brain

@@ -8,6 +8,7 @@
 </div>
 <style>
   label { display: inline-flex; align-items: center; gap: var(--space-2); font: 15px/1.4 var(--font); color: var(--fg); cursor: pointer; }
-  input { width: 18px; height: 18px; accent-color: var(--accent); }
+  input { width: 18px; height: 18px; }
   .error { font-size: 13px; color: var(--bad); margin: var(--space-1) 0 0; }
+  @supports (accent-color: auto) { input { accent-color: var(--accent); } }
 </style>

package/ui/dialog.brain

@@ -1,9 +1,10 @@
-<meta props="title:str closeLabel:str='Close'" emits="close" expose="open close">
+<meta props="title:str closeLabel:str='Close' urlKey:str=''" emits="close" expose="open close">
 <script>
   let dlg = ref()
   // native modal <dialog>: focus moves inside, the rest of the page is inert, Escape closes
   const open = () => { if (!dlg.open) dlg.showModal() }
   const close = () => { if (dlg.open) dlg.close() }
+  fx(() => { if (dlg) return urlDialog(dlg, urlKey) })
 </script>
 <dialog bind:ref={dlg} aria-labelledby="dlg-title" on:close={emit('close')}>
   <header>
@@ -17,13 +18,14 @@
   dialog {
     width: min(520px, calc(100vw - 32px)); padding: 0; border: 1px solid var(--glass-edge);
     border-radius: var(--radius-lg); color: var(--fg); background: var(--glass); box-shadow: var(--shadow);
-    backdrop-filter: blur(24px) saturate(1.4);
+
   }
-  dialog::backdrop { background: var(--scrim); backdrop-filter: blur(4px); }
+  dialog::backdrop { background: var(--scrim); }
   header { display: flex; align-items: center; justify-content: space-between; padding: var(--space-4) var(--space-4) 0; }
   h2 { font: 650 18px/1.3 var(--font); margin: 0; }
   .x { font-size: 22px; line-height: 1; width: 36px; height: 36px; border: 0; border-radius: var(--radius-sm); color: var(--muted); background: var(--surface); cursor: pointer; }
   .body { padding: var(--space-4); }
   footer { display: flex; justify-content: flex-end; gap: var(--space-2); padding: 0 var(--space-4) var(--space-4); }
   footer:empty { display: none; }
+  @supports (backdrop-filter: blur(1px)) { dialog { backdrop-filter: blur(24px) saturate(1.4); } dialog::backdrop { backdrop-filter: blur(4px); } }
 </style>

package/ui/error-state.brain

@@ -10,7 +10,7 @@
     if (e.kind === 'timeout') return 'The server took too long to answer.'
     if (e.kind === 'schema') return 'The server sent something unexpected.'
     if (e.status === 401) return 'Sign in to continue.'
-    if (e.status === 403) return e.message && e.message !== 'Forbidden' ? 'You do not have permission: ' + e.message : 'You do not have permission to see this.'
+    if (e.status === 403) return 'You do not have permission to see this.'
     if (e.status === 404) return 'Not found.'
     if (e.status === 422) return 'Check the highlighted fields.'
     if (e.status === 429) return 'Too many requests. Trying again in ' + (e.retryAfter || 30) + ' seconds.'

package/ui/input.brain

@@ -1,7 +1,8 @@
-<meta props="label:str value:str~ type:str='text' name:str? placeholder:str? autocomplete:str? required:bool=false disabled:bool=false error:str? help:str?">
+<meta props="label:str value:str~ type:str='text' step:str='any' name:str? placeholder:str? autocomplete:str? required:bool=false disabled:bool=false error:str? help:str?">
 <Field label={label} error={error} help={help}>
   <input
     type={type}
+    step={type === 'number' ? step : null}
     name={name}
     placeholder={placeholder}
     autocomplete={autocomplete}
@@ -13,8 +14,8 @@
 </Field>
 <style>
   input {
-    width: 100%; min-height: 40px; padding: var(--space-2) var(--space-3);
-    font: 15px/1.4 var(--font); color: var(--fg); background: var(--surface);
+    width: 100%; min-height: 44px; padding: var(--space-2) var(--space-3);
+    font: 16px/1.4 var(--font); color: var(--fg); background: var(--surface);
     border: 1px solid var(--line); border-radius: var(--radius-sm);
   }
   input:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }

package/ui/menu.brain

@@ -54,7 +54,10 @@
   .menu > button { font: 600 14px/1.2 var(--font); padding: var(--space-2) var(--space-3); border: 1px solid var(--glass-edge); border-radius: var(--radius-sm); color: var(--fg); background: var(--glass); cursor: pointer; }
   .pop {
     position: absolute; top: calc(100% + 6px); left: 0; min-width: 180px; display: grid; padding: var(--space-1); z-index: 50;
-    border: 1px solid var(--glass-edge); border-radius: var(--radius); background: var(--glass); box-shadow: var(--shadow); backdrop-filter: blur(20px) saturate(1.4);
+    border: 1px solid var(--glass-edge); border-radius: var(--radius); background: var(--glass); box-shadow: var(--shadow);
+  }
+  @supports (backdrop-filter: blur(20px)) {
+    .pop { backdrop-filter: blur(20px) saturate(1.4); }
   }
   .pop[hidden] { display: none; }
   [role=menuitem] { text-align: left; font: 14px/1.3 var(--font); padding: var(--space-2) var(--space-3); border: 0; border-radius: var(--radius-sm); color: var(--fg); background: transparent; cursor: pointer; }

package/ui/select.brain

@@ -20,8 +20,8 @@
 </Field>
 <style>
   select {
-    width: 100%; min-height: 40px; padding: var(--space-2) var(--space-3);
-    font: 15px/1.4 var(--font); color: var(--fg); background: var(--surface);
+    width: 100%; min-height: 44px; padding: var(--space-2) var(--space-3);
+    font: 16px/1.4 var(--font); color: var(--fg); background: var(--surface);
     border: 1px solid var(--line); border-radius: var(--radius-sm);
   }
   select:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }

package/ui/toast.brain

@@ -36,7 +36,10 @@
   .toast {
     display: flex; align-items: center; gap: var(--space-3); padding: var(--space-3) var(--space-4); min-width: 240px;
     font: 14px/1.4 var(--font); color: var(--fg); background: var(--glass); border: 1px solid var(--glass-edge);
-    border-radius: var(--radius); box-shadow: var(--shadow); backdrop-filter: blur(20px) saturate(1.4);
+    border-radius: var(--radius); box-shadow: var(--shadow);
+  }
+  @supports (backdrop-filter: blur(20px)) {
+    .toast { backdrop-filter: blur(20px) saturate(1.4); }
   }
   .toast.ok { border-color: var(--ok); }
   .toast.bad { border-color: var(--bad); }