@christianirack/brainllm-runtime 0.10.6 → 0.10.11

package/brain-env.js

@@ -143,8 +143,8 @@ const strip = p => {
   const m = G.document && document.querySelector('meta[name=brain-base]'), b = (m && m.getAttribute('content')) || '/'
   return b !== '/' && (p + '/').startsWith(b) ? '/' + p.slice(b.length) : p
 }
-const read = () => {
-  const u = new URL(location.href)
+const read = (href = location.href) => {
+  const u = new URL(href, location.href)
   return [strip(u.pathname), paramsOf(), Object.fromEntries(u.searchParams)]
 }
 export function route() {
@@ -154,8 +154,10 @@ export function route() {
     const S = [...read(), false].map(v => sig(v))
     cur = { get path() { return S[0].v }, get params() { return S[1].v }, get query() { return S[2].v }, get navigating() { return S[3].v } }
     G.__brainRouted = on => {
-      if (on !== undefined) return void (S[3].v = !!on)
-      const v = read()
+      // A string is the destination URL: the router passes it before the new view mounts, since the Navigation API may
+      // not have committed location yet and the view would read the previous page's query.
+      if (on < 2) return void (S[3].v = !!on) // 0|1|boolean: the navigating flag; a string is a URL
+      const v = read(on)
       v.forEach((x, i) => JSON.stringify(untrack(() => S[i].v)) !== JSON.stringify(x) && (S[i].v = x)) // only what changed
     }
   }

package/brain-router.js

@@ -47,10 +47,11 @@ G.__brainNavigate = navigate // brain-form follows a server function's { redirec
 
 // route() lives in brain-env.js (it needs the core's signals; a page without islands downloads only this router):
 // after every client navigation the router calls the hook it installs.
-const routed = () => G.__brainRouted?.()
+const routed = to => G.__brainRouted?.(to)
 
 // Active links (§41.5): every internal <a href> to the current page gets aria-current="page" (the CSS hook is
 // [aria-current=page]); the others lose it. On start and after every client navigation.
+const marked = new WeakSet()
 const current = () => {
   if (!G.document || !G.location) return
   for (const a of document.querySelectorAll('a[href]')) {
@@ -60,8 +61,11 @@ const current = () => {
     } catch {
       continue
     }
-    if (u.origin === location.origin && u.pathname.replace(/\/$/, '') === location.pathname.replace(/\/$/, '')) a.setAttribute('aria-current', 'page')
-    else if (a.getAttribute('aria-current') === 'page') a.removeAttribute('aria-current')
+    // An aria-current the author wrote or bound is theirs: the router only manages the ones it set itself.
+    if (a.hasAttribute('aria-current') && !marked.has(a)) continue
+    // A link with its own query is current only on that exact query (`/?tab=b` is not the page `/?tab=a`).
+    if (u.origin === location.origin && u.pathname.replace(/\/$/, '') === location.pathname.replace(/\/$/, '') && (!u.search || u.search === location.search)) a.setAttribute('aria-current', 'page'), marked.add(a)
+    else if (marked.delete(a)) a.removeAttribute('aria-current')
   }
 }
 
@@ -217,8 +221,10 @@ export function router(o = {}) {
       const cur = document.querySelector(region), next = doc.querySelector(region)
       if (!cur || !next) return hard(url)
       // DOM, head and active links change in one callback (one frame); a newer navigation that started meanwhile skips it
+      const dest = r.redirected && r.url || url
       const swap = () => {
         if (my !== seq) return
+        routed(dest) // route() already shows the destination when the new view mounts
         dispose(cur)
         fresh()
         cur.replaceChildren(...[...next.childNodes].map(adopt))

package/brain-url.js

@@ -109,6 +109,26 @@ export function urlDialog(element, key, options) {
 }
 
 // Internal compiler binding for public select/tab/modal signals, once during component setup.
+let pending = null
+function flushUrl() {
+  const writes = pending
+  pending = null
+  if (!writes || !G.location) return
+  const next = new URL(G.location.href)
+  let replace = true
+  for (const [key, path, value, quiet] of writes) {
+    if (next.pathname !== path) continue
+    if (value == null) next.searchParams.delete(key)
+    else next.searchParams.set(key, value)
+    replace &&= quiet
+  }
+  if (next.search.length > 8192) { report('URL state exceeds 8 KiB; shorten public selections'); return }
+  if (next.href === G.location.href) return
+  try {
+    G.history[replace ? 'replaceState' : 'pushState'](G.history.state, '', next.href)
+    G.__brainRouted?.()
+  } catch { report('URL state history write failed; reduce the frequency of changes or use history: replace') }
+}
 export function urlBind(cell, key, options = {}) {
   if (G.__brainRoute || G.__brainSSR) {
     if (typeof key === 'string' && key.length <= 200 && !privateKey.test(key) && encode(untrack(() => cell.v)) != null) {
@@ -141,16 +161,10 @@ export function urlBind(cell, key, options = {}) {
     if (value === b.last) return
     b.last = value
     if (value == null) { report('URL state value is private, unsupported or too large; keep it out of navigation state'); return }
-    const next = new URL(G.location.href)
-    if (next.pathname !== b.path) return
-    if (value === encode(base)) next.searchParams.delete(key)
-    else next.searchParams.set(key, value)
-    if (next.search.length > 8192) { report('URL state exceeds 8 KiB; shorten public selections'); return }
-    if (next.href === G.location.href) return
-    try {
-      G.history[options.history === 'replace' ? 'replaceState' : 'pushState'](G.history.state, '', next.href)
-      G.__brainRouted?.()
-    } catch { report('URL state history write failed; reduce the frequency of changes or use history: replace') }
+    // Several keys written in one handler land in one history entry: writing each at once let the first write's
+    // route notification restore the others from the old URL before their own effect ran.
+    if (!pending) { pending = []; queueMicrotask(flushUrl) }
+    pending.push([key, b.path, value === encode(base) ? null : value, options.history === 'replace'])
   })
   fx(() => () => {
     if (bindings.get(key) === b) bindings.delete(key)

package/brain.js

@@ -246,13 +246,14 @@ const bind = (f, s) => {
   })
 }
 
-export function tpl(h) {
+export function tpl(h, s) {
   let n
   return () => {
     if (!n) {
-      const t = document.createElement('template')
+      const t = document.createElement('template'), c = t.content
       t.innerHTML = h
-      const c = t.content
+      // s: the compiler wrapped an SVG block fragment in <svg> so it parses in the SVG namespace; unwrap it
+      if (s) c.replaceChildren(...c.firstChild.childNodes)
       n = c.childNodes.length == 1 ? c.firstChild : c
     }
     // A: SSR stamps the clone, hydration adopts the node the server rendered (#285)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.10.6",
+  "version": "0.10.11",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/server.mjs

@@ -100,14 +100,15 @@ function intendedStatus(error) {
   return Number.isInteger(status) && STATUS_CODES[status] && (error instanceof HttpError && status >= 400 && status <= 599 || plain && status >= 400 && status < 500) ? status : null
 }
 // A deliberate public failure → { status, message } for f.error: a plain `{ message }` without a status (400) or an
-// author's Error subclass with a 4xx `status`. Plain `{ status, message }` keeps its message private (driver detail);
+// author's Error subclass with a 4xx `status`, or `throw { status: 404, message, public: true }` (BrainScript has no
+// `class`). Plain `{ status, message }` without `public` keeps its message private (driver detail);
 // built-in errors and bare `Error` messages stay private too.
 const BUILTIN_ERRORS = new Set([Error, TypeError, RangeError, SyntaxError, ReferenceError, EvalError, URIError, AggregateError].map(c => c.prototype))
 function publicError(error) {
   if (!error || typeof error !== 'object' || error instanceof HttpError) return null
   const proto = Object.getPrototypeOf(error), plain = proto === Object.prototype || proto === null
   const typed = error instanceof Error && !BUILTIN_ERRORS.has(proto)
-  const status = plain ? (error.status === undefined ? 400 : 0) : error.status, message = error.message
+  const status = plain ? (error.status === undefined ? 400 : error.public === true ? error.status : 0) : error.status, message = error.message
   if (!(plain || typed) || typeof message !== 'string' || !message || message.length > 500) return null
   return Number.isInteger(status) && status >= 400 && status < 500 && STATUS_CODES[status] ? { status, message } : null
 }
@@ -1089,6 +1090,11 @@ export function createServer(o = {}) {
   try {const path=join(dist,'brain-build.json'),meta=lstatSync(path);if(meta.isFile()&&!meta.isSymbolicLink()&&meta.size<=16384&&JSON.parse(readFileSync(path,'utf8')).compilerBranding===false)compilerBranding=false}catch{}
   const SECURITY={...DEFAULT_SECURITY}
   if(!compilerBranding)delete SECURITY['x-generated-by']
+  // brain.json `csp.frameAncestors` (written into the build policy) decides who may embed the pages: XFO cannot list
+  // origins, so it stays DENY only while the policy forbids every embedder, SAMEORIGIN for 'self' alone.
+  const ancestors = /(?:^|;)\s*frame-ancestors\s+([^;]*)/.exec(mf.csp || '')?.[1]?.trim() || "'none'"
+  if (ancestors === "'self'") SECURITY['x-frame-options'] = 'SAMEORIGIN'
+  else if (ancestors !== "'none'") delete SECURITY['x-frame-options']
   // brain.json `server` (§11.1), written into the manifest by the build; createServer options and env still win
   const SL = mf.server || {}
   const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? SL.timeoutMs ?? 10000)

package/shim/dom.js

@@ -181,6 +181,14 @@ class Node {
   getBoundingClientRect() {
     return { top: 0, left: 0, right: 0, bottom: 0, width: 0, height: 0, x: 0, y: 0 }
   }
+  getClientRects() { return [] }
+  // Layout and focus have no meaning while the server renders: an effect that calls them must not fail the build.
+  scrollIntoView() {}
+  scrollTo() {}
+  scrollBy() {}
+  focus() {}
+  blur() {}
+  select() {}
   contains(n) {
     for (; n; n = n.parentNode) if (n === this) return true
     return false