@christianirack/brainllm-runtime 0.8.11 → 0.8.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/server.mjs

@@ -28,7 +28,7 @@ import { BlockList, isIP } from 'node:net'
 import { Readable } from 'node:stream'
 import zlib from 'node:zlib'
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'
-import { existsSync, readFileSync, realpathSync, statSync, lstatSync } from 'node:fs'
+import { closeSync, existsSync, openSync, readFileSync, readSync, realpathSync, statSync, lstatSync } from 'node:fs'
 import * as Module from 'node:module'
 import { basename, dirname, extname, join, normalize, resolve, sep } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
@@ -201,6 +201,17 @@ function bodyEncoding(req, status, headers) {
   if (status < 200 || status === 204 || status === 206 || status === 304 || headers['content-encoding'] || !COMPRESSIBLE.test(headers['content-type'] || '') || /no-transform/i.test(headers['cache-control'] || '')) return null
   return acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] || ''
 }
+// One `bytes=` span of a file of `size` bytes (RFC 9110 §14): { start, end } inclusive, false when it cannot be
+// satisfied (416), or null when the header is not one well-formed span (several, another unit, reversed): the whole
+// file is sent then, which the RFC allows.
+function byteRange(header, size) {
+  const m = /^bytes=(\d*)-(\d*)$/.exec(String(header).trim())
+  if (!m || (m[1] === '' && m[2] === '')) return null
+  if (m[1] === '') return Number(m[2]) > 0 && size > 0 ? { start: Math.max(0, size - Number(m[2])), end: size - 1 } : false
+  const start = Number(m[1])
+  if (m[2] !== '' && Number(m[2]) < start) return null
+  return start < size ? { start, end: m[2] === '' ? size - 1 : Math.min(Number(m[2]), size - 1) } : false
+}
 const encodeBody = (enc, buf) => enc === 'zstd' ? zlib.zstdCompressSync(buf) : enc === 'br' ? zlib.brotliCompressSync(buf, { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5, [zlib.constants.BROTLI_PARAM_SIZE_HINT]: buf.length } }) : zlib.gzipSync(buf)
 const encodeStream = enc => enc === 'zstd' ? zlib.createZstdCompress() : enc === 'br' ? zlib.createBrotliCompress({ params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5 } }) : zlib.createGzip()
 
@@ -220,11 +231,14 @@ function googleSignInPage(page) {
     for (const item of tag.slice(5, -1).matchAll(/([^\s=/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g)) {
       const key = item[1].toLowerCase(); if (!attrs.has(key)) attrs.set(key, item[2] ?? item[3] ?? item[4] ?? '')
     }
-    if (attrs.get('name')?.toLowerCase() === 'brain-google-signin' && attrs.get('content') === '1') return true
+    // Google's and Apple's sign-in popups both answer through window.opener.
+    if (['brain-google-signin', 'brain-apple-signin'].includes(attrs.get('name')?.toLowerCase()) && attrs.get('content') === '1') return true
   }
   return false
 }
 
+// One-use provider cookies (Google nonce, Apple nonce, LinkedIn state): relayed to the backend and cleared at logout.
+const PROVIDER_COOKIES = ['__Host-brain-google', '__Host-brain-apple', '__Host-brain-linkedin']
 // One configured loopback authority. No user-controlled target, proxy, redirect, auth cache or pending queue.
 // ctx.backend.files(bucket): the same file calls as job and route handlers (docs/backend/files.md).
 function bucketClient(target, key, bucket, readBudgetMs = () => 0) {
@@ -365,7 +379,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
             for (const value of backend.headers['set-cookie'] || []) {
               if (value.length > 8192 || /[\r\n]/.test(value)) return finish(true)
               const name = value.split('=', 1)[0]
-              if (names.has(name) || name === '__Host-brain-google') cleared.push(value)
+              if (names.has(name) || PROVIDER_COOKIES.includes(name)) cleared.push(value)
             }
             finish(false, { 'set-cookie': cleared, 'clear-site-data': '"storage"' })
           })
@@ -439,14 +453,14 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
     const selected = []
     for (const part of String(req.headers.cookie || '').split(';')) {
       const name = part.trim().split('=')[0]
-      if (['__Host-brain','__Host-brain-access','__Host-brain-refresh','__Host-brain-google'].includes(name)) selected.push(part.trim())
+      if (['__Host-brain','__Host-brain-access','__Host-brain-refresh',...PROVIDER_COOKIES].includes(name)) selected.push(part.trim())
     }
     if (selected.length) headers.cookie = selected.join('; ')
     const client = forwardedFor(req)
     if (client) headers['x-forwarded-for'] = client
     return headers
   }
-  const nativeCookies = values => (values || []).filter(value => /^(?:__Host-brain(?:-access|-refresh|-google)?)=/.test(value) && value.length <= 8192).slice(0,8)
+  const nativeCookies = values => (values || []).filter(value => /^(?:__Host-brain(?:-access|-refresh|-google|-apple|-linkedin)?)=/.test(value) && value.length <= 8192).slice(0,8)
   // /_brain/files: both directions stream with backpressure. The bucket enforces its own maxBytes and access checks.
   function fileStream(req, res, url, rid) {
     if (stopped || streams >= 32) throw bridgeBusy('Backend stream capacity is unavailable')
@@ -1027,6 +1041,48 @@ export function createServer(o = {}) {
     }
     return resolveClient(req.socket.remoteAddress, forwarded, proxies)
   }
+  // platform.access (docs/backend/access.md): /api, /_brain and /s answer this site only. Refused sources are counted
+  // per client address (at most 512, the oldest dropped) for `brain access sources`, and logged at most 16 a minute.
+  const access = accessPolicy(o.access ?? mf.access ?? {}, mf.site || env.PUBLIC_SITE_URL)
+  const refusedSources = new Map()
+  const budgetKey = `edge ${++servers} `
+  let accessWindow = 0, accessLogs = 0, inFlight = 0, limitedWindow = 0, limited = 0, limitedLogs = 0
+  // the dynamic budget (accessBudget) and the in-flight cap: past either the answer is an immediate 429 or 503 with
+  // Retry-After, no queue, and one log line per minute sums what was turned away
+  const overBudget = (req, res, path, client) => {
+    const wait = access ? accessBudget(path, client, access, budgetKey) : 0
+    const busy = !wait && access.concurrency !== null && !ACCESS_EXEMPT.test(path) && inFlight >= access.concurrency
+    if (!wait && !busy) {
+      if (access.concurrency !== null) { inFlight++; res.once('close', () => inFlight--) }
+      return false
+    }
+    const minute = Math.floor(Date.now() / 60000)
+    if (limitedWindow !== minute) {
+      if (limited) log('warn', 'requests limited', { count: limited, minute: new Date(limitedWindow * 60000).toISOString(), fix: 'raise platform.access.perMinute or concurrency if real visitors are among them' })
+      limitedWindow = minute; limited = 0; limitedLogs = 0
+    }
+    limited++
+    if (limitedLogs++ < 4) log('warn', 'request limited', { ip: client, path: String(path).slice(0, 256), reason: busy ? 'concurrency' : 'perMinute', userAgent: typeof req.headers['user-agent'] === 'string' ? req.headers['user-agent'].slice(0, 256) : null })
+    send(res, busy ? 503 : 429, busy ? 'Busy, try again shortly' : 'Too many requests', { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store', 'retry-after': String(busy ? 2 : wait) })
+    return true
+  }
+  const accessRefused = (req, rid, path, client, reason) => {
+    const bound = v => typeof v === 'string' ? v.slice(0, 256) : null
+    const now = new Date().toISOString()
+    let entry = refusedSources.get(client)
+    if (entry) refusedSources.delete(client)
+    else {
+      if (refusedSources.size >= 512) refusedSources.delete(refusedSources.keys().next().value)
+      entry = { ip: client, count: 0, first: now, reasons: {} }
+    }
+    entry.count++; entry.last = now; entry.reasons[reason] = (entry.reasons[reason] || 0) + 1
+    Object.assign(entry, { path: bound(path), origin: bound(req.headers.origin), referer: bound(req.headers.referer), host: bound(req.headers['x-forwarded-host'] || req.headers.host), userAgent: bound(req.headers['user-agent']), country: bound(req.headers['cf-ipcountry']) })
+    refusedSources.set(client, entry)
+    const minute = Math.floor(Date.now() / 60000)
+    if (accessWindow !== minute) { accessWindow = minute; accessLogs = 0 }
+    if (accessLogs++ >= 16) return
+    log('warn', 'access refused', { code: 'B0752', reason, rid, ip: client, path: entry.path, origin: entry.origin, referer: entry.referer, secFetchSite: bound(req.headers['sec-fetch-site']), host: entry.host, userAgent: entry.userAgent, fix: 'the native API answers this site only; a page of the site, an API key, or an address in platform.access.ips passes. Run brain explain B0752' })
+  }
   // server/routes/* of the native backend, listed by the build: only these exact shapes cross the bridge
   const nativeRoutes = (Array.isArray(mf.nativeRoutes) ? mf.nativeRoutes : []).map(route => {
     if (typeof route?.path !== 'string' || !Array.isArray(route.headers)) throw Error('Manifest nativeRoutes must list path and headers')
@@ -1833,6 +1889,19 @@ export function createServer(o = {}) {
         'cache-control': p.startsWith('/_b/') ? 'public, max-age=31536000, immutable' : p === '/sw.js' ? 'no-cache' : 'public, max-age=3600',
         vary: 'accept-encoding',
       }
+      // Range: media players ask for byte spans (Safari plays no video without them). The span is of the plain file, so
+      // a ranged request skips the precompressed siblings; If-Range has no validator to match here, so it gets it all.
+      const span = req.headers.range && !req.headers['if-range'] ? byteRange(req.headers.range, statSync(f).size) : null
+      if (span === false) return send(res, 416, '', { 'content-range': `bytes */${statSync(f).size}` }), true
+      if (span) {
+        const len = span.end - span.start + 1, buf = Buffer.alloc(req.method === 'HEAD' ? 0 : len)
+        if (buf.length) {
+          const fd = openSync(f, 'r')
+          try { readSync(fd, buf, 0, len, span.start) } finally { closeSync(fd) }
+        }
+        send(res, 206, buf, { ...headers, 'accept-ranges': 'bytes', 'content-range': `bytes ${span.start}-${span.end}/${statSync(f).size}`, 'content-length': String(len) })
+        return true
+      }
       // the smallest precompressed sibling the client accepts (the build keeps only those smaller than the file)
       let best = null
       for (const enc of acceptedEncodings(req.headers['accept-encoding'])) {
@@ -1844,7 +1913,7 @@ export function createServer(o = {}) {
         send(res, 200, req.method === 'HEAD' ? '' : readFileSync(best.encoded), { ...headers, 'content-encoding': best.enc })
         return true
       }
-      send(res, 200, req.method === 'HEAD' ? '' : readFileSync(f), headers)
+      send(res, 200, req.method === 'HEAD' ? '' : readFileSync(f), { ...headers, 'accept-ranges': 'bytes' })
       return true
     }
     return false
@@ -1936,6 +2005,11 @@ export function createServer(o = {}) {
       let full
       try { full = new URL(req.url, 'http://' + host) } catch { return send(res, 400, 'Bad Request') }
       // /_health stays at the root: the supervisor calls it there whatever the base
+      // refused API sources, for an operator on this machine only (a loopback socket and no forwarded hop)
+      if (full.pathname === '/_access/sources' && req.method === 'GET') {
+        if (!LOOPBACK(plainIp(req.socket.remoteAddress ?? '') || '') || req.headers['x-forwarded-for']) return notFound(req, res)
+        return send(res, 200, json({ sources: [...refusedSources.values()].sort((a, b) => b.count - a.count) }), { 'content-type': MIME['.json'], 'cache-control': 'no-store' })
+      }
       if (full.pathname === '/_health' || full.pathname === BASE + '_health') return send(res, 200, json({ ok: true, build: mf.build || null }), { 'content-type': MIME['.json'], 'cache-control': 'no-store' })
       let url = full
       if (BASE !== '/') {
@@ -1950,9 +2024,20 @@ export function createServer(o = {}) {
       const probe = brainProbe(url.pathname)
       if (probe) return await answerProbe(req, res, new URL(probe, url), rid)
       if (native && /^\/_brain\/files(?:\/|$)/.test(url.pathname)) return await native.fileStream(req,res,url,rid)
-      if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
+      if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) {
+        const client = ipOf(req), refused = accessRefusal(req, url.pathname, client, access)
+        if (refused) {
+          accessRefused(req, rid, url.pathname, client, refused)
+          return send(res, 403, json({ error: 'This API answers its own site only', code: 'B0752' }), { 'content-type': MIME['.json'], 'cache-control': 'no-store', 'x-brain-code': 'B0752' })
+        }
+        if (overBudget(req, res, url.pathname, client)) return
+        return await native.proxy(req,res,url,rid,send)
+      }
       const declaredRoute = native && nativeRoutes.find(route => route.rx.test(url.pathname))
-      if (declaredRoute) return await native.proxy(req,res,url,rid,send,undefined,declaredRoute)
+      if (declaredRoute) {
+        if (overBudget(req, res, url.pathname, ipOf(req))) return
+        return await native.proxy(req,res,url,rid,send,undefined,declaredRoute)
+      }
       // redirects.json (manifest `redirects`, brain-seo server_json): exact sources first, then patterns, on the app path;
       // same-site targets get the base, the query is kept when the target has none; slash policy and host in the same hop
       const to = (req.method === 'GET' || req.method === 'HEAD') && canonicalOf(req, url)
@@ -1985,6 +2070,7 @@ export function createServer(o = {}) {
         const paged = post ? null : pageParameter(route, url)
         if (paged === 404) return notFound(req, res)
         if (paged) return send(res, 301, '', { location: withBase(paged), 'cache-control': 'public, max-age=3600' })
+        if (overBudget(req, res, url.pathname, ipOf(req))) return
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
@@ -2203,6 +2289,7 @@ export async function runChain({ guards = [], middleware = [], ctx }) {
 // key past HITS_KEY_MAX characters is stored as its digest. The map stays ordered by window start: a new window is
 // re-inserted at the end, so the expired entries are always the first ones.
 const HITS = new Map() // key → [windowStart, count]
+let servers = 0 // each createServer keeps its own dynamic budget (accessBudget) in HITS
 export const HITS_MAX = 50000, HITS_KEY_MAX = 256
 export const rateLimitKeys = () => HITS.size
 const WINDOW = 60000
@@ -2424,6 +2511,94 @@ export function trustedProxies(list = []) {
  * The client is the right-most forwarded hop that is not a trusted proxy, and only when the TCP peer is trusted: hops
  * left of it are client-supplied and never consulted. Same walk as resolve_client (brain-backend/src/edge_http.rs).
  */
+/**
+ * platform.access (docs/backend/access.md): who may reach the dynamic answers and how much each client may take.
+ * `mode` "open" (default) lets any client in, scripts and headless browsers included; "own-host" refuses /api, /_brain
+ * and /s to anything without evidence of this site. Nothing is limited unless the app sets `perMinute` (dynamic
+ * requests per client and minute) or `concurrency` (dynamic requests in flight for the whole process). Normalizes `{ mode, perMinute, concurrency, origins, hosts, ips,
+ * local }`; `site` is the site origin (PUBLIC_SITE_URL), whose host is always one of the hosts.
+ * Same limits as the backend's parse_access (brain-backend/src/platform.rs).
+ */
+export function accessPolicy(raw = {}, site) {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw Error('platform.access must be an object')
+  for (const key of Object.keys(raw)) if (!['mode', 'perMinute', 'concurrency', 'origins', 'hosts', 'ips', 'local'].includes(key)) throw Error(`platform.access.${key} is not a setting; use mode, perMinute, concurrency, origins, hosts, ips or local`)
+  const list = (key, max) => {
+    const value = raw[key] ?? []
+    if (!Array.isArray(value) || value.length > max || value.some(v => typeof v !== 'string' || !v || v.length > 256)) throw Error(`platform.access.${key} must be an array of at most ${max} strings`)
+    return value
+  }
+  const origins = new Set()
+  for (const origin of list('origins', 32)) {
+    let parsed
+    try { parsed = new URL(origin) } catch { throw Error(`platform.access.origins entry \`${origin}\` must be an origin such as https://admin.example.com`) }
+    if (parsed.origin !== origin || !/^https?:$/.test(parsed.protocol)) throw Error(`platform.access.origins entry \`${origin}\` must be exactly scheme://host[:port], without a path or a trailing slash`)
+    origins.add(origin)
+  }
+  const hosts = new Set()
+  for (const host of list('hosts', 32)) {
+    if (!/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/.test(host)) throw Error(`platform.access.hosts entry \`${host}\` must be a lowercase host name without scheme, port or wildcard`)
+    hosts.add(host)
+  }
+  try { if (site) hosts.add(new URL(site).hostname) } catch {}
+  const ips = list('ips', 64)
+  const nets = ips.length ? trustedProxies(ips) : null
+  if (raw.local !== undefined && typeof raw.local !== 'boolean') throw Error('platform.access.local must be true or false')
+  const mode = raw.mode ?? 'open'
+  if (mode !== 'open' && mode !== 'own-host') throw Error('platform.access.mode must be "open" or "own-host"')
+  const count = (key, max) => {
+    const value = raw[key] ?? null
+    if (value !== null && (!Number.isInteger(value) || value < 1 || value > max)) throw Error(`platform.access.${key} must be a whole number from 1 to ${max}`)
+    return value
+  }
+  return Object.freeze({ mode, perMinute: count('perMinute', 100000), concurrency: count('concurrency', 10000), origins, hosts, nets, local: raw.local !== false })
+}
+// Paths a third party reaches on purpose: links, the analytics script, signed inbound webhooks and Apple's
+// server-to-server notifications. Each carries its own check.
+const ACCESS_EXEMPT = /^\/(?:s\/|_brain\/analytics\.js$|_brain\/webhooks\/in\/[a-z][a-z0-9_]{0,47}$|_brain\/auth\/apple\/notifications$)/
+const LOOPBACK = ip => /^(?:127\.|::1$)/.test(ip)
+/**
+ * Why a request to /api, /_brain or /s may not reach the backend, or null when it may. It passes with browser evidence
+ * of this site (an Origin of this host or of access.origins, Sec-Fetch-Site same-origin, a same-host Referer), a
+ * non-ambient credential the backend verifies (Authorization, X-Api-Key), a client address in access.ips, or a
+ * loopback client while access.local is on. Headers can be forged: this keeps other sites' pages, foreign hosts and
+ * plain scripts out, and the per-client rate limits bound what a forger reads.
+ */
+export function accessRefusal(req, path, client, policy) {
+  if (!policy || policy.mode !== 'own-host' || ACCESS_EXEMPT.test(path) || req.method === 'OPTIONS') return null
+  const h = req.headers
+  const host = String(h['x-forwarded-host'] || h.host || '').toLowerCase()
+  const hostname = host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '')
+  const local = policy.local && LOOPBACK(client)
+  if (policy.hosts.size && !policy.hosts.has(hostname) && !(local && ['localhost', '127.0.0.1', '::1'].includes(hostname))) return 'host'
+  if (local) return null
+  if (h.authorization || h['x-api-key']) return null
+  if (policy.nets && client !== '?' && policy.nets.check(client, isIP(client) === 4 ? 'ipv4' : 'ipv6')) return null
+  const own = value => {
+    try {
+      const url = new URL(value)
+      return url.host === host || policy.origins.has(url.origin)
+    } catch { return false }
+  }
+  if (h.origin) return own(h.origin) ? null : 'origin'
+  const site = h['sec-fetch-site']
+  const navigation = (req.method === 'GET' || req.method === 'HEAD') && h['sec-fetch-mode'] === 'navigate'
+  if (site === 'same-origin') return null
+  // a person who opened the URL, or a sign-in provider sending the browser back to its callback
+  if (navigation && (site === 'none' || path.startsWith('/_brain/auth/'))) return null
+  if (h.referer && own(h.referer)) return null
+  return site ? 'cross-site' : 'no-browser-evidence'
+}
+/**
+ * Whether a dynamic request (a page render, a form post, /api, /_brain, /s) stays inside its budget: 0, or the seconds
+ * to wait. Checked before any body is read or the backend is asked, so a refused client costs one map lookup. A
+ * loopback client while access.local is on, an address in access.ips and the exempt callbacks are not counted.
+ */
+export function accessBudget(path, client, policy, key = 'edge ') {
+  if (!policy || !policy.perMinute || ACCESS_EXEMPT.test(path)) return 0
+  if (policy.local && LOOPBACK(client)) return 0
+  if (policy.nets && client !== '?' && policy.nets.check(client, isIP(client) === 4 ? 'ipv4' : 'ipv6')) return 0
+  return overLimit(key + client, policy.perMinute)
+}
 export function resolveClient(peer, forwarded, nets) {
   const socketPeer = plainIp(peer ?? '')
   const trusted = ip => nets.check(ip, isIP(ip) === 4 ? 'ipv4' : 'ipv6')

package/sw/brain-sw.js

@@ -18,6 +18,8 @@ const BASE = B.base || '/' // app served under a base path (§23 #148); precache
 const NS = 'brain' + BASE.replace(/\/$/, '') // `brain` at the root, `brain/app` under /app/
 const BUILD = NS + '-' + B.hash, META = NS + ':meta'
 const NAV_TIMEOUT = 3000
+// precache downloads at once: hundreds in one burst tripped per-IP proxy rate limits (429) and competed with the page
+const PRECACHE_PARALLEL = 4
 // responses marked personal or uncacheable are never stored
 const storable = r => r.ok && !/no-store|private/i.test(r.headers.get('cache-control') || '')
 const ROUTES = (B.routes || []).map(r => ({ ...r, cache: NS + ':route:' + r.match + (r.prefix ? '*' : '') }))
@@ -34,9 +36,28 @@ self.addEventListener('install', e => {
   e.waitUntil(
     (async () => {
       const c = await caches.open(BUILD)
+      // a _b/ file is content-hashed: the same URL in an earlier build of this app holds the same bytes, so an
+      // update downloads only what changed
+      const olds = (await caches.keys()).filter(k => k.startsWith(NS + '-') && k !== BUILD)
+      const kept = async u => {
+        if (!u.startsWith(BASE + '_b/')) return null
+        for (const k of olds) {
+          const r = await (await caches.open(k)).match(u)
+          if (r) return r
+        }
+        return null
+      }
+      // default cache mode: the page may have just filled the HTTP cache with these immutable files
+      const one = async u => {
+        const r = (await kept(u)) || (await fetch(u))
+        if (r.ok) await c.put(u, r)
+      }
       // one failing URL must not abort the install: cache what answers, the rest is cached on first use
-      // default cache mode: the page just filled the HTTP cache with these immutable files, so this costs no bytes
-      await Promise.allSettled(B.precache.map(u => fetch(u).then(r => r.ok && c.put(u, r))))
+      const queue = [...B.precache]
+      const lane = async () => {
+        while (queue.length) await one(queue.shift()).catch(() => {})
+      }
+      await Promise.all(Array.from({ length: Math.min(PRECACHE_PARALLEL, queue.length) }, lane))
       // update: 'prompt' → an update waits for the page (appUpdate); the first install has nothing to replace
       if (B.update !== 'prompt' || !self.registration.active) await self.skipWaiting()
     })()

package/templates/apple-signin.js

@@ -0,0 +1,117 @@
+// Application-owned Sign in with Apple JS adapter (popup flow). No tokens, private errors or session data are logged or stored.
+const SDK = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js'
+let loading = null, active = null
+const sdk = () => {
+  if (globalThis.AppleID?.auth) return Promise.resolve(globalThis.AppleID.auth)
+  if (loading) return loading
+  loading = new Promise((resolve, reject) => {
+    const doc = globalThis.document, existing = doc.querySelector(`script[src="${SDK}"]`)
+    const script = existing || doc.createElement('script')
+    const done = error => {
+      clearTimeout(timer); script.removeEventListener('load', loaded); script.removeEventListener('error', failed)
+      if (error) { if (!existing) script.remove(); reject(Error('Apple sign-in is unavailable')) }
+      else resolve(globalThis.AppleID.auth)
+    }
+    const loaded = () => globalThis.AppleID?.auth ? done(false) : done(true), failed = () => done(true)
+    const timer = setTimeout(failed, 6000)
+    script.addEventListener('load', loaded); script.addEventListener('error', failed)
+    if (!existing) { script.src = SDK; script.async = true; script.defer = true; doc.head.appendChild(script) }
+  }).catch(error => { loading = null; throw error })
+  return loading
+}
+// Apple sends the name only on the first authorization and unsigned: it is a display hint, never an identity.
+const name = user => {
+  const first = typeof user?.name?.firstName === 'string' ? user.name.firstName.trim() : ''
+  const last = typeof user?.name?.lastName === 'string' ? user.name.lastName.trim() : ''
+  const full = `${first} ${last}`.trim()
+  return full && full.length <= 200 ? full : undefined
+}
+export default {
+  mount(element, initial = {}) {
+    if (active) throw Error('Only one Apple sign-in widget may be active')
+    let props = initial, alive = true, busy = false, pending = null
+    const owner = {}; active = owner
+    const notify = (message, waiting, signedIn = false) => {
+      if (!alive) return
+      busy = waiting; element.setAttribute('aria-busy', String(waiting))
+      if ('inert' in element) element.inert = waiting
+      if (typeof props.onState === 'function') props.onState({ message, busy: waiting, signedIn })
+    }
+    const request = async (path, body, method = 'POST') => {
+      const controller = new AbortController(); pending = controller
+      const timer = setTimeout(() => controller.abort(), 8000)
+      try {
+        const base = globalThis.document?.querySelector('meta[name=brain-base]')?.getAttribute('content') || ''
+        if (base && (!base.startsWith('/') || base.startsWith('//') || /[\\?#\x00-\x20]/.test(base))) throw Error('Invalid application base')
+        const response = await fetch(base.replace(/\/$/, '') + path, { method, credentials: 'same-origin', headers: body == null ? {} : { 'content-type': 'application/json' }, ...(body == null ? {} : { body: JSON.stringify(body) }), signal: controller.signal })
+        if (!response.ok) return { $status: response.status }
+        return await response.json()
+      } finally { clearTimeout(timer); if (pending === controller) pending = null }
+    }
+    const failed = () => notify('Sign-in could not be completed. Retry or use email sign-in.', false)
+    const start = async () => {
+      if (!alive || busy) return
+      notify('Preparing secure sign-in.', true)
+      try {
+        const current = await request('/_brain/auth/me', null, 'GET')
+        if (!alive) return
+        if (current?.user) { element.replaceChildren(); return notify('You are signed in.', false, true) }
+        if (current?.$status !== 401) return failed()
+        const renewed = await request('/_brain/auth/refresh')
+        if (!alive) return
+        if (renewed?.user) { notify('You are signed in.', false, true); globalThis.location?.reload(); return }
+        if (renewed?.$status !== 401) return failed()
+        const challenge = await request('/_brain/auth/apple/challenge')
+        if (!alive) return
+        if (!challenge || !/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(challenge.client_id) || !/^[a-f0-9]{64}$/.test(challenge.nonce) || typeof challenge.redirect_uri !== 'string') return failed()
+        const auth = await sdk()
+        if (!alive) return
+        auth.init({ clientId: challenge.client_id, scope: 'name email', redirectURI: challenge.redirect_uri, nonce: challenge.nonce, usePopup: true })
+        const button = globalThis.document.createElement('button')
+        button.type = 'button'; button.className = 'brain-apple-signin'; button.textContent = 'Sign in with Apple'
+        button.addEventListener('click', async () => {
+          if (!alive || busy) return
+          notify('Completing secure sign-in.', true)
+          try {
+            const result = await auth.signIn()
+            const token = result?.authorization?.id_token
+            if (!alive) return
+            if (typeof token !== 'string' || token.length > 16384) return failed()
+            const session = await request('/_brain/auth/apple', { id_token: token, ...(name(result.user) ? { name: name(result.user) } : {}) })
+            if (!alive) return
+            if (!session?.user) return failed()
+            notify('You are signed in.', false, true)
+            // A full auth-boundary reload forgets all prior user-specific in-memory application state.
+            globalThis.location?.reload()
+          } catch {
+            // A closed popup (`popup_closed_by_user`) is a choice, not an error.
+            if (alive) notify('Choose Apple sign-in or use email sign-in.', false)
+          }
+        })
+        element.replaceChildren(button)
+        notify('Choose Apple sign-in or use email sign-in.', false)
+      } catch { if (alive) failed() }
+    }
+    void start()
+    return {
+      update(next) {
+        props = next || {}
+        if (!alive || busy) return
+        if (props.action === 'logout') {
+          notify('Signing out.', true)
+          void request('/_brain/auth/logout').then(result => {
+            if (!alive) return
+            if (!result?.ok) return failed()
+            notify('You are signed out.', false); globalThis.location?.reload()
+          }, () => { if (alive) failed() })
+        } else void start()
+      },
+      destroy() {
+        if (!alive) return
+        alive = false; pending?.abort(); element.replaceChildren(); element.removeAttribute('aria-busy')
+        if ('inert' in element) element.inert = false
+        if (active === owner) active = null
+      },
+    }
+  },
+}