@christianirack/brainllm-runtime 0.8.11 → 0.9.0

package/shim/dom.js

@@ -6,28 +6,19 @@ const VOID = new Set(['area', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link'
 const esc = s => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
 const unesc = s => s.replace(/&(amp|lt|gt|quot|#39);/g, (_, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', '#39': "'" })[e])
 
-export class Event {
+// Keep Node's native event brand: SSR and its test DOM share a process with fetch/WebSocket EventTargets.
+const NativeEvent = globalThis.Event
+export class Event extends NativeEvent {
   constructor(type, init = {}) {
-    this.type = type
-    this.bubbles = !!init.bubbles
-    this.cancelable = !!init.cancelable
-    this.target = null
-    this.currentTarget = null
-    this.cancelBubble = false
-    this.defaultPrevented = false
+    super(type, init)
     this._p = []
   }
   composedPath() {
-    return this._p
+    return this._p.length ? this._p : super.composedPath()
   }
   stopImmediatePropagation() {
-    this.cancelBubble = this._stop = true
-  }
-  stopPropagation() {
-    this.cancelBubble = true
-  }
-  preventDefault() {
-    this.defaultPrevented = true
+    this._stop = true
+    super.stopImmediatePropagation()
   }
 }
 export class MouseEvent extends Event {}
@@ -162,7 +153,7 @@ class Node {
     if (i >= 0) a.splice(i, 1)
   }
   dispatchEvent(e) {
-    e.target = this
+    Object.defineProperty(e, 'target', { configurable: true, writable: true, value: this })
     const path = []
     for (let n = this; n; n = n.parentNode || n.host) path.push(n)
     if (path[path.length - 1].nodeType === 9 && path[path.length - 1].defaultView) path.push(path[path.length - 1].defaultView)

package/sw/brain-sw.js

@@ -14,10 +14,19 @@
 // cache that survives builds, bounded by entries and age; personal responses are never stored. `cache.update:
 // "prompt"` keeps a new worker waiting (while an older one controls tabs) until a page posts `brain:skip-waiting`.
 const B = self.BRAIN_BUILD || { hash: 'dev', precache: [], offline: null }
+const IMMUTABLE = Array.isArray(B.immutable) ? new Set(B.immutable) : null
+const isHashed = path => IMMUTABLE ? IMMUTABLE.has(path) : path.startsWith(BASE + '_b/')
 const BASE = B.base || '/' // app served under a base path (§23 #148); precache/offline URLs already carry it
 const NS = 'brain' + BASE.replace(/\/$/, '') // `brain` at the root, `brain/app` under /app/
 const BUILD = NS + '-' + B.hash, META = NS + ':meta'
+let priorImmutable
+const previousAssets = () => priorImmutable ||= caches.open(META).then(cache => cache.match('/__brain_immutable')).then(async response => {
+  const manifests = response ? await response.json() : {}
+  return new Set(Object.values(manifests).filter(Array.isArray).flat().filter(path => typeof path === 'string'))
+}).catch(() => new Set())
 const NAV_TIMEOUT = 3000
+// precache downloads at once: hundreds in one burst tripped per-IP proxy rate limits (429) and competed with the page
+const PRECACHE_PARALLEL = 4
 // responses marked personal or uncacheable are never stored
 const storable = r => r.ok && !/no-store|private/i.test(r.headers.get('cache-control') || '')
 const ROUTES = (B.routes || []).map(r => ({ ...r, cache: NS + ':route:' + r.match + (r.prefix ? '*' : '') }))
@@ -34,9 +43,28 @@ self.addEventListener('install', e => {
   e.waitUntil(
     (async () => {
       const c = await caches.open(BUILD)
+      // a _b/ file is content-hashed: the same URL in an earlier build of this app holds the same bytes, so an
+      // update downloads only what changed
+      const olds = (await caches.keys()).filter(k => k.startsWith(NS + '-') && k !== BUILD)
+      const kept = async u => {
+        if (!isHashed(u)) return null
+        for (const k of olds) {
+          const r = await (await caches.open(k)).match(u)
+          if (r) return r
+        }
+        return null
+      }
+      // default cache mode: the page may have just filled the HTTP cache with these immutable files
+      const one = async u => {
+        const r = (await kept(u)) || (await fetch(u))
+        if (r.ok) await c.put(u, r)
+      }
       // one failing URL must not abort the install: cache what answers, the rest is cached on first use
-      // default cache mode: the page just filled the HTTP cache with these immutable files, so this costs no bytes
-      await Promise.allSettled(B.precache.map(u => fetch(u).then(r => r.ok && c.put(u, r))))
+      const queue = [...B.precache]
+      const lane = async () => {
+        while (queue.length) await one(queue.shift()).catch(() => {})
+      }
+      await Promise.all(Array.from({ length: Math.min(PRECACHE_PARALLEL, queue.length) }, lane))
       // update: 'prompt' → an update waits for the page (appUpdate); the first install has nothing to replace
       if (B.update !== 'prompt' || !self.registration.active) await self.skipWaiting()
     })()
@@ -53,6 +81,24 @@ self.addEventListener('activate', e => {
       const gens = r ? await r.json() : []
       const keep = [...gens.filter(g => g !== BUILD).slice(-1), BUILD]
       await meta.put('/__brain_generations', new Response(JSON.stringify(keep)))
+      // Keep exact custom asset identities for the same two generations as their bytes, including old open tabs.
+      const stored = await meta.match('/__brain_immutable')
+      if (IMMUTABLE || stored) {
+        const decoded = stored ? await stored.json().catch(() => ({})) : {}
+        const old = decoded && typeof decoded === 'object' ? decoded : {}
+        const manifests = {}
+        for (const generation of keep) {
+          if (generation === BUILD) manifests[generation] = [...(IMMUTABLE || [])]
+          else if (Array.isArray(old[generation])) manifests[generation] = old[generation]
+          else if (generation.startsWith(NS + '-')) {
+            // A pre-inventory worker treated only its historical namespace as immutable; infer no other cached URL.
+            const entries = await (await caches.open(generation)).keys()
+            manifests[generation] = entries.map(entry => new URL(entry.url, self.location.origin)).filter(url => url.origin === self.location.origin && url.pathname.startsWith(BASE + '_b/')).map(url => url.pathname)
+          }
+        }
+        await meta.put('/__brain_immutable', new Response(JSON.stringify(manifests)))
+        priorImmutable = Promise.resolve(new Set(Object.values(manifests).flat()))
+      }
       for (const k of await caches.keys())
         if ((k.startsWith(NS + '-') && !keep.includes(k)) || (k.startsWith(NS + ':route:') && !ROUTES.some(r => r.cache === k))) await caches.delete(k)
       await self.clients.claim()
@@ -70,10 +116,18 @@ self.addEventListener('fetch', e => {
   if (req.method !== 'GET') return
   const url = new URL(req.url)
   if (url.origin !== self.location.origin || url.pathname.startsWith(BASE + '_r/') || url.pathname === BASE + 'sw.js') return
+  // A cached whole response cannot satisfy a byte range; live manifests must never lag one revalidation behind.
+  if (req.headers?.has?.('range') || /\.(m3u8?|mpd)$/i.test(url.pathname)) return
   // offline: false (B.offline null) → navigations go straight to the network: no page cache, no offline page
   if (req.mode === 'navigate') return B.offline ? e.respondWith(navigate(e)) : undefined
-  if (url.pathname.startsWith(BASE + '_b/')) return e.respondWith(hashed(e))
+  if (isHashed(url.pathname)) return e.respondWith(hashed(e))
   const rt = route(url.pathname)
+  // A custom layout can change between builds; only exact retained inventory entries use old immutable bytes.
+  if (IMMUTABLE) return e.respondWith((async () => {
+    if ((await previousAssets()).has(url.pathname)) return hashed(e)
+    if (rt) return rt.strategy === 'network-only' ? fetch(req) : data(e, rt)
+    return req.destination ? revalidate(e) : fetch(req)
+  })())
   if (rt) return e.respondWith(rt.strategy === 'network-only' ? fetch(req) : data(e, rt))
   // only files the page itself loads (img, style, script, font, manifest…); fetch()/XHR data is never touched (§35:
   // data is not cached by default)

package/templates/apple-signin.js

@@ -0,0 +1,117 @@
+// Application-owned Sign in with Apple JS adapter (popup flow). No tokens, private errors or session data are logged or stored.
+const SDK = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js'
+let loading = null, active = null
+const sdk = () => {
+  if (globalThis.AppleID?.auth) return Promise.resolve(globalThis.AppleID.auth)
+  if (loading) return loading
+  loading = new Promise((resolve, reject) => {
+    const doc = globalThis.document, existing = doc.querySelector(`script[src="${SDK}"]`)
+    const script = existing || doc.createElement('script')
+    const done = error => {
+      clearTimeout(timer); script.removeEventListener('load', loaded); script.removeEventListener('error', failed)
+      if (error) { if (!existing) script.remove(); reject(Error('Apple sign-in is unavailable')) }
+      else resolve(globalThis.AppleID.auth)
+    }
+    const loaded = () => globalThis.AppleID?.auth ? done(false) : done(true), failed = () => done(true)
+    const timer = setTimeout(failed, 6000)
+    script.addEventListener('load', loaded); script.addEventListener('error', failed)
+    if (!existing) { script.src = SDK; script.async = true; script.defer = true; doc.head.appendChild(script) }
+  }).catch(error => { loading = null; throw error })
+  return loading
+}
+// Apple sends the name only on the first authorization and unsigned: it is a display hint, never an identity.
+const name = user => {
+  const first = typeof user?.name?.firstName === 'string' ? user.name.firstName.trim() : ''
+  const last = typeof user?.name?.lastName === 'string' ? user.name.lastName.trim() : ''
+  const full = `${first} ${last}`.trim()
+  return full && full.length <= 200 ? full : undefined
+}
+export default {
+  mount(element, initial = {}) {
+    if (active) throw Error('Only one Apple sign-in widget may be active')
+    let props = initial, alive = true, busy = false, pending = null
+    const owner = {}; active = owner
+    const notify = (message, waiting, signedIn = false) => {
+      if (!alive) return
+      busy = waiting; element.setAttribute('aria-busy', String(waiting))
+      if ('inert' in element) element.inert = waiting
+      if (typeof props.onState === 'function') props.onState({ message, busy: waiting, signedIn })
+    }
+    const request = async (path, body, method = 'POST') => {
+      const controller = new AbortController(); pending = controller
+      const timer = setTimeout(() => controller.abort(), 8000)
+      try {
+        const base = globalThis.document?.querySelector('meta[name=brain-base]')?.getAttribute('content') || ''
+        if (base && (!base.startsWith('/') || base.startsWith('//') || /[\\?#\x00-\x20]/.test(base))) throw Error('Invalid application base')
+        const response = await fetch(base.replace(/\/$/, '') + path, { method, credentials: 'same-origin', headers: body == null ? {} : { 'content-type': 'application/json' }, ...(body == null ? {} : { body: JSON.stringify(body) }), signal: controller.signal })
+        if (!response.ok) return { $status: response.status }
+        return await response.json()
+      } finally { clearTimeout(timer); if (pending === controller) pending = null }
+    }
+    const failed = () => notify('Sign-in could not be completed. Retry or use email sign-in.', false)
+    const start = async () => {
+      if (!alive || busy) return
+      notify('Preparing secure sign-in.', true)
+      try {
+        const current = await request('/_brain/auth/me', null, 'GET')
+        if (!alive) return
+        if (current?.user) { element.replaceChildren(); return notify('You are signed in.', false, true) }
+        if (current?.$status !== 401) return failed()
+        const renewed = await request('/_brain/auth/refresh')
+        if (!alive) return
+        if (renewed?.user) { notify('You are signed in.', false, true); globalThis.location?.reload(); return }
+        if (renewed?.$status !== 401) return failed()
+        const challenge = await request('/_brain/auth/apple/challenge')
+        if (!alive) return
+        if (!challenge || !/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(challenge.client_id) || !/^[a-f0-9]{64}$/.test(challenge.nonce) || typeof challenge.redirect_uri !== 'string') return failed()
+        const auth = await sdk()
+        if (!alive) return
+        auth.init({ clientId: challenge.client_id, scope: 'name email', redirectURI: challenge.redirect_uri, nonce: challenge.nonce, usePopup: true })
+        const button = globalThis.document.createElement('button')
+        button.type = 'button'; button.className = 'brain-apple-signin'; button.textContent = 'Sign in with Apple'
+        button.addEventListener('click', async () => {
+          if (!alive || busy) return
+          notify('Completing secure sign-in.', true)
+          try {
+            const result = await auth.signIn()
+            const token = result?.authorization?.id_token
+            if (!alive) return
+            if (typeof token !== 'string' || token.length > 16384) return failed()
+            const session = await request('/_brain/auth/apple', { id_token: token, ...(name(result.user) ? { name: name(result.user) } : {}) })
+            if (!alive) return
+            if (!session?.user) return failed()
+            notify('You are signed in.', false, true)
+            // A full auth-boundary reload forgets all prior user-specific in-memory application state.
+            globalThis.location?.reload()
+          } catch {
+            // A closed popup (`popup_closed_by_user`) is a choice, not an error.
+            if (alive) notify('Choose Apple sign-in or use email sign-in.', false)
+          }
+        })
+        element.replaceChildren(button)
+        notify('Choose Apple sign-in or use email sign-in.', false)
+      } catch { if (alive) failed() }
+    }
+    void start()
+    return {
+      update(next) {
+        props = next || {}
+        if (!alive || busy) return
+        if (props.action === 'logout') {
+          notify('Signing out.', true)
+          void request('/_brain/auth/logout').then(result => {
+            if (!alive) return
+            if (!result?.ok) return failed()
+            notify('You are signed out.', false); globalThis.location?.reload()
+          }, () => { if (alive) failed() })
+        } else void start()
+      },
+      destroy() {
+        if (!alive) return
+        alive = false; pending?.abort(); element.replaceChildren(); element.removeAttribute('aria-busy')
+        if ('inert' in element) element.inert = false
+        if (active === owner) active = null
+      },
+    }
+  },
+}

package/ui/dialog.brain

@@ -1,10 +1,10 @@
-<meta props="title:str closeLabel:str='Close' urlKey:str=''" emits="close" expose="open close">
+<meta props="title:str closeLabel:str='Close' urlKey:str='' dismissible:bool=false" emits="close" expose="open close">
 <script>
   let dlg = ref()
   // native modal <dialog>: focus moves inside, the rest of the page is inert, Escape closes
   const open = () => { if (!dlg.open) dlg.showModal() }
   const close = () => { if (dlg.open) dlg.close() }
-  fx(() => { if (dlg) return urlDialog(dlg, urlKey) })
+  fx(() => { if (dlg) return urlDialog(dlg, urlKey, { dismissible }) })
 </script>
 <dialog bind:ref={dlg} aria-labelledby="dlg-title" on:close={emit('close')}>
   <header>