@christianirack/brainllm-runtime 0.8.12 → 0.10.0

package/server/warmup-watchdog.mjs

@@ -0,0 +1,9 @@
+// One opt-in startup watchdog. It cannot outlive this process or target any other process.
+import { workerData, parentPort } from 'node:worker_threads'
+import { writeSync } from 'node:fs'
+const remaining = Math.max(0, Number(BigInt(workerData.deadline) - process.hrtime.bigint()) / 1e6)
+setTimeout(() => {
+  try { writeSync(2, '{"event":"startup-warmup-failed","code":"WARMUP_DEADLINE","private":true,"valuesCaptured":false}\n') } catch {}
+  process.kill(process.pid, 'SIGKILL')
+}, remaining)
+parentPort.postMessage('armed')

package/server/warmup.mjs

@@ -0,0 +1,134 @@
+// Opt-in anonymous read-only SSR warmup. No background work or outbound request exists when it is absent.
+import { createServer, request } from 'node:http'
+import { Worker } from 'node:worker_threads'
+const MAX_BODY = 256 * 1024, MAX_TOTAL = 2 * 1024 * 1024
+const configError = () => Object.assign(new Error('server.warmup requires up to eight exact public cached SSR paths, a valid site origin, timeoutMs from 100 to 10000, and onError continue or abort'), { code:'WARMUP_CONFIG_INVALID' })
+export function safePath(path) {
+  if (typeof path !== 'string' || Buffer.byteLength(path) > 256 || !path.startsWith('/') || /[\\?#\s\u0000-\u0020\u007f-\u009f]/.test(path) || path.includes('//') || /%2f|%5c/i.test(path)) return false
+  let decoded
+  try { decoded = decodeURIComponent(path) } catch { return false }
+  if (/[\\?#\s\u0000-\u0020\u007f-\u009f]/.test(decoded) || decoded.includes('//') || decoded.split('/').some(part => part === '.' || part === '..')) return false
+  return new URL(path, 'http://warmup.invalid').pathname === path
+}
+export function warmupSettings(value, routes, base, site, redirects = {}) {
+  if (value === undefined) return null
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !['paths','timeoutMs','onError'].includes(key))) throw configError()
+  const paths = value.paths, timeoutMs = value.timeoutMs ?? 8000, onError = value.onError ?? 'continue'
+  if (!Array.isArray(paths) || paths.length < 1 || paths.length > 8 || new Set(paths).size !== paths.length || !Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 10000 || !['continue','abort'].includes(onError)) throw configError()
+  let origin
+  try {
+    if (typeof site !== 'string' || /[\s\u0000-\u0020\u007f-\u009f]/.test(site)) throw configError()
+    origin = new URL(site)
+    if (!['http:','https:'].includes(origin.protocol) || origin.username || origin.password || origin.search || origin.hash || origin.pathname !== '/' || !origin.hostname || origin.hostname.length > 253 || origin.host.length > 260 || /(?:^|\.)(?:example\.(?:com|org|net)|example|invalid|test)$/.test(origin.hostname)) throw configError()
+  } catch { throw configError() }
+  for (const path of paths) {
+    if (!safePath(path) || base !== '/' && !path.startsWith(base)) throw configError()
+    const local = base === '/' ? path : '/' + path.slice(base.length)
+    if (/^\/(?:api|_brain|_r|_server|s|_health|health)(?:\/|$)/.test(local)) throw configError()
+    const route = routes.find(route => {
+      const canonical = redirects.slash === 'always' && route.path !== '/' && !route.path.endsWith('/') && !/\.[^/]*$/.test(route.path) ? route.path + '/' : route.path
+      return canonical === local
+    })
+    if (typeof route?.server !== 'string' || !route.server || !Number.isSafeInteger(route.cache) || route.cache <= 0 || /[:*\[\]]/.test(route.path) || route.forms || route.guards?.length || route.middleware?.length) throw configError()
+  }
+  return Object.freeze({paths:Object.freeze([...paths]), timeoutMs, onError, host:origin.host})
+}
+const monotonic = () => process.hrtime.bigint()
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms))
+
+// Called only by an explicitly warming production instance, before it binds its public listener.
+export async function runWarmup({ server, settings, warm, prepare, log, started = monotonic() }) {
+  const deadline = started + BigInt(settings.timeoutMs) * 1000000n
+  const reserve = Math.min(1000, Math.max(25, Math.floor(settings.timeoutMs / 8)))
+  const requestDeadline = deadline - BigInt(reserve) * 1000000n
+  const state = { pending:new Set(), controllers:new Set(), deadline:requestDeadline }
+  const watchdog = new Worker(new URL('./warmup-watchdog.mjs', import.meta.url), {workerData:{deadline:String(deadline)},env:{},execArgv:[]})
+  const owned = new Set(), peers = new Map(), sockets = new Set(), handlers = new Set()
+  let total = 0, failed = 0, stopped = false, timer, privateServer, modules
+  const abort = () => {
+    stopped = true
+    for (const controller of state.controllers) controller.abort()
+    for (const outgoing of owned) outgoing.destroy()
+    for (const socket of sockets) socket.destroy()
+  }
+  const track = (promise, set) => {
+    set.add(promise)
+    promise.then(() => set.delete(promise), () => set.delete(promise))
+    return promise
+  }
+  const secondsLeft = until => Math.max(0, Number(until - monotonic()) / 1e6)
+  let failure
+  try {
+    await new Promise((resolve, reject) => { watchdog.once('message', message => message === 'armed' ? resolve() : reject(configError())); watchdog.once('error', reject); watchdog.once('exit', () => reject(configError())) })
+    timer = setTimeout(abort, secondsLeft(requestDeadline))
+    const controller = new AbortController()
+    state.controllers.add(controller)
+    modules = await track(Promise.resolve().then(() => warm(controller.signal)), state.pending)
+    if (stopped) throw Object.assign(new Error('Startup warmup deadline'), {code:'WARMUP_TIMEOUT'})
+    const dispatch = server.listeners('request')[0]
+    privateServer = createServer((incoming, response) => {
+      const peer = peers.get(incoming.socket.remotePort)
+      if (!peer || peer.path !== incoming.url || incoming.method !== 'GET' || incoming.headers.authorization || incoming.headers.cookie || handlers.size >= 2) { response.writeHead(403,{connection:'close'}); response.end(); return }
+      prepare(incoming, peer.controller, state)
+      const handling = Promise.resolve().then(() => dispatch.call(server, incoming, response))
+      track(handling, handlers).catch(() => { if (!response.headersSent) response.writeHead(500); response.end() })
+    })
+    privateServer.on('connection', socket => { sockets.add(socket); socket.once('close', () => sockets.delete(socket)) })
+    privateServer.maxConnections = 2
+    privateServer.maxRequestsPerSocket = 1
+    privateServer.maxHeadersCount = 16
+    privateServer.headersTimeout = settings.timeoutMs
+    privateServer.requestTimeout = settings.timeoutMs
+    await new Promise((resolve, reject) => { privateServer.once('error', reject); privateServer.listen(0, '127.0.0.1', resolve) })
+    const port = privateServer.address().port
+    const one = path => new Promise(resolve => {
+      if (stopped) return resolve()
+      const controller = new AbortController()
+      state.controllers.add(controller)
+      let outgoing, settled = false, localPort
+      const finish = ok => {
+        if (settled) return
+        settled = true
+        if (!ok) { failed++; controller.abort() }
+        owned.delete(outgoing); peers.delete(localPort); state.controllers.delete(controller)
+        resolve()
+      }
+      outgoing = request({host:'127.0.0.1',port,path,method:'GET',agent:false,headers:{host:settings.host,accept:'text/html','accept-encoding':'identity',connection:'close'}}, response => {
+        let bytes = 0
+        const rejected = response.statusCode !== 200 || response.headers['set-cookie'] || /(?:private|no-store|no-cache)/i.test(response.headers['cache-control'] || '') || response.headers['content-encoding'] || Number(response.headers['content-length']) > MAX_BODY
+        if (rejected) { response.destroy(); outgoing.destroy(); return finish(false) }
+        response.on('data', chunk => {
+          bytes += chunk.length; total += chunk.length
+          if (bytes > MAX_BODY || total > MAX_TOTAL) { response.destroy(); outgoing.destroy(); finish(false) }
+        })
+        response.once('end', () => finish(true))
+        response.once('error', () => finish(false))
+        response.once('aborted', () => finish(false))
+      })
+      owned.add(outgoing)
+      outgoing.once('socket', socket => socket.once('connect', () => { localPort = socket.localPort; peers.set(localPort, {path,controller}) }))
+      outgoing.once('error', () => finish(false))
+      outgoing.end()
+    })
+    let next = 0
+    await Promise.all(Array.from({length:Math.min(2,settings.paths.length)}, async () => { while (!stopped && next < settings.paths.length) await one(settings.paths[next++]) }))
+    if (stopped) throw Object.assign(new Error('Startup warmup deadline'), {code:'WARMUP_TIMEOUT'})
+    if (failed && settings.onError === 'abort') throw Object.assign(new Error('Required startup warmup failed'), {code:'WARMUP_FAILED'})
+  } catch (error) { failure = error }
+  finally {
+    abort()
+    if (privateServer) {
+      privateServer.closeAllConnections()
+      await new Promise(resolve => { if (!privateServer.listening) return resolve(); privateServer.close(resolve) })
+    }
+    // A load/import that ignores cancellation is not allowed to run behind a ready process.
+    // The independent watchdog terminates this owned instance if cleanup cannot finish within the absolute budget.
+    while (owned.size || sockets.size || handlers.size || state.pending.size) await delay(1)
+    clearTimeout(timer)
+    await watchdog.terminate()
+  }
+  if (monotonic() >= deadline) throw Object.assign(new Error('Startup warmup cleanup exceeded its absolute deadline'),{code:'WARMUP_DEADLINE'})
+  log?.(failed || failure ? 'warn' : 'info', 'startup data warmup', {event:'startup-data-warmup',requested:settings.paths.length,failed,bytes:total,code:failure?.code || (failed ? 'WARMUP_PARTIAL' : 'WARMUP_READY'),private:true,valuesCaptured:false})
+  if (failure && settings.onError === 'abort') throw failure
+  return {...modules,dataPaths:settings.paths.length,dataFailed:failed}
+}

package/shim/dom.js

@@ -6,28 +6,19 @@ const VOID = new Set(['area', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link'
 const esc = s => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
 const unesc = s => s.replace(/&(amp|lt|gt|quot|#39);/g, (_, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', '#39': "'" })[e])
 
-export class Event {
+// Keep Node's native event brand: SSR and its test DOM share a process with fetch/WebSocket EventTargets.
+const NativeEvent = globalThis.Event
+export class Event extends NativeEvent {
   constructor(type, init = {}) {
-    this.type = type
-    this.bubbles = !!init.bubbles
-    this.cancelable = !!init.cancelable
-    this.target = null
-    this.currentTarget = null
-    this.cancelBubble = false
-    this.defaultPrevented = false
+    super(type, init)
     this._p = []
   }
   composedPath() {
-    return this._p
+    return this._p.length ? this._p : super.composedPath()
   }
   stopImmediatePropagation() {
-    this.cancelBubble = this._stop = true
-  }
-  stopPropagation() {
-    this.cancelBubble = true
-  }
-  preventDefault() {
-    this.defaultPrevented = true
+    this._stop = true
+    super.stopImmediatePropagation()
   }
 }
 export class MouseEvent extends Event {}
@@ -162,7 +153,7 @@ class Node {
     if (i >= 0) a.splice(i, 1)
   }
   dispatchEvent(e) {
-    e.target = this
+    Object.defineProperty(e, 'target', { configurable: true, writable: true, value: this })
     const path = []
     for (let n = this; n; n = n.parentNode || n.host) path.push(n)
     if (path[path.length - 1].nodeType === 9 && path[path.length - 1].defaultView) path.push(path[path.length - 1].defaultView)

package/sw/brain-sw.js

@@ -14,9 +14,16 @@
 // cache that survives builds, bounded by entries and age; personal responses are never stored. `cache.update:
 // "prompt"` keeps a new worker waiting (while an older one controls tabs) until a page posts `brain:skip-waiting`.
 const B = self.BRAIN_BUILD || { hash: 'dev', precache: [], offline: null }
+const IMMUTABLE = Array.isArray(B.immutable) ? new Set(B.immutable) : null
+const isHashed = path => IMMUTABLE ? IMMUTABLE.has(path) : path.startsWith(BASE + '_b/')
 const BASE = B.base || '/' // app served under a base path (§23 #148); precache/offline URLs already carry it
 const NS = 'brain' + BASE.replace(/\/$/, '') // `brain` at the root, `brain/app` under /app/
 const BUILD = NS + '-' + B.hash, META = NS + ':meta'
+let priorImmutable
+const previousAssets = () => priorImmutable ||= caches.open(META).then(cache => cache.match('/__brain_immutable')).then(async response => {
+  const manifests = response ? await response.json() : {}
+  return new Set(Object.values(manifests).filter(Array.isArray).flat().filter(path => typeof path === 'string'))
+}).catch(() => new Set())
 const NAV_TIMEOUT = 3000
 // precache downloads at once: hundreds in one burst tripped per-IP proxy rate limits (429) and competed with the page
 const PRECACHE_PARALLEL = 4
@@ -40,7 +47,7 @@ self.addEventListener('install', e => {
       // update downloads only what changed
       const olds = (await caches.keys()).filter(k => k.startsWith(NS + '-') && k !== BUILD)
       const kept = async u => {
-        if (!u.startsWith(BASE + '_b/')) return null
+        if (!isHashed(u)) return null
         for (const k of olds) {
           const r = await (await caches.open(k)).match(u)
           if (r) return r
@@ -74,6 +81,24 @@ self.addEventListener('activate', e => {
       const gens = r ? await r.json() : []
       const keep = [...gens.filter(g => g !== BUILD).slice(-1), BUILD]
       await meta.put('/__brain_generations', new Response(JSON.stringify(keep)))
+      // Keep exact custom asset identities for the same two generations as their bytes, including old open tabs.
+      const stored = await meta.match('/__brain_immutable')
+      if (IMMUTABLE || stored) {
+        const decoded = stored ? await stored.json().catch(() => ({})) : {}
+        const old = decoded && typeof decoded === 'object' ? decoded : {}
+        const manifests = {}
+        for (const generation of keep) {
+          if (generation === BUILD) manifests[generation] = [...(IMMUTABLE || [])]
+          else if (Array.isArray(old[generation])) manifests[generation] = old[generation]
+          else if (generation.startsWith(NS + '-')) {
+            // A pre-inventory worker treated only its historical namespace as immutable; infer no other cached URL.
+            const entries = await (await caches.open(generation)).keys()
+            manifests[generation] = entries.map(entry => new URL(entry.url, self.location.origin)).filter(url => url.origin === self.location.origin && url.pathname.startsWith(BASE + '_b/')).map(url => url.pathname)
+          }
+        }
+        await meta.put('/__brain_immutable', new Response(JSON.stringify(manifests)))
+        priorImmutable = Promise.resolve(new Set(Object.values(manifests).flat()))
+      }
       for (const k of await caches.keys())
         if ((k.startsWith(NS + '-') && !keep.includes(k)) || (k.startsWith(NS + ':route:') && !ROUTES.some(r => r.cache === k))) await caches.delete(k)
       await self.clients.claim()
@@ -91,10 +116,18 @@ self.addEventListener('fetch', e => {
   if (req.method !== 'GET') return
   const url = new URL(req.url)
   if (url.origin !== self.location.origin || url.pathname.startsWith(BASE + '_r/') || url.pathname === BASE + 'sw.js') return
+  // A cached whole response cannot satisfy a byte range; live manifests must never lag one revalidation behind.
+  if (req.headers?.has?.('range') || /\.(m3u8?|mpd)$/i.test(url.pathname)) return
   // offline: false (B.offline null) → navigations go straight to the network: no page cache, no offline page
   if (req.mode === 'navigate') return B.offline ? e.respondWith(navigate(e)) : undefined
-  if (url.pathname.startsWith(BASE + '_b/')) return e.respondWith(hashed(e))
+  if (isHashed(url.pathname)) return e.respondWith(hashed(e))
   const rt = route(url.pathname)
+  // A custom layout can change between builds; only exact retained inventory entries use old immutable bytes.
+  if (IMMUTABLE) return e.respondWith((async () => {
+    if ((await previousAssets()).has(url.pathname)) return hashed(e)
+    if (rt) return rt.strategy === 'network-only' ? fetch(req) : data(e, rt)
+    return req.destination ? revalidate(e) : fetch(req)
+  })())
   if (rt) return e.respondWith(rt.strategy === 'network-only' ? fetch(req) : data(e, rt))
   // only files the page itself loads (img, style, script, font, manifest…); fetch()/XHR data is never touched (§35:
   // data is not cached by default)

package/ui/dialog.brain

@@ -1,10 +1,10 @@
-<meta props="title:str closeLabel:str='Close' urlKey:str=''" emits="close" expose="open close">
+<meta props="title:str closeLabel:str='Close' urlKey:str='' dismissible:bool=false" emits="close" expose="open close">
 <script>
   let dlg = ref()
   // native modal <dialog>: focus moves inside, the rest of the page is inert, Escape closes
   const open = () => { if (!dlg.open) dlg.showModal() }
   const close = () => { if (dlg.open) dlg.close() }
-  fx(() => { if (dlg) return urlDialog(dlg, urlKey) })
+  fx(() => { if (dlg) return urlDialog(dlg, urlKey, { dismissible }) })
 </script>
 <dialog bind:ref={dlg} aria-labelledby="dlg-title" on:close={emit('close')}>
   <header>