@christianirack/brainllm-runtime 0.8.7 → 0.8.9

package/brain.js

@@ -276,15 +276,23 @@ export function insert(p, f, end) {
 }
 
 // aria-* and data-* are enumerated, not boolean: true and false render as text (k[4] is their dash)
+// A select only takes a value its options offer, and {#each}/{#if} options mount after attr() or change later.
+const keepSelected = (el, f, M = globalThis.MutationObserver) =>
+  M && new M(() => {
+    const i = el.selectedIndex
+    el.value = typeof f == 'function' ? untrack(f) : f
+    if (el.selectedIndex < 0) el.selectedIndex = i // no option matches yet: the browser's choice stays
+  }).observe(el, { childList: true, subtree: true })
+
 export function attr(el, k, f) {
   bind(
     f,
     k.startsWith('style:')
       ? ((k = k.slice(6)), v => (v == null || v === false ? el.style.removeProperty(k) : el.style.setProperty(k, v)))
       : /^(value|checked|selected)$/.test(k) && !(k == 'value' && el.tagName == 'OPTION') // an option's value is its attribute (SSR, value="")
-        ? v => {
+        ? ((el.tagName == 'SELECT' && k == 'value') ? keepSelected(el, f) : 0, v => {
             if (el[k] !== v) el[k] = v
-          }
+          })
         : v => (v == null || (v === false && k[4] != '-') ? el.removeAttribute(k) : el.setAttribute(k, v === true && k[4] != '-' ? '' : /^(href|src|action|formaction|poster)$/.test(k) && typeof v == 'string' ? inBase(v) : v))
   )
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.8.7",
+  "version": "0.8.9",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/server.mjs

@@ -193,7 +193,7 @@ const cacheSearch = url => {
   return kept.size ? '?' + kept : ''
 }
 // Messages this file writes itself, safe to log as the cause; anything else in an error message may hold private data.
-const OWN_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native authentication is temporarily unavailable', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Invalid final response status', 'Invalid configured redirect location', 'timeout'])
+const OWN_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Invalid final response status', 'Invalid configured redirect location', 'timeout'])
 const CODE_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/
 const varyEncoding = v => (/accept-encoding/i.test(v || '') ? v : [v, 'Accept-Encoding'].filter(Boolean).join(', '))
 function bodyEncoding(req, status, headers) {
@@ -308,9 +308,9 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     if (!user || typeof user.id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(user.id) || typeof user.email !== 'string' || user.email.length > 254 || typeof user.role !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(user.role) || ['public','owner'].includes(user.role) || typeof user.verified !== 'boolean') throw new HttpError(503,'Native authentication response is unavailable')
     return Object.freeze({id:user.id,email:user.email,role:user.role,verified:user.verified})
   }
-  const unavailable = () => new HttpError(503, 'Native authentication is temporarily unavailable')
+  const unavailable = (why = 'the backend did not answer') => new HttpError(503, `Native authentication is unavailable: ${why}`)
   const call = (incoming, response, path, method, rid, origin) => {
-    if (stopped || active >= 8) return Promise.reject(unavailable())
+    if (stopped || active >= 8) return Promise.reject(unavailable(stopped ? 'the server is shutting down' : '8 session checks are already in flight'))
     const cookie = cookies(incoming, method === 'POST')
     const client = forwardedFor(incoming)
     active++
@@ -350,7 +350,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           })
         })
         owned.add(outgoing); incoming.once('aborted', cancel); response.once('close', disconnected)
-        timer = setTimeout(() => outgoing.destroy(unavailable()), 2000)
+        timer = setTimeout(() => outgoing.destroy(unavailable('the backend took more than 2 s')), 2000)
         outgoing.once('error', () => finish(true)); outgoing.end()
       } catch { outgoing?.destroy(); finish(true) }
     })
@@ -363,7 +363,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     let origin
     try { origin = new URL(process.env.PUBLIC_SITE_URL).origin } catch { origin = 'https://' + (req.headers['x-forwarded-host'] || req.headers.host) }
     return new Promise((resolve, reject) => {
-      if (stopped || active >= 8) return reject(unavailable())
+      if (stopped || active >= 8) return reject(unavailable(stopped ? 'the server is shutting down' : '8 session checks are already in flight'))
       active++
       let settled = false
       const done = (error, value) => { if (settled) return; settled = true; active--; clearTimeout(timer); error ? reject(unavailable()) : resolve(value) }
@@ -388,7 +388,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           } catch { done(true) }
         })
       })
-      const timer = setTimeout(() => outgoing.destroy(unavailable()), 2000)
+      const timer = setTimeout(() => outgoing.destroy(unavailable('the backend took more than 2 s')), 2000)
       owned.add(outgoing); outgoing.once('close', () => owned.delete(outgoing))
       outgoing.once('error', () => done(true)); outgoing.end()
     })
@@ -949,7 +949,8 @@ export function createServer(o = {}) {
   // log fields for a thrown value: its stack (sanitized by log) plus, for B09xx budget failures, the typed fields only
   const trace = e => {
     const out = { stack: String((e && e.stack) || e) }
-    if (e instanceof HttpError && OWN_CAUSES.has(e.message)) out.cause = e.message
+    if (e instanceof HttpError && (OWN_CAUSES.has(e.message) || e.message.startsWith('Native authentication is unavailable:'))) out.cause = e.message
+    if (e && e.code === 'ERR_MODULE_NOT_FOUND') out.fix = 'this process runs an older build whose files are gone; restart it after brain build'
     if (e && CODE_SHAPE.test(e.transport || '')) out.transport = e.transport
     if (e && typeof e.code === 'string' && CODE_SHAPE.test(e.code)) out.backendCode = e.code
     if (e && e.kind === 'budget' && /^B09\d\d$/.test(e.code) && typeof e.budget === 'string' && /^[a-zA-Z]{1,16}$/.test(e.budget)) {
@@ -1706,6 +1707,15 @@ export function createServer(o = {}) {
     const href = tag && /\bhref="(https?:\/\/[^"<>\s]+)"/.exec(tag)?.[1].replaceAll('&amp;', '&')
     return href && URL.canParse(href) && !/\/[:*]/.test(new URL(href).pathname) ? { link: `<${href}>; rel="canonical"` } : {}
   }
+  // What exists whatever the routes say: generated sitemaps, built files and the icon browsers ask for by habit.
+  async function serveFixed(req, res, url) {
+    if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return true
+    if (serveStatic(req, res, url)) return true
+    if (url.pathname !== '/favicon.ico' || !file('favicon.svg')) return false
+    send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
+    return true
+  }
+
   function serveStatic(req, res, url) {
     const p = publicStaticPath(url.pathname)
     if (p === null) return false
@@ -1825,7 +1835,9 @@ export function createServer(o = {}) {
       const variant = urlVariant(req)
       if (variant) return send(res, 301, '', { location: variant, 'cache-control': 'public, max-age=3600' })
       if (req.url.startsWith('//')) return notFound(req, res)
-      const full = new URL(req.url, 'http://' + (req.headers.host || 'localhost'))
+      const host = req.headers.host || 'localhost'
+      let full
+      try { full = new URL(req.url, 'http://' + host) } catch { return send(res, 400, 'Bad Request') }
       // /_health stays at the root: the supervisor calls it there whatever the base
       if (full.pathname === '/_health' || full.pathname === BASE + '_health') return send(res, 200, json({ ok: true, build: mf.build || null }), { 'content-type': MIME['.json'], 'cache-control': 'no-store' })
       let url = full
@@ -1865,6 +1877,8 @@ export function createServer(o = {}) {
         if (!m) continue
         // a form page without load is prerendered: GET serves that file (build ETag); only its POST needs the server
         if (!post && route.forms && serveStatic(req, res, url)) return
+        // a parameter never hides a real file: `/[code]` must not swallow /favicon.svg, /sitemap.xml or a prerendered /login
+        if (!post && m.groups && (await serveFixed(req, res, url))) return
         if (!post && serveTwin(req, res, url)) return
         const paged = post ? null : pageParameter(route, url)
         if (paged === 404) return notFound(req, res)
@@ -1872,15 +1886,13 @@ export function createServer(o = {}) {
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
-      if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return
-      if (serveStatic(req, res, url)) return
-      // browsers still ask for /favicon.ico: the app's SVG icon answers it
-      if (url.pathname === '/favicon.ico' && file('favicon.svg')) return send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
+      if (await serveFixed(req, res, url)) return
       if (isProbe(url.pathname)) return await answerProbe(req, res, url, rid)
       notFound(req, res)
     } catch (e) {
       const busy = e instanceof HttpError && e.code === 'BRIDGE_BUSY'
       if (busy) log('warn', 'backend bridge busy', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], fix: e.fix })
+      else if (e instanceof HttpError && OWN_CAUSES.has(e.message)) log('warn', 'backend unavailable', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], status: e.status, cause: e.message, ...(CODE_SHAPE.test(e.transport || '') ? { transport: e.transport } : {}) })
       else log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
       try {
         if (busy && !res.headersSent) { res.setHeader('retry-after', String(e.retryAfter)); failPage(res, 503, rid, { code: e.code, message: 'Service Unavailable', fix: e.fix }) }
@@ -2247,7 +2259,11 @@ function parseCookies(h = '') {
     const i = part.indexOf('=')
     if (i > 0) {
       const k = part.slice(0, i).trim()
-      if (k && !(k in out)) out[k] = decodeURIComponent(part.slice(i + 1).trim())
+      if (k && !(k in out)) {
+        // Another site's cookie on this domain may hold anything: it must not cost the page.
+        const value = part.slice(i + 1).trim()
+        try { out[k] = decodeURIComponent(value) } catch { out[k] = value }
+      }
     }
   }
   return out