The OG function deployed and worked (`/api/og?v=<nevent>` returns the real
title, description, thumbnail and player card), but crawlers hitting
`/?v=<nevent>` still got the site-wide card: Vercel evaluates `rewrites` AFTER
the filesystem, and `/` matches the static index.html, so the rewrite never
fired.
Middleware runs before the filesystem check, so that is where the routing
belongs. Replace the dead `rewrites` block with a root middleware that matches
only `/`, bails immediately when there is no `v` param or the user-agent is not
a known preview crawler, and otherwise rewrites to /api/og.
Real viewers are unaffected -- they fall through to the untouched SPA. Note the
one behavioral difference from the rewrite design: middleware now executes on
homepage requests (matcher is `/` only) rather than being invoked solely for
crawlers. It returns next() after two cheap checks.
Verified on the live unstable deployment that /api/og already renders
`x-bitvid-og: video` with og:type video.other for the real note; this only
fixes how crawlers reach it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
bitvid attached every hosted source with `videoEl.src = url`, which only plays
HLS on Safari-family browsers. Firefox 146 fails with MEDIA_ERR_SRC_NOT_SUPPORTED
(canPlayType returns ""), so every .m3u8 note -- e.g. anything published by
nostube/slidestr -- was unplayable there and the URL-health badge showed
"offline". Chrome/Brave 149 happen to play HLS natively, which is why this
looked browser-specific.
Vendor hls.js (npm run build:hls) and route HLS sources through it:
- js/services/hlsPlayback.js owns detection, engine choice and the hls.js
lifecycle. Engine choice keys off MediaSource, NOT canPlayType: Chrome
returns "maybe" for every HLS type, so a native-first branch would hang.
Native is used only when MSE is genuinely unavailable.
- The bundle is the FULL build, not hls.js/light -- light drops the alternate
audio stream controller and real ladders demux audio into an EXT-X-MEDIA
group. It is lazy-imported only when a .m3u8 is encountered, so ordinary
MP4/WebTorrent playback never pays the ~500KB.
- modalCoordinator tears the instance down first; clearing `src` alone leaves
the transmuxing worker and segment fetches running after the modal closes.
- urlHealthController probes HLS by fetching the playlist for #EXTM3U. The old
bare-<video> probe could not load it and on Chrome emitted no events at all,
burning the full timeout on every HLS card.
- HLS_PLAYBACK_START_TIMEOUT widens the 3s start window, which fired
mid-startup: the bundle, master playlist, variant playlist, init segment and
first media segment are four-plus serial round trips.
Also fixes two bugs found while verifying this:
- A stale MediaError was reported as the current failure. Teardown clears `src`
and calls load(), leaving MEDIA_ERR_SRC_NOT_SUPPORTED ("Empty src attribute")
on the element; a later watchdog fallback rendered that as "Hosted playback
failed: source not supported or blocked." over a stream that was playing
fine. Only a MediaError produced by the current attempt is surfaced now.
Sources are also bound before the watchdogs are armed, so hls.js's own
attachMedia() src swap cannot read as a playback failure.
- `audio/x-mpegurl` is a legacy alias for an HLS playlist of any kind, not an
audio-only assertion. isAudioOnlyVideoObject misfiled HLS video ladders
published with it as podcasts and dropped them from every video feed.
Verified end-to-end in Chromium, Chrome 149, Brave 149 and Firefox 146 against
a live HLS stream: Firefox goes from "No playable source found." to playing.
Rollback: stop calling attachHlsSource() and the previous `src` assignment
returns; see docs/playback-fallback.md.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Phase 0 of docs/blossom-plan.md. No UX; off-by-default ("off = no trace").
- Vendored: pinned [email protected] bundled by scripts/build-blossom-sdk.mjs
→ vendor/blossom-client-sdk.bundle.min.js (esbuild, browser ESM, ~27KB). The
optional @cashu/cashu-ts peer dep (BUD-07 payments, only reached on a lazy 402
branch bitvid never hits) is aliased to a throwing stub. `npm run build:blossom-sdk`.
- Flag: FEATURE_BLOSSOM_STORAGE wired like FEATURE_AUDIO_INGEST / _BITCOIN_CONNECT
(instance-config → config → constants), default FALSE.
- Service: js/services/blossomService.js implements the same
uploadFile({…}) → {url,key} contract as s3UploadService (so a later
isBlossomProvider branch drops into mediaUploader). Lazy-loads the SDK; core
path = createUploadAuth(signer, sha256) + multiServerUpload (BUD-11 auth via
bitvid's existing signer, BUD-04 mirror). Torrent parity + result-shape mapping +
mediaUploader wiring + Storage-pane config land in Phase 1.
Tests: tests/blossom-service.test.mjs (5 — availability gate + input guards).
Lint + build clean. Nothing wired into the app yet.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Phase 0+1 of docs/bitcoin-connect-plan.md (#61). Adds Alby's Bitcoin Connect as a
one-tap NWC connect front-end that feeds bitvid's EXISTING wallet pipeline; manual
URI entry stays as the backup.
- Vendored: pinned @getalby/[email protected].3 bundled by
scripts/build-bitcoin-connect.mjs → vendor/bitcoin-connect.bundle.min.js (esbuild,
browser ESM). crypto-shim aliases the L402-only `import('crypto')` bitvid never
calls. `npm run build:bitcoin-connect` rebuilds it.
- Flag: FEATURE_BITCOIN_CONNECT wired like FEATURE_AUDIO_INGEST
(instance-config → config → constants).
- UI: a "Connect wallet" button in the Wallet Connect pane (hidden unless the flag
is on); the manual URI field stays below as the backup.
- Controller: ProfileWalletController.handleBitcoinConnect() lazy-imports the bundle
(only on click — the ~700KB never touches the main bundle), inits NWC-only with
least-privilege requestMethods and persistConnection:false, then on onConnected
extracts provider.client.nostrWalletConnectUrl → the SAME validate→save path as
the manual field → disconnect() so bitvid solely holds the spending secret. The
URI is never logged.
NOTE: config/instance-config.js FEATURE_BITCOIN_CONNECT is TRUE for local testing
only. Reset to false (shipping default) before pushing/deploying. Local commit;
not pushed, not deployed.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Removes the TORCH task-locking/scheduler-memory subsystem in full:
- delete torch/ (4900+ files), torch-config.json, and tracked .scheduler-memory/
- drop torch:* npm scripts and the torch-lock dependency; regenerate
package-lock.json (only torch-lock removed)
- strip the dead "TORCH Memory Integration" / "Task Claiming Protocol (TORCH)"
sections from AGENTS.md and CLAUDE.md (agent coordination is now PR-based) and
the torch/TORCH.md doc-table row
- drop the stale `torch` ignore entries from check-hex / check-inline-styles /
check-design-tokens
Build + touched lints pass. Note: views/dev/agent-dashboard.html still embeds
the external TORCH dashboard URL — left in place (separate dev-tools view).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- `handleVisibility` only scheduled intervals but didn't trigger an immediate refresh when returning to the tab.
- This caused `tests/unit/services/exploreDataService.test.mjs` to fail (assertion `0 !== 1`).
- Added explicit calls to `refreshWatchHistoryTagCounts` and `refreshTagIdf` when `document.hidden` becomes false.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Switched from `tailwindcss` CLI to `postcss-cli` in `build:css` script to robustly handle PostCSS plugins.
- Installed `postcss-import` and `postcss-cli` as dev dependencies.
- Updated `postcss.config.cjs` to include `postcss-import` before `tailwindcss`.
- Removed `--minify` from `build:css` command as `cssnano` was stripping critical CSS variables from `tokens.css`.
- This ensures `tokens.css` is correctly inlined into `tailwind.generated.css`, fixing undefined variables that caused broken styles in the distribution build.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted prepareVideoPublishPayload and prepareVideoMirrorOptions to js/nostr/videoPayloadBuilder.js
- Created js/utils/cryptoUtils.js and js/utils/mime.js
- Updated js/nostr/client.js to use new builder and helpers
- Fixed SignerManager permission hydration and session actor logic
- Fixed nostrClientRegistry update logic
- Fixed unit tests: nostr-private-key-signer, integration-remote-flow, dmSignalEvents
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces pure JS `finalizeEvent` with `nostr-tools/wasm` implementation in `scripts/agent/load-test.mjs`.
This reduces signing time from ~6ms to ~1ms per event (5x-6x speedup), significantly increasing the event generation throughput capacity of the load test agent.
- Adds `nostr-wasm` to devDependencies.
- Updates `scripts/agent/load-test.mjs` to initialize and use WASM crypto.
- Adds `benchmarks/signing_benchmark.mjs` to verify performance gains.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed `export` from `NIP46_SESSION_STORAGE_KEY`, `NIP46_PUBLISH_TIMEOUT_MS`, `NIP46_RESPONSE_TIMEOUT_MS`, `NIP46_SIGN_EVENT_TIMEOUT_MS`, and `NIP46_MAX_RETRIES` in `js/nostr/nip46Client.js` as they are only used internally.
Updated `js/nostr/client.js` to remove unused imports of these constants.
Verified that `NIP46_HANDSHAKE_TIMEOUT_MS` and `NIP46_AUTH_CHALLENGE_MAX_ATTEMPTS` are used in `js/nostr/client.js` and thus remain exported.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated playwright and @playwright/test to 1.58.2.
- Updated dependency tracking issues for nostr-tools, stylelint, and esbuild.
- Included dependency scan artifacts in description.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updated `NostrClient.subscribeVideos` to accept dynamic tags for filtering.
Integrated `HashtagPreferencesService` into `NostrService` to refresh the video subscription whenever user interests change.
This ensures the main video feed correctly reflects the user's selected hashtags by fetching matching content from relays.
Co-authored-by: PR0M3TH3AN <[email protected]>
Regenerated package-lock.json to ensure consistency with package.json dependencies.
This resolves the `npm ci` failure in GitHub Actions ("Missing: @noble/[email protected]"), ensuring all dependencies including `jsdom` and `stylelint` are correctly installed for tests and linting.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updated package-lock.json by running a clean install to match package.json dependencies.
This resolves the `npm ci` failure in GitHub Actions ("Missing: @noble/[email protected]"), ensuring all dependencies including `jsdom` and `stylelint` are correctly installed for tests and linting.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `js/userBlocks.js` to handle NIP-07 decryption timeouts gracefully.
Previously, if a background decryption timed out (common with busy extensions or queues), the user's block list was reset to an empty state, exposing them to blocked content until the next successful retry.
The fix ensures that if a timeout occurs, the existing (stale) block list is preserved while a retry is scheduled in the background.
Also increased the `BACKGROUND_DECRYPT_TIMEOUT_MS` from 2500ms to 5000ms to reduce false positives.
Added `tests/user-blocks-decryption.test.mjs` to verify the fix and audit the decryption flow.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Synced `package-lock.json` with `package.json` to resolve `npm ci` failures.
- Updated `nostr-tools` dependencies to resolve conflicts.
- Fixed `SyntaxError` in `tests/nostr-login-permissions.test.mjs` caused by duplicate code.
- Updated `js/nostr/client.js`, `js/nostr/publishHelpers.js`, `js/nostr/adapters/nsecAdapter.js`, `js/nostr/nip46Client.js` to use `hexToBytes` helper when calling `nostr-tools` functions, as v2+ expects `Uint8Array` instead of hex strings.
- Added `hexToBytes` helper in `js/utils/hex.js`.
- Updated tests (`tests/nostr/dm-direct-message-flow.test.mjs`, `tests/nostr-send-direct-message.test.mjs`, `tests/nostr-private-key-signer.test.mjs`, `tests/nostr/nip46Client.test.js`) to use `Uint8Array` for keys where required.
Co-authored-by: PR0M3TH3AN <[email protected]>
Previously, `probePeers` would mark a stream as unhealthy if no P2P peers were found, even if a valid webseed was present. This caused the UI to disable playback for webseed-only content.
This fix:
1. Updates `js/webtorrent.js` to return `healthy: true` (reason: "webseed") if `peers === 0` but `hasWebSeed` is true.
2. Adds `tests/webtorrent-regression.test.mjs` to verify this behavior.
3. Fixes `package-lock.json` to resolve inconsistencies with `esbuild` versions that were causing CI build failures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `nostr-tools`, `esbuild`, `cross-env` to `dependencies` to ensure availability in production builds.
- Remove duplicate dependencies (`autoprefixer`, `@noble/hashes`, `@tailwindcss/typography`) to fix potential version conflicts.
- Fix timeout leak in `hashtagPreferencesService.js`.
- Fix test mock in `hashtag-preferences.test.mjs` to prevent timeouts.
- Update `nostrClient` permission request to use correct constant.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removes `@noble/hashes`, `@tailwindcss/typography`, and `autoprefixer` from `devDependencies`.
- These packages are already listed in `dependencies` (sometimes with mismatched versions), which violates the project's dependency guidelines and can cause build instability on CI platforms like Netlify.
- Updates `package-lock.json` via `npm install`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix flaky `tests/hashtag-preferences.test.mjs` by correcting mock implementation for `fetchListIncrementally`.
- Fix `tests/nostr-login-permissions.test.mjs` failure by requesting correct permissions in `js/nostr/client.js` (ReferenceError fix).
- Fix 90s timeout in `HashtagPreferencesService` by clearing the timeout timer upon successful decryption.
- Correct `package.json` dependency classification:
- Remove duplicate devDependencies (`autoprefixer`, `@tailwindcss/typography`) that are already in `dependencies`.
- Ensure build-critical tools (`tailwindcss`, etc.) are in `dependencies` to survive `npm prune --production` on Netlify.
- Install `esbuild` and `cross-env` as devDependencies.
Co-authored-by: PR0M3TH3AN <[email protected]>
Resolves a SyntaxError where 'originalReadRelays' was declared twice in 'tests/app-batch-fetch-profiles.test.mjs', causing CI failures. This change ensures the test file parses and runs correctly.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `cross-env` to latest version.
- Updated `package-lock.json` to resolve build warnings and potential CI cache issues.
- Includes previous test fixes and onboarding report.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `@tailwindcss/typography` from `devDependencies` to `dependencies`.
- This ensures it is available during Netlify's production build, which prunes `devDependencies` but requires this plugin for `tailwind.config.cjs`.
- Fixes "Deploy failed" errors related to build script failures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `tailwindcss`, `autoprefixer`, and `postcss` to `dependencies` to ensure they are available during Netlify build (which defaults to production environment).
- Keep version compatibility with v3.
- (Implicit) Includes the `package-lock.json` update.
Co-authored-by: PR0M3TH3AN <[email protected]>
Run `npm install` to regenerate `package-lock.json`, ensuring that all dependencies (including `@noble/hashes`) are correctly resolved and synchronized with `package.json`. This resolves the `npm ci` failure in the CI environment.
Co-authored-by: PR0M3TH3AN <[email protected]>
