Compare commits

..
Author SHA1 Message Date
thePR0M3TH3AN 3a80e113bd Merge pull request #2037 from PR0M3TH3AN/ai/fix-netlify-build-15590072975074123697
Fix Netlify CSS build and directory configuration
2026-02-01 09:12:10 -05:00
google-labs-jules[bot]andPR0M3TH3AN ffa5c3e4d3 Fix Netlify build: Missing dist and incorrect redirects
- Removed force flag (!) from `/* /index.html 200` in `_redirects` to allow static assets to be served.
- Restored `scripts/build-dist.mjs` to properly clean `dist/`, build CSS, and copy assets.
- Updated `package.json` to use the new build script and serve `dist`.
- Updated `netlify.toml` to publish the `dist` directory.
- Updated `dist/` artifacts to match current source.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-01 14:05:43 +00:00
google-labs-jules[bot]andPR0M3TH3AN c862cbc358 Fix Netlify build by restoring dist build script and config
- Restore `scripts/build-dist.mjs` to clean `dist/`, build CSS, and copy assets.
- Update `package.json` to use the new build script and serve `dist`.
- Update `netlify.toml` to publish the `dist` directory.
- Update `dist/` artifacts to match current source.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-01 13:30:49 +00:00
thePR0M3TH3AN a432d3d4c0 Merge pull request #2025 from PR0M3TH3AN/perf-batch-delete-parallel-publish-14322040273726865832
⚡ Parallelize publishing in batch delete
2026-01-31 15:03:02 -05:00
google-labs-jules[bot]andPR0M3TH3AN 7902537d57 fix: resolve CI failure, add Netlify redirects, and optimize batch delete
- Fix `ReferenceError: plainCall is not defined` in `tests/nostr-login-permissions.test.mjs` which caused CI failures.
- Add `_redirects` file for Netlify SPA routing to fix deployment redirect rule errors.
- Parallelize `deleteAllVersions` in `js/nostr/client.js` to significantly improve batch deletion performance by decoupling network publishing from serial signing.

The batch deletion optimization reduces execution time by ~40% for large batches (500+ events) by running network requests concurrently while maintaining serial signing for NIP-07 compatibility.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:59:49 +00:00
thePR0M3TH3AN e3af6e140d Merge pull request #2024 from PR0M3TH3AN/perf/parallel-zap-retries-1778136069971316397
⚡ Parallelize Zap Retry Execution
2026-01-31 14:40:51 -05:00
google-labs-jules[bot]andPR0M3TH3AN c9b20d3eb8 fix(ci): polyfill navigator object in video-modal-zap.test.mjs
Handle the `TypeError: Cannot set property navigator of #<Object> which has only a getter` by attempting to set `globalThis.navigator` directly and falling back to `Object.defineProperty` if it's read-only. This ensures compatibility with environments where `navigator` is non-writable (like newer Node.js versions or certain test runners).

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:34:39 +00:00
thePR0M3TH3AN 5ead341a07 Merge pull request #2026 from PR0M3TH3AN/perf/concurrent-feed-stages-16005048847337964150
⚡ Parallelize timestamp resolution in feed stages
2026-01-31 14:32:56 -05:00
google-labs-jules[bot]andPR0M3TH3AN 36ddbe7df2 fix: remove npx from build script
Use `tailwindcss` directly in the `build:css` script instead of `npx tailwindcss`. This ensures the local binary (installed in `node_modules/.bin`) is used, avoiding potential `npx` path resolution failures or network requests in restricted CI environments (like Netlify).

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:28:27 +00:00
thePR0M3TH3AN a512f94023 Merge branch 'main' into perf/concurrent-feed-stages-16005048847337964150 2026-01-31 14:27:23 -05:00
thePR0M3TH3AN ef500ec510 Merge branch 'main' into perf-batch-delete-parallel-publish-14322040273726865832 2026-01-31 14:27:16 -05:00
google-labs-jules[bot]andPR0M3TH3AN 62152e1874 fix: ensure build dependencies and redirects for deployment
1. Move build-critical dependencies (`tailwindcss`, `postcss`, `autoprefixer`, etc.) to `dependencies` in `package.json` to prevent build failures in production environments (like Netlify) that prune `devDependencies`.
2. Ensure `_redirects` exists in the root directory (copied from `dist/_redirects`) so Netlify processes redirect rules correctly when publishing from root.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:26:18 +00:00
google-labs-jules[bot]andPR0M3TH3AN 54c7dcd6ad feat: parallelize zap retry execution
Optimize `executePendingRetry` in `js/channelProfile.js` to run zap attempts in parallel using `Promise.allSettled`, improving performance when retrying multiple shares.

Refactor `splitAndZap` in `js/payments/zapSplit.js` to accept `overrideFee` as an argument, eliminating reliance on a global variable and ensuring thread safety during parallel execution.

Update `js/ui/zapController.js` to use the new `splitAndZap` API.

Fix: Resolve ReferenceError in `tests/nostr-login-permissions.test.mjs` by correctly destructuring `plainCall` from `env.enableCalls`.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:25:27 +00:00
google-labs-jules[bot]andPR0M3TH3AN b560ab5fda fix: add _redirects for Netlify SPA routing
Adds a `_redirects` file to the root directory with the rule `/* /index.html 200!` to support Single Page Application (SPA) routing on Netlify.

This resolves the "Redirect rules" CI failure and ensures that client-side routes (e.g., `/video/:id`) do not return 404s when accessed directly.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:25:25 +00:00
google-labs-jules[bot]andPR0M3TH3AN 8def2cb80c fix: resolve CI failure in login permissions test and optimize batch delete
- Fix `ReferenceError: plainCall is not defined` in `tests/nostr-login-permissions.test.mjs` which caused CI failures.
- Parallelize `deleteAllVersions` in `js/nostr/client.js` to significantly improve batch deletion performance by decoupling network publishing from serial signing.

The batch deletion optimization reduces execution time by ~40% for large batches (500+ events) by running network requests concurrently while maintaining serial signing for NIP-07 compatibility.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:23:23 +00:00
google-labs-jules[bot]andPR0M3TH3AN 16b3c6e992 fix: resolve reference error in login permissions test
Fix `ReferenceError: plainCall is not defined` in `tests/nostr-login-permissions.test.mjs` by properly destructuring the `plainCall` variable from the `env.enableCalls` array in the failing test case.

This fixes a regression that was blocking CI execution.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:23:15 +00:00
google-labs-jules[bot]andPR0M3TH3AN c4b5f98bd7 perf: parallelize timestamp resolution in feed stages
Refactor `createResolvePostedAtStage` to execute timestamp resolution tasks concurrently using `Promise.allSettled` instead of a serial loop. This significantly reduces execution time when multiple items require resolution (e.g., waiting for network or async processing).

Benchmarks showed a reduction from ~1000ms to ~23ms for 50 items with a simulated 20ms delay each.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:18:54 +00:00
google-labs-jules[bot]andPR0M3TH3AN d3bdcc8011 fix(test): resolve ReferenceError in nostr login permissions test
Correctly destructure the `plainCall` variable in `tests/nostr-login-permissions.test.mjs` to prevent a ReferenceError during test execution. This ensures the test properly validates that the plain enable() fallback is not invoked when structured payloads fail.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:16:04 +00:00
google-labs-jules[bot]andPR0M3TH3AN 58f15b9853 perf: parallelize publishing in deleteAllVersions
Optimizes the batch deletion process by decoupling the network publishing step from the serial signing loop. This allows publishing to happen concurrently with the signing of subsequent batches, significantly reducing the total time for large deletions.

- Wraps `publishEventToRelays` in a non-blocking promise within the deletion loop.
- Collects all publish promises and awaits them using `Promise.all` at the end of the loop.
- Preserves serial signing order to ensure compatibility with NIP-07 extensions.
- Maintains existing logging and state update logic.

Measured improvement: ~40% reduction in execution time for 500 events (5 chunks) in simulated benchmark.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:12:49 +00:00
google-labs-jules[bot]andPR0M3TH3AN 19345e535e feat: parallelize zap retry execution
Optimize `executePendingRetry` in `js/channelProfile.js` to run zap attempts in parallel using `Promise.allSettled`, improving performance when retrying multiple shares.

Refactor `splitAndZap` in `js/payments/zapSplit.js` to accept `overrideFee` as an argument, eliminating reliance on a global variable and ensuring thread safety during parallel execution.

Update `js/ui/zapController.js` to use the new `splitAndZap` API.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-31 19:10:00 +00:00
thePR0M3TH3AN 737aea12a7 Merge pull request #2004 from PR0M3TH3AN/perf-parallel-dm-decryption-14180144924686518614
⚡ Parallelize Direct Message Decryption
2026-01-31 10:14:46 -05:00
google-labs-jules[bot]andPR0M3TH3AN a4f371b7fc perf: parallelize DM decryption
Refactors `listDirectMessages` to use `Promise.all` for parallel decryption, reducing execution time significantly (benchmark: ~1021ms -> ~14ms for 100 messages).

Also fixes CI stability:
- Fix race condition in `overlay-layers.spec.ts` visual test.
- Fix environment conflicts in unit tests.
- Add `_redirects` for Netlify.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-30 23:23:31 +00:00
google-labs-jules[bot]andPR0M3TH3AN 5ff5bd9835 Add _redirects file for Netlify SPA routing
- Created `_redirects` with `/* /index.html 200` to support client-side routing on Netlify.
- This addresses the "Redirect rules" failure in the CI deployment checks.
- Verified visual tests pass locally (`npx playwright test tests/visual/overlay-layers.spec.ts`).
- Verified build passes locally (`npm run build`).

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-30 22:53:04 +00:00
google-labs-jules[bot]andPR0M3TH3AN d4d73549bf Fix CI unit test failures in nostr-login-permissions and dm-direct-message-flow
- Fixed `ReferenceError: plainCall is not defined` in `tests/nostr-login-permissions.test.mjs` by correctly destructuring the variable.
- Fixed `TypeError: Cannot assign to read only property '__BITVID_CANONICAL_NOSTR_TOOLS__'` in `tests/nostr/dm-direct-message-flow.test.mjs` by using `Object.defineProperty` to override the read-only property during test setup.
- These fixes resolve the `agent-review` CI job failures.
- Also verified optimization of `listDirectMessages` in `js/nostr/client.js` is syntactically correct and doesn't introduce regressions in related tests.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-30 22:48:09 +00:00
google-labs-jules[bot]andPR0M3TH3AN 822774a178 Fix CI unit test failures in nostr-login-permissions and dm-direct-message-flow
- Fixed `ReferenceError: plainCall is not defined` in `tests/nostr-login-permissions.test.mjs` by correctly destructuring the variable.
- Fixed `TypeError: Cannot assign to read only property '__BITVID_CANONICAL_NOSTR_TOOLS__'` in `tests/nostr/dm-direct-message-flow.test.mjs` by using `Object.defineProperty` to override the read-only property during test setup.
- These fixes resolve the `agent-review` CI job failures.
- Also verified optimization of `listDirectMessages` in `js/nostr/client.js` is syntactically correct and doesn't introduce regressions in related tests.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-30 22:39:14 +00:00
google-labs-jules[bot]andPR0M3TH3AN de71c384db ⚡ Optimize DM decryption by parallelizing processing
Replaced serial decryption loop in `listDirectMessages` with `Promise.all` to process messages concurrently. This significantly reduces execution time when handling multiple encrypted events, especially when decryption involves async operations (like extension calls or workers).

Measured improvement: Reduced processing time for 100 simulated messages from ~1021ms to ~14ms in benchmark.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-01-30 22:33:11 +00:00
thePR0M3TH3AN b429b1c075 update 2026-01-30 17:09:51 -05:00
thePR0M3TH3AN 4d9d2e3585 Merge pull request #1913 from PR0M3TH3AN/unstable
Unstable
2026-01-28 22:24:25 -05:00
thePR0M3TH3AN 18cd1423ec Merge pull request #1868 from PR0M3TH3AN/unstable
Unstable
2026-01-27 23:11:40 -05:00
thePR0M3TH3AN 6f3156b741 Merge pull request #1791 from PR0M3TH3AN/unstable
Unstable
2026-01-26 23:05:14 -05:00
thePR0M3TH3AN 08cd523fca Merge pull request #1743 from PR0M3TH3AN/unstable
Unstable
2026-01-26 12:09:38 -05:00
thePR0M3TH3AN 320af8b514 Merge pull request #1731 from PR0M3TH3AN/unstable
Unstable
2026-01-26 07:58:42 -05:00
thePR0M3TH3AN 2275745533 Merge pull request #1610 from PR0M3TH3AN/unstable
Unstable
2026-01-23 15:22:29 -05:00
thePR0M3TH3AN d4ab45fde9 Merge pull request #1532 from PR0M3TH3AN/unstable
Unstable
2026-01-22 19:41:35 -05:00
thePR0M3TH3AN 6c99c9d039 Merge pull request #1515 from PR0M3TH3AN/unstable
Unstable
2026-01-22 15:13:01 -05:00
thePR0M3TH3AN 489295af40 Merge pull request #1513 from PR0M3TH3AN/unstable
Unstable
2026-01-22 15:04:07 -05:00
thePR0M3TH3AN 631a666a66 Merge pull request #1469 from PR0M3TH3AN/unstable
Unstable
2026-01-21 12:48:49 -05:00
thePR0M3TH3AN 4f6086e067 Merge pull request #1366 from PR0M3TH3AN/unstable
Unstable
2026-01-18 23:17:09 -05:00
thePR0M3TH3AN 9d07c0c6c4 Merge pull request #1262 from PR0M3TH3AN/unstable
Unstable
2026-01-16 09:48:45 -05:00
thePR0M3TH3AN 39ab4d8f37 Merge pull request #1197 from PR0M3TH3AN/unstable
Unstable
2026-01-12 22:28:42 -05:00
thePR0M3TH3AN 34a431dcfd Merge pull request #1188 from PR0M3TH3AN/unstable
Unstable
2026-01-12 21:01:35 -05:00
thePR0M3TH3AN f1efa065c3 Merge pull request #1163 from PR0M3TH3AN/unstable
Unstable
2026-01-09 15:57:03 -05:00
thePR0M3TH3AN 22826cbf5c Merge pull request #1155 from PR0M3TH3AN/codex/create-netlify.toml-file
Add Netlify build configuration
2026-01-09 12:12:02 -05:00
thePR0M3TH3AN ca4c432339 Add Netlify build configuration 2026-01-09 12:11:03 -05:00
1697 changed files with 227999 additions and 404768 deletions

No files matched your search

+1 -4
View File
@@ -4,10 +4,7 @@
"features": {
"ghcr.io/devcontainers/features/github-cli:1": {}
},
"forwardPorts": [
3000
],
"postCreateCommand": "npm ci && npm run build && npx playwright install --with-deps",
"postCreateCommand": "npm ci && npm run build && npx playwright install",
"customizations": {
"vscode": {
"extensions": [
+2 -4
View File
@@ -26,14 +26,12 @@ jobs:
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 22
node-version: 20
cache: 'npm'
- name: Add upstream remote
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
git remote add upstream https://x-access-token:${GITHUB_TOKEN}@github.com/PR0M3TH3AN/bitvid.git || true
git remote add upstream https://github.com/PR0M3TH3AN/bitvid.git || true
git fetch upstream
- name: Verify upstream branch and diff
+7 -292
View File
@@ -4,7 +4,6 @@ on:
push:
branches:
- main
- unstable
pull_request:
concurrency:
@@ -17,13 +16,11 @@ jobs:
timeout-minutes: 45
strategy:
matrix:
node-version: [22]
node-version: [20]
steps:
- name: Check out repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
@@ -52,9 +49,7 @@ jobs:
run: npm ci
- name: Install ripgrep
run: |
sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
sudo apt-get update && sudo apt-get install -y ripgrep
run: sudo apt-get update && sudo apt-get install -y ripgrep
- name: Run lint suite
run: npm run lint
@@ -62,78 +57,6 @@ jobs:
- name: Build assets
run: npm run build
- name: Verify deploy artifact markup and hashed references
run: npm run verify:dist:deploy-artifact
- name: Smoke check hashed dist asset references
run: npm run smoke:dist-assets
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium
- name: Run cache-upgrade smoke test
if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
run: npm run test:e2e:cache-upgrade
- name: Generate dist hash state
if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
run: |
mkdir -p artifacts
node scripts/hash-dist.mjs --dist dist --output artifacts/dist-hashes-current.json
- name: Upload dist hash artifact
if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
uses: actions/upload-artifact@v4
with:
name: dist-hashes-current
path: artifacts/dist-hashes-current.json
if-no-files-found: error
# Visual regression runs as its own job so an environment-sensitive pixel diff
# (CI Chromium/font rendering can differ from the committed baseline) reports a
# failure WITHOUT blocking the build job — and therefore without blocking the
# deploy-cache-state CDN purge below. Real build/lint failures still gate the
# deploy via the build job.
visual-regression:
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
matrix:
node-version: [22]
steps:
- name: Check out repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- name: Cache npm directory
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ matrix.node-version }}-npm-${{ hashFiles('package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-${{ matrix.node-version }}-npm-
- name: Cache node_modules
id: node-modules-cache
uses: actions/cache@v4
with:
path: node_modules
key: ${{ runner.os }}-node-${{ matrix.node-version }}-modules-${{ hashFiles('package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-${{ matrix.node-version }}-modules-
- name: Install dependencies
if: steps.node-modules-cache.outputs.cache-hit != 'true'
run: npm ci
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium
@@ -156,173 +79,13 @@ jobs:
if: steps.visual.outcome == 'failure'
run: exit 1
deploy-cache-state:
if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
needs: build
runs-on: ubuntu-latest
timeout-minutes: 20
concurrency:
group: deploy-cache-state-unstable
cancel-in-progress: false
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Download dist hash artifact
uses: actions/download-artifact@v4
with:
name: dist-hashes-current
path: artifacts
- name: Fetch prior dist hash state and metadata
env:
DIST_HASH_STATE_URL: ${{ secrets.DIST_HASH_STATE_URL }}
run: |
mkdir -p artifacts
if [ -n "$DIST_HASH_STATE_URL" ]; then
curl --fail --silent --show-error --dump-header artifacts/dist-hashes-previous.headers "$DIST_HASH_STATE_URL" -o artifacts/dist-hashes-previous.json
DIST_HASH_STATE_ETAG=$(awk 'tolower($1)=="etag:" {print $2}' artifacts/dist-hashes-previous.headers | tr -d '\r' | tail -n 1)
DIST_HASH_STATE_VERSION=$(awk 'tolower($1)=="x-dist-hash-version:" {print $2}' artifacts/dist-hashes-previous.headers | tr -d '\r' | tail -n 1)
DIST_HASH_STATE_LAST_MODIFIED=$(awk 'BEGIN{IGNORECASE=1} /^Last-Modified:/ {sub(/^Last-Modified:[[:space:]]*/, ""); sub(/\r$/, ""); print; exit}' artifacts/dist-hashes-previous.headers)
echo "Loaded prior dist hash state from authoritative store."
else
echo '{"combined":"","files":[]}' > artifacts/dist-hashes-previous.json
DIST_HASH_STATE_ETAG=''
DIST_HASH_STATE_VERSION=''
DIST_HASH_STATE_LAST_MODIFIED=''
echo "No DIST_HASH_STATE_URL configured; using empty baseline."
fi
{
echo "DIST_HASH_STATE_ETAG=$DIST_HASH_STATE_ETAG"
echo "DIST_HASH_STATE_VERSION=$DIST_HASH_STATE_VERSION"
echo "DIST_HASH_STATE_LAST_MODIFIED=$DIST_HASH_STATE_LAST_MODIFIED"
} >> "$GITHUB_ENV"
echo "State metadata snapshot: etag='${DIST_HASH_STATE_ETAG:-<none>}', version='${DIST_HASH_STATE_VERSION:-<none>}', last-modified='${DIST_HASH_STATE_LAST_MODIFIED:-<none>}'"
- name: Diff dist hash states
run: |
node scripts/diff-dist-hashes.mjs \
--current artifacts/dist-hashes-current.json \
--previous artifacts/dist-hashes-previous.json > artifacts/dist-hashes-changed.txt
echo "Changed dist paths (initial baseline):"
cat artifacts/dist-hashes-changed.txt || true
- name: Plan cache purge scope
run: |
node scripts/plan-cache-purge.mjs \
--changed-file artifacts/dist-hashes-changed.txt \
--output-file artifacts/dist-purge-targets.txt > artifacts/dist-purge-plan.json
echo "Initial purge plan:"
cat artifacts/dist-purge-plan.json
- name: Record authoritative dist hash state with CAS and resolve races
env:
DIST_HASH_STATE_URL: ${{ secrets.DIST_HASH_STATE_URL }}
DIST_HASH_STATE_UPLOAD_URL: ${{ secrets.DIST_HASH_STATE_UPLOAD_URL }}
run: |
if [ -z "$DIST_HASH_STATE_UPLOAD_URL" ]; then
echo "No DIST_HASH_STATE_UPLOAD_URL configured; skipping authoritative hash-state update."
exit 0
fi
set +e
node scripts/store-dist-hash-state.mjs \
--input artifacts/dist-hashes-current.json \
--upload-url "$DIST_HASH_STATE_UPLOAD_URL" \
--if-match "$DIST_HASH_STATE_ETAG" \
--if-version "$DIST_HASH_STATE_VERSION" \
--if-unmodified-since "$DIST_HASH_STATE_LAST_MODIFIED"
STORE_EXIT=$?
set -e
if [ "$STORE_EXIT" -eq 0 ]; then
echo "CAS write succeeded on first attempt; retaining initial purge plan."
exit 0
fi
if [ "$STORE_EXIT" -ne 3 ]; then
echo "Hash-state upload failed with exit code $STORE_EXIT"
exit "$STORE_EXIT"
fi
echo "CAS conflict detected. Re-fetching state and recomputing purge targets before any CDN purge."
if [ -z "$DIST_HASH_STATE_URL" ]; then
echo "DIST_HASH_STATE_URL is required for race resolution after CAS conflict."
exit 1
fi
curl --fail --silent --show-error --dump-header artifacts/dist-hashes-previous.headers "$DIST_HASH_STATE_URL" -o artifacts/dist-hashes-previous.json
DIST_HASH_STATE_ETAG=$(awk 'tolower($1)=="etag:" {print $2}' artifacts/dist-hashes-previous.headers | tr -d '\r' | tail -n 1)
DIST_HASH_STATE_VERSION=$(awk 'tolower($1)=="x-dist-hash-version:" {print $2}' artifacts/dist-hashes-previous.headers | tr -d '\r' | tail -n 1)
DIST_HASH_STATE_LAST_MODIFIED=$(awk 'BEGIN{IGNORECASE=1} /^Last-Modified:/ {sub(/^Last-Modified:[[:space:]]*/, ""); sub(/\r$/, ""); print; exit}' artifacts/dist-hashes-previous.headers)
echo "Race-resolution metadata: etag='${DIST_HASH_STATE_ETAG:-<none>}', version='${DIST_HASH_STATE_VERSION:-<none>}', last-modified='${DIST_HASH_STATE_LAST_MODIFIED:-<none>}'"
node scripts/diff-dist-hashes.mjs \
--current artifacts/dist-hashes-current.json \
--previous artifacts/dist-hashes-previous.json > artifacts/dist-hashes-changed.txt
echo "Changed dist paths (race-resolved baseline):"
cat artifacts/dist-hashes-changed.txt || true
node scripts/plan-cache-purge.mjs \
--changed-file artifacts/dist-hashes-changed.txt \
--output-file artifacts/dist-purge-targets.txt > artifacts/dist-purge-plan.json
echo "Race-resolved purge plan:"
cat artifacts/dist-purge-plan.json
node scripts/store-dist-hash-state.mjs \
--input artifacts/dist-hashes-current.json \
--upload-url "$DIST_HASH_STATE_UPLOAD_URL" \
--if-match "$DIST_HASH_STATE_ETAG" \
--if-version "$DIST_HASH_STATE_VERSION" \
--if-unmodified-since "$DIST_HASH_STATE_LAST_MODIFIED"
echo "CAS write succeeded after race resolution; proceeding with recomputed purge targets."
- name: Purge changed Cloudflare URLs
env:
CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
CLOUDFLARE_PURGE_BASE_URL: ${{ secrets.CLOUDFLARE_PURGE_BASE_URL }}
run: |
if [ ! -s artifacts/dist-purge-targets.txt ]; then
echo "No purge targets detected. Skipping purge."
exit 0
fi
if [ -z "$CLOUDFLARE_ZONE_ID" ] || [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_PURGE_BASE_URL" ]; then
echo "Cloudflare secrets not configured; skipping targeted purge."
exit 0
fi
node scripts/purge-cloudflare-changed.mjs \
--changed-file artifacts/dist-purge-targets.txt \
--base-url "$CLOUDFLARE_PURGE_BASE_URL"
- name: Verify deployed index.html version markup
env:
CLOUDFLARE_PURGE_BASE_URL: ${{ secrets.CLOUDFLARE_PURGE_BASE_URL }}
run: |
if [ -z "$CLOUDFLARE_PURGE_BASE_URL" ]; then
echo "CLOUDFLARE_PURGE_BASE_URL is not configured; skipping deployed index.html verification."
exit 0
fi
DEPLOY_INDEX_URL="${CLOUDFLARE_PURGE_BASE_URL%/}/index.html" npm run verify:deployed:index-html
unit-tests:
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
node-version: [22]
node-version: [20]
shard: [1, 2, 3]
steps:
@@ -365,7 +128,7 @@ jobs:
timeout-minutes: 20
strategy:
matrix:
node-version: [22]
node-version: [20]
steps:
- name: Check out repository
@@ -400,60 +163,12 @@ jobs:
- name: Run DM unit tests
run: npm run test:dm:unit
e2e-tests:
runs-on: ubuntu-latest
timeout-minutes: 35
strategy:
fail-fast: false
matrix:
node-version: [22]
project: [e2e, e2e-firefox]
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- name: Cache npm directory
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ matrix.node-version }}-npm-${{ hashFiles('package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-${{ matrix.node-version }}-npm-
- name: Cache node_modules
id: node-modules-cache
uses: actions/cache@v4
with:
path: node_modules
key: ${{ runner.os }}-node-${{ matrix.node-version }}-modules-${{ hashFiles('package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-${{ matrix.node-version }}-modules-
- name: Install dependencies
if: steps.node-modules-cache.outputs.cache-hit != 'true'
run: npm ci
- name: Build app
run: npm run build
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium firefox
- name: Run deterministic E2E suite (${{ matrix.project }})
run: npx playwright test tests/e2e --project=${{ matrix.project }}
dm-integration-tests:
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
matrix:
node-version: [22]
node-version: [20]
steps:
- name: Check out repository
@@ -493,7 +208,7 @@ jobs:
timeout-minutes: 45
strategy:
matrix:
node-version: [22]
node-version: [20]
steps:
- name: Check out repository
@@ -526,7 +241,7 @@ jobs:
run: npm ci
- name: Install Playwright browsers
run: npx playwright install --with-deps chromium firefox
run: npx playwright install --with-deps chromium
- name: Run headless E2E tests
run: npm run test:e2e
@@ -23,7 +23,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '22'
node-version: '20'
cache: 'npm'
- name: Verify gh CLI availability
-97
View File
@@ -1,97 +0,0 @@
# Build a fresh, downloadable site archive on every push (any branch), so a
# ready-to-upload copy of the compiled app is always available for a MANUAL nsite
# publish (NIP-5A). This does NOT publish to nsite or touch any Nostr signing key —
# it just builds `dist/`.
# - every branch: upload it as a 30-day workflow artifact.
# - main only: also cut an immutable GitHub Release with the .zip attached,
# giving a stable download URL:
# https://github.com/PR0M3TH3AN/bitvid/releases/latest/download/bitvid-site.zip
# The Release contains only the public compiled app (same as Vercel serves) — no
# secret. See docs/nsite-mirror-plan.md.
name: Build site archive
on:
push:
workflow_dispatch:
permissions:
contents: read
# One archive build in flight per branch; a newer push supersedes an older one.
concurrency:
group: nsite-archive-${{ github.ref }}
cancel-in-progress: true
jobs:
archive:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22
cache: npm
- name: Install dependencies
run: npm ci
- name: Build static site
run: npm run build
- name: Short SHA
id: vars
run: echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
# `path: dist` stores the site files at the artifact root (index.html at top),
# so the downloaded .zip extracts straight to the nsite site directory.
- name: Upload site archive
uses: actions/upload-artifact@v4
with:
name: bitvid-site-${{ github.ref_name }}-${{ steps.vars.outputs.sha }}
path: dist
if-no-files-found: error
retention-days: 30
# Production only: publish an immutable GitHub Release with the .zip attached, so
# the latest prod archive is always at a stable URL:
# https://github.com/PR0M3TH3AN/bitvid/releases/latest/download/bitvid-site.zip
# This is purely a download convenience + per-release snapshot — it does NOT
# publish to nsite and holds no Nostr signing key (that step stays manual).
release:
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22
cache: npm
- name: Install dependencies
run: npm ci
# `npm run archive` builds dist/ and writes bitvid-site.zip (index.html at root).
- name: Build site archive
run: npm run archive
- name: Publish site release
env:
GH_TOKEN: ${{ github.token }}
run: |
tag="site-$(date -u +%Y%m%d)-${GITHUB_SHA::7}"
notes="Compiled bitvid static app (\`dist/\`) at ${GITHUB_SHA}.
Stable latest link: https://github.com/${GITHUB_REPOSITORY}/releases/latest/download/bitvid-site.zip"
# Re-runs of the same commit reuse the tag: refresh the asset instead of failing.
if gh release view "$tag" >/dev/null 2>&1; then
gh release upload "$tag" bitvid-site.zip --clobber
gh release edit "$tag" --latest
else
gh release create "$tag" bitvid-site.zip \
--title "Site archive $tag" \
--notes "$notes" \
--latest
fi
-12
View File
@@ -6,19 +6,7 @@ playwright-report/
test-results/
tests/visual/__snapshots__/
artifacts/
!artifacts/load-report-*.json
css/tailwind.generated.css
ai/reports/
*.log
coverage/
dist/
TEST_LOG.mdtest_logs/nip-hits.txt
!artifacts/audit/
!artifacts/audit/*.md
!artifacts/audit/*.json
# Vercel CLI local link/state
.vercel
# Local site archive for manual nsite upload (npm run archive)
bitvid-site.zip
-1
View File
@@ -1 +0,0 @@
engine-strict=true
-1
View File
@@ -1 +0,0 @@
22
-23
View File
@@ -1,23 +0,0 @@
# After Benchmark for Moderation Stage Batching
## Command
`node benchmarks/moderation_batch_bench.js`
## Environment
- Node.js v22.22.0
- 5000 items
- 500 authors
- 100 muters per author
- Forced prune check (lastPrunedAt = 0)
## Results
- Run 1: 184.34ms
- Run 2: 277.68ms
- Run 3: 188.89ms
- Run 4: 256.48ms
- **Average: ~227ms**
## Comparison
- Baseline: ~454ms
- After: ~227ms
- **Improvement: ~50% faster**
+11 -498
View File
@@ -4,7 +4,7 @@ This guide tells AI agents how to keep bitvid aligned with the current product d
**Important:** Before starting any development or debugging, please review `KNOWN_ISSUES.md`. This file documents pre-existing test failures, environmental quirks, and architectural limitations that you should be aware of to avoid unnecessary investigation.
For any nostr related work, please review the nip documentation located in /docs/nips before beginning work.
For any nostr related work, please review the nip documentation located in /docs/nips before begining work.
**Comment publishing guardrail:** Session actors are limited to passive telemetry (e.g., view counters). Always require the logged-in Nostr signer when sending video comments through [`js/nostr/commentEvents.js`](js/nostr/commentEvents.js). See the reminder in [`docs/nostr-event-schemas.md`](docs/nostr-event-schemas.md#event-catalogue) for context.
@@ -14,7 +14,7 @@ For any nostr related work, please review the nip documentation located in /docs
* **Main** is the production track. Anything merged here must preserve today’s UX and magnet safety guarantees. Rollbacks should be painless: keep commits atomic, avoid destructive migrations, and leave feature flags in a known-good default (`false` unless product explicitly flips them).
* **Unstable** is our experimentation lane. Gate risky behavior behind feature flags defined in `js/constants.js` and document the toggle/rollback plan in PR descriptions.
* **Emergency response:** If a change regresses playback or breaks magnet parsing, revert immediately, call this out in the PR, and annotate the AGENTS.md changelog with remediation tips. **Note:** These regressions usually surface in dev logs and tests around playback/magnet helpers—reference them when triaging so future agents don’t repeat the mistake.
* **Emergency response:** If a change regresses URL-first playback or breaks magnet parsing, revert immediately, call this out in the PR, and annotate the AGENTS.md changelog with remediation tips. **Note:** These regressions usually surface in dev logs and tests around playback/magnet helpers—reference them when triaging so future agents don’t repeat the mistake.
### Browser logging policy
@@ -23,11 +23,12 @@ For any nostr related work, please review the nip documentation located in /docs
* Before promoting a build, flip `IS_DEV_MODE` in `config/instance-config.js` to match the target environment so `window.__BITVID_DEV_MODE__` and the logger channels behave correctly.
* Review and follow [`docs/logging.md`](docs/logging.md) whenever you add new logging or touch inline scripts.
## 2. Mission: Hybrid Playback Strategy
## 2. Mission: URL‑First Playback with WebTorrent Fallback
* **Goal:** Always deliver smooth playback while optimizing for the configured priority (hosted URL or P2P).
* **Configuration:** `DEFAULT_PLAYBACK_SOURCE` in `config/instance-config.js` determines whether `url` or `torrent` is attempted first.
* **Runtime behavior:** Call `bitvidApp.playVideoWithFallback({ url, magnet })` (implemented in `js/app/playbackCoordinator.js` and bound to the app instance in `js/app.js`). This function attempts the preferred source first and falls back to the alternative if the primary fails or stalls. `js/playbackUtils.js` now provides magnet/session helper utilities rather than the playback entry point itself.
* **Goal:** Always deliver smooth playback while keeping hosting costs low.
* **Primary transport:** A hosted video URL (MP4/WebM/HLS/DASH) that the `<video>` element can stream directly.
* **Fallback transport:** A WebTorrent magnet that includes browser‑safe trackers plus optional HTTP hints.
* **Runtime behavior:** Call `bitvidApp.playVideoWithFallback({ url, magnet })` in `js/app.js`. This function orchestrates URL probing and magnet fallback, delegating low-level stream handling to `js/services/playbackService.js`. `js/playbackUtils.js` now provides magnet/session helper utilities rather than the playback entry point itself.
* **Content contract:** bitvid posts (Nostr kind `30078`) must include a `title` and at least one of `url` or `magnet`. Prefer to publish both along with optional `thumbnail`, `description`, and `mode` fields. When mirroring to NIP‑94 (`kind 1063`), copy the hosted URL and (optionally) the magnet so other clients can discover the same asset.
## Styling & Theming Rules (token-first)
@@ -58,20 +59,11 @@ For any nostr related work, please review the nip documentation located in /docs
1. **Required fields:** Validation must ensure a title exists and that either a hosted URL or a magnet (or both) is supplied. Optional `ws` / `xs` inputs should be appended only when a magnet is present.
2. **Magnet parsing errors:** When a user pastes encoded magnets, run `safeDecodeMagnet()` before normalizing. Show inline errors if decoding fails and confirm the raw `magnet:?xt=` string survives the round trip.
3. **Playback source promise:** After submission, confirm the resulting feed item carries `data-play-url` and `data-play-magnet` attributes so playback utilities can attempt the configured source first.
3. **URL-first promise:** After submission, confirm the resulting feed item carries `data-play-url` and `data-play-magnet` attributes so playback utilities can attempt the URL first.
4. **Mixed-content warnings:** If the page is served over HTTPS, reject `ws=` or `xs=` hints that begin with `http://` and show guidance to upgrade to HTTPS. Document the copy in README/UX strings so operators can align messaging.
5. **Telemetry hooks:** Keep existing analytics/logging untouched unless instructed. If you add new modal states, annotate them clearly in code comments.
6. **Modal regressions:** If validation or helper wiring breaks in Main, disable new feature flags and ship a revert PR immediately. Note the rollback steps in AGENTS.md for posterity.
### 4a. Cloudflare/S3 upload-path gotchas (audited 2026-06-16)
* **Two near-identical upload services exist** — `js/services/r2Service.js` (Cloudflare R2) and `js/services/s3UploadService.js` (generic S3). They share `buildR2Key`, `resolveUploadIdentifier`, and the magnet build but are *copies*. **Any fix to one must be mirrored in the other** or they silently drift.
* **Storage-key collisions = data loss — FIXED 2026-06-16.** `buildR2Key` (`js/r2.js`) builds `u/<npub>/<namespace>/<slug>.<ext>` where `namespace` used to fall back to the literal `"uploads"` and `slug` to `"video"` (e.g. a non-ASCII filename, or no info-hash) — so a URL-first upload with no info-hash and a duplicate filename overwrote the previous object while the old note still pointed at that URL. WebTorrent uploads were always safe (info-hash namespaces the key = content-addressed). Fix: `computeStorageContentHash(file)` (`js/r2.js`) derives a content-based namespace when no info-hash is available (full SHA-256 for ≤512 MB, sampled metadata+edge fingerprint above that to avoid buffering huge files), wired into **both** `r2Service` and `s3UploadService`. Test: `tests/storage-key-collision.test.mjs`. **If you add a third upload path, reuse `computeStorageContentHash`.**
* **Whole-file hash before upload.** When the modal doesn't pre-seed an info-hash, `resolveUploadIdentifier` runs `calculateTorrentInfoHash(file)`, which reads the *entire* file before the upload begins and before any progress is emitted — on multi-GB files this looks like a hang. Emit a "preparing/hashing" status or parallelize.
* **Publish can report success unconfirmed.** `publishEventToRelay` (`js/nostrPublish.js`) has an optimistic-success fallthrough when the relay handle exposes no `on()`/`then()` — a note may show "Published" with no relay ACK. Don't tighten blindly (legacy `seen`-only relays rely on it), but log it.
* **Silent partial failures.** Thumbnail and `.torrent` upload failures are caught and `warn`-only; the video note still publishes with no user signal. Empty (0-byte) files hit `CompleteMultipartUpload` with `Parts:[]` and surface a cryptic error — guard `file.size === 0`.
* **Object cleanup (deletes/edits).** `R2Service.deleteVideoStorage()` removes the backing objects so "deleted" videos aren't left publicly downloadable. Contract to preserve: it's **best-effort and never throws** (must not block note deletion), it derives keys via `collectVideoStorageKeys()` and **only ever touches URLs under the owner's bucket base** (never external/3rd-party URLs), and it skips cleanly when storage is locked/credential-less. Wired into delete (`app.handleDeleteModalConfirm`) and edit-with-replaced-URL (`editModalController.handleSubmit`). Edit cleanup intentionally does **not** delete thumbnails (the new note may still reference them) and only fires when both old and new URLs are present and different.
---
## 5. Manual QA Checklist
@@ -82,10 +74,10 @@ Run this script before shipping notable UI changes, especially around upload/pla
* Launch the site, open the Upload modal, and confirm required-field validation (title + one of URL/magnet).
* Submit with URL only, magnet only, and both; ensure success states are clear.
2. **Hybrid playback**
2. **URL-first playback**
* Publish a post with both URL and magnet. Load the card and verify the player fetches the configured preferred source first (check network tab or logs).
* Temporarily block the primary source (e.g., devtools throttling or offline). Confirm playback seamlessly falls back to the secondary source.
* Publish a post with both URL and magnet. Load the card and verify the player fetches the hosted URL first (check network tab or logs).
* Temporarily block the URL (e.g., devtools throttling or offline). Confirm playback seamlessly falls back to the magnet.
3. **Magnet hygiene**
* Paste an encoded magnet; ensure `safeDecodeMagnet()` returns the raw value and the final string still includes the original `xt` hash.
@@ -198,485 +190,6 @@ When moving a feature to a controller, follow these steps:
---
## 11. Telemetry & Error Aggregation
* **Tooling:** Use `npm run telemetry:aggregate` (which runs `scripts/agent/telemetry-aggregator.mjs`) to collect, sanitize, and aggregate errors from CI/test runs, smoke tests, and agent logs.
* **Privacy Policy:** The tool automatically strips PII (IPs, emails, hex keys, bech32 keys) from logs. **Do not** manually inspect raw logs containing PII unless necessary for debugging in a secure environment; rely on the sanitized reports in `ai/reports/`.
* **Opt-in:** Telemetry generation is opt-in. You must set the environment variable `ENABLE_TELEMETRY=true` when running the aggregator.
* **Reports:** Aggregated reports are generated in `ai/reports/telemetry-YYYYMMDD.md` and `artifacts/error-aggregates.json`. These files provide prioritized issues for triage.
---
## 12. Multi-Agent Coordination
This project uses multiple AI agents (Claude Code, OpenAI Codex, Google Jules) working in parallel. Without coordination, agents will create conflicting PRs, duplicate work, and cause painful merge conflicts. Follow these rules to keep things clean.
### Before Starting Work
1. **Check open PRs.** Run the following command to list all open PRs:
```
curl -s "https://api.github.com/repos/PR0M3TH3AN/bitvid/pulls?state=open&per_page=100" | jq '{count: length, titles: [.[].title]}'
```
If another agent already has a PR touching the same files or subsystem, do not create a competing PR. Instead, note the conflict and ask the maintainer how to proceed.
2. **Check this section for in-flight work.** The maintainer may list active work areas below. Respect these reservations.
3. **Read KNOWN_ISSUES.md.** Do not open PRs to fix issues already documented there unless explicitly asked.
### Subsystem Boundaries
To minimize merge conflicts, treat these as independent work zones. An agent should avoid touching files outside its assigned zone in a single PR:
| Zone | Key Files | Description |
|------|-----------|-------------|
| **Nostr Core** | `js/nostr/client.js`, `js/nostr/adapters/`, `js/nostrClientFacade.js` | Protocol client, signers, relay management |
| **Event Schemas** | `js/nostrEventSchemas.js`, `docs/nostr-event-schemas.md` | Event definitions and documentation |
| **Playback** | `js/services/playbackService.js`, `js/playbackUtils.js`, `js/magnetUtils.js` | Video streaming, magnet handling |
| **UI Controllers** | `js/ui/` | Modal controllers, notification, components |
| **State** | `js/state/` | Profile cache, application state |
| **DMs** | `js/ui/dm/`, `js/nostr/dm/` | Direct messaging subsystem |
| **Moderation** | `js/moderation/`, `docs/moderation/` | Content moderation, reports, admin lists |
| **Build & CI** | `.github/workflows/`, `scripts/`, `tailwind.config.cjs` | CI pipeline, lint scripts, build tooling |
| **Styling** | `css/tokens.css`, `css/tailwind.source.css` | Design tokens and Tailwind source |
| **App Orchestrator** | `js/app.js`, `js/app/` | Main app wiring (high conflict risk — only one PR at a time) |
**`js/app.js` is the highest-risk file.** It wires everything together. Never have two agent PRs modifying it simultaneously.
### PR Discipline
- **One subsystem per PR.** A PR that touches Nostr Core and UI Controllers is two PRs. Split them.
- **Small and mergeable.** Target PRs that can be reviewed in one sitting. If a refactor spans 10+ files, break it into sequential PRs.
- **Merge before branching.** Before starting new work on a subsystem, ensure all open PRs for that subsystem are merged or closed.
- **Rebase, don't stack.** Long-lived branches diverge fast with multiple agents. Rebase onto `unstable` frequently.
### Signaling Work to Other Agents
When you create a PR or start work, leave a clear signal:
- **PR title prefix**: Use a descriptive prefix like `[nostr-core]`, `[playback]`, `[ui]`, `[ci]` so the scope is visible at a glance.
- **PR description**: Include a "Files Modified" section listing the key files touched, so other agents can quickly detect conflicts.
### Task Coordination
> The previous TORCH relay-locking protocol (and its `torch/` tooling) has been
> removed. Coordinate via GitHub instead: before starting, check open PRs
> (`gh pr list` or the GitHub API) for overlap on the same subsystem, and use a
> descriptive PR title prefix so scope is visible. Don't run two agents on the
> same subsystem simultaneously, and keep `js/app.js` single-writer (see the
> Multi-Agent Coordination rules above).
### Currently In-Flight Work
<!-- Maintainer: update this list when assigning work to agents. Agents: check this before starting. -->
_No reservations currently active._
---
## 13. Code Health Rules (CI-Enforced)
Three automated lint checks protect the codebase from common growth problems. These run in CI via `npm run lint` and will block your PR if violated.
### File Size Limits
**Script:** `npm run lint:file-size` (`scripts/check-file-size.mjs`)
- New `.js` files under `js/` must stay **under 1,000 lines**.
- Existing oversized files are grandfathered with a recorded line count. They must **not grow** beyond their recorded count + 50 lines.
- If your change would push a grandfathered file over its limit, **extract logic into a new module first**, then make your change.
**Decomposition strategy for agents:**
1. Identify a cohesive block of logic (e.g., a group of related methods, a subsection of a controller).
2. Extract it into a new file in the same directory.
3. Export the extracted functions/class.
4. Import and re-wire from the original file.
5. Run `npm run lint:file-size` to confirm the original file shrank.
6. Update the grandfathered count if needed (the maintainer will handle this when merging).
### innerHTML Baseline
**Script:** `npm run lint:innerhtml` (`scripts/check-innerhtml.mjs`)
- Every file has a **baseline** innerHTML assignment count. Adding new `innerHTML` usage beyond the baseline fails the lint.
- For new UI code, use **safe DOM APIs** instead:
```javascript
// PREFERRED: auto-escaped, no XSS risk
element.textContent = userProvidedString;
const el = document.createElement("div");
el.className = "card";
parent.appendChild(el);
// ACCEPTABLE: innerHTML with escapeHtml for all user data
import { escapeHtml } from "../utils/domUtils.js";
container.innerHTML = `<span>${escapeHtml(title)}</span>`;
// BLOCKED: innerHTML with unescaped user data
container.innerHTML = `<span>${title}</span>`; // XSS vulnerability
```
- If you must add innerHTML (e.g., loading a view template), update the baseline: `node scripts/check-innerhtml.mjs --update` and include the updated BASELINE in your PR.
### Constants — No Duplication
- Relay timing constants live in **`js/nostr/relayConstants.js`** — always import from there.
- Before defining a new numeric constant, search for existing ones with the same value. If a match exists, import it.
- Feature flags live in **`js/constants.js`**.
- Cache policies live in **`js/nostr/cachePolicies.js`**.
- Do not define the same constant in two files. If two modules need the same value, create a shared module and import from it.
---
## 14. Playwright Agent Testing Infrastructure
bitvid includes a test harness and fixtures that let Playwright CLI agents programmatically log in, seed relay data, and inspect app state — no browser extensions or real relays required.
### Activating Test Mode
Add `?__test__=1` to the URL, or set `localStorage.__bitvidTestMode__ = "1"` via `addInitScript`. This installs `window.__bitvidTest__` on the page.
### Overriding Relays
Point the app at a local mock relay instead of production:
```
?__test__=1&__testRelays__=ws://127.0.0.1:8877
```
Or set `localStorage.__bitvidTestRelays__` to a JSON array of relay URLs.
### Test Harness API (`window.__bitvidTest__`)
| Method | Returns | Purpose |
|--------|---------|---------|
| `loginWithNsec(hexKey)` | `Promise<string>` (pubkey) | Programmatic login, bypasses the modal |
| `logout()` | `void` | Clear active signer |
| `getAppState()` | `{ isLoggedIn, activePubkey, relays, ... }` | Inspect current state |
| `getFeedItems()` | `Array<{ title, pubkey, dTag, hasUrl, hasMagnet }>` | Scrape video cards from DOM |
| `waitForFeedItems(n, ms)` | `Promise<Array>` | Wait for N cards to appear |
| `waitForSelector(sel, ms)` | `Promise<true>` | Wait for a DOM element |
| `getRelayHealth()` | `{ relays, unreachable, backoff }` | Relay connection status |
| `applyRelayOverrides(urls)` | `boolean` | Redirect relay connections |
| `setTestRelays(urls)` | `{ ok, relays }` | Align relayManager + nostrClient to a deterministic relay set |
| `setSignerDecryptBehavior(mode, opts?)` | `{ ok, mode, ... }` | Force decrypt behavior (`passthrough`, `timeout`, `error`, `delay`) for signer-based list sync tests |
| `getListSyncEvents()` | `Array<{ source, at, detail }>` | Read captured sync timeline (`bitvid:auth-loading-state` + `userBlocks` status) |
| `clearListSyncEvents()` | `void` | Reset captured sync events between assertions |
| `waitForListSyncEvent(criteria, ms?)` | `Promise<Event>` | Wait for sync milestones (`status`, `reason`, `source`) |
| `nostrClient` | `NostrClient` | Direct access for advanced use |
### Mock Relay (`scripts/agent/simple-relay.mjs`)
Start with `startRelay(port, { httpPort })`. Alongside the Nostr WebSocket protocol, exposes an HTTP API:
| Endpoint | Method | Purpose |
|----------|--------|---------|
| `/seed` | `POST` | Inject signed events (single object or array) |
| `/events` | `GET` | List all stored events |
| `/events` | `DELETE` | Clear all events |
| `/health` | `GET` | Event count + connection count |
Programmatic API: `relay.seedEvent(event)`, `relay.clearEvents()`, `relay.getEvents()`.
### Playwright Fixture (`tests/e2e/helpers/bitvidTestFixture.ts`)
Import `test` and `expect` from the fixture for tests that need the full stack:
```typescript
import { test, expect } from "./helpers/bitvidTestFixture";
test("agent can seed and view videos", async ({ page, gotoApp, loginAs, seedEvent }) => {
await seedEvent({ title: "Test Video", url: "https://example.com/v.mp4" });
await gotoApp();
await loginAs(page);
// ... assertions
});
```
**Available fixture values:**
| Fixture | Type | Purpose |
|---------|------|---------|
| `relay` | Relay instance | Auto-started/stopped per test |
| `seedEvent(video)` | `(TestVideoEvent) => Promise` | Create a signed kind 30078 event and inject it |
| `seedRawEvent(event)` | `(any) => Promise` | Inject a pre-built event |
| `clearRelay()` | `() => Promise` | Wipe all relay events |
| `gotoApp(path?)` | `(string?) => Promise` | Navigate with test mode + relay overrides |
| `loginAs(page)` | `(Page) => Promise<string>` | Login with deterministic test key |
| `setTestRelays(page, relays)` | `(Page, string[]) => Promise<{ok, relays}>` | Force relay alignment through harness + relayManager |
| `setDecryptBehavior(page, mode, opts?)` | `(Page, mode, opts?) => Promise` | Force signer decrypt behavior (`passthrough`, `timeout`, `error`, `delay`) |
| `startDiagnostics(page, opts?)` | `(Page, opts?) => Promise<{stop()}>` | Capture console/page errors and list-sync telemetry for assertions |
| `testPubkey` | `string` | Hex pubkey of the test key |
| `relayUrl` | `string` | WebSocket URL of the mock relay |
### `data-testid` Selectors
Use these for stable element targeting:
| Selector | Element |
|----------|---------|
| `[data-testid="login-button"]` | Header login button |
| `[data-testid="upload-button"]` | Header upload button (hidden until logged in) |
| `[data-testid="profile-button"]` | Header profile button (hidden until logged in) |
| `[data-testid="profile-permission-prompt"]` | Profile list-sync permission CTA container |
| `[data-testid="profile-permission-prompt-button"]` | Profile list-sync permission/retry CTA button |
| `[data-testid="search-input"]` | Header search field |
| `[data-testid="login-modal"]` | Login modal container |
| `[data-testid="login-provider-button"]` | Login provider option buttons |
| `[data-testid="nsec-secret-input"]` | Private key textarea in nsec login |
| `[data-testid="nsec-submit"]` | Nsec login submit button |
| `[data-testid="upload-modal"]` | Upload modal container |
| `[data-testid="upload-title"]` | Video title input |
| `[data-testid="upload-url"]` | Video URL input |
| `[data-testid="upload-magnet"]` | Magnet link input |
| `[data-testid="upload-submit"]` | Publish button |
| `[data-testid="hashtags-sync-status"]` | Profile hashtag sync status message |
| `[data-testid="subscriptions-sync-status"]` | Profile subscriptions sync status message |
| `[data-testid="blocked-refresh-button"]` | Profile blocked creators refresh button |
| `[data-testid="blocked-sync-status"]` | Profile blocked creators sync status message |
| `[data-testid="blocked-list"]` | Blocked creators list container |
| `[data-testid="blocked-empty-state"]` | Blocked creators empty state |
| `[data-testid="video-modal"]` | Video player modal |
| `[data-testid="video-card"]` | Individual video card in the feed |
| `[data-testid="video-list"]` | Video feed grid container |
### Key Files
| File | Purpose |
|------|---------|
| `js/testHarness.js` | Test harness module (installs `window.__bitvidTest__`) |
| `scripts/agent/simple-relay.mjs` | Mock relay with HTTP seeding API |
| `tests/e2e/helpers/bitvidTestFixture.ts` | Reusable Playwright fixture |
| `tests/e2e/agent-testability.spec.ts` | Infrastructure validation tests |
| `scripts/playwright/run-extension-persistent.mjs` | Dedicated persistent-context launcher for extension smoke tests |
| `docs/testing/playwright-integration-recommendations-2026-02-22.md` | Playwright/extension integration recommendations and follow-ups |
| `docs/testing/playwright-function-coverage.md` | Playwright coverage integration, latest baseline metrics, and improvement plan |
---
## 15. Agent Execution Protocol
This section defines the meta-workflow that **every AI agent** must follow when executing tasks in this codebase. It ensures safe, incremental changes, a clear decision trail, and continuity across context resets or agent hand-offs.
### Mindset
- Implement changes safely. Match existing conventions. Leave a clear trail of decisions.
- Correctness > cleverness. Consistent conventions > personal preference. Explicit tradeoffs > "should work."
- Prefer minimal, incremental changes over rewrites. Keep the build and tests green.
- Do not invent files, APIs, libraries, or behaviors. If unsure, inspect the codebase first.
### Scoping the Work
Before writing any code, establish clarity on three things:
1. **Primary goal** — What is being built or fixed?
2. **Success criteria** — How will we know it's done? (e.g., tests pass, feature visible in UI, lint clean)
3. **Non-goals** — What is explicitly out of scope? (Prevents scope creep across agent sessions.)
### External Notes (Persistent State Files)
Agents lose context across sessions. These files act as persistent memory that any agent (or human) can read to resume work or understand project status. **Update them before any likely context reset.**
**Storage Rule:** To prevent conflicts, these files are stored in dedicated directories with timestamps.
- **Read:** Always look for the **latest** timestamped file in the directory (e.g., `ls context/ | sort | tail -n 1`).
- **Write:** Never overwrite an existing file. Create a **new** file with a new timestamp (e.g., `context/CONTEXT_YYYY-MM-DD_HH-MM-SS.md`).
| Directory | File Pattern | Purpose | When to Update |
|-----------|--------------|---------|----------------|
| `context/` | `CONTEXT_<timestamp>.md` | Current goal, scope, assumptions, constraints, and "Definition of Done" | At start; when scope changes |
| `todo/` | `TODO_<timestamp>.md` | Checkbox task list with "Done" and "Blocked/Questions" sections | After planning; after tasks |
| `decisions/` | `DECISIONS_<timestamp>.md` | Key choices made, alternatives considered, and rationale | When making tradeoffs |
| `test_logs/` | `TEST_LOG_<timestamp>.md` | Commands run and their results (including failures) | After every lint/test/build run |
**Rules for external notes:**
- These files are working documents. They should reflect the *current* state of work.
- When starting a fresh task, clear stale content (by writing a fresh file) and re-scope.
- Keep entries concise — bullet points and checklists, not prose.
- `decisions/` is especially important: when you make a tradeoff, write it down so the next agent doesn't undo it.
### Work Loop
For each task item, repeat this cycle:
#### A) Locate
- Identify the relevant code and existing patterns. Find the "right place" to make the change.
- Write a short plan (3–7 bullets) before editing. If the task touches multiple subsystem zones (see Section 12), flag this — it may need to be split into separate PRs.
#### B) Implement
- Make the smallest change that satisfies the requirement.
- Keep edits cohesive. Avoid unrelated refactors in the same commit.
- Follow all conventions already documented in this file (logging via `logger`, token-first styling, magnet safety, schema definitions in `nostrEventSchemas.js`, etc.).
#### C) Verify
- Run the most relevant lint/test commands (see CLAUDE.md "Available Scripts" for the full list):
```bash
npm run lint # Required
npm run test:unit:shard1 # Fast feedback; run full suite before PR
```
- If there's no test coverage for your change, add focused tests or document in `decisions/` why tests aren't feasible.
- Log all commands and results in a new `test_logs/TEST_LOG_<timestamp>.md` file.
#### D) Update Notes
- Check off completed items in the latest `todo/` file (by creating a new one).
- Record decisions in a new `decisions/` file.
- Log verification results in a new `test_logs/` file.
- **Do this before any likely context/memory reset** — if you're about to hit a token limit, finish a long session, or hand off to another agent, update notes first.
### Context Recovery
If an agent starts a session and finds existing work-in-progress:
1. **Immediately read the latest files** in `context/`, `todo/`, `decisions/`, and `test_logs/`.
2. Resume from the next unchecked item in the latest `todo/` file.
3. Verify the current state by running `git status`, `git log --oneline -10`, and a quick lint/test pass.
4. Do not re-do work that the latest `test_logs/` shows already passed — unless the code has changed since.
### Output Requirements
When finishing a task or handing off, provide:
- **Summary** of what changed and why.
- **Files changed** (list).
- **Verification results** (from the latest `test_logs/` file).
- **Follow-ups / risks / remaining TODOs**.
- **If blocked:** Ask specific questions and propose 1–2 options.
### Quality Bar
| Principle | Meaning |
|-----------|---------|
| Correctness over cleverness | Simple, working code beats elegant abstractions |
| Conventions over preference | Match what's already in the repo, even if you'd do it differently |
| Explicit tradeoffs | Write down *why* in `decisions/`, don't leave the next agent guessing |
| Logged verification | Every claim of "tests pass" must have a `test_logs/` entry to back it up |
| Incremental over sweeping | Small, reviewable changes that keep the build green at every step |
---
## 16. Scenario-First Tests & Test Integrity (Dark Factory Standard)
In this repo, **validation replaces code review**. That means our test/scenario system is the *only* thing standing between “working software” and “green-but-worthless software.”
Agents will naturally optimize for short-term goals (e.g., “get CI green”) unless we constrain them. If we ever allow “edit tests until they pass,” we destroy the signal, and over time the suite becomes meaningless.
### Core philosophy: scenarios > checklists
We treat tests as **behavioral specifications** expressed as **scenarios**:
- “User stories” / end-to-end behaviors (Given/When/Then or equivalent)
- Assertions focus on **externally observable outcomes** at boundaries (API responses, persisted state, emitted events, CLI output, UI state), not internal call sequences.
- We prefer *minimal coupling* to implementation details so refactors don’t require rewriting “truth.”
(StrongDM reached the same conclusion: repo-local tests are easy to reward-hack; scenarios and satisfaction-based validation reduce “teaching to the test.”)
### Non-negotiable constitution (anti-cheat)
**Hard rules (always on):**
1) **Never weaken, delete, or rewrite a test just to make CI pass.**
2) **Never change expected behavior to match buggy output** (“rubber-stamp the snapshot”, “update golden”, “adjust assertion”) unless it is a **spec correction** (see below).
3) Do not “fix” flaky tests with retries, sleeps, timeouts, or looser assertions. **Remove nondeterminism** instead (control time, randomness, IO, network).
4) Prefer black-box assertions at system boundaries; avoid tests that merely mirror internal logic.
### Definitions
- **Scenario**: a behavioral spec (often end-to-end) describing what must happen for a user/system in a real environment.
- **Invariant**: a property that must always hold across many inputs/states (great for property-based or metamorphic testing).
- **Holdout scenario**: an evaluation scenario kept outside the agent-editable area to reduce overfitting / reward-hacking.
### When tests may change (spec correction protocol)
Changing a test expectation is allowed **only** when the test was enforcing the wrong behavior.
If you believe a test should change:
1) Identify the **scenario/spec** that defines correct behavior.
2) Explain precisely why the old expectation was wrong.
3) Replace it with an **equally strict or stricter** behavior-based check.
4) Record a **Test Integrity Note** (below) and, if applicable, a short spec note (e.g., `docs/spec_changes/<date>-<slug>.md`).
If you cannot point to scenario/spec truth, **do not change the test**. Add a “Needs Spec Clarification” note instead.
### “Test Integrity Note” (required for any PR touching tests)
Every PR that adds/changes tests must include this machine-readable block in the PR description (or in a `TEST_INTEGRITY.md` entry referenced by the PR):
```yaml
test_integrity_note:
change_type: ["new_tests" | "refactor_tests" | "spec_correction" | "flake_fix"]
scenarios:
- id: SCN-<slug>
given: "<preconditions>"
when: "<stimulus>"
then: "<observable outcomes>"
observable_outcomes:
- "<what the user/system can observe at the boundary>"
determinism_controls:
- "<fake clock / fixed seed / hermetic env / service virtualization>"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
- "over-mocking internal logic"
- "snapshot rubber-stamping"
- "retry/sleep-based flake masking"
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
### Test portfolio guidance (scenario-first, still layered)
We want a balanced suite:
- **Scenario/E2E**: user-story validation at boundaries (few, high value, high fidelity)
- **Integration/contract**: service boundaries, serialization, persistence, workflows
- **Unit/invariants**: properties that kill trivial cheats (“return true” shouldn’t survive)
For cheat resistance, strongly prefer:
- invariants/property-based tests for critical logic
- metamorphic relations where “exact expected output” is hard
- periodic mutation testing to “test the tests” (surviving mutants indicate missing assertions)
### External dependency realism (service virtualization / “digital twins”)
Where third-party services are involved, we prefer deterministic “behavioral clones” (mocks/stubs at the API boundary that reproduce edge cases and contracts) over live calls. This keeps scenarios realistic without being flaky or rate-limited, and it makes high-volume scenario validation affordable.
### Role: Test Integrity & Scenario Spec Agent (Enforcer)
This repo includes (or assumes) a dedicated agent role whose only job is to protect validation integrity.
This agent’s goal is NOT “make CI green.” Its goal is “make the suite reflect reality and reject fake passes.”
**Authority:**
- May add new scenarios, invariants, and tests.
- May refactor tests to be more behavioral and less procedural.
- May improve determinism (fixed seeds, fake clocks, hermetic env).
- May only change expectations via the Spec Correction Protocol above.
**Prohibitions:**
- Must never weaken tests to pass.
- Must never edit holdout scenarios (if configured).
- Must never solve flakiness via retries/sleeps/loosening.
**Deliverables each run:**
- Scenario list (Given/When/Then)
- Proposed test diffs
- Test Integrity Note
- “Cheat vectors blocked” summary (what trivial implementations it prevents)
---
## 17. NIP-07 Signer Reliability & Encrypted-List Loading (hard-won, 2026-06-16)
The single biggest source of "DMs / hashtags / watch-history / block & subscription lists won't load after login" is **not** bitvid — it's an **unresponsive NIP-07 signer**. The extension's MV3 background service-worker can die or its content-script↔worker channel can orphan, after which raw `window.nostr` calls hang forever. No client change can force a dead signer to answer.
* **Diagnose first, don't guess.** Run a single raw `window.nostr` probe in the page console (`getPublicKey → nip04.encrypt → nip04.decrypt`) that bypasses bitvid entirely. If *that* hangs, it's the extension/environment. Recommend a well-maintained signer (nos2x, Alby); KeysBand's dead worker was the root cause and switching to nos2x fixed everything.
* **Resilience invariants — do not regress these** (see `docs/KNOWN_BUGS.md` #0 for the full history and the files):
1. **Cap relay fan-out** (`js/nostr/toolkit.js` `capReadRelays`, ≤8, user-relays-first + 2 reserved default slots). An uncapped cold-login REQ storm to ~20 dead NIP-65 relays starves the single-threaded signer's postMessage round-trips.
2. **Circuit breaker** on the NIP-07 channel (`js/nostr/nip07Permissions.js`): after N consecutive *timeouts* fast-fail instead of hanging ~15s each. Channel-death errors must count toward opening (not reset it); interactive permission prompts bypass it; one periodic probe detects recovery.
3. **Never swallow a transient decrypt error as an empty result.** Re-throw channel-death/timeout sub-errors so the retry path runs — returning `[]` turns "signer is slow" into "user has no blocks/lists" and kills retries.
4. **Generous decrypt budget** (~25–30s/call, ~60s backoff cap); a 6s timeout kills slow-but-responsive signers mid-decrypt. Handshake variant timeout is ~20s for the same reason.
5. **One actionable user notice** (`js/utils/signerHealthNotice.js`) after a few timeouts with `signerStatus: "present"` — not a silent forever-retry.
* **Don't render into closed modals at login.** Once a responsive signer makes decryption instant, eagerly populating every profile panel at login (friends avatars, subscriptions, blocks, DM summaries) freezes the main thread ~10–15s. Populate each pane lazily on open (`selectPane`) and gate data-change re-render listeners on "is the view open".
* **Deterministic testing.** Reproduce signer-dependent bugs headlessly with a fake `window.nostr` (Playwright `exposeBinding` + `addInitScript`) + a mock relay + configurable channel models (healthy/slow/overload/dead, latency override). See `scripts/perf/nip07-channel-sim.mjs`.
---
## Next
Please read these documents next.
-26
View File
@@ -1,26 +0,0 @@
# Weekly Audit Report
**Branch:** `unstable`
**Date:** 2024-02-12
## Metrics
### 1. File Size Audit
- **Grandfathered oversized files:** 44
- **Sum of excess lines:** 50,025 (lines exceeding the 1000-line threshold)
- **Status:** **PASS** (No new violations beyond grandfathered list)
### 2. InnerHTML Audit
- **Total innerHTML assignments:** 99
- **Status:** **PASS** (No new assignments found)
### 3. Lint Status
- **Result:** **PASS**
- **Notes:** All checks passed. `lint:assets` and `lint:sw-compat` were skipped due to the environment (missing build artifacts/git history), which is expected.
## Comparison
- **Previous Week:** No previous report was found in the PR comments or issues for comparison.
## Recommendations
- Continue decomposition efforts for the largest grandfathered files (e.g., `js/ui/profileModalController.js`, `js/ui/components/VideoModal.js`).
- Maintain strict checks on innerHTML usage to prevent new security risks.
-18
View File
@@ -1,18 +0,0 @@
# Baseline Benchmark for Moderation Stage Batching
## Command
`node benchmarks/moderation_batch_bench.js`
## Environment
- Node.js v22.22.0
- 5000 items
- 500 authors
- 100 muters per author
- Forced prune check (lastPrunedAt = 0)
## Results
- Run 1: 545.80ms
- Run 2: 370.08ms
- Run 3: 523.04ms
- Run 4: 379.80ms
- **Average: ~454ms**
-21
View File
@@ -8,25 +8,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
### Added
- New views for Kids, History, Search, Subscriptions, and Docs. (PR #2129, PR #2153 by PR0M3TH3AN)
- Comprehensive test suite for Nostr features and UI components. (PR #2153 by PR0M3TH3AN)
- Provider-agnostic S3 multipart upload helpers to support large file uploads and bucket management. (PR #1620 by PR0M3TH3AN)
### Changed
- Documentation alignment and updates. (PR #2563 by PR0M3TH3AN)
- Cleanup of Search Filter Modal comments. (PR #2562 by PR0M3TH3AN)
- Performance improvements for documentation scroll spy. (PR #2129 by PR0M3TH3AN)
- Optimized Nostr login speed. (PR #2153 by PR0M3TH3AN)
- Updated `nostr-tools`, `floating-ui`, and `crypto-helpers` dependencies. (PR #2153 by PR0M3TH3AN)
- Major repository update and synchronization (Commit `b429b1c` by thePR0M3TH3AN)
- Removed runtime `ASSET_VERSION` query-string cache busting for static assets. Deployment freshness is now driven by build-time hashed filenames and `asset-manifest.json` rewrites.
### Fixed
- Reverted webseed regression fix (PR #2002 by thePR0M3TH3AN)
### Security
- Fixed magnet parameter injection vulnerability via `xt` parameter decoding. (PR #2345 by PR0M3TH3AN)
-642
View File
@@ -1,642 +0,0 @@
# CLAUDE.md — AI Assistant Guide for bitvid
This document provides context and guidance for AI assistants working with the bitvid codebase. It explains the project structure, development workflows, conventions, and key architectural decisions.
---
## Project Overview
**bitvid** is a decentralized video sharing platform built on the Nostr protocol. It operates as a static client — no backend server, no custody of user keys, no server-side signing. All authentication and state management happens client-side or via connected Nostr signers.
### Key Technologies
- **Nostr**: Decentralized identity and event protocol (NIP-07, NIP-33, NIP-44, NIP-46, NIP-51, NIP-71, etc.)
- **WebTorrent**: P2P video streaming fallback
- **Tailwind CSS**: Utility-first styling with custom design tokens
- **Playwright**: E2E and visual regression testing
- **Node.js 22+**: Development environment
### License
GPL-3.0-or-later (see `LICENSE`)
---
## Codebase Structure
```
bitvid/
├── js/ # Main application JavaScript
│ ├── app.js # Main orchestrator (bitvidApp)
│ ├── nostr/ # Nostr protocol implementation
│ │ ├── client.js # Core Nostr client with signer adapters
│ │ ├── nip71.js # NIP-71 video note parsing
│ │ ├── sessionActor.js # Anonymous session actors for telemetry
│ │ └── adapters/ # NIP-07, NIP-46, nsec signer adapters
│ ├── services/ # Business logic services
│ │ └── playbackService.js # Video playback orchestration
│ ├── ui/ # UI components and controllers
│ ├── state/ # State management (cache.js)
│ ├── utils/ # Utility functions
│ ├── constants.js # Feature flags and WSS trackers
│ ├── config.js # Re-exports from instance config
│ ├── magnetUtils.js # Magnet URI helpers
│ ├── nostrEventSchemas.js # Event schema definitions (source of truth)
│ └── nostrClientFacade.js # Main Nostr client entry point
├── config/
│ └── instance-config.js # Deployment configuration
├── css/
│ ├── tokens.css # Design token definitions
│ ├── tailwind.source.css # Tailwind input file
│ └── tailwind.generated.css # Generated (gitignored)
├── tests/ # Test suites
│ ├── unit/ # Unit tests
│ ├── e2e/ # End-to-end tests
│ ├── visual/ # Visual regression tests
│ ├── nostr/ # Nostr-specific tests
│ └── moderation/ # Moderation feature tests
├── docs/ # Documentation
│ ├── nostr-event-schemas.md # Event schema reference
│ ├── playback-fallback.md # Playback architecture
│ ├── moderation/ # Moderation system docs
│ └── nips/ # NIP reference documentation
├── views/ # HTML view templates
├── components/ # HTML component templates
├── content/ # Markdown content (docs, roadmap)
├── torrent/ # WebTorrent integration
├── scripts/ # Build and utility scripts
└── .github/workflows/ # CI/CD configuration
```
---
## Essential Files to Know
| File | Purpose |
|------|---------|
| `AGENTS.md` | AI agent guide with architectural rules and mission |
| `KNOWN_ISSUES.md` | Pre-existing test failures and environmental quirks |
| `CONTRIBUTING.md` | Developer setup and contribution guidelines |
| `js/app.js` | Main application orchestrator (`bitvidApp`) |
| `js/nostr/client.js` | Core Nostr client with signer registry |
| `js/nostrEventSchemas.js` | **Source of truth** for all Nostr event schemas |
| `js/constants.js` | Feature flags and runtime configuration |
| `config/instance-config.js` | Deployment-specific settings |
| `js/testHarness.js` | Playwright test harness (`window.__bitvidTest__`) |
| `tests/e2e/helpers/bitvidTestFixture.ts` | Reusable Playwright fixture for agent testing |
| `scripts/agent/simple-relay.mjs` | Mock Nostr relay with HTTP seeding API |
| `docs/nostr-event-schemas.md` | Event schema documentation |
| `context/` | Agent working state: current goal, scope, assumptions (see AGENTS.md §15) |
| `todo/` | Agent task checklist with done/blocked sections (see AGENTS.md §15) |
| `decisions/` | Agent decision log: choices, alternatives, rationale (see AGENTS.md §15) |
| `test_logs/` | Agent verification log: commands run and results (see AGENTS.md §15) |
---
## Development Workflow
### Initial Setup
```bash
# Clone and install
git clone https://github.com/PR0M3TH3AN/bitvid.git
cd bitvid
npm ci # Use ci for exact lockfile deps
# Build (generates Tailwind CSS)
npm run build
# Start local server
python -m http.server 8000
# or
npx serve
```
### Before Every PR
```bash
# Required checks
npm run format # Format CSS/HTML/MD
npm run lint # All lint checks
npm run test:unit # Or use shards for faster feedback
# Recommended for UI changes
npm run test:visual
```
### Available Scripts
| Script | Purpose |
|--------|---------|
| `npm run build` | Full build (Tailwind + dist + verify) |
| `npm run build:css` | Regenerate Tailwind only |
| `npm run format` | Format with Prettier |
| `npm run lint` | Run all linting checks |
| `npm run lint:css` | CSS token validation |
| `npm run lint:inline-styles` | Block inline styles |
| `npm run lint:tokens` | Design token enforcement |
| `npm run lint:file-size` | Enforce file size limits |
| `npm run lint:innerhtml` | Enforce innerHTML baseline |
| `npm run audit` | Run design system audit |
| `npm run build:beacon` | Build torrent beacon assets |
| `npm run test:unit` | Full unit test suite |
| `npm run test:unit:shard1` | Shard 1/3 (faster local dev) |
| `npm run test:unit:shard2` | Shard 2/3 |
| `npm run test:unit:shard3` | Shard 3/3 |
| `npm run test:smoke` | Run critical path smoke tests |
| `npm run test:dm:unit` | Direct message unit tests |
| `npm run test:dm:integration` | DM integration tests |
| `npm run test:e2e` | Headless E2E tests |
| `npm run test:load` | Run load tests |
| `npm run test:visual` | Visual regression tests |
| `npm run test:visual:update` | Update visual regression baselines |
| `npm run telemetry:aggregate` | Aggregate telemetry logs |
| `node scripts/agent/validate-events.mjs` | Validate Nostr event schemas |
---
## CI/CD Pipeline
The CI workflow (`.github/workflows/ci.yml`) runs on every push to `main` and all PRs:
| Job | Timeout | Description |
|-----|---------|-------------|
| `build` | 45 min | Lint, build, visual regression |
| `unit-tests` | 30 min | Sharded unit tests (3 shards) |
| `dm-unit-tests` | 20 min | Direct message unit tests |
| `dm-integration-tests` | 30 min | DM integration tests |
| `e2e-headless` | 45 min | Playwright E2E tests |
**Concurrency**: `cancel-in-progress: true` — new commits cancel running jobs.
---
## Code Conventions
### Logging
**Always use the logger utility**, never call `console.*` directly:
```javascript
import { logger } from './utils/logger.js';
logger.user.error('User-facing error'); // Production visible
logger.dev.log('Debug info'); // Dev mode only (IS_DEV_MODE)
```
### Styling Rules
1. **Token-first**: Use design tokens from `css/tokens.css`, never raw hex colors
2. **No inline styles**: `style=` attributes and `element.style` are blocked by lint
3. **Semantic tokens**: Use `bg`, `text`, `accent`, `border`, `danger`, etc.
4. **Theme scopes**: Toggle themes via `data-theme` attribute, not code
### Nostr Event Schemas
All Nostr events must be defined in `js/nostrEventSchemas.js`:
```javascript
import { buildVideoPostEvent, NOTE_TYPES } from './nostrEventSchemas.js';
const event = buildVideoPostEvent({
pubkey: hexPubkey,
created_at: Math.floor(Date.now() / 1000),
dTagValue: 'video-id',
content: {
version: 3,
title: 'My Video',
videoRootId: 'video-id',
url: 'https://example.com/video.mp4'
}
});
```
### Magnet Handling
**Critical rules** — magnets are fragile:
```javascript
import { safeDecodeMagnet, normalizeAndAugmentMagnet } from './magnetUtils.js';
// Always decode first
const raw = safeDecodeMagnet(userInput);
// Then normalize with hints
const enriched = normalizeAndAugmentMagnet(raw, { wsHint, xsHint });
// NEVER use new URL() on magnets — it corrupts hashes!
```
- WSS trackers only (from `js/constants.js`)
- Persist raw magnet strings, decode only at playback
- Include HTTPS `ws=`/`xs=` hints when available
### Architecture Pattern
**Separation of concerns**:
- `bitvidApp` (js/app.js) — Orchestrator, manages app-wide state
- UI Controllers — Handle specific UI components (e.g., `ProfileModalController`)
- Services — Business logic (e.g., `playbackService.js`)
- State — Central truth in `js/state/cache.js`
**Data flow**:
1. User action triggers controller event handler
2. Controller invokes callback provided by `bitvidApp`
3. `bitvidApp` executes logic, updates central state
4. `bitvidApp` notifies controller to re-render
---
## Feature Flags
Feature flags in `js/constants.js` gate experimental behavior:
| Flag | Default | Purpose |
|------|---------|---------|
| `URL_FIRST_ENABLED` | Depends on config | Try URL before magnet |
| `FEATURE_WATCH_HISTORY_V2` | true | Watch history system |
| `FEATURE_PUBLISH_NIP71` | false | NIP-71 video publishing |
| `FEATURE_SEARCH_FILTERS` | Dev mode only | Advanced search |
| `FEATURE_TRUST_SEEDS` | true | Baseline trust seeds |
| `FEATURE_TRUSTED_HIDE_CONTROLS` | true | Trusted mute/spam hide controls |
| `FEATURE_IMPROVED_COMMENT_FETCHING` | true | Improved comment fetching logic |
Toggle at runtime:
```javascript
import { setUrlFirstEnabled } from './constants.js';
setUrlFirstEnabled(false); // Disable URL-first playback
```
---
## Nostr Integration
### Key NIPs Used
| NIP | Purpose |
|-----|---------|
| NIP-07 | Browser extension signing |
| NIP-33 | Parameterized replaceable events (videos) |
| NIP-04 | Legacy DM encryption |
| NIP-44 | Modern encryption |
| NIP-46 | Remote signing |
| NIP-51 | Lists (mute, admin) |
| NIP-56 | Moderation reports |
| NIP-71 | Video events |
### Signer Adapters
```javascript
import { nostrClient } from './nostrClientFacade.js';
import { setActiveSigner } from './nostr/client.js';
// Register a signer
setActiveSigner({
pubkey,
signEvent: (event) => signer.sign(event),
nip04Encrypt: (target, text) => signer.nip04.encrypt(target, text),
nip04Decrypt: (actor, cipher) => signer.nip04.decrypt(actor, cipher),
// Optional: nip44Encrypt, nip44Decrypt
});
```
### NIP-33 Addressing (Important!)
Video events are addressed by `kind + pubkey + d-tag`:
```javascript
// CORRECT: Use the d-tag for addressing
const dTag = event.tags.find(t => t[0] === 'd')?.[1];
// WRONG: Don't use logical IDs like videoRootId for relay lookups
```
### NIP-07 Signer Reliability (hard-won)
The #1 cause of "DMs / hashtags / watch-history / lists won't load after login" is an **unresponsive NIP-07 signer**, not bitvid. The extension's MV3 background worker can die and `window.nostr` calls then hang forever — no client change fixes a dead signer. **Diagnose with a raw `window.nostr` probe** (`getPublicKey → nip04.encrypt → nip04.decrypt`) in the console; if that hangs, it's the extension (recommend nos2x/Alby). See `AGENTS.md` §17 and `docs/KNOWN_BUGS.md` #0.
Resilience invariants — **do not regress**:
1. **Cap relay fan-out** (`js/nostr/toolkit.js` `capReadRelays`, ≤8, user-relays-first + 2 reserved defaults) — an uncapped cold-login REQ storm starves the single-threaded signer.
2. **Circuit breaker** on consecutive NIP-07 timeouts (`js/nostr/nip07Permissions.js`) — fast-fail instead of hanging; channel-death counts toward opening; permission prompts bypass.
3. **Never swallow a transient decrypt error as `[]`** — re-throw channel-death/timeout so retries run (returning empty = "user has no lists" + no retry).
4. **Generous decrypt budget** (~25–30s/call) — a 6s timeout kills slow signers mid-decrypt.
5. **Lazy modal population** — don't render every profile panel into a closed modal at login; populate per-pane on open (`selectPane`).
---
## Testing & Validation: Scenario-First, Cheat-Resistant (Dark Factory Rules)
You are operating inside a “Dark Factory” workflow where **validation replaces human code review**. Passing tests is only meaningful if tests are truthful.
### Prime directive
**Never alter a test merely to make it pass.**
If you change tests to match buggy behavior, you are destroying the only feedback signal and producing code with no real-world value.
StrongDM describes the exact failure mode we are preventing: agents discovering shortcuts (“return true”) and narrow tests being reward-hacked, leading to a shift from “tests” to scenario-based validation.
### How to think about tests here
Tests are not procedural checklists. They are **behavioral specifications**:
- Write tests as **scenarios** (Given/When/Then or equivalent).
- Assert **externally observable outcomes** at boundaries.
- Avoid “testing the implementation” (internal call sequences, private methods, mirrored logic).
- Prefer deterministic/harmonic execution: fixed seeds, controlled clocks, hermetic IO, virtualized dependencies.
### Prohibited behaviors (reward-hacking patterns)
Do NOT:
- weaken assertions, broaden tolerances, or reduce coverage to get green
- update snapshots/goldens without proving the change is intended behavior
- add retries/sleeps/timeouts to hide flakes
- mock so heavily that tests can pass with a broken system
- “hard-code to the test” (single fixtures, single input paths, brittle constants)
### Allowed test changes: Spec Correction Protocol
You may change test expectations only if the test is wrong relative to intended behavior.
Required steps:
1) Identify the scenario/spec that defines correct behavior.
2) Explain why the previous expectation was incorrect.
3) Replace it with an equally strict (or stricter) behavioral assertion.
4) Provide a **Test Integrity Note** (machine-readable) documenting the change.
If you cannot justify a change with scenario/spec truth: **do not change the test**. Instead, output a “Needs Spec Clarification” note and propose candidate scenarios.
### Required output when you touch tests
Include this YAML block in your PR description (or reference it from a `TEST_INTEGRITY.md` entry):
```yaml
test_integrity_note:
change_type: ["new_tests" | "refactor_tests" | "spec_correction" | "flake_fix"]
scenarios:
- id: SCN-<slug>
given: "<preconditions>"
when: "<stimulus>"
then: "<observable outcomes>"
observable_outcomes:
- "<boundary/output asserted>"
determinism_controls:
- "<fixed seed / fake clock / hermetic env / service virtualization>"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
- "over-mocking internal logic"
- "snapshot rubber-stamping"
- "retry/sleep-based flake masking"
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
### If external services are involved
Prefer boundary-level service virtualization (“digital twins” / behavioral clones) so scenario tests remain:
- high fidelity (realistic edge cases)
- deterministic and replayable
- not rate-limited / not flaky
(StrongDM’s “Digital Twin Universe” is the reference pattern.)
---
## Testing Guidelines
### Before Starting Work
1. Read `KNOWN_ISSUES.md` for pre-existing failures
2. Run relevant test shard to verify baseline
### Running Tests
```bash
# Fast feedback during development
npm run test:unit:shard1
# Full suite before PR
npm run test:unit
# Visual changes
npm run test:visual
# DM features
npm run test:dm:unit && npm run test:dm:integration
# E2E journeys
npm run test:e2e
```
### Test Artifacts
Failed visual tests store artifacts in `artifacts/test-results/`:
- Screenshots
- Videos
- Traces
View with: `./scripts/show-artifacts.sh`
### Agent E2E Testing (Playwright)
bitvid includes a test harness for programmatic Playwright testing without browser extensions or real relays. See `AGENTS.md` Section 14 for the full reference. Quick start:
```typescript
import { test, expect } from "./helpers/bitvidTestFixture";
test("my test", async ({ page, gotoApp, loginAs, seedEvent }) => {
await seedEvent({ title: "Test Video", url: "https://example.com/v.mp4" });
await gotoApp();
await loginAs(page);
// interact with the app using data-testid selectors
await expect(page.locator('[data-testid="upload-button"]')).toBeVisible();
});
```
Key capabilities:
- **Programmatic login**: `loginAs(page)` uses `window.__bitvidTest__.loginWithNsec()` — no modal interaction needed
- **Mock relay**: Each test gets an isolated in-memory relay with HTTP seeding
- **Relay override**: `?__test__=1&__testRelays__=ws://localhost:8877` redirects all connections
- **State inspection**: `window.__bitvidTest__.getAppState()` returns login status, relays, etc.
- **Stable selectors**: All key elements have `data-testid` attributes (see AGENTS.md Section 14)
---
## Common Tasks
### Adding a New Nostr Event Type
1. Define schema in `js/nostrEventSchemas.js`
2. Add builder function
3. Document in `docs/nostr-event-schemas.md`
4. Add tests
### Creating UI Components
1. Create controller in `js/ui/`
2. Wire callbacks through `bitvidApp`
3. Read state via provided getters, never directly
4. Use design tokens for styling
### Modifying Playback Behavior
1. Check `js/services/playbackService.js` for stream handling
2. Update `js/constants.js` feature flags if needed
3. Test with both URL and magnet sources
4. Document rollback steps in PR
---
## Troubleshooting
### Build Issues
```bash
# Browserslist warning
npx update-browserslist-db@latest
# Tailwind not regenerating
rm css/tailwind.generated.css && npm run build:css
```
### Test Hangs
- Unit tests may hang after completion — use `Ctrl+C`
- Use shards for faster local runs
- Set `UNIT_TEST_TIMEOUT_MS=120000` for slow tests
### Lint Failures
- **Inline styles**: Move to CSS classes or tokens
- **Hex colors**: Use design tokens
- **Design tokens**: Use `theme()` or existing utilities
---
## Release Channels & Promotion Pipeline
Code flows through three branches with increasing stability:
```
unstable → beta → main
(dev) (soak) (prod)
```
| Branch | Purpose | CI Required | Manual QA |
|--------|---------|-------------|-----------|
| `unstable` | Active development, AI agent PRs land here | Yes | No |
| `beta` | Stabilization soak (hosted for testing) | Yes | Yes — hosted domain |
| `main` | Production | Yes | Verified via beta |
**Promotion rules:**
- `unstable → beta`: After a batch of improvements passes CI and local testing
- `beta → main`: After weeks of soak time on the beta hosted domain with no regressions
- Never push directly to `main` or `beta` — always promote from the previous stage
### Emergency Response
If a change breaks playback or magnet handling:
1. Revert immediately
2. Note rollback in PR
3. Document in AGENTS.md
---
## Multi-Agent Development Workflow
This project uses multiple AI coding agents working in parallel:
- **Claude Code** — Refactoring, convention enforcement, codebase-wide changes
- **OpenAI Codex** — Isolated feature implementation with clear specs
- **Google Jules** — Issue triage and straightforward bug fixes
### Coordination Rules
All agents **must** follow the subsystem boundaries and PR discipline rules in `AGENTS.md` Section 12. The key principles:
1. **Check before you start.** Look at open PRs before beginning work by running:
```
curl -s "https://api.github.com/repos/PR0M3TH3AN/bitvid/pulls?state=open&per_page=100" | jq '{count: length, titles: [.[].title]}'
```
If another agent has an open PR touching the same files, stop and flag the conflict.
2. **One subsystem per PR.** Don't mix unrelated changes. A lint fix and a feature addition are two separate PRs.
3. **`js/app.js` is single-writer.** Only one PR at a time should modify the main orchestrator.
4. **Merge fast, branch short.** Long-lived branches cause exponential merge pain with multiple agents. Keep PRs small and mergeable in one sitting.
### For Human Maintainers
When assigning work to agents:
- Update the "Currently In-Flight Work" section in `AGENTS.md` to reserve subsystems
- Avoid sending two agents at the same subsystem simultaneously
- Review and merge agent PRs promptly to keep the queue short — stale PRs compound conflicts
- Use PR title prefixes (`[nostr-core]`, `[ui]`, `[playback]`, etc.) to make scope visible
---
## Key Documentation
| Document | What It Covers |
|----------|---------------|
| `AGENTS.md` | AI agent rules, mission, architectural decisions |
| `CONTRIBUTING.md` | Setup, PR process, DCO |
| `KNOWN_ISSUES.md` | Pre-existing test failures |
| `docs/nostr-event-schemas.md` | Event definitions |
| `docs/playback-fallback.md` | URL-first strategy |
| `docs/moderation/README.md` | Moderation system |
| `docs/logging.md` | Logger usage |
| `context/` / `todo/` / `decisions/` / `test_logs/` | Agent persistent state files (see AGENTS.md §15) |
---
## Quick Reference
### Import Patterns
```javascript
// Nostr client
import { nostrClient } from './nostrClientFacade.js';
// View events (analytics)
import { recordVideoView } from './nostrViewEventsFacade.js';
// Watch history
import { updateWatchHistoryListWithDefaultClient } from './nostrWatchHistoryFacade.js';
// Event building
import { buildVideoPostEvent } from './nostrEventSchemas.js';
// Feature flags
import { URL_FIRST_ENABLED, setUrlFirstEnabled } from './constants.js';
// Logger
import { logger } from './utils/logger.js';
```
### Content Schema v3
```javascript
{
version: 3,
title: string, // Required
url?: string, // HTTPS video URL
magnet?: string, // WebTorrent magnet
thumbnail?: string,
description?: string,
mode: 'live' | 'dev',
isPrivate: boolean,
deleted: boolean,
videoRootId: string // Stable identifier
}
```
Validation: Must have `title` + at least one of `url` or `magnet`.
---
## Final Notes
1. **Read AGENTS.md first** — it contains mission-critical architectural decisions and the Agent Execution Protocol (§15)
2. **Check KNOWN_ISSUES.md** — avoid investigating pre-existing failures
3. **Use sharded tests** — faster feedback during development
4. **Never commit generated CSS** — `css/tailwind.generated.css` is gitignored
5. **Token-first styling** — no raw colors, no inline styles
6. **Keep magnets raw** — decode only at playback time
7. **Document rollback steps** — especially for playback changes
+19 -87
View File
@@ -22,34 +22,31 @@ See [https://developercertificate.org/](https://developercertificate.org/) for t
## (Optional) Contributor License Agreement (CLA)
If we later introduce **dual-licensing** options (e.g., commercial licenses for enterprises), we may add an _optional_ CLA for contributors who want to grant relicense rights. You will be asked to agree explicitly in any PR that requires it. We will keep community use under GPL-3.0-or-later.
If we later introduce **dual-licensing** options (e.g., commercial licenses for enterprises), we may add an *optional* CLA for contributors who want to grant relicense rights. You will be asked to agree explicitly in any PR that requires it. We will keep community use under GPL-3.0-or-later.
## Code Guidelines
- Prefer small, focused PRs.
- Add tests where reasonable; keep UI accessible.
- Follow existing formatting/lint rules.
- Update docs and user-facing text when behavior changes.
- Do not commit `css/tailwind.generated.css`; it is generated at build time.
* Prefer small, focused PRs.
* Add tests where reasonable; keep UI accessible.
* Follow existing formatting/lint rules.
* Update docs and user-facing text when behavior changes.
* Do not commit `css/tailwind.generated.css`; it is generated at build time.
## Agent PR Conventions
Automated agents contributing to this repository should follow these rules:
- **Atomic Commits**: Keep changes small, focused, and self-contained.
- **Descriptive Titles**: Use clear, semantic titles (e.g., `fix(ui): resolve upload modal overflow`).
- **Commit Messages**: Use the convention `type(scope): description (agent)` (e.g., `fix(ai): formatting (agent)` or `docs(ai): update quickstart (agent)`).
- **Reference Issues**: Link to relevant issues in the PR description.
- **Review AGENTS.md**: Always consult `AGENTS.md` for specific architectural guidelines (like URL-first playback, token-first design system) and constraints before starting work.
- **Review KNOWN_ISSUES.md**: Before starting development or debugging, review `KNOWN_ISSUES.md` to avoid investigating pre-existing failures or limitations.
- **Dependency Upgrades**: Major or risky dependency upgrades must be documented by creating a Markdown file in the `issues/` directory (e.g., `issues/upgrade-<pkg>.md`) with a plan and risk assessment, rather than opening an immediate PR.
- **Efficiency**: Prefer running targeted or sharded tests (e.g., `npm run test:unit:shard1`, `shard2`, or `shard3`) to conserve resources during iteration.
- **Review AGENTS.md**: Always consult `AGENTS.md` for specific architectural guidelines and constraints before starting work.
- **Efficiency**: Prefer running targeted or sharded tests (e.g., `npm run test:unit:shard1`) to conserve resources during iteration.
## Submitting a Pull Request
1. Fork the repository and create a new branch from `main`.
2. Make your changes, adding tests if applicable.
3. Run `npm run format`, `npm run lint`, and unit tests (e.g. `npm run test:unit` or a shard like `npm run test:unit:shard1`) to ensure quality before pushing.
3. Run `npm run format`, `npm run lint`, and unit tests (e.g. `npm run test:unit` or a shard like `npm run test:unit:shard1`) to ensure quality.
4. (Optional) Run `npm run test:visual` if you made UI changes.
5. (Optional) Run domain-specific tests if relevant (e.g., `npm run test:dm:unit` for Direct Messages).
6. Push your branch and open a Pull Request against the `main` branch.
@@ -94,96 +91,44 @@ This workflow uses the `force-cancel` endpoint to ensure stalled runs are termin
To set up the project locally:
1. **Prerequisites**:
- **Node.js**: v22 or higher (enforced by `.npmrc`).
- **NPM**: v10 or higher (included with Node 22).
2. **Install Dependencies**:
Use `npm ci` to ensure you get the exact dependencies from `package-lock.json`. If you intend to run smoke, visual, or end-to-end tests, also install Playwright browsers.
1. **Install Dependencies**:
Use `npm ci` to ensure you get the exact dependencies from `package-lock.json`.
```bash
npm ci
npx playwright install
```
3. **Start the Application**:
```bash
npm start
```
This command runs a full production build (generating `dist/` and `css/tailwind.generated.css`) and starts a local server.
**Or, build manually:**
2. **Build**:
```bash
npm run build
npx serve dist
```
(This runs `npm run build:css` to generate Tailwind styles.)
(The build command populates the `dist/` directory, which you can then serve locally.)
**For CSS-only changes:**
If you are only iterating on styles, you can run the faster CSS build:
```bash
npm run build:css
```
4. **Run Tests**:
3. **Run Tests**:
```bash
npm run test:unit
```
*Note: Running the full suite (`npm run test:unit`) is resource-intensive and may time out in some environments. We strongly recommend using sharded runs for local development: `npm run test:unit:shard1`.*
_Note: Running the full suite (`npm run test:unit`) is resource-intensive, runs sequentially, and may time out in some environments. We strongly recommend using sharded runs for local development to save time: `npm run test:unit:shard1`, `shard2`, or `shard3`._
You can also run end-to-end, smoke, and visual tests:
You can also run end-to-end and visual tests:
```bash
npm run test:e2e
npm run test:smoke # Critical path verification
npm run test:visual
```
To run load tests (agent-driven):
```bash
npm run test:load
```
To update visual regression baselines:
```bash
npm run test:visual:update
```
For Direct Message features, run:
```bash
npm run test:dm:unit
npm run test:dm:integration
```
To aggregate telemetry from test logs:
```bash
npm run telemetry:aggregate
```
5. **Format & Lint**:
4. **Format & Lint**:
```bash
npm run format
npm run lint
```
*Note: `npm run format` currently only targets CSS, HTML, and Markdown files.*
- **Format**: Targets CSS, HTML, Markdown, and config files. (Note: JavaScript files are not currently auto-formatted by this command).
- **Lint**: Checks for CSS errors, hex color usage, inline styles, design tokens, Tailwind guards, file size limits, innerHTML usage, asset references, and Service Worker compatibility. (Note: There is no ESLint configuration for JavaScript logic; this step focuses on style and design system guards).
- **Note**: `npm run lint` includes an asset verification step (`lint:assets`) which checks the `dist/` directory. For full coverage, run `npm run build` before linting.
- **Audit**: `npm run audit` runs a design system audit and generates `REMEDIATION_REPORT.md` with auto-fix suggestions.
6. **Git Hooks (Optional)**:
5. **Git Hooks (Optional)**:
We provide a script to set up a git pre-commit hook that runs linting and CSS builds automatically before you commit.
```bash
./scripts/setup-pre-commit.sh
@@ -191,20 +136,9 @@ To set up the project locally:
For a full guide, see the [Local Setup section in README.md](./README.md#local-setup).
### Event Schema Validation
When modifying event schemas or builders, verify your changes against the codebase and test suite:
```bash
node scripts/agent/validate-events.mjs
```
This script checks that all event builders produce valid events according to the definitions in `js/nostrEventSchemas.js`.
### Troubleshooting
- **Browserslist Warning**: If you see `Browserslist: caniuse-lite is outdated` during the build, run:
```bash
npx update-browserslist-db@latest
```
@@ -218,7 +152,6 @@ This script checks that all event builders produce valid events according to the
This project includes a `.devcontainer` configuration for VS Code. It provides a pre-configured environment with Node.js 22, the GitHub CLI, and necessary extensions.
To use it:
1. Open the project in VS Code.
2. When prompted, re-open in Container (or use the command palette: "Dev Containers: Reopen in Container").
3. The container will automatically:
@@ -231,7 +164,6 @@ To use it:
Before starting your work, please review these key documents:
- **[AGENTS.md](./AGENTS.md)**: Architectural guidelines, mission statement, and troubleshooting tips.
- **[Documentation Index](./docs/README.md)**: A complete list of system documentation, including architecture and feed logic.
- **[Nostr Event Schemas](./docs/nostr-event-schemas.md)**: The source of truth for all Nostr events published by the application.
- **[Playback Fallback](./docs/playback-fallback.md)**: Details on the URL-first playback strategy and WebTorrent fallback mechanism.
-13
View File
@@ -1,13 +0,0 @@
# Initial Baseline - Performance & Docs (Feb 2026)
## Performance Bottlenecks
- **Unbounded Concurrency (P0):** `js/nostr/commentEvents.js` uses `Promise.all` for relay requests in `publishComment` and `listVideoComments`. This can saturate network connections if a user has many relays (20+), causing UI freeze or timeouts.
- **Remediation:** Apply `pMap` with `RELAY_BACKGROUND_CONCURRENCY` (3).
- **VideoEventBuffer (P1):** Flushes every 75ms on event ingest regardless of visibility.
- **Remediation:** Implemented visibility gating (2026-02-13).
- **WatchHistory (P2):** Republish loop has backoff but no visibility check.
## Documentation Gaps
- **CORS Configuration:** `content/docs/guides/upload-content.md` suggests `http://localhost:5500` for CORS, but the default dev port is `3000`.
- **Remediation:** Update port to `3000`.
- **Upload Limit:** 2GB (documented and code-verified).
+25 -31
View File
@@ -1,40 +1,34 @@
# Known Issues
## Test Infrastructure
## Tests
### Missing `jsdom` Dependency
- **Status:** Active
- **Detected:** 2026-02-26
- **Description:** Multiple unit tests fail with `ERR_MODULE_NOT_FOUND` because `jsdom` is imported but not installed in the project.
- **Impact:** Prevents running unit tests that rely on DOM simulation.
- **Remediation:** `npm install --save-dev jsdom`
### Unit Tests
- `npm run test:unit` consistently times out in the CI environment due to resource constraints. Targeted testing (`test:dm:unit`, `test:dm:integration`) is recommended.
## Run Notes (2026-03-04)
### Visual Regression Tests (`test:visual`)
- **Artifact Retention**: Visual tests are configured to retain screenshots, traces, and videos on failure to assist with debugging. These artifacts can be found in `artifacts/test-results/`.
- **Moderation UI (`tests/visual/moderation.spec.ts`)**: The "Show anyway" button and related moderation badges fail to render in the test environment, causing `toBeVisible()` assertions to fail. The logic for creating the button appears correct (`allowOverride` is true), but the button element is not found in the DOM during the test execution. This might be due to a race condition in the test fixture's state initialization or an environment-specific rendering issue.
- **Sidebar Layout (`tests/visual/overlay-layers.spec.ts`)**: The `mobile sidebar shares desktop rail behavior` test fails. The expected margin for the app container does not match the computed margin in the test environment (diff of ~45px). Attempts to fix this by adjusting CSS margin calculations were incomplete and reverted to avoid instability.
- **Kitchen Sink (`tests/visual/kitchen-sink.spec.ts`)**: Minor pixel mismatch (width 1292 vs expected 1280) in snapshot comparison.
### Firefox E2E feed hydration flakes under full parallel load
- **Status:** Active
- **Description:** `test:e2e` can intermittently fail in Firefox with `[testHarness] Timed out waiting for <n> feed items (found 0)` in `waitForFeedItems`, while the same failing specs usually pass in isolated reruns.
- **Impact:** Full-suite Firefox E2E runs are flaky even after local polling hardening.
- **Observed failures:** `tests/e2e/video-crud-flows.spec.ts`, `tests/e2e/video-edit-delete-execution.spec.ts`, `tests/e2e/view-navigation.spec.ts`.
### E2E Tests (`test:e2e`)
- **Modals (`tests/e2e/ui-modals.spec.ts`)**:
- `application-form` and `profile-modal` fail with 404 errors for requested resources (likely related to how `http-server` serves relative paths or nested components in the test runner).
- Several modals (`upload-modal`, `edit-video-modal`, etc.) timeout waiting for close actions or visibility checks. This might be due to the `reducedMotion` application interacting poorly with visibility checks or genuine performance issues in the test runner.
- `login-modal` fails to find the `[data-nsec-error]` element (it expects it to be visible but it remains hidden).
- **Popover (`tests/e2e/popover.spec.ts`)**: Fails with `ReferenceError: getPanelWithTriggerMetrics is not defined`. This helper function seems to be missing or not imported correctly in the test file.
### Nostr tools signing/key API expectation in unit tests
- **Status:** Addressed
- **Description:** `tests/nostr-send-direct-message.test.mjs` must pass `Uint8Array` secret keys to `getPublicKey/finalizeEvent` for current `nostr-tools`.
- **Impact:** Passing hex strings causes failures like `expected Uint8Array, got type=string`.
## CSS / Design System
- The global CSS (`css/tailwind.source.css`) was updated to fix a linter error by using `calc(theme("screens.md") - var(--breakpoint-edge-offset))` instead of raw pixels.
## Run Notes (2026-06-20)
## Retrospective & Future Improvements
### Additional E2E specs flake under full parallel load (pass in isolation)
- **Status:** Active
- **Description:** Under the full `test:e2e` run (378 tests, 4 workers) these intermittently fail on `not.toBeVisible`/feed-appearance timeouts, but pass deterministically when re-run in isolation (`--workers=1`): `login-flows.spec.ts:149` (upload/profile buttons hide after logout), `video-upload-publish-lifecycle.spec.ts:49` and `:79` (URL-first publish appears / owner delete). Same root cause as the Firefox feed-hydration flakes above — worker resource contention, not an app regression (verified: pass in isolation on the current branch).
- **Impact:** Full-suite e2e is flaky; isolated reruns are green.
### Challenges
- **Generated Artifacts**: The build process modifies `css/tailwind.generated.css`, which creates noise in diffs and potential merge conflicts. It is recommended to ignore this file in version control or enforce a check that it matches the build output without committing it manually in every PR.
- **Test Environment Isolation**: Debugging visual test failures (like the Sidebar Layout and Moderation UI) was difficult without access to the live browser UI or artifacts. The reproduction script failed due to environment restrictions on launching browsers.
- **Test Flakiness**: E2E tests for modals are prone to timeouts, likely due to animation/transition handling or resource loading delays in the CI environment. Using `applyReducedMotion` consistently helps but doesn't solve all timing issues.
### `webseed-playback.spec.ts:31` fails on Firefox headless (CDN mode)
- **Status:** Active (pre-existing — reproduced on pre-refactor commit `1b11cb1b`)
- **Description:** "plays directly from HTML link (CDN mode)" fails on `--project=e2e-firefox` with `#modalVideo` `src` empty instead of the test's archive.org URL. The Chromium variant and the WebTorrent-fallback variant (`:63`) both pass. Firefox-headless-specific (external URL reachability/codec), not an app regression.
- **Impact:** One Firefox-only e2e failure; CDN playback works on Chromium and in manual testing.
### `uploadModal-reset.test.mjs` ("UploadModal Reset Logic") hangs/cancels
- **Status:** Active (pre-existing — reproduced on pre-refactor commit `1b11cb1b`)
- **Description:** The jsdom-based UploadModal reset suite intermittently fails with `cancelledByParent` / "Promise resolution is still pending but the event loop has already resolved" (~12s hang). It passes or fails depending on full-suite test ordering/timing (an async-hang flake, likely a torrent-metadata/upload promise not settling under the mocked services). Not a regression from the MediaUploader extraction — it fails identically on `1b11cb1b`.
- **Impact:** One unit suite can report `not ok 1`; the runner still exits 0. Other tests unaffected.
### Suggestions
- **Commit Hooks**: Implement a pre-commit hook that runs the linter and potentially the build to ensure generated files are in sync, or configure CI to fail if they are not.
- **Dockerized Testing**: Running tests in a consistent Docker container with Xvfb properly configured would help reproduce environment-specific failures locally.
- **Visual Testing improvements**: Ensure that test fixtures (like `moderation/fixtures/index.html`) correctly force UI updates after state injection to avoid race conditions.
+20
View File
@@ -0,0 +1,20 @@
# Lint Issues Report
## Summary
Automated linting and formatting checks were run. No auto-fixable formatting issues were found. However, one linting error persists which requires manual intervention.
## Issues
### css/tailwind.source.css
The `npm run lint:tokens` check failed with the following error:
```
css/tailwind.source.css:5757 → 767.98px
@media (max-width: 767.98px) {
```
**Recommendation:**
This raw measurement (`767.98px`) should be moved into `css/tokens.css` as a design token, or the linter configuration (`scripts/check-design-tokens.mjs`) should be updated to whitelist this specific value if it represents a standard responsive breakpoint for mobile layout fixes.
Note: This error currently prevents `npm run lint` from completing successfully, meaning subsequent checks (`lint:tailwind-brackets`, `lint:tailwind-colors`) are skipped in the standard run script. These subsequent checks were run manually and passed.
-56
View File
@@ -1,56 +0,0 @@
# NIP Inventory
| NIP / Kind | Description | Repo Locations | Status | Notes |
|------------|-------------|----------------|--------|-------|
| **NIP-01** | Basic Protocol Flow | `js/nostr/client.js`, `docs/nips/01.md` | Compliant | Base implementation verified via `client.js`. |
| **NIP-04** | Encrypted Direct Message | `js/nostr/dmDecryptWorker.js`, `js/nostr/client.js` | Compliant | Verified by `tests/nostr-specs/nip04-nip44.test.mjs`. |
| **NIP-07** | `window.nostr` Capability | `js/nostr/nip07Permissions.js`, `js/nostr/adapters/nip07Adapter.js` | Compliant | Verified in `tests/compliance/nip07_compliance.test.mjs`. |
| **NIP-09** | Event Deletion | `js/nostr/client.js`, `js/nostrEventSchemas.js` | Compliant | `deleteAllVersions` calls `_hardDeleteVersions` which uses Kind 5. |
| **NIP-10** | Text Notes & Threads | `js/nostr/commentEvents.js`, `docs/nips/10.md` | Compliant | `buildCommentEvent` implements NIP-10 threading markers (E, P, K tags). |
| **NIP-17** | Private Direct Messages | `js/nostr/client.js`, `js/ui/profileModal/ProfileDirectMessageRenderer.js` | Compliant | Explicit support for Gift Wraps (Kind 1059) and Seals (Kind 13). |
| **NIP-18** | Reposts | `js/nostrEventSchemas.js` | Compliant | Implements Kind 6 and 16. |
| **NIP-19** | bech32-encoded entities | `js/utils/nostrHelpers.js`, `js/nostr/nip71.js` | Compliant | Uses `nostr-tools` for correct encoding/decoding. |
| **NIP-21** | `nostr:` URI scheme | `js/app/routerCoordinator.js`, `js/utils/nostrHelpers.js` | Partial | Router handles `nostr:` prefix but only for hex/npub. `nprofile`/`nevent` not supported in helper. |
| **NIP-25** | Reactions | `js/nostr/reactionEvents.js`, `js/nostrEventSchemas.js` | Compliant | Implements Kind 7 reaction events. |
| **NIP-33** | Addressable Events | `js/nostr/client.js` | Compliant | `d` tag usage verified in `video_note_compliance.test.mjs`. |
| **NIP-42** | Authentication of clients to relays | `js/nostr/client.js` | Non-compliant | No `AUTH` command handling found in client or pool. |
| **NIP-44** | Encrypted Payloads (Versioned) | `js/nostr/dmDecryptWorker.js`, `js/nostr/client.js` | Compliant | Verified by `tests/nostr-specs/nip04-nip44.test.mjs`. |
| **NIP-46** | Nostr Remote Signing | `js/nostr/nip46Client.js` | Compliant | Full client implementation for remote signing. |
| **NIP-47** | Wallet Connect | `js/payments/nwcClient.js` | Compliant | Implements NWC client for zaps. |
| **NIP-51** | Lists | `js/userBlocks.js`, `js/subscriptions.js` | Compliant | Mute list (Kind 10000) and Subscription list (Kind 30000) logic aligns with spec. |
| **NIP-56** | Reporting | `js/services/moderationService.js`, `docs/nips/56.md` | Compliant | `buildReportEvent` implements Kind 1984. |
| **NIP-57** | Zaps | `js/payments/zapRequests.js`, `js/payments/zapSplit.js` | Compliant | Implements Kind 9734/9735 flow. |
| **NIP-59** | Gift Wrap | `js/nostr/client.js` | Compliant | Implemented as part of NIP-17. |
| **NIP-65** | Relay List Metadata | `js/relayManager.js` | Compliant | Code supports Kind 10002. Verified by `tests/nostr-specs/nip65_compliance.test.mjs`. |
| **NIP-71** | Video Events | `js/nostr/nip71.js` | Partial | Kinds 21/22 supported in schema, but Kind 30078 is primary. Verified tag generation in `tests/nostr-specs/kind30078.test.mjs`. |
| **NIP-78** | Application-specific data | `js/services/hashtagPreferencesService.js` | Compliant | Used for hashtag preferences (Kind 30015). |
| **NIP-94** | File Metadata | `js/nostr/videoPublisher.js` | Compliant | `buildVideoMirrorEvent` implements Kind 1063. |
| **NIP-96** | HTTP File Storage Integration | `js/nostr/videoPublisher.js` | Partial | References `service nip96` in NIP-71 tags. |
| **NIP-98** | HTTP Auth | `js/services/r2Service.js` | Compliant | Used for R2 service authentication (Kind 27235). |
| **Kind 0** | Profile Metadata | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 1** | Share | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 4** | Legacy DM | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 5** | Deletion | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 6** | Repost | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 7** | Reaction | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 13** | Seal | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 14** | Chat Message | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 16** | Generic Repost | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 21** | NIP-71 Video | `js/nostr/nip71.js` | Compliant | Implemented. |
| **Kind 22** | NIP-71 Short Video | `js/nostr/nip71.js` | Compliant | Implemented. |
| **Kind 1059** | Gift Wrap | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 1111** | Video Comment | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 1984** | Report | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 9734** | Zap Request | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 9735** | Zap Receipt | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 10000** | Mute List | `js/userBlocks.js` | Compliant | Uses standard NIP-51 (no d tag for main list). |
| **Kind 10002** | Relay List | `js/relayManager.js` | Compliant | Verified. |
| **Kind 10050** | DM Relay List | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 20001** | DM Read Receipt | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 20002** | DM Typing | `js/nostrEventSchemas.js` | Compliant | Implemented. |
| **Kind 27235** | HTTP Auth | `js/services/r2Service.js` | Compliant | Implemented. |
| **Kind 1063** | File Header | `js/nostr/videoPublisher.js` | Compliant | Implemented for NIP-94 mirroring. |
| **Kind 30000** | Subscription List | `js/subscriptions.js` | Compliant | Implements NIP-51 follow sets. |
| **Kind 30015** | Hashtag Preferences | `js/services/hashtagPreferencesService.js` | Compliant | Implemented. |
| **Kind 30078** | App Data | `js/nostr/client.js`, `js/nostr/videoPayloadBuilder.js` | Compliant | Verified by `tests/nostr-specs/kind30078.test.mjs`. |
| **Kind 30079** | Watch History | `js/nostr/watchHistory.js`, `config/instance-config.js` | Compliant | Parameterized replaceable list (custom kind). Implements bucketing and encryption. |
-59
View File
@@ -1,59 +0,0 @@
# Onboarding Audit Report
**Date:** 2026-02-21
**Agent:** onboarding-audit-agent
**Headline:** ⚠️ Onboarding failures found
## 1. Environment Assumptions
- **Node**: v22.22.0
- **NPM**: 10.9.0
- **OS**: Linux
## 2. Steps Executed
1. `npm ci`
2. `npx playwright install`
3. `npm run build` (Simulating `npm start` build phase)
4. `npm run test:unit:shard1`
5. `npm run test:smoke`
6. `npm run format`
7. `npm run lint`
8. `npm run audit`
## 3. Results
| Command | Status | Notes |
| :--- | :--- | :--- |
| `npm ci` | ✅ Pass | Installed dependencies successfully. |
| `npx playwright install` | ✅ Pass | Downloaded Chromium, Firefox, WebKit. |
| `npm run build` | ✅ Pass | Build completed, assets hashed. |
| `npm run test:unit:shard1` | ✅ Pass | Unit tests passed. |
| `npm run test:smoke` | ✅ Pass | Smoke test passed. |
| `npm run format` | ✅ Pass | No formatting changes needed. |
| `npm run lint` | ❌ Fail | **File size violation** in `js/subscriptions.js`. |
| `npm run audit` | ✅ Pass | Audit report generated. |
## 4. Failures
### `npm run lint`
**Error Log:**
```
1 file size violation(s):
✗ GREW: js/subscriptions.js (2426 lines, was 2374, limit 2424)
New files must stay under 1000 lines. Grandfathered files must not grow.
To decompose a large file, extract logic into smaller modules and re-export.
```
**Root Cause:**
`js/subscriptions.js` has grown beyond its grandfathered limit + buffer. The documented limit is 2424 lines, but the file is now 2426 lines.
**Recommendation:**
1. Immediate fix: Increase the limit in `scripts/check-file-size.mjs` slightly to unblock CI if decomposition is not immediately possible.
2. Long term: Decompose `js/subscriptions.js`.
## 5. Docs Changes Made
- None. Documentation accurately reflects the commands, but the codebase fails the lint check.
## 6. Devcontainer/Docker
- Not required. Environment setup (`npm ci`, `playwright install`) worked reliably.
-50
View File
@@ -1,50 +0,0 @@
# Optimization Task Stubs
The following tasks were identified and implemented to resolve high CPU/GPU usage and potential crashes on the website.
## Completed Tasks
### 1. Optimize Ambient Background Animation
**Problem:** The `AmbientBackground` controller was calling `resizeCanvas` inside the `requestAnimationFrame` loop. This function accessed `getBoundingClientRect()`, causing synchronous layout thrashing (forced reflow) on every frame, leading to high CPU/GPU usage.
**Fix:**
- Refactor `js/ui/ambientBackground.js` to use `ResizeObserver`.
- Only update canvas dimensions when the element actually resizes.
- Remove layout reads from the animation loop.
### 2. Async Chunking for Explore Data Service
**Problem:** `ExploreDataService` performed heavy synchronous iterations over large datasets (Watch History and Video Tags) on the main thread. This could cause the UI to freeze (long tasks) during initialization or updates.
**Fix:**
- Refactor `buildWatchHistoryTagCounts` and `buildTagIdf` in `js/services/exploreDataService.js`.
- Implement processing in chunks (e.g., 500 items).
- Yield to the main thread using `setTimeout` between chunks to allow user interaction and frame rendering.
### 3. Throttle URL Health Video Probes
**Problem:** The `UrlHealthController` spawned a `<video>` element for every video card to probe connectivity. When loading a grid of 50+ videos, this caused a storm of simultaneous media decoding requests, leading to resource exhaustion and browser instability.
**Fix:**
- Refactor `js/ui/urlHealthController.js`.
- Implement a concurrency limiter (queue) for `probeUrlWithVideoElement`.
- Limit active video probes to a maximum of 3 concurrent instances.
## Future Optimization Tasks
### 4. Virtualize Video List Rendering
**Description:** Implement virtual scrolling (windowing) for the main video grid.
**Benefit:** Reduces DOM node count and memory usage when displaying thousands of videos.
**Action:**
- Create a `VirtualScroller` component.
- Only render video cards that are currently in the viewport (plus a buffer).
### 5. Move Heavy Computation to Web Worker
**Description:** Move the tag IDF and Watch History analysis entirely off the main thread.
**Benefit:** Zero impact on UI responsiveness during data refreshes.
**Action:**
- Create `js/workers/exploreData.worker.js`.
- Move `ExploreDataService` logic into the worker.
- Use `postMessage` to send video data and receive calculated stats.
### 6. Optimize Image Loading with `loading="lazy"` & `decoding="async"`
**Description:** Ensure all thumbnails and avatars use modern browser lazy loading.
**Benefit:** Faster initial page load and lower bandwidth usage.
**Action:**
- Audit `VideoCard` and `VideoModal` templates.
- Ensure `<img>` tags have `loading="lazy"` and `decoding="async"`.
-62
View File
@@ -1,62 +0,0 @@
# Protocol Inventory
This document tracks external protocol and specification dependencies used by the codebase. It complements `NIP_INVENTORY.md` which specifically tracks Nostr Implementation Possibilities.
## 1. Nostr (NIPs)
For a detailed inventory of supported NIPs (Nostr Implementation Possibilities), please refer to [NIP_INVENTORY.md](./NIP_INVENTORY.md).
**Summary of Key NIPs:**
- **NIP-01:** Basic Protocol Flow (Compliant)
- **NIP-71:** Video Events (Partial/Compliant)
- **NIP-94:** File Metadata (Compliant)
- **NIP-44:** Encrypted Payloads (Compliant)
## 2. BitTorrent / WebTorrent
| Protocol | Spec | Source URL | Implementation | Status |
|----------|------|------------|----------------|--------|
| **BitTorrent** | BEP-0003 | [bittorrent.org](http://www.bittorrent.org/beps/bep_0003.html) | `js/services/playbackService.js` | Compliant (via WebTorrent) |
| **Magnet URI** | BEP-0009 | [bittorrent.org](http://www.bittorrent.org/beps/bep_0009.html) | `js/magnetUtils.js` | Compliant |
| **WebSeed** | BEP-0019 | [bittorrent.org](http://www.bittorrent.org/beps/bep_0019.html) | `js/magnetUtils.js` | Compliant |
| **WebTorrent** | WebRTC-based BitTorrent | [webtorrent.io](https://webtorrent.io/docs) | `js/services/playbackService.js` | Compliant |
**Notes:**
- `js/magnetUtils.js` implements parsing and normalization of magnet links, ensuring `xt`, `ws`, and `xs` parameters are handled correctly.
- `js/services/playbackService.js` handles the fallback logic between HTTP and WebTorrent playback.
## 3. Media Streaming
| Protocol | Spec | Source URL | Implementation | Status |
|----------|------|------------|----------------|--------|
| **HLS** | RFC 8216 | [rfc-editor.org](https://datatracker.ietf.org/doc/html/rfc8216) | Native Browser / `video` tag | Compliant |
**Notes:**
- The application supports `.m3u8` (HLS) playback natively via the browser's video element (Safari) or via HLS.js if integrated (currently relies on browser/device native support or passthrough).
- Inputs in `components/upload-modal.html` accept `.m3u8` and `.ts` files.
## 4. Lightning Network (LNURL)
| Protocol | Spec | Source URL | Implementation | Status |
|----------|------|------------|----------------|--------|
| **LNURL** | LUD-01, LUD-06, LUD-16 | [github.com/lnurl](https://github.com/lnurl/luds) | `js/payments/lnurl.js` | Compliant |
| **Zap Requests** | NIP-57 | [nips.be](https://github.com/nostr-protocol/nips/blob/master/57.md) | `js/payments/zapRequests.js` | Compliant |
**Notes:**
- `js/payments/lnurl.js` implements Bech32 decoding/encoding and LNURL resolution.
- `js/payments/zapReceiptValidator.js` validates receipts against the LNURL server's public key.
## 5. HTTP & Authentication
| Protocol | Spec | Source URL | Implementation | Status |
|----------|------|------------|----------------|--------|
| **Nostr HTTP Auth** | NIP-98 / Kind 27235 | [nips.be](https://github.com/nostr-protocol/nips/blob/master/98.md) | `js/services/r2Service.js` | Compliant |
| **S3 / R2 API** | AWS S3 Compat | [aws.amazon.com](https://docs.aws.amazon.com/s3/) | `js/services/r2Service.js` | Compliant |
**Notes:**
- `js/services/r2Service.js` uses NIP-98 style authentication for uploads to compatible storage services (Cloudflare R2).
## Compliance & Remediation
- **NIP-42 (Auth):** Marked as `Non-compliant` in `NIP_INVENTORY.md`. Remediation involves implementing `AUTH` command handling in `js/nostr/client.js`.
- **HLS:** Reliance on native browser support might limit compatibility on some desktop browsers (Firefox/Chrome on Windows without extensions). Consider integrating `hls.js` if not already present.
+56 -140
View File
@@ -30,9 +30,7 @@
1. **Visit the Site**: Navigate to the live instance of **bitvid** (e.g., `[https://bitvid.network](https://bitvid.network)`).
2. **Login with Nostr**:
- Use a compatible NIP-07 browser extension or manually input your public key.
- For the most reliable experience we recommend a well-maintained signer such as [nos2x](https://github.com/fiatjaf/nos2x) or [Alby](https://getalby.com/). Encrypted features (DMs, hashtag preferences, watch history, block/subscription lists) require the extension to respond to decryption requests.
- **Troubleshooting:** if those encrypted lists never finish loading after login, bitvid will surface a notice — your extension's signer is likely locked or its background worker went to sleep. Unlock/reload the extension and refresh the page. (bitvid caps relay fan-out and fast-fails an unresponsive signer so the tab no longer pins the CPU while waiting.)
- Use a compatible Nostr browser extension or manually input your public key.
### Upload a video
@@ -45,6 +43,7 @@ Pick the flow that matches your source material. Supported S3 upload modes inclu
1. **Browser-held S3 keys (trusted operator only):** Enter your S3 credentials in the Storage tab to upload directly from the browser.
> **Security Warning:** This mode requires storing encrypted credentials in the browser's IndexedDB. While keys are encrypted at rest, they are decrypted in memory during use. Use this mode only on self-hosted, trusted deployments where you control the environment. Do not enter high-value credentials on public or untrusted instances.
2. **Manual upload via provider console:** Upload your file to your storage provider (e.g., R2, S3) manually, then paste the public URL into the upload form.
3. **Operator-provided presigned manifests:** Use a presigned JSON manifest prepared externally to authorize the upload without exposing long-lived credentials to the browser.
**Upload File (direct S3 upload)**:
If you are using **Mode 1** (Browser-held keys), enter your credentials in the guided form or Storage tab. Optionally expand the **Advanced options** accordion to override pathing or access controls, then drop media files for bitvid to upload through the S3 API. The modal tracks progress, applies your metadata selections, auto-fills the primary `imeta` variant once the upload completes, and publishes the resulting URL back into the note automatically.
@@ -82,8 +81,8 @@ Info JSON: https://cdn.example.com/uploads/demo/video.info.json
### How playback works
1. **Configurable Priority**: `playVideoWithFallback({ url, magnet })` attempts the preferred source (URL or WebTorrent) based on the `DEFAULT_PLAYBACK_SOURCE` configuration.
2. **Seamless Fallback**: If the preferred source fails, stalls, or is unavailable, bitvid automatically switches to the alternative source.
1. **URL-first**: `playVideoWithFallback({ url, magnet })` attempts the hosted URL immediately. Healthy URLs deliver the full experience without touching P2P resources.
2. **WebTorrent fallback**: If the URL probe fails or returns an error status, bitvid falls back to WebTorrent using the raw magnet. The helpers append HTTPS `ws=`/`xs=` hints so peers seed quickly.
3. **Safety checks**: Magnets are decoded with `safeDecodeMagnet()` and normalized via `normalizeAndAugmentMagnet()` before reaching WebTorrent. Trackers remain WSS-only to satisfy browser constraints.
4. **Operator playbook**: If a deployment causes playback regressions, flip the relevant feature flags back to their default values in `js/constants.js` and redeploy. Capture the rollback steps in AGENTS.md and the PR description so the Main channel stays stable.
5. **Deep dive**: See [`docs/playback-fallback.md`](docs/playback-fallback.md) for the call flow into `playbackService`, magnet normalization details, and fallback hand-off points.
@@ -145,87 +144,52 @@ To run **bitvid** locally:
2. Install dependencies:
Use `npm ci` to install dependencies exactly as specified in `package-lock.json`. If you intend to run smoke, visual, or end-to-end tests, also install Playwright browsers.
Use `npm ci` to install dependencies exactly as specified in `package-lock.json`. This ensures `npx` finds the correct local `tailwindcss` version.
```bash
npm ci
npx playwright install
```
3. Start the application:
3. Build the project:
```bash
npm start
npm run build
```
This command runs a full production build (generating `dist/` and `css/tailwind.generated.css`) and starts a local server.
(This generates `css/tailwind.generated.css`, which is gitignored and required for styling.)
4. Open the site in your browser:
4. Start a local server:
- Using Python:
```bash
python -m http.server 8000
```
- Or with Node.js:
```bash
npx serve
```
```
http://localhost:3000
```
5. Open the site in your browser:
_(Note: The application runs via `npx serve`. The default port is 3000, but it may select a different port if 3000 is occupied. Check your terminal output for the correct URL.)_
_Note: If you prefer manual steps, run `npm run build` followed by `npx serve dist`. Because `dist` is the document root in this mode, always open `/` rather than appending `/dist`._
_If you use a static server from the repository root (for example VS Code Live Server or `python3 -m http.server`), open `http://127.0.0.1:8000/dist/` with the trailing slash._
5. Verify setup:
Run tests and linting to ensure everything is working correctly.
```bash
npm run test:unit:shard1 # Run a subset of tests for speed
npm run test:smoke # Critical path verification
npm run format
npm run lint
npm run audit # Design system audit
```
_Tip: Use `npm run test:unit` to run the full suite (can be slow)._
#### Quick Reference
- **Run unit tests**: `npm run test:unit`
- **Run smoke tests**: `npm run test:smoke`
- **Format code**: `npm run format` (CSS, HTML, MD, Config - no JS logic)
- **Lint code**: `npm run lint` (Styles, Tokens, Hex, Tailwind guards, file size, innerHTML, assets, SW compat - no ESLint/logic linting)
- **Visual tests**: `npm run test:visual` (Playwright snapshots)
### Dev Container
This project includes a `.devcontainer` configuration. If you use VS Code, you can open the project in a container to get a pre-configured environment with all dependencies installed.
```
http://localhost:8000
```
### Developer Quickstart
See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the full developer guide.
For detailed architecture and system documentation, see the [Documentation Index](docs/README.md).
**Verify your work:**
- **Run unit tests**: `npm run test:unit` (Required before PRs). _Tip: Use `npm run test:unit:shard1`, `shard2`, or `shard3` for faster local feedback._
- **Format code**: `npm run format` (Required before PRs - only formats CSS, HTML, MD, and Config)
- **Lint code**: `npm run lint` (Checks for CSS, hex colors, inline styles, design tokens, Tailwind guards, file size, innerHTML, assets, and SW compat - no ESLint/logic linting)
- **Run unit tests**: `npm run test:unit` (Required before PRs). _Tip: Use `npm run test:unit:shard1` for faster local feedback._
- **Format code**: `npm run format` (Required before PRs)
- **Lint code**: `npm run lint` (Checks for CSS, hex colors, inline styles)
**Other commands:**
- **Run load tests**: `npm run test:load`
- **Run DM unit tests**: `npm run test:dm:unit`
- **Run DM integration tests**: `npm run test:dm:integration`
- **Run headless E2E tests (Chromium + Firefox)**: `npm run test:e2e`
- **Run E2E tests (Chromium only)**: `npm run test:e2e:chromium`
- **Run E2E tests (Firefox only)**: `npm run test:e2e:firefox`
- **Run deterministic E2E matrix**: `npm run test:e2e:deterministic`
- **Run NIP-07 extension smoke (opt-in)**: `PLAYWRIGHT_EXTENSION_PATH=/abs/path/to/extension npm run test:e2e:extension`
- Uses persistent-context launcher: `scripts/playwright/run-extension-persistent.mjs`
- Optional profile dir: `PLAYWRIGHT_EXTENSION_USER_DATA_DIR=/abs/path/to/profile`
- **Run headless E2E tests**: `npm run test:e2e`
- **Run visual regression tests**: `npm run test:visual`
- **Update visual baselines**: `npm run test:visual:update`
- **Run design system audit**: `npm run audit` (Generates remediation report)
- **Aggregate telemetry**: `npm run telemetry:aggregate`
- **Cancel CI runs**: See [`docs/cancelling-ci-runs.md`](docs/cancelling-ci-runs.md) for a script to clear pending workflows.
### Docs navigation & TOC updates
@@ -262,14 +226,13 @@ To quickly view the location of these artifacts:
Use these artifacts to inspect the UI state at the moment of failure and diagnose rendering issues or regressions.
### Quickstart: Send your first video post
### Send your first video post
To programmatically publish videos, use the event builders in `js/nostrEventSchemas.js` (the source of truth for all event definitions) to construct valid video notes. See [`docs/nostr-event-schemas.md`](docs/nostr-event-schemas.md) for full schema documentation.
Use the event builders in `js/nostrEventSchemas.js` (the source of truth for all event definitions) to construct valid video notes. See [`docs/nostr-event-schemas.md`](docs/nostr-event-schemas.md) for full schema documentation.
```javascript
import { buildVideoPostEvent } from "./js/nostrEventSchemas.js";
// Ensure dependencies are installed (npm ci)
// 1. Build the event object (useful for inspection or custom publishing)
const event = buildVideoPostEvent({
// Provide your hex pubkey (not npub)
@@ -280,7 +243,7 @@ const event = buildVideoPostEvent({
version: 3,
title: "My First Video",
videoRootId: "my-first-video", // Logical ID, matches the d-tag
url: "https://example.com/video.mp4", // The builder automatically derives the required 's' storage tag from this URL
url: "https://example.com/video.mp4",
description: "This is a test video post sent via the SDK."
// magnet: "magnet:?xt=urn:btih:..." // Optional fallback (provide the raw magnet string)
}
@@ -288,18 +251,23 @@ const event = buildVideoPostEvent({
console.log("Event constructed:", event);
// 2. Publish the event (requires browser/extension or active signer)
// In an application context (e.g. browser console or module):
// 2. Publish using the high-level client (requires browser/extension or active signer)
/*
import { nostrClient } from "./js/nostrClientFacade.js";
// Ensure client is connected
await nostrClient.init();
// Login (prompts NIP-07 extension)
await nostrClient.loginWithExtension();
await nostrClient.login();
// Publish the built event
await nostrClient.signAndPublishEvent(event);
// Publish! (Handles signing and relay broadcasting)
await nostrClient.publishVideo({
title: "My First Video",
url: "https://example.com/video.mp4",
description: "Published via bitvid SDK"
}, nostrClient.pubkey);
*/
```
### CSS build pipeline
@@ -315,9 +283,9 @@ package scripts to keep formatting, linting, and generated output consistent:
- **Core scripts:**
```bash
npm run format # normalize CSS/HTML/MD/Config sources with Prettier + tailwindcss plugin
npm run format # normalize CSS/HTML/JS/MD sources with Prettier + tailwindcss plugin
npm run lint:css # enforce design token usage and guard against raw hex colors
npm run build # run the full production build (generates dist/ and css/tailwind.generated.css)
npm run build # run the Tailwind build locally (output remains gitignored)
```
- **No hard-coded colors:** Follow the token-first rules in `AGENTS.md`—reach
@@ -328,10 +296,10 @@ package scripts to keep formatting, linting, and generated output consistent:
```bash
npm install # install Prettier, Stylelint, and Tailwind toolchain
npm run format # format CSS/HTML/MD with Prettier + tailwindcss plugin
npm run lint # run CSS, hex, inline-style, tokens, Tailwind, file-size, innerHTML, assets, and SW compat guards
npm run lint # run CSS, hex color, inline-style, design-token, and Tailwind color/bracket guards in one pass
npm run lint:css # enforce token usage and forbid raw hex colors
npm run lint:inline-styles # fail CI if inline style attributes or element.style usage slip in
npm run build # run the full production build (cleans dist/, runs build:css, and copies assets)
npm run build # run the Tailwind build (delegates to npm run build:css)
npm run build:beacon # bundle torrent/dist assets and re-run the inline-style guard
npm run build:beacon:bundle # bundle beacon assets without running the guard (rarely needed)
```
@@ -344,7 +312,7 @@ commands from the repo root:
1. Install dependencies (only required after cloning or when packages change):
```bash
npm ci
npm install
```
2. Rebuild the Tailwind bundle for local verification (the output stays
@@ -358,46 +326,6 @@ The generated `css/tailwind.generated.css` artifact is ignored in git. CI
workflows and Netlify deploys run `npm run build` to produce the compiled
stylesheet during deployment, so source changes are all you need to commit.
Deploy targets must publish the `dist/` directory as the web root (never the
repository root). CI enforces deploy artifact integrity with
`npm run verify:dist:deploy-artifact` immediately after `npm run build`, and
hosts that support a publish/output directory (for example Netlify and Vercel)
should be configured to use `dist`.
#### Netlify cache policy for safe fast rollouts
bitvid uses path-class cache rules so deployments propagate quickly without
breaking long-term static asset caching:
- `index.html`, `embed.html`, and other `*.html` shell pages are served with
`Cache-Control: no-cache, must-revalidate` so clients always revalidate the
app entry document before booting a new session.
- Hashed bundles under `/css/*` and `/js/*` are served with
`Cache-Control: public, max-age=31536000, immutable` so browsers and CDNs can
keep them for a year with zero revalidation churn.
- Service-worker-related files (`/sw.min.js`, `/site.webmanifest`) use short,
revalidation-friendly cache controls (`max-age=0, must-revalidate`) so rollout
metadata and worker updates are picked up promptly.
This split is required for safe fast rollouts: HTML needs rapid update pickup,
while fingerprinted static assets should remain aggressively cacheable for
performance and cost control.
> Migration note: runtime `ASSET_VERSION` query-parameter mutation has been
> removed. Static asset freshness now comes from build-time hashed filenames
> recorded in `dist/asset-manifest.json` and rewritten into `dist/index.html`
> / `dist/embed.html` during `npm run build`.
#### Service worker rollback playbook
If a deploy regresses playback and you suspect `sw.min.js`, use this rollback runbook:
1. **Freeze impact**: redeploy the last known-good commit so clients fetch the previous worker script immediately.
2. **Invalidate active workers**: from DevTools > Application > Service Workers, click **Unregister** for `sw.min.js` and hard reload once to verify playback without stale worker state.
3. **Confirm claim flow**: in the browser console, confirm worker lifecycle messages (`BITVID_SW_LIFECYCLE`) appear and that requests to `/webtorrent/*` carry the `X-Bitvid-SW-Version` response header.
4. **Check compatibility guardrails**: run `npm run lint:sw-compat` before shipping the fix. This fails deploys when service-worker runtime paths/scope changes are not accompanied by `_headers`, `index.html`, and `embed.html` updates in the same commit.
5. **Redeploy + monitor**: publish the fix, then replay the URL-first fallback QA script in `docs/qa.md` and capture logs/screenshots in the PR.
Inline styles are intentionally blocked. `npm run lint:inline-styles` scans HTML
and scripts for `style=` attributes, `element.style`, or `style.cssText` usage
and will fail CI until offending markup is moved into the shared CSS/token
@@ -458,14 +386,13 @@ call the facade to keep API surfaces consistent.
### Nostr video fetch limits
The `nostrClient` uses `subscribeVideos(callback, options)` for the main feed to support buffering and streaming. It accepts an optional `options.limit` to control how many video events are requested per relay. The request size defaults
`nostrClient.fetchVideos(options)` now accepts an optional `options.limit` to
control how many video events are requested per relay. The request size defaults
to `DEFAULT_VIDEO_REQUEST_LIMIT` (150) and is clamped to
`MAX_VIDEO_REQUEST_LIMIT` (500) to avoid accidental firehose requests as the
network grows. Use a smaller limit for lightweight surfaces or a larger value
when running batch jobs that can tolerate additional load.
`nostrClient.fetchVideos(options)` is a legacy wrapper around subscription and is deprecated.
The build command compiles Tailwind with `tailwind.config.cjs`, runs it through
the PostCSS pipeline defined in `postcss.config.cjs` (for autoprefixing), and
emits the purged, minified stylesheet at `css/tailwind.generated.css`. That
@@ -502,11 +429,8 @@ artifacts now that the deploy pipeline owns the build step.
preparing a new deployment.
- See [`docs/instance-config.md`](docs/instance-config.md) for a full
reference of every setting and how to tune it.
- `IS_DEV_MODE` and `IS_VERBOSE_DEV_MODE` default to `false` for production.
If you need dev logging in a staging or QA build without editing source,
inject `window.__BITVID_DEV_MODE_OVERRIDE__` and/or
`window.__BITVID_VERBOSE_DEV_MODE_OVERRIDE__` before `js/config.js` loads.
The flag flows into `js/config.js` as `isDevMode`, seeds the
- Flip `IS_DEV_MODE` to `false` before shipping production builds. The flag
flows into `js/config.js` as `isDevMode`, seeds the
`window.__BITVID_DEV_MODE__` global for inline scripts, and gates whether the
dev logging channel emits to the console. See
[`docs/logging.md`](docs/logging.md) for rollout guidance.
@@ -567,24 +491,16 @@ Please see [`CONTRIBUTING.md`](./CONTRIBUTING.md) for detailed setup instruction
## Testing
Continuous integration runs CSS linting/builds, the DM unit/integration suites, the Playwright kitchen-sink snapshots, headless E2E flows, and the Node-based unit tests on every push.
Before pushing, run `npm run build` locally so the Tailwind bundle regenerates.
- **Unit Tests**: Run `npm run test:unit` for application logic changes.
- _Tip_: Use `npm run test:unit:shard1`, `shard2`, or `shard3` for faster local feedback.
- Custom shards: `cross-env UNIT_TEST_SHARD=1/3 node scripts/run-unit-tests.mjs` or pass `--shard=1/3`.
- Timeout override: `cross-env UNIT_TEST_TIMEOUT_MS=120000` to abort stalled files.
- **Visual Regression**: Run `npm run test:visual` to verify UI presentation against baselines.
- Update baselines: `npm run test:visual:update`.
- **Direct Messages**: Run `npm run test:dm:unit` and `npm run test:dm:integration` for DM flows.
- **End-to-End**:
- `npm run test:e2e` runs deterministic Playwright journeys on Chromium + Firefox.
- `npm run test:e2e:chromium` / `npm run test:e2e:firefox` runs a single browser target.
- `npm run test:e2e:extension` runs the opt-in Chromium extension suite (set `PLAYWRIGHT_EXTENSION_PATH` and optionally `PLAYWRIGHT_ENABLE_EXTENSION_E2E=1`).
- Recommendations/roadmap: `docs/testing/playwright-integration-recommendations-2026-02-22.md`
Pair that with `npm run test:unit` for application logic changes, or a shard
(`npm run test:unit:shard1`, `test:unit:shard2`, `test:unit:shard3`) when you want to
split the suite. You can also set `UNIT_TEST_SHARD=1/3` or pass `--shard=1/3`
to `scripts/run-unit-tests.mjs` for custom shard splits, and use
`UNIT_TEST_TIMEOUT_MS=120000` to abort a single stalled test file without
blocking the entire run. `npm run test:visual` covers presentation updates to mirror the CI surface area.
For DM-specific changes, also run `npm run test:dm:unit` and
`npm run test:dm:integration` to cover the direct message flows.
Use `npm run test:e2e` to execute the headless Playwright journeys in `tests/e2e`.
### Manual QA checklist
+1 -1
View File
@@ -1,4 +1,4 @@
# Daily Design System Audit Report (2026-02-22)
# Daily Design System Audit Report
Headline: ✓ No violations
-590
View File
@@ -1,590 +0,0 @@
# Test Integrity Notes
Machine-readable record of test-expectation changes made under the Spec
Correction Protocol (see CLAUDE.md → Dark Factory rules). Each entry justifies
why a previous expectation was wrong relative to intended behavior and confirms
the replacement is equally strict (or stricter).
---
```yaml
test_integrity_note:
date: 2026-06-14
file: tests/app-batch-fetch-profiles.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-profiles-batched
given: "Multiple relays configured (one fast, one failing) and uncached, valid pubkeys to fetch"
when: "batchFetchProfiles runs after profile fetches were migrated to the L1 SubscriptionManager"
then: "Profiles are fetched in ONE batched query across all relays (not one query per relay); the fast relay's newest profile still renders, cached profiles hydrate immediately, and a failing relay does not break the result"
observable_outcomes:
- "exactly one pool.list call, targeting all configured relays"
- "query authors = only uncached/valid pubkeys"
- "DOM updates: cached profile first, then newest fast-relay profile"
- "cache set with the newest (Fast) profile only"
determinism_controls:
- "mock pool.list with deterministic per-relay responses; fixed createdAt ordering"
anti_cheat_rationale:
prevents:
- "over-mocking internal logic"
- "hard-coded return value"
note: "Only the per-relay CALL-COUNT assertion changed (2 -> 1), because the
refactor intentionally batches the fetch. All behavioral assertions
(correct/newest profile rendered, cached hydration, failing relay
tolerated) are unchanged, and a new assertion verifies the single batched
query targets all relays — so coverage is equal or stronger."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-14
files:
- tests/relay-subscribe-cap.test.mjs
- tests/user-blocks.test.mjs
- tests/subscriptions-manager.test.mjs
- tests/nostr/client.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-relay-reads-bounded
given: "A user's NIP-65 read set (in prod often ~20 relays, most dead) and a
cold login that must decrypt encrypted lists (blocks, subs, hashtags) via
the nip-07 extension"
when: "Reads/subscriptions are built via capReadRelays — the user's own
relays first, with RESERVED_DEFAULT_RELAY_SLOTS reserved for reliable
default aggregators, bounded to MAX_SUBSCRIBE_RELAYS=8; writes stay
uncapped"
then: "Every configured relay is still queried when the user's set is small
(data lives on the user's own relays); the distinct read fan-out never
exceeds 8 (so a large dead list can't storm the pool and starve nip-07
decryption); at least the reserved reliable defaults remain reachable even
when the user supplied none; write reach is unchanged and defaults are NOT
injected into writes"
observable_outcomes:
- "read/subscribe relay set length <= 8"
- "writeRelays == full configured set; no default injected into writes"
- ">= RESERVED_DEFAULT_RELAY_SLOTS reliable defaults present in the read set"
- "user-blocks: every configured relay queried; fast-then-full background
ordering preserved; block list hydrates from the background relay payload"
- "subscriptions-manager: every configured relay queried even when one
rejects; only the newest event decrypted"
- "nostr/client: same events arriving from multiple seeded relays still
dedupe to the expected set; relay fan-out bounded"
determinism_controls:
- "deterministic per-relay mock pool.list responses; fixed created_at ordering"
- "capReadRelays is test-aware: the reserved core resolves to the test-relay
override under test, keeping harnesses isolated from prod default URLs"
- "tests set nostrClient.readRelays to the user's relays to mirror the
logged-in state applyRelayPreferences establishes in prod (the fetcher ranks
candidates by read preference)"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
- "over-mocking internal logic"
- "retry/sleep-based flake masking"
note: "Only incidental EXACT relay-count assertions were loosened to BOUNDS
(<=8) because the storm fix intentionally adds a small reliable-default
backstop to the read set. Every behavioral assertion (correct/newest event
decrypted, block hydration from the right relay, dedup correctness, per-relay
coverage, writes uncapped) is unchanged or strengthened — coverage is equal
or stronger, and new assertions pin the reserved-defaults liveness guarantee."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: "Exact-count assertions became bounded-count
assertions, but this reflects intended new behavior (reliable-default
backstop) rather than weakening a real correctness check; coverage of the
actual security/decrypt behavior is preserved."
```
---
```yaml
test_integrity_note:
date: 2026-06-23
file: tests/nip71-mirror-flags.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-mirror-delete-unconditional
given: "A video that was shared to NIP-71 on one device/session, then deleted from another device (or after the per-video opt-in flag — browser-local localStorage — was cleared)"
when: "resolveDeleteSync runs during delete with FEATURE_NIP71_MIRROR on but the local enabled flag false/absent"
then: "The mirror teardown (NIP-09 + empty tombstone, idempotent) is still attempted, so the NIP-71 mirror is not orphaned on other apps; the feature flag still fully gates it"
observable_outcomes:
- "resolveDeleteSync({featureOn:true, enabled:false|undefined}) -> {action:'unshare'}"
- "resolveDeleteSync({featureOn:false, ...}) -> {action:'none'} (feature flag still gates)"
determinism_controls:
- "pure function; explicit input matrix"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
note: "The previous expectation (enabled:false -> none) encoded the bug: it
gated teardown on a browser-local flag, orphaning the mirror across devices.
The corrected spec is STRICTER — teardown fires whenever the feature is on —
and adds the enabled:undefined case. The feature-flag gate assertion is
retained, so no real gate was weakened."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-23
file: tests/nostr-delete-flow.test.mjs
change_type: ["spec_correction", "refactor_tests"]
scenarios:
- id: SCN-delete-surfaces-relay-failures
given: "A logged-in delete where one write relay rejects the kind-5 deletion"
when: "deleteAllVersions publishes to the WRITE set via getDeletePublishRelays() (the afb6200b relay-scope fix)"
then: "The delete summary surfaces the failing relay"
- id: SCN-buffered-feed-tombstone-guard
given: "A delete event seeds a tombstone, then an OLDER non-deleted event for the same root arrives on the live stream"
when: "events flow through the real VideoEventBuffer (the path subscribeVideos builds via the SubscriptionManager), not the removed direct pool.sub() injection"
then: "The older event is tombstone-guarded (marked deleted, kept out of activeMap) and never surfaces as a LIVE video; a deletion event surfaces marked deleted:true so the UI removes the card"
observable_outcomes:
- "deleteSummary.summary.failed identifies wss://relay.fail (writeRelays now configured so the injected failure is exercised)"
- "no callback video with the deleted/older event id and deleted:false"
- "client.activeMap cleared for the root; tombstone advanced; stored event marked deleted"
determinism_controls:
- "videoEventVerifier virtualizes the off-thread signature worker (all events valid)"
- "buffer.scheduleFlush(true) awaited for synchronous commit"
- "real NostrClient + real VideoEventBuffer (no mocked tombstone guard)"
anti_cheat_rationale:
prevents:
- "over-mocking internal logic"
- "snapshot rubber-stamping"
note: "Two corrections. (1) The file used bare assert + top-level await, so the
unit runner (which requires a node:test import) SILENTLY EXCLUDED it — it had
rotted and was failing on main unnoticed. Converted to node:test so it runs
in CI. (2) The relay-failure test set only client.relays, but deletes moved to
the write set (getDeletePublishRelays); it now sets writeRelays so the
injected failure is actually exercised — the assertion was previously passing
vacuously. (3) The subscription assertions drove the REMOVED pool.sub() path
and expected 'no callback at all' for deleted events; the current
VideoEventBuffer intentionally surfaces deleted events marked deleted:true so
the UI can remove the card. Rewritten to drive the real buffer + real client
and assert the stricter, accurate invariant (never surfaces as LIVE; guarded
and removed from activeMap). Coverage is stronger: the buffer's own unit test
mocks the client's tombstone guard, whereas this exercises the real guard."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-23
file: tests/watch-history.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-watch-history-partial-acceptance-durable
given: "A logged-in user snapshots watch history to 3 write relays where 2 accept and 1 rejects (single attempt, no escalation)"
when: "watchHistoryService.snapshot runs after the 565a9618 fix (a snapshot is durable as soon as ANY relay accepts; reads take the newest event per d-tag)"
then: "The snapshot SUCCEEDS — it does not throw, the result is ok and not retryable, no republish is scheduled, the month result is flagged partial with the accepting/rejecting relays captured, and the pointer queue is emptied (the pointer was durably published)"
- id: SCN-watch-history-logged-in-not-session
given: "A logged-in user (nostrClient.pubkey set) records a watch and the entry is published and re-loaded"
when: "publishView resolves the owning actor as the logged-in pubkey and sets the session flag only when nobody is logged in"
then: "The round-tripped entry is NOT flagged session=true (it is the logged-in user's history, not a local-only session entry); the queue files under the logged-in pubkey so getQueuedPointers(actor) sees it"
observable_outcomes:
- "snapshot() resolves (does not throw); result.ok === true; result.retryable === false"
- "scheduleWatchHistoryRepublish NOT called"
- "result.results[0].partial === true; relayStatus.pointer shows relay.one/two accepted, relay.three rejected"
- "getQueuedPointers(actor).length === 0 after a successful snapshot"
- "resolvedItems[0].session !== true for a logged-in user"
determinism_controls:
- "poolHarness resolver with a fixed accept/reject plan per relay url"
- "session crypto + recordVideoView virtualized; stable relay set"
- "logged-in pubkey aligned with the queried actor (matches the convention used by the other tests in the file)"
anti_cheat_rationale:
prevents:
- "snapshot rubber-stamping"
- "hard-coded return value"
note: "Three corrections in this file, all matching shipped behavior. (1) The
partial-acceptance test asserted the INVERSE of intended behavior — that
snapshot() THROWS on partial acceptance and retries until EVERY relay accepts —
encoding exactly the all-relays false-failure bug 565a9618 fixed. Rewritten to
the success path (no throw, partial flag, per-relay status, queue drained, no
spurious republish). (2) testWatchHistoryServiceIntegration set the logged-in
pubkey to a value DIFFERENT from the actor it queried; since watch history now
files under the logged-in pubkey, the queue assertions looked at the wrong key.
Aligned pubkey to the queried actor (the convention every other test uses) — a
setup fix, no assertion weakened. (3) The same test asserted session===true for
a logged-in watch, which is the pre-fix bug (logged-in watches were wrongly
flagged session by comparing against the view actor); corrected to session!==true
per the current rule that session marks only logged-out, local-only entries.
With these the full file is green and was REMOVED from the run-unit-tests
QUARANTINE."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-23
files:
- tests/zap-shared-state.test.mjs
- tests/video-modal-zap.test.mjs
change_type: ["spec_correction", "refactor_tests"]
scenarios:
- id: SCN-platform-fee-unparseable-override
given: "An unparseable platform-fee override value (e.g. 'not-a-number') with PLATFORM_FEE_PERCENT configured > 0"
when: "resolvePlatformFeePercent runs"
then: "It falls back to the configured platform default (getDefaultPlatformFeePercent), NOT to 0 — a junk override cannot silently disable/bypass the platform fee"
- id: SCN-zap-completion-state-resets-then-completes
given: "A zap whose receipts validate to a warning (awaiting validated receipt)"
when: "sendZap runs"
then: "The modal completion state is reset to false at the start of the send and set true at the terminal path, so two completion-state changes are recorded and the end state is true"
- id: SCN-zap-receipts-render-into-controller-element
given: "VideoModal.renderZapReceipts called with one validated (or one failed) receipt"
when: "rendering delegates to the inner zapController"
then: "Exactly one entry is rendered into the controller's modalZapReceipts element"
observable_outcomes:
- "resolvePlatformFeePercent('not-a-number') === getDefaultPlatformFeePercent() (> 0)"
- "completedStates grows by 2 (false then true) on a completing send; end state true"
- "controller.modalZapReceipts.children.length === 1 per rendered receipt"
determinism_controls:
- "pure fee function with explicit inputs; configured PLATFORM_FEE_PERCENT read via getDefaultPlatformFeePercent (not hard-coded)"
- "modal stub records setZapCompleted/resetZapForm calls; DummyElement DOM"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
- "over-mocking internal logic"
note: "Three corrections, all to match shipped behavior. (1) The fee-fallback test
asserted 0; the function correctly falls back to the configured platform default
so a garbage override cannot zero out (bypass) the fee — corrected to assert
against getDefaultPlatformFeePercent and that the result is > 0 (STRICTER: pins
the no-bypass guarantee). (2) The completion-count test asserted +1; sendZap
legitimately resets completed=false at the start of every send and sets true at
the terminal path (+2), with the end-state==true assertion retained as the real
invariant. (3) The receipt-render tests set modalZapReceipts on the outer
VideoModal, but rendering was refactored to delegate to the inner zapController
which owns that element — set/assert on the controller's element (a harness fix,
no assertion weakened). NOTE: these accompany three PRODUCTION bug fixes found
via the same tests — NWC getPublicKey hex->bytes (connection was broken), the
in-flight 'Sending…' status mis-toned as warning, and the success path not using
the holistic resetZapForm."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-23
file: tests/video-modal-zap.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-zap-paid-but-receipt-unconfirmed-is-success
given: "A zap share whose PAYMENT succeeded (NWC returned a preimage) but whose kind-9735 zap receipt could not be validated on the advertised relays"
when: "sendZap finishes"
then: "It is reported as a SUCCESS (Sent N sats) with a soft note that the on-relay receipt couldn't be confirmed — NOT as a warning/error. The form resets and the attempt is marked completed."
observable_outcomes:
- "last zap status tone === 'success' (was 'warning')"
- "status message matches /sent 750 sats/i and /couldn't confirm the zap receipt/i (was /awaiting validated zap receipt/i)"
- "receipts rendered in partial mode; form reset; completedStates +2 ending true"
determinism_controls:
- "injected splitAndZap returns a paid receipt (status:success, payment.preimage) with validation.status:'failed'"
anti_cheat_rationale:
prevents:
- "snapshot rubber-stamping"
- "hard-coded return value"
note: "The previous expectation asserted the BUG: a paid share whose 9735 receipt
wasn't found was surfaced as a 'warning' error ('Awaiting validated zap receipt')
and routed through notifyError — telling users a SUCCESSFUL zap had failed
(confirmed live: the platform fee landed but the UI showed a red error). The NWC
payment preimage is proof the invoice was paid; the 9735 receipt is supplementary
and is commonly not seen by a static client (relay coverage/timing). Corrected to
assert success-with-a-soft-note. Genuine PAYMENT failures (status !== 'success')
still go through the failure/retry path, unchanged."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-23
file: tests/zap-split.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-zap-receipt-found-by-indexed-tags
given: "A published kind-9735 zap receipt for a video zap (the zap request carries #p recipient + #e event tags)"
when: "validateZapReceipt queries relays for the receipt"
then: "It filters by the reliably-indexed #e + #p tags (not #bolt11, which most relays don't index), then confirms via author pubkey + bolt11 + description hash"
observable_outcomes:
- "the relay query filter has filters[0]['#e'] === [eventId] and ['#p'] === [recipient]"
- "filters[0]['#bolt11'] is absent"
- "a matching receipt still validates as status:'passed'"
determinism_controls:
- "mock SimplePool.list captures the filter; fixed zap request tags + test bolt11 with matching description hash"
anti_cheat_rationale:
prevents:
- "snapshot rubber-stamping"
- "over-mocking internal logic"
note: "The previous test asserted filters[0]['#bolt11'][0] === invoice — encoding the
bug. Relays generally do not index arbitrary tags like bolt11, so that query found
nothing and a successfully-paid zap was reported as having no receipt. Corrected to
assert the reliably-indexed #e/#p anchors (added an #e tag to the request to model a
real video zap). The receipt-matching assertions (passed status, correct event,
checked relays) are unchanged/retained — coverage is stronger, not weaker."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-24
file: tests/view-counter.test.mjs
change_type: ["spec_correction", "flake_fix"]
scenarios:
- id: SCN-view-counter-legacy-path
given: "The view-counter unit harness mocks the legacy per-pointer view APIs (list/count/subscribe) on the singleton client"
when: "A pointer is subscribed and hydrated"
then: "viewCounter exercises the legacy per-pointer hydrate/subscribe path (the one viewCounter.js explicitly designates 'for tests / mocks'), so the mocked APIs actually fire"
- id: SCN-view-counter-dedupe-window-aligned
given: "Two views by the same viewer within one fixed dedupe window"
when: "Counted"
then: "They dedupe to one (floor(created_at/window) bucket, matching the replaceable view-event d-tag)"
observable_outcomes:
- "hydration triggers a list()/count() call (legacy path) instead of the batched SubscriptionManager path silently taking over"
- "two same-pubkey views in one aligned bucket yield total === 1"
determinism_controls:
- "nostrClient.getSubscriptionManager pinned to () => null so the path is deterministic"
- "the dedupe test's base timestamp is aligned to a window-bucket boundary (was Date.now(), which made the +window/2 offset straddle a boundary depending on time of day)"
anti_cheat_rationale:
prevents:
- "over-mocking internal logic"
- "retry/sleep-based flake masking"
note: "The batched SubscriptionManager path was added later (relay-storm work); the
test mocks the legacy APIs but never pinned getSubscriptionManager, so the real
singleton's manager took over and the mocks never fired. Pinning it to null restores
the intended (and code-designated 'tests/mocks') legacy-path coverage. The dedupe
assertion (count === 1) is unchanged — only its setup was made deterministic."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
```yaml
test_integrity_note:
date: 2026-06-24
file: tests/view-counter.test.mjs
change_type: ["spec_correction"]
scenarios:
- id: SCN-hydrate-root-timestamp
given: "A latest video revision whose root event is fetched by hydrateVideoHistory"
when: "History is hydrated, then the timestamp-sync step runs"
then: "rootCreatedAtByRoot caches the earliest (root) created_at, AND the active video's rootCreatedAt FIELD is set by syncActiveVideoRootTimestamp"
observable_outcomes:
- "nostrClient.rootCreatedAtByRoot.get(rootId) === root.created_at (hydrateVideoHistory's direct output)"
- "after syncActiveVideoRootTimestamp(...), latestVideo.rootCreatedAt === root.created_at"
determinism_controls:
- "pool.get returns a fixed root event; rootCreatedAtByRoot seeded empty"
anti_cheat_rationale:
prevents:
- "snapshot rubber-stamping"
note: "hydrateVideoHistory's contract is to populate the per-root created_at MAP; the
video OBJECT's rootCreatedAt field is applied by a separate util
(syncActiveVideoRootTimestamp) after a refactor moved that unit boundary. The test
previously expected hydrateVideoHistory to mutate the passed object directly, which it
no longer does. Corrected to assert the map (its real output) and to drive the sync
util for the field — stronger, not weaker (it now exercises the full real pipeline)."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
---
## 2026-06-25 — todo-11b triage: un-quarantine nostr-boost-actions + admin-list-store
```yaml
test_integrity_note:
change_type: ["spec_correction", "refactor_tests"]
scenarios:
- id: SCN-repost-optional-relay
given: "A repost is built with no relay hint available (buildRepostEvent, nostrEventSchemas.js)"
when: "buildRepostEvent({ eventId, authorPubkey, targetKind }) is called without eventRelay"
then: "It returns a VALID repost (kind 16 for a non-kind-1 target, two-element ['e', id] tag, ['p', author], ['k', kind]) instead of throwing"
- id: SCN-community-blacklist-merge-batched
given: "An admin community-blacklist sources list references two curator kind-30000 lists, each with p-tag members"
when: "loadAdminState() runs and fetches curator lists via the BATCHED SubscriptionManager path"
then: "adminState.blacklist merges the curator members with the direct entry (deduped, guards respected)"
observable_outcomes:
- "buildRepostEvent output shape (kind/tags) with no relay — asserted exactly, stricter than the old throws-check"
- "adminState.blacklist === [direct, communityMemberOne, communityMemberTwo]"
determinism_controls:
- "pure builder (no IO) for repost; in-memory list registry + mocked pool.list AND getSubscriptionManager for the admin store"
anti_cheat_rationale:
prevents:
- "hard-coded return value"
- "over-mocking internal logic"
note: |
nostr-boost-actions: STALE SPEC. The test required buildRepostEvent to throw
/missing-event-relay/ when no relay hint is given, but a relay hint is a NIP-18
SHOULD (not MUST). The builder intentionally degrades to a two-element `e` tag so a
user can always repost. Replaced the throws-assertion with an EXACT assertion of the
valid output (kind 16 + e/p/k tags) — strictly stronger.
admin-list-store: STALE HARNESS, no production change, no assertion weakened. Three
fidelity fixes so the test exercises the real batched community-blacklist path:
(1) curator lists are now fetched via the batched SubscriptionManager (cold-start
relay-storm fix), which the harness didn't mock — added a getSubscriptionManager().list
mock serving the same registry; (2) curator coordinates now use REAL 64-char hex
pubkeys (the old mock-"hex" started with "npub", so parseCommunityBlacklistReferences'
isHexPubkey()/npub branch decoded them twice and the batched filter no longer matched);
(3) createListEvent now emits a `d` tag (real kind-30000 lists always have one;
selectNewestEventsForReferences matches curator events to references by their d tag).
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
## 2026-07-05 — todo-11b final: un-quarantine nwc-client (+ user-blocks / nostr-publish-rejection hangs)
```yaml
test_integrity_note:
change_type: ["spec_correction", "refactor_tests", "flake_fix"]
scenarios:
- id: SCN-nwc-unsupported-encryption-scheme
given: "An NWC wallet whose info event (kind 13194) advertises ONLY an encryption scheme bitvid does not implement (nip44_v3)"
when: "ensureEncryptionForContext(context) negotiates a scheme"
then: "It rejects with message /Wallet advertises unsupported encryption schemes: nip44_v3\\./ AND error.code === 'UNSUPPORTED_ENCRYPTION'"
- id: SCN-nwc-mock-toolkit-selection
given: "Each nwc-client section installs a per-section window.NostrTools mock to drive encryption-scheme selection"
when: "The nostr-tools bootstrap has installed its frozen canonical toolkit on the global scope"
then: "Removing scope.__BITVID_CANONICAL_NOSTR_TOOLS__ lets readToolkitFromScope fall through to the section mock, so the wiring under test runs against the mock (not real @noble against fake keys)"
observable_outcomes:
- "ensureEncryptionForContext rejection message + error.code (UNSUPPORTED_ENCRYPTION) — asserted exactly"
- "nip44_v2 section still resolves via the mock's nip44 (assert.match on the mock ciphertext shape)"
determinism_controls:
- "per-section in-memory window.NostrTools mocks; canonical-toolkit removal is deterministic (one-time, nothing re-installs it); no network"
anti_cheat_rationale:
prevents:
- "over-mocking internal logic"
- "hard-coded return value"
note: |
nwc-client: TWO issues. (1) MOCK SHADOW (not a spec change): the bootstrap installs a
frozen canonical toolkit that readToolkitFromScope() prefers over window.NostrTools, so
the per-section mocks never took effect and real @noble ran against the fake test keys
("bad point: is not on curve"). Deleting the scope canonical lets the resolver use each
section's mock — the tests exercise the NWC client's encryption-SELECTION wiring, not
@noble crypto (which is real elsewhere; the parseNwcUri hex-vs-bytes production bug is
guarded by tests/nwc-parse-uri.test.mjs). (2) SPEC CORRECTION: one section asserted a
rejection when the toolkit "lacks nip44" by omitting nip44 from the mock. That precondition
is architecturally unreachable — the bootstrap's mergeWithCanonical ALWAYS backfills the
canonical nip44 (even an explicit `nip44: null` is overwritten by `!merged.nip44`), so
nip44_v2 is never an unsupported scheme. Replaced with a wallet advertising a scheme bitvid
genuinely cannot provide (nip44_v3), exercising the SAME UNSUPPORTED_ENCRYPTION rejection
via a reachable scenario, and strengthened the check to also assert error.code — strictly
stronger than the old message-only match.
user-blocks + nostr-publish-rejection: FLAKE_FIX (no assertion changed). Both are
bare-assert files that PASS all assertions then hang on lingering handles after completion
(user-blocks: a never-resolving decrypt's background retry timer that manager.reset() doesn't
cancel; nostr-publish-rejection: js/app.js + subscriptions + userBlocks module-load
timers/connection managers). Applied the repo's established post-completion
`setTimeout(() => process.exit(0), 50)` exit after cleanup. No behavior or expectation was
altered — the process simply exits once the assertions have all run.
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
## 2026-07-05 — todo-11: uploadModal-reset zombie-callback test made deterministic (correct mock boundary)
```yaml
test_integrity_note:
change_type: ["flake_fix", "refactor_tests"]
scenarios:
- id: SCN-upload-zombie-callback-guard
given: "An upload is in progress (videoUploadState.status === 'uploading') via a controllable pending mediaUploader.uploadVideo"
when: "resetUploads() runs mid-upload (bumping videoUploadId), then the in-flight upload later resolves (a 'zombie' completion)"
then: "The stale completion is ignored — status stays 'idle' and results.videoUrl stays '' — because handleVideoSelection guards on videoUploadId !== currentUploadId"
observable_outcomes:
- "videoUploadState.status: 'uploading' after start, 'idle' after reset, still 'idle' after the zombie resolve"
- "results.videoUrl.value === '' after the zombie resolve"
- "test exits 0 with no async-after-test activity (was leaking webtorrent/Blob errors)"
determinism_controls:
- "mediaUploader.uploadVideo replaced with a manually-resolved promise; captureVideoMetadata stubbed; jsdom DOM; no webtorrent, no network, no real Blob ops"
anti_cheat_rationale:
prevents:
- "over-mocking internal logic"
- "retry/sleep-based flake masking"
note: |
FLAKE_FIX + REFACTOR_TESTS, no assertion weakened. The subtest PASSED its asserts but
leaked async activity after the test ended, which node:test flags as a failure. Root
cause: it mocked modal.generateTorrentMetadata / resolveUploadIdentifier, but
handleVideoSelection drives the upload through this.mediaUploader.uploadVideo — a
DIFFERENT object with its OWN helpers — so the mediaUploader still ran real
createTorrentMetadata()/hashing on a synthetic {name:'video.mp4'} file ("invalid input
type" async), and captureVideoMetadata() ran URL.createObjectURL(file) ("must be an
instance of Blob"). Fixed by mocking at the correct DI boundary
(modal.mediaUploader.uploadVideo returns the controllable pending promise) and stubbing
captureVideoMetadata. The unit under test is the modal's videoUploadId zombie-guard, so
mocking the uploader boundary is correct isolation, not over-mocking (real upload/torrent
paths are covered by the mediaUploader / s3-upload suites).
mutation_verification:
- "Broke the guard (`if (this.videoUploadId !== currentUploadId) return` → `if (false)`) → the test FAILS ('State should remain idle after zombie completion', # fail 1). Reverted."
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
## 2026-07-05 — todo-11b: un-quarantine dm-block-filter (hermetic subscription; no force-exit)
```yaml
test_integrity_note:
change_type: ["flake_fix"]
scenarios:
- id: SCN-dm-block-filter-hermetic
given: "The 'integration with loaded user block list' test loads standard + legacy block lists and filters incoming DMs"
when: "manager.loadBlocks() runs against stubbed fetchListIncrementally, with the live block-list subscription stubbed out"
then: "Both blocked contacts (standard + legacy) are filtered (dmMessages === [ALLOWED]) AND the process opens NO real relay sockets, so node:test exits naturally with the correct exit code"
observable_outcomes:
- "manager.isBlocked(legacy) && manager.isBlocked(standard) === true; dmMessages length 1 (ALLOWED only)"
- "process.getActiveResourcesInfo() shows no TCPSocketWrap after loadBlocks; node exits 0 on pass, 1 on a forced failure (verified — failures NOT masked)"
determinism_controls:
- "stubbed nostrClient.fetchListIncrementally; truthy stub nostrClient.pool; no-op nostrClient.getSubscriptionManager; window.nostr.nip04.decrypt stub. All restored in finally. No network."
anti_cheat_rationale:
prevents:
- "retry/sleep-based flake masking"
- "over-mocking internal logic"
note: |
FLAKE_FIX, no assertion changed. The file PASSED all subtests then hung: loadBlocks()
opens a LIVE block-list subscription through nostrClient's real SimplePool aimed at the
test's fake relay URLs, leaking TCP sockets + reconnect timers that outlive the run so
node:test never exits (surfaced only once the runner was given a per-file timeout).
Diagnosed with process.getActiveResourcesInfo() — 4 TCPSocketWrap + reconnect Timeouts;
NOT the decrypt-retry timer (verified absent). Nulling the pool did not help because
loadBlocks calls ensurePool() (userBlocks.js:967) to re-create+connect a real pool when
pool is falsy. Fix keeps the test hermetic: a TRUTHY stub pool (so ensurePool is skipped)
+ a no-op getSubscriptionManager (so the subscription opens nothing). The block-merge
logic under test still runs fully through the stubbed fetchListIncrementally. A force
`process.exit` in an after() hook was explicitly REJECTED after verifying it masks real
failures (process.exitCode is not set when the hook's timer fires — a deliberately broken
assertion still exited 0 under that approach). Under this fix, the forced-failure control
correctly exits 1.
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
```
-69
View File
@@ -1,69 +0,0 @@
# Validation Report
This report documents the verification of user-facing documentation in `/content` against the codebase.
## 1. Storage Configuration (CORS)
**Claim:** Users must configure CORS with specific headers to allow browser uploads.
**Source:** `content/docs/guides/upload-content.md`
**Code:** `js/storage/s3-multipart.js` (function `ensureBucketCors`)
**Verification:**
The `ensureBucketCors` function hardcodes the following CORS rules:
- `AllowedHeaders`: `["*"]` (Matches docs)
- `AllowedMethods`: `["GET", "HEAD", "PUT", "POST", "DELETE", "OPTIONS"]` (Matches docs, order irrelevant)
- `ExposeHeaders`: `["ETag", "Content-Length", "Content-Range", "Accept-Ranges"]` (Matches docs)
- `MaxAgeSeconds`: `3600` (Matches docs)
The `AllowedOrigins` in code is dynamic (`allowedOrigins` variable), while the docs provide a concrete example (`["http://localhost:5500", "https://bitvid.network"]`) which is correct for users.
## 2. File Type Limits
**Claim:** Accepted file types are `.mp4, .webm, .mov, .mkv, .ts, .m3u8, .mpg, .mpeg`.
**Source:** `content/docs/guides/upload-content.md`
**Code:** `components/upload-modal.html`
**Verification:**
The input element is defined as:
```html
<input id="input-file" type="file" class="hidden" accept="video/*,.m3u8,.ts,.mp4,.webm,.mov,.mkv,.mpg,.mpeg" />
```
The documentation matches the specific extensions listed in the code. The docs now also clarify that "other standard video formats" are accepted via `video/*`.
## 3. File Size Limit
**Claim:** Recommended limit is 2GB due to browser memory.
**Source:** `content/docs/guides/upload-content.md`
**Code:** `js/utils/torrentHash.js`
**Verification:**
The client-side hashing logic uses `FileReader.readAsArrayBuffer(file)`. This loads the entire file into memory. Browser implementations (especially Chrome) typically crash or fail when allocating ArrayBuffers larger than ~2GB. This technical constraint confirms the documentation's warning.
## 4. Moderation (Whitelist Mode)
**Claim:** "Whitelist Mode" restricts visibility to approved accounts.
**Source:** `content/docs/guides/upload-content.md` & `getting-started.md`
**Code:** `js/accessControl.js`
**Verification:**
The `AccessControl` class implements `canAccess(candidate)`:
```javascript
if (this.whitelistEnabled && !this.whitelistPubkeys.has(hex)) {
return false;
}
```
If `whitelistEnabled` is true (Whitelist Mode), non-whitelisted pubkeys return `false`, blocking their content from being displayed in feeds that use this check. This confirms the documentation.
## 5. Upload Lifecycle
**Claim:** Direct upload to bucket -> Client-side hashing -> NIP-71/Nostr publication.
**Source:** `content/docs/guides/upload-content.md`
**Code:** `js/ui/components/UploadModal.js`
**Verification:**
`handleVideoSelection` in `UploadModal.js`:
1. Calls `service.uploadFile` (Direct upload to R2/S3).
2. Calls `generateTorrentMetadata` (Client-side hashing).
3. Calls `publish` -> `publishVideoNote` (Nostr publication).
This flow matches the documentation exactly.
-22
View File
@@ -1,24 +1,2 @@
/*
Content-Security-Policy: frame-ancestors *
/index.html
Cache-Control: no-cache, must-revalidate
/embed.html
Cache-Control: no-cache, must-revalidate
/*.html
Cache-Control: no-cache, must-revalidate
/css/*
Cache-Control: public, max-age=31536000, immutable
/js/*
Cache-Control: public, max-age=31536000, immutable
/sw.min.js
Cache-Control: public, max-age=0, must-revalidate
X-Bitvid-SW-Version: bitvid-sw-2026-02-10
/site.webmanifest
Cache-Control: public, max-age=0, must-revalidate
-28
View File
@@ -1,28 +0,0 @@
# Telemetry Report - 2026-02-24
**Total Unique Issues:** 1
**Generated:** 2026-02-24T13:31:15.378Z
## Top 10 Priority Issues
| Priority | Count | Issue | Owner | Sources |
| :--- | :---: | :--- | :--- | :--- |
| **Medium** | 1 | Load Test Bottleneck: Cryptographic Bottleneck (Avg Sign ... | P2P Team | load-test:load-report-20260204.json |
## Detailed Breakdown
### [Medium] Load Test Bottleneck: Cryptographic Bottleneck (Avg Sign Time 5.87ms > 5ms)
- **Occurrences:** 1
- **Sources:** load-test:load-report-20260204.json
- **Suggested Owner:** P2P Team
- **Fingerprint:** `00257328`
**Stack Trace / Details:**
```
Bottleneck: Cryptographic Bottleneck (Avg Sign Time 5.87ms > 5ms)
Remediation: Client-side event signing is slow. Review cryptographic library (nostr-tools) usage or client hardware capabilities.
```
---
*Privacy Notice: PII (IPs, emails, keys) has been sanitized from this report.*
-72
View File
@@ -1,72 +0,0 @@
# Weekly Agent Synthesis — 2026-02-25 (covers 2026-02-18 → 2026-02-25)
## Summary
- Total PRs opened: 8 (currently open)
- Total PRs merged: 48 (in the last 7 days)
- Notable themes:
- **Testing & CI Stability:** Significant effort on stabilizing flaky E2E tests (#2683, #2669), improving coverage (#2707, #2667), and adding comprehensive E2E suites (#2666).
- **Performance:** Optimizations in feed moderation (#2665) and mute pruning (#2653).
- **Refactoring:** Cleaning up `app.js` (#2681) and test harnesses (#2688).
- **Routine Maintenance:** High volume of daily agent executions (todo-triage, style, audit).
## PRs Opened / Updated (Selected)
- **test(smoke): add smoke-test.mjs harness** — Open — Status: Open
- Notes: New harness for smoke testing.
- Risk: None (test infra).
- **docs(agents): sync scheduler rosters** — Open — Status: Open
- Notes: Routine scheduler updates.
- Risk: None.
- **Add unit tests for js/nostr/utils.js (test-coverage-agent)** — #2707 — Status: Merged
- Notes: Improved coverage for core utilities.
- Risk: None.
- **[ci] Stabilize flaky E2E tests & skip deploy-index verification** — #2683 — Status: Merged
- Notes: Addressed CI flakes.
- Risk: None (test infra).
- **refactor(ui): extract bindThumbnailFallbacks from app.js** — #2681 — Status: Merged
- Notes: Extracted logic from the main `bitvidApp` class.
- Risk: **Requires UI regression check** (thumbnails).
- **perf(feed): optimize moderation stage with batch author lookups** — #2665 — Status: Merged
- Notes: Changed how authors are looked up during feed rendering.
- Risk: **Requires protocol review** (feed correctness).
- **fix: race condition in app initialization** — #2674 — Status: Merged
- Notes: Fixed startup race.
- Risk: **Requires protocol review** (startup timing).
- **Replace alert() with non-blocking notifications in UploadModal** — #2652 — Status: Merged
- Notes: UX improvement.
- Risk: None.
## Issues Created / Updated
*(Derived from PR descriptions and titles, as direct issue fetching via git is limited)*
- **Stabilize flaky E2E tests** (referenced in #2683) — Priority: P1
- **Race condition in app initialization** (referenced in #2674) — Priority: P1
## Tests / Quality
- **Tests added/updated:**
- Unit tests for `js/nostr/utils.js` (#2707).
- Comprehensive E2E test suite for accessibility/playback (#2666).
- Refactored smoke test harness (#2688).
- **Coverage:**
- Coverage improved for `js/nostr/utils.js` and E2E scenarios.
## Security / Dependencies
- **Daily Agent: Audit Agent** (#2702) — #2702
- Routine audit run. No critical vulnerabilities flagged in summary.
- **daily: nip-research-agent NIP-42 update** — #2661
- Rationale: Touches authentication protocols.
- Risk: **requires-protocol-review**.
## Requires Human Review (Do Not Auto-Merge)
- **#2661 (NIP-42 update)** — Touches authentication logic — [PR #2661](https://github.com/PR0M3TH3AN/bitvid/pull/2661)
- **#2665 (Batch author lookups)** — Complex logic change in feed rendering — [PR #2665](https://github.com/PR0M3TH3AN/bitvid/pull/2665)
- **#2681 (Refactor app.js)** — Core UI refactor — [PR #2681](https://github.com/PR0M3TH3AN/bitvid/pull/2681)
## Top 5 Recommended Human Actions (ranked)
1. **Verify NIP-42/Auth Changes (#2661, #2669):** Ensure authentication flows remain secure and functional.
2. **Review Feed Optimization (#2665):** Verify that batch author lookups correctly handle all moderation cases.
3. **Validate App.js Refactor (#2681):** Check thumbnail loading across the app to ensure no regressions.
4. **Confirm CI Stability (#2683, #2703):** Monitor CI for recurrence of flakes; verify tests weren't simply disabled/loosened.
5. **Review New E2E Suite (#2666):** Ensure new tests align with "Scenario-First" guidelines.
## Method & Limitations
- Data sources used: GitHub API (`curl`), `git log`.
- Links are derived from API output.
-130
View File
@@ -1,130 +0,0 @@
import os
filepath = 'js/dmDecryptor.js'
with open(filepath, 'r') as f:
content = f.read()
search_block = """ for (const decryptor of ordered) {
for (const remotePubkey of remoteCandidates) {
try {
const plaintext = await decryptor.decrypt(remotePubkey, ciphertext, {
event,
stage: "content",
remotePubkey,
});
if (typeof plaintext === "string") {
const resolvedScheme =
normalizeScheme(hints.algorithms?.[0]) ||
normalizeScheme(decryptor.scheme) ||
"";
return buildDecryptResult({
ok: true,
event,
message: {
...cloneEvent(event),
content: plaintext,
},
plaintext,
recipients,
senderPubkey,
actorPubkey,
decryptor,
scheme: resolvedScheme,
});
}
} catch (error) {
errors.push({
scheme: decryptor.scheme || "",
source: decryptor.source || "",
stage: "content",
remotePubkey,
error,
});
}
}
}
return buildDecryptResult({
ok: false,
event,
actorPubkey,
errors,
});"""
replace_block = """ const attemptDecryption = async (decryptor, remotePubkey) => {
try {
const plaintext = await decryptor.decrypt(remotePubkey, ciphertext, {
event,
stage: "content",
remotePubkey,
});
if (typeof plaintext === "string") {
const resolvedScheme =
normalizeScheme(hints.algorithms?.[0]) ||
normalizeScheme(decryptor.scheme) ||
"";
return buildDecryptResult({
ok: true,
event,
message: {
...cloneEvent(event),
content: plaintext,
},
plaintext,
recipients,
senderPubkey,
actorPubkey,
decryptor,
scheme: resolvedScheme,
});
}
throw new Error("Decrypted content was not a valid string.");
} catch (error) {
throw {
scheme: decryptor.scheme || "",
source: decryptor.source || "",
stage: "content",
remotePubkey,
error,
};
}
};
const attempts = [];
for (const decryptor of ordered) {
for (const remotePubkey of remoteCandidates) {
attempts.push(attemptDecryption(decryptor, remotePubkey));
}
}
try {
return await Promise.any(attempts);
} catch (aggregateError) {
const aggregatedErrors = aggregateError.errors || [];
errors.push(...aggregatedErrors);
return buildDecryptResult({
ok: false,
event,
actorPubkey,
errors,
});
}"""
if search_block in content:
new_content = content.replace(search_block, replace_block)
with open(filepath, 'w') as f:
f.write(new_content)
print("Successfully replaced content.")
else:
print("Search block not found.")
# Debug: print what we have roughly where it should be
start_idx = content.find("for (const decryptor of ordered) {")
if start_idx != -1:
print("Found start of block, but full block mismatch.")
print("Existing content snippet:")
print(content[start_idx:start_idx+500])
-29
View File
@@ -1,29 +0,0 @@
# Onboarding Audit Report
Date: 2025-02-11
## Summary
The onboarding process was audited by simulating a fresh checkout and running the documented commands. All steps passed successfully. To further improve reliability, strict Node version enforcement was added.
## Environment
- **Node Version**: v22.22.0
- **NPM Version**: 11.7.0
- **OS**: Linux (Sandbox)
## Commands Executed
1. `npm ci` - **PASS**
- Clean install of dependencies.
- Added 424 packages.
2. `npm run build:css` - **PASS**
- Built Tailwind CSS successfully.
3. `npm run format` - **PASS**
- Checked formatting for CSS, HTML, MD, Config.
- No files were modified (compliance verified).
## Configuration Checks
- **package.json**: `engines.node` is set to `>=22`.
- **.devcontainer/devcontainer.json**: Uses `mcr.microsoft.com/devcontainers/javascript-node:22`, consistent with `package.json`.
- **Dockerfile**: Uses `mcr.microsoft.com/playwright:v1.58.0-jammy`. Verified compatible with Node 22 requirement.
## Improvements Implemented
- **Enforce Node Version**: created `.npmrc` with `engine-strict=true`. This ensures developers are using the required Node version (>=22) during `npm install`/`ci`.
- **Documentation**: Updated `README.md` and `CONTRIBUTING.md` to explicitly mention the Node version requirement and its enforcement.
@@ -1,224 +0,0 @@
{
"grandfathered_files": 43,
"grandfathered_excess_lines": 49463,
"new_oversized_files": 0,
"new_excess_lines": 0,
"grandfathered_list": [
{
"path": "js/adminListStore.js",
"lines": 1033,
"excess": 33
},
{
"path": "js/app/authSessionCoordinator.js",
"lines": 1743,
"excess": 743
},
{
"path": "js/app/feedCoordinator.js",
"lines": 1767,
"excess": 767
},
{
"path": "js/app/playbackCoordinator.js",
"lines": 1217,
"excess": 217
},
{
"path": "js/app.js",
"lines": 5245,
"excess": 4245
},
{
"path": "js/channelProfile.js",
"lines": 5530,
"excess": 4530
},
{
"path": "js/feedEngine/stages.js",
"lines": 1350,
"excess": 350
},
{
"path": "js/historyView.js",
"lines": 2547,
"excess": 1547
},
{
"path": "js/index.js",
"lines": 1407,
"excess": 407
},
{
"path": "js/nostr/client.js",
"lines": 3990,
"excess": 2990
},
{
"path": "js/nostr/managers/SignerManager.js",
"lines": 1106,
"excess": 106
},
{
"path": "js/nostr/nip46Client.js",
"lines": 2102,
"excess": 1102
},
{
"path": "js/nostr/nip46Connector.js",
"lines": 1094,
"excess": 94
},
{
"path": "js/nostr/nip71.js",
"lines": 1531,
"excess": 531
},
{
"path": "js/nostr/publishHelpers.js",
"lines": 1415,
"excess": 415
},
{
"path": "js/nostr/watchHistory.js",
"lines": 2211,
"excess": 1211
},
{
"path": "js/nostrEventSchemas.js",
"lines": 2908,
"excess": 1908
},
{
"path": "js/payments/nwcClient.js",
"lines": 1642,
"excess": 642
},
{
"path": "js/services/authService.js",
"lines": 1321,
"excess": 321
},
{
"path": "js/services/commentThreadService.js",
"lines": 1122,
"excess": 122
},
{
"path": "js/services/hashtagPreferencesService.js",
"lines": 1435,
"excess": 435
},
{
"path": "js/services/moderationService.js",
"lines": 2513,
"excess": 1513
},
{
"path": "js/services/nostrService.js",
"lines": 2227,
"excess": 1227
},
{
"path": "js/services/playbackService.js",
"lines": 1289,
"excess": 289
},
{
"path": "js/services/r2Service.js",
"lines": 1194,
"excess": 194
},
{
"path": "js/state/cache.js",
"lines": 1829,
"excess": 829
},
{
"path": "js/subscriptions.js",
"lines": 2374,
"excess": 1374
},
{
"path": "js/ui/applicationBootstrap.js",
"lines": 1169,
"excess": 169
},
{
"path": "js/ui/components/EditModal.js",
"lines": 1130,
"excess": 130
},
{
"path": "js/ui/components/RevertModal.js",
"lines": 1663,
"excess": 663
},
{
"path": "js/ui/components/SimilarContentCard.js",
"lines": 1303,
"excess": 303
},
{
"path": "js/ui/components/UploadModal.js",
"lines": 1320,
"excess": 320
},
{
"path": "js/ui/components/VideoCard.js",
"lines": 3130,
"excess": 2130
},
{
"path": "js/ui/components/VideoModal.js",
"lines": 6285,
"excess": 5285
},
{
"path": "js/ui/loginModalController.js",
"lines": 2552,
"excess": 1552
},
{
"path": "js/ui/moreMenuController.js",
"lines": 1601,
"excess": 601
},
{
"path": "js/ui/overlay/popoverEngine.js",
"lines": 1070,
"excess": 70
},
{
"path": "js/ui/profileModalController.js",
"lines": 8757,
"excess": 7757
},
{
"path": "js/ui/views/VideoListView.js",
"lines": 1392,
"excess": 392
},
{
"path": "js/ui/zapController.js",
"lines": 1206,
"excess": 206
},
{
"path": "js/userBlocks.js",
"lines": 2305,
"excess": 1305
},
{
"path": "js/watchHistoryService.js",
"lines": 1400,
"excess": 400
},
{
"path": "js/webtorrent.js",
"lines": 1038,
"excess": 38
}
],
"new_list": []
}
@@ -1,177 +0,0 @@
{
"total_assignments": 87,
"files_count": 34,
"top_offenders": [
{
"path": "js/channelProfile.js",
"count": 10,
"is_new": false
},
{
"path": "js/ui/components/RevertModal.js",
"count": 10,
"is_new": false
},
{
"path": "js/docsView.js",
"count": 8,
"is_new": false
},
{
"path": "js/subscriptions.js",
"count": 7,
"is_new": false
},
{
"path": "js/ui/subscriptionHistoryController.js",
"count": 7,
"is_new": false
},
{
"path": "js/historyView.js",
"count": 4,
"is_new": false
},
{
"path": "js/ui/components/DeleteModal.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/components/ShareNostrModal.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/dm/DMSettingsModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/loginModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/views/VideoListView.js",
"count": 3,
"is_new": false
},
{
"path": "js/viewManager.js",
"count": 3,
"is_new": false
},
{
"path": "js/utils/qrcode.js",
"count": 2,
"is_new": false
},
{
"path": "js/app/feedCoordinator.js",
"count": 1,
"is_new": false
},
{
"path": "js/app.js",
"count": 1,
"is_new": false
},
{
"path": "js/exploreView.js",
"count": 1,
"is_new": false
},
{
"path": "js/forYouView.js",
"count": 1,
"is_new": false
},
{
"path": "js/index.js",
"count": 1,
"is_new": false
},
{
"path": "js/kidsView.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EditModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EmbedVideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EventDetailsModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/UploadModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/VideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/nip71FormManager.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/AppShell.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/Composer.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/ConversationList.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/DMRelaySettings.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/MessageThread.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/NotificationCenter.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/moreMenuController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/profileModalController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/videoListViewController.js",
"count": 1,
"is_new": false
}
],
"violations": []
}
@@ -1,11 +0,0 @@
{
"total_failures": 0,
"files_with_errors": [],
"skipped_checks": [
{
"check": "lint:assets",
"reason": "Missing dist/asset-manifest.json.",
"details": "asset reference check (build required)."
}
]
}
-40
View File
@@ -1,40 +0,0 @@
Title: Audit Report — 2026-02-12 (unstable)
**Summary**
* Date: 2026-02-12
* Branch: unstable
**Metrics**
* Grandfathered oversized files: 43 files (total excess lines: 49463)
* New oversized files: 0 files (total excess lines: 0)
* Total innerHTML assignments: 87 across 34 files
* Top offenders:
1. js/channelProfile.js — 10
2. js/ui/components/RevertModal.js — 10
3. js/docsView.js — 8
4. js/subscriptions.js — 7
5. js/ui/subscriptionHistoryController.js — 7
6. js/historyView.js — 4
7. js/ui/components/DeleteModal.js — 3
8. js/ui/components/ShareNostrModal.js — 3
9. js/ui/dm/DMSettingsModalController.js — 3
10. js/ui/loginModalController.js — 3
* Lint failures: 0
* Skipped checks: 1
* lint:assets: Missing dist/asset-manifest.json.
**High-priority items**
* None. Keep it up!
**Artifacts**
* file-size-report.json
* innerhtml-report.json
* lint-report.json
* raw logs
@@ -1,224 +0,0 @@
{
"grandfathered_files": 43,
"grandfathered_excess_lines": 45216,
"new_oversized_files": 0,
"new_excess_lines": 0,
"grandfathered_list": [
{
"path": "js/adminListStore.js",
"lines": 1033,
"excess": 33
},
{
"path": "js/app/authSessionCoordinator.js",
"lines": 1743,
"excess": 743
},
{
"path": "js/app/feedCoordinator.js",
"lines": 1767,
"excess": 767
},
{
"path": "js/app/playbackCoordinator.js",
"lines": 1217,
"excess": 217
},
{
"path": "js/app.js",
"lines": 5133,
"excess": 4133
},
{
"path": "js/channelProfile.js",
"lines": 5579,
"excess": 4579
},
{
"path": "js/feedEngine/stages.js",
"lines": 1350,
"excess": 350
},
{
"path": "js/historyView.js",
"lines": 2547,
"excess": 1547
},
{
"path": "js/index.js",
"lines": 1409,
"excess": 409
},
{
"path": "js/nostr/client.js",
"lines": 4001,
"excess": 3001
},
{
"path": "js/nostr/managers/SignerManager.js",
"lines": 1107,
"excess": 107
},
{
"path": "js/nostr/nip46Client.js",
"lines": 2104,
"excess": 1104
},
{
"path": "js/nostr/nip46Connector.js",
"lines": 1094,
"excess": 94
},
{
"path": "js/nostr/nip71.js",
"lines": 1600,
"excess": 600
},
{
"path": "js/nostr/publishHelpers.js",
"lines": 1415,
"excess": 415
},
{
"path": "js/nostr/watchHistory.js",
"lines": 2211,
"excess": 1211
},
{
"path": "js/nostrEventSchemas.js",
"lines": 3192,
"excess": 2192
},
{
"path": "js/payments/nwcClient.js",
"lines": 1642,
"excess": 642
},
{
"path": "js/services/authService.js",
"lines": 1321,
"excess": 321
},
{
"path": "js/services/commentThreadService.js",
"lines": 1122,
"excess": 122
},
{
"path": "js/services/hashtagPreferencesService.js",
"lines": 1435,
"excess": 435
},
{
"path": "js/services/moderationService.js",
"lines": 2557,
"excess": 1557
},
{
"path": "js/services/nostrService.js",
"lines": 2227,
"excess": 1227
},
{
"path": "js/services/playbackService.js",
"lines": 1316,
"excess": 316
},
{
"path": "js/services/r2Service.js",
"lines": 1194,
"excess": 194
},
{
"path": "js/state/cache.js",
"lines": 1829,
"excess": 829
},
{
"path": "js/subscriptions.js",
"lines": 2410,
"excess": 1410
},
{
"path": "js/ui/applicationBootstrap.js",
"lines": 1169,
"excess": 169
},
{
"path": "js/ui/components/EditModal.js",
"lines": 1130,
"excess": 130
},
{
"path": "js/ui/components/RevertModal.js",
"lines": 1509,
"excess": 509
},
{
"path": "js/ui/components/SimilarContentCard.js",
"lines": 1303,
"excess": 303
},
{
"path": "js/ui/components/UploadModal.js",
"lines": 1320,
"excess": 320
},
{
"path": "js/ui/components/VideoCard.js",
"lines": 3130,
"excess": 2130
},
{
"path": "js/ui/components/VideoModal.js",
"lines": 4976,
"excess": 3976
},
{
"path": "js/ui/loginModalController.js",
"lines": 2574,
"excess": 1574
},
{
"path": "js/ui/moreMenuController.js",
"lines": 1601,
"excess": 601
},
{
"path": "js/ui/overlay/popoverEngine.js",
"lines": 1070,
"excess": 70
},
{
"path": "js/ui/profileModalController.js",
"lines": 5541,
"excess": 4541
},
{
"path": "js/ui/views/VideoListView.js",
"lines": 1392,
"excess": 392
},
{
"path": "js/ui/zapController.js",
"lines": 1206,
"excess": 206
},
{
"path": "js/userBlocks.js",
"lines": 2302,
"excess": 1302
},
{
"path": "js/watchHistoryService.js",
"lines": 1400,
"excess": 400
},
{
"path": "js/webtorrent.js",
"lines": 1038,
"excess": 38
}
],
"new_list": []
}
@@ -1,147 +0,0 @@
{
"total_assignments": 37,
"files_count": 28,
"top_offenders": [
{
"path": "js/ui/dm/DMSettingsModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/loginModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/views/VideoListView.js",
"count": 3,
"is_new": false
},
{
"path": "js/viewManager.js",
"count": 3,
"is_new": false
},
{
"path": "js/utils/qrcode.js",
"count": 2,
"is_new": false
},
{
"path": "js/app/feedCoordinator.js",
"count": 1,
"is_new": false
},
{
"path": "js/app.js",
"count": 1,
"is_new": false
},
{
"path": "js/docsView.js",
"count": 1,
"is_new": false
},
{
"path": "js/exploreView.js",
"count": 1,
"is_new": false
},
{
"path": "js/forYouView.js",
"count": 1,
"is_new": false
},
{
"path": "js/index.js",
"count": 1,
"is_new": false
},
{
"path": "js/kidsView.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EditModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EmbedVideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EventDetailsModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/UploadModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/VideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/nip71FormManager.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/AppShell.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/Composer.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/ConversationList.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/DMRelaySettings.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/MessageThread.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/NotificationCenter.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/moreMenuController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/profileModalController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/subscriptionHistoryController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/videoListViewController.js",
"count": 1,
"is_new": false
}
],
"violations": []
}
@@ -1,11 +0,0 @@
{
"total_failures": 0,
"files_with_errors": [],
"skipped_checks": [
{
"check": "lint:assets",
"reason": "Missing dist/asset-manifest.json.",
"details": "asset reference check (build required)."
}
]
}
@@ -1,47 +0,0 @@
43 grandfathered oversized file(s):
⚠ grandfathered: js/adminListStore.js (1033 lines)
⚠ grandfathered: js/app/authSessionCoordinator.js (1743 lines)
⚠ grandfathered: js/app/feedCoordinator.js (1767 lines)
⚠ grandfathered: js/app/playbackCoordinator.js (1217 lines)
⚠ grandfathered: js/app.js (5133 lines)
⚠ grandfathered: js/channelProfile.js (5579 lines)
⚠ grandfathered: js/feedEngine/stages.js (1350 lines)
⚠ grandfathered: js/historyView.js (2547 lines)
⚠ grandfathered: js/index.js (1409 lines)
⚠ grandfathered: js/nostr/client.js (4001 lines)
⚠ grandfathered: js/nostr/managers/SignerManager.js (1107 lines)
⚠ grandfathered: js/nostr/nip46Client.js (2104 lines)
⚠ grandfathered: js/nostr/nip46Connector.js (1094 lines)
⚠ grandfathered: js/nostr/nip71.js (1600 lines)
⚠ grandfathered: js/nostr/publishHelpers.js (1415 lines)
⚠ grandfathered: js/nostr/watchHistory.js (2211 lines)
⚠ grandfathered: js/nostrEventSchemas.js (3192 lines)
⚠ grandfathered: js/payments/nwcClient.js (1642 lines)
⚠ grandfathered: js/services/authService.js (1321 lines)
⚠ grandfathered: js/services/commentThreadService.js (1122 lines)
⚠ grandfathered: js/services/hashtagPreferencesService.js (1435 lines)
⚠ grandfathered: js/services/moderationService.js (2557 lines)
⚠ grandfathered: js/services/nostrService.js (2227 lines)
⚠ grandfathered: js/services/playbackService.js (1316 lines)
⚠ grandfathered: js/services/r2Service.js (1194 lines)
⚠ grandfathered: js/state/cache.js (1829 lines)
⚠ grandfathered: js/subscriptions.js (2410 lines)
⚠ grandfathered: js/ui/applicationBootstrap.js (1169 lines)
⚠ grandfathered: js/ui/components/EditModal.js (1130 lines)
⚠ grandfathered: js/ui/components/RevertModal.js (1509 lines)
⚠ grandfathered: js/ui/components/SimilarContentCard.js (1303 lines)
⚠ grandfathered: js/ui/components/UploadModal.js (1320 lines)
⚠ grandfathered: js/ui/components/VideoCard.js (3130 lines)
⚠ grandfathered: js/ui/components/VideoModal.js (4976 lines)
⚠ grandfathered: js/ui/loginModalController.js (2574 lines)
⚠ grandfathered: js/ui/moreMenuController.js (1601 lines)
⚠ grandfathered: js/ui/overlay/popoverEngine.js (1070 lines)
⚠ grandfathered: js/ui/profileModalController.js (5541 lines)
⚠ grandfathered: js/ui/views/VideoListView.js (1392 lines)
⚠ grandfathered: js/ui/zapController.js (1206 lines)
⚠ grandfathered: js/userBlocks.js (2302 lines)
⚠ grandfathered: js/watchHistoryService.js (1400 lines)
⚠ grandfathered: js/webtorrent.js (1038 lines)
No violations. 43 grandfathered file(s) remain as decomposition targets.
@@ -1,30 +0,0 @@
innerHTML usage: 37 assignments across 28 files
js/ui/dm/DMSettingsModalController.js: 3
js/ui/loginModalController.js: 3
js/ui/views/VideoListView.js: 3
js/viewManager.js: 3
js/utils/qrcode.js: 2
js/app/feedCoordinator.js: 1
js/app.js: 1
js/docsView.js: 1
js/exploreView.js: 1
js/forYouView.js: 1
js/index.js: 1
js/kidsView.js: 1
js/ui/components/EditModal.js: 1
js/ui/components/EmbedVideoModal.js: 1
js/ui/components/EventDetailsModal.js: 1
js/ui/components/UploadModal.js: 1
js/ui/components/VideoModal.js: 1
js/ui/components/nip71FormManager.js: 1
js/ui/dm/AppShell.js: 1
js/ui/dm/Composer.js: 1
js/ui/dm/ConversationList.js: 1
js/ui/dm/DMRelaySettings.js: 1
js/ui/dm/MessageThread.js: 1
js/ui/dm/NotificationCenter.js: 1
js/ui/moreMenuController.js: 1
js/ui/profileModalController.js: 1
js/ui/subscriptionHistoryController.js: 1
js/ui/videoListViewController.js: 1
-48
View File
@@ -1,48 +0,0 @@
> [email protected] lint
> npm run lint:css && npm run lint:hex && npm run lint:inline-styles && npm run lint:tokens && npm run lint:tailwind-brackets && npm run lint:tailwind-colors && npm run lint:file-size && npm run lint:innerhtml && npm run lint:assets && npm run lint:sw-compat
> [email protected] lint:css
> stylelint css/tailwind.source.css css/tokens.css css/docs.css
> [email protected] lint:hex
> node scripts/check-hex.js
> [email protected] lint:inline-styles
> node scripts/check-inline-styles.mjs
No inline style usage found.
> [email protected] lint:tokens
> node scripts/check-design-tokens.mjs --check=tokens
> [email protected] lint:tailwind-brackets
> node scripts/check-design-tokens.mjs --check=brackets
> [email protected] lint:tailwind-colors
> node scripts/check-tailwind-colors.mjs
> [email protected] lint:file-size
> node scripts/check-file-size.mjs
> [email protected] lint:innerhtml
> node scripts/check-innerhtml.mjs
> [email protected] lint:assets
> node scripts/check-asset-references.mjs
[lint:assets] Missing dist/asset-manifest.json. Skipping asset reference check (build required).
> [email protected] lint:sw-compat
> node scripts/check-sw-compat.mjs
[sw-compat] Skipping check: unable to determine HEAD^ or git history unavailable.
[sw-compat] No commit delta found; skipping compatibility check.
-47
View File
@@ -1,47 +0,0 @@
# Audit Report — 2026-02-21 (unstable)
**Summary**
* **Date:** 2026-02-21 15:15 UTC
* **Node:** v22.22.0 / **OS:** Linux
* **Status:** ✅ Clean. Significant improvements in technical debt metrics.
**Metrics**
* **Grandfathered oversized files:** 43 files
* Total excess lines: **45,216** (was 49,463)
* Delta: **-4,247 lines** (Improvement)
* **New oversized files:** 0 files (total excess lines: 0)
* **Total innerHTML assignments:** **37** (was 87)
* Delta: **-50 assignments** (Improvement)
* Files with innerHTML: 28 (was 34)
**Top offenders (innerHTML):**
1. `js/ui/dm/DMSettingsModalController.js` — 3
2. `js/ui/loginModalController.js` — 3
3. `js/ui/views/VideoListView.js` — 3
4. `js/viewManager.js` — 3
5. `js/utils/qrcode.js` — 2
* **Lint failures:** 0 (files: 0)
**Delta vs previous (2026-02-12)**
* **Grandfathered:** 0 files, **-4,247** excess lines
* **InnerHTML:** **-50** total assignments, **-6** files
* **Lint:** 0 failures
**High-priority items**
* No new regressions.
* Continue targeting the remaining 43 grandfathered files for decomposition.
* Continue migrating the remaining 37 `innerHTML` assignments to safe DOM APIs.
**Artifacts**
* `file-size-report.json`
* `innerhtml-report.json`
* `lint-report.json`
* `raw-check-file-size.log`
* `raw-check-innerhtml.log`
* `raw-lint.log`
@@ -1,224 +0,0 @@
{
"grandfathered_files": 43,
"grandfathered_excess_lines": 45288,
"new_oversized_files": 0,
"new_excess_lines": 0,
"grandfathered_list": [
{
"path": "js/adminListStore.js",
"lines": 1078,
"excess": 78
},
{
"path": "js/app/authSessionCoordinator.js",
"lines": 1770,
"excess": 770
},
{
"path": "js/app/feedCoordinator.js",
"lines": 1767,
"excess": 767
},
{
"path": "js/app/playbackCoordinator.js",
"lines": 1217,
"excess": 217
},
{
"path": "js/app.js",
"lines": 5077,
"excess": 4077
},
{
"path": "js/channelProfile.js",
"lines": 5579,
"excess": 4579
},
{
"path": "js/feedEngine/stages.js",
"lines": 1388,
"excess": 388
},
{
"path": "js/historyView.js",
"lines": 2613,
"excess": 1613
},
{
"path": "js/index.js",
"lines": 1409,
"excess": 409
},
{
"path": "js/nostr/client.js",
"lines": 4004,
"excess": 3004
},
{
"path": "js/nostr/managers/SignerManager.js",
"lines": 1135,
"excess": 135
},
{
"path": "js/nostr/nip46Client.js",
"lines": 2104,
"excess": 1104
},
{
"path": "js/nostr/nip46Connector.js",
"lines": 1094,
"excess": 94
},
{
"path": "js/nostr/nip71.js",
"lines": 1600,
"excess": 600
},
{
"path": "js/nostr/publishHelpers.js",
"lines": 1415,
"excess": 415
},
{
"path": "js/nostr/watchHistory.js",
"lines": 2335,
"excess": 1335
},
{
"path": "js/nostrEventSchemas.js",
"lines": 3192,
"excess": 2192
},
{
"path": "js/payments/nwcClient.js",
"lines": 1642,
"excess": 642
},
{
"path": "js/services/authService.js",
"lines": 1343,
"excess": 343
},
{
"path": "js/services/commentThreadService.js",
"lines": 1122,
"excess": 122
},
{
"path": "js/services/hashtagPreferencesService.js",
"lines": 1451,
"excess": 451
},
{
"path": "js/services/moderationService.js",
"lines": 2140,
"excess": 1140
},
{
"path": "js/services/nostrService.js",
"lines": 2227,
"excess": 1227
},
{
"path": "js/services/playbackService.js",
"lines": 1316,
"excess": 316
},
{
"path": "js/services/r2Service.js",
"lines": 1194,
"excess": 194
},
{
"path": "js/state/cache.js",
"lines": 1829,
"excess": 829
},
{
"path": "js/subscriptions.js",
"lines": 2437,
"excess": 1437
},
{
"path": "js/ui/applicationBootstrap.js",
"lines": 1169,
"excess": 169
},
{
"path": "js/ui/components/EditModal.js",
"lines": 1130,
"excess": 130
},
{
"path": "js/ui/components/RevertModal.js",
"lines": 1509,
"excess": 509
},
{
"path": "js/ui/components/SimilarContentCard.js",
"lines": 1303,
"excess": 303
},
{
"path": "js/ui/components/UploadModal.js",
"lines": 1326,
"excess": 326
},
{
"path": "js/ui/components/VideoCard.js",
"lines": 3141,
"excess": 2141
},
{
"path": "js/ui/components/VideoModal.js",
"lines": 4976,
"excess": 3976
},
{
"path": "js/ui/loginModalController.js",
"lines": 2574,
"excess": 1574
},
{
"path": "js/ui/moreMenuController.js",
"lines": 1601,
"excess": 601
},
{
"path": "js/ui/overlay/popoverEngine.js",
"lines": 1070,
"excess": 70
},
{
"path": "js/ui/profileModalController.js",
"lines": 5572,
"excess": 4572
},
{
"path": "js/ui/views/VideoListView.js",
"lines": 1392,
"excess": 392
},
{
"path": "js/ui/zapController.js",
"lines": 1206,
"excess": 206
},
{
"path": "js/userBlocks.js",
"lines": 2403,
"excess": 1403
},
{
"path": "js/watchHistoryService.js",
"lines": 1400,
"excess": 400
},
{
"path": "js/webtorrent.js",
"lines": 1038,
"excess": 38
}
],
"new_list": []
}
@@ -1,147 +0,0 @@
{
"total_assignments": 37,
"files_count": 28,
"top_offenders": [
{
"path": "js/ui/dm/DMSettingsModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/loginModalController.js",
"count": 3,
"is_new": false
},
{
"path": "js/ui/views/VideoListView.js",
"count": 3,
"is_new": false
},
{
"path": "js/viewManager.js",
"count": 3,
"is_new": false
},
{
"path": "js/utils/qrcode.js",
"count": 2,
"is_new": false
},
{
"path": "js/app/feedCoordinator.js",
"count": 1,
"is_new": false
},
{
"path": "js/app.js",
"count": 1,
"is_new": false
},
{
"path": "js/docsView.js",
"count": 1,
"is_new": false
},
{
"path": "js/exploreView.js",
"count": 1,
"is_new": false
},
{
"path": "js/forYouView.js",
"count": 1,
"is_new": false
},
{
"path": "js/index.js",
"count": 1,
"is_new": false
},
{
"path": "js/kidsView.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EditModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EmbedVideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/EventDetailsModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/UploadModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/VideoModal.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/components/nip71FormManager.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/AppShell.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/Composer.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/ConversationList.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/DMRelaySettings.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/MessageThread.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/dm/NotificationCenter.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/moreMenuController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/profileModalController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/subscriptionHistoryController.js",
"count": 1,
"is_new": false
},
{
"path": "js/ui/videoListViewController.js",
"count": 1,
"is_new": false
}
],
"violations": []
}
@@ -1,11 +0,0 @@
{
"total_failures": 0,
"files_with_errors": [],
"skipped_checks": [
{
"check": "lint:assets",
"reason": "Missing dist/asset-manifest.json.",
"details": "asset reference check (build required)."
}
]
}
@@ -1,47 +0,0 @@
43 grandfathered oversized file(s):
⚠ grandfathered: js/adminListStore.js (1078 lines)
⚠ grandfathered: js/app/authSessionCoordinator.js (1770 lines)
⚠ grandfathered: js/app/feedCoordinator.js (1767 lines)
⚠ grandfathered: js/app/playbackCoordinator.js (1217 lines)
⚠ grandfathered: js/app.js (5077 lines)
⚠ grandfathered: js/channelProfile.js (5579 lines)
⚠ grandfathered: js/feedEngine/stages.js (1388 lines)
⚠ grandfathered: js/historyView.js (2613 lines)
⚠ grandfathered: js/index.js (1409 lines)
⚠ grandfathered: js/nostr/client.js (4004 lines)
⚠ grandfathered: js/nostr/managers/SignerManager.js (1135 lines)
⚠ grandfathered: js/nostr/nip46Client.js (2104 lines)
⚠ grandfathered: js/nostr/nip46Connector.js (1094 lines)
⚠ grandfathered: js/nostr/nip71.js (1600 lines)
⚠ grandfathered: js/nostr/publishHelpers.js (1415 lines)
⚠ grandfathered: js/nostr/watchHistory.js (2335 lines)
⚠ grandfathered: js/nostrEventSchemas.js (3192 lines)
⚠ grandfathered: js/payments/nwcClient.js (1642 lines)
⚠ grandfathered: js/services/authService.js (1343 lines)
⚠ grandfathered: js/services/commentThreadService.js (1122 lines)
⚠ grandfathered: js/services/hashtagPreferencesService.js (1451 lines)
⚠ grandfathered: js/services/moderationService.js (2140 lines)
⚠ grandfathered: js/services/nostrService.js (2227 lines)
⚠ grandfathered: js/services/playbackService.js (1316 lines)
⚠ grandfathered: js/services/r2Service.js (1194 lines)
⚠ grandfathered: js/state/cache.js (1829 lines)
⚠ grandfathered: js/subscriptions.js (2437 lines)
⚠ grandfathered: js/ui/applicationBootstrap.js (1169 lines)
⚠ grandfathered: js/ui/components/EditModal.js (1130 lines)
⚠ grandfathered: js/ui/components/RevertModal.js (1509 lines)
⚠ grandfathered: js/ui/components/SimilarContentCard.js (1303 lines)
⚠ grandfathered: js/ui/components/UploadModal.js (1326 lines)
⚠ grandfathered: js/ui/components/VideoCard.js (3141 lines)
⚠ grandfathered: js/ui/components/VideoModal.js (4976 lines)
⚠ grandfathered: js/ui/loginModalController.js (2574 lines)
⚠ grandfathered: js/ui/moreMenuController.js (1601 lines)
⚠ grandfathered: js/ui/overlay/popoverEngine.js (1070 lines)
⚠ grandfathered: js/ui/profileModalController.js (5572 lines)
⚠ grandfathered: js/ui/views/VideoListView.js (1392 lines)
⚠ grandfathered: js/ui/zapController.js (1206 lines)
⚠ grandfathered: js/userBlocks.js (2403 lines)
⚠ grandfathered: js/watchHistoryService.js (1400 lines)
⚠ grandfathered: js/webtorrent.js (1038 lines)
No violations. 43 grandfathered file(s) remain as decomposition targets.
@@ -1,30 +0,0 @@
innerHTML usage: 37 assignments across 28 files
js/ui/dm/DMSettingsModalController.js: 3
js/ui/loginModalController.js: 3
js/ui/views/VideoListView.js: 3
js/viewManager.js: 3
js/utils/qrcode.js: 2
js/app/feedCoordinator.js: 1
js/app.js: 1
js/docsView.js: 1
js/exploreView.js: 1
js/forYouView.js: 1
js/index.js: 1
js/kidsView.js: 1
js/ui/components/EditModal.js: 1
js/ui/components/EmbedVideoModal.js: 1
js/ui/components/EventDetailsModal.js: 1
js/ui/components/UploadModal.js: 1
js/ui/components/VideoModal.js: 1
js/ui/components/nip71FormManager.js: 1
js/ui/dm/AppShell.js: 1
js/ui/dm/Composer.js: 1
js/ui/dm/ConversationList.js: 1
js/ui/dm/DMRelaySettings.js: 1
js/ui/dm/MessageThread.js: 1
js/ui/dm/NotificationCenter.js: 1
js/ui/moreMenuController.js: 1
js/ui/profileModalController.js: 1
js/ui/subscriptionHistoryController.js: 1
js/ui/videoListViewController.js: 1
-48
View File
@@ -1,48 +0,0 @@
> [email protected] lint
> npm run lint:css && npm run lint:hex && npm run lint:inline-styles && npm run lint:tokens && npm run lint:tailwind-brackets && npm run lint:tailwind-colors && npm run lint:file-size && npm run lint:innerhtml && npm run lint:assets && npm run lint:sw-compat
> [email protected] lint:css
> stylelint css/tailwind.source.css css/tokens.css css/docs.css
> [email protected] lint:hex
> node scripts/check-hex.js
> [email protected] lint:inline-styles
> node scripts/check-inline-styles.mjs
No inline style usage found.
> [email protected] lint:tokens
> node scripts/check-design-tokens.mjs --check=tokens
> [email protected] lint:tailwind-brackets
> node scripts/check-design-tokens.mjs --check=brackets
> [email protected] lint:tailwind-colors
> node scripts/check-tailwind-colors.mjs
> [email protected] lint:file-size
> node scripts/check-file-size.mjs
> [email protected] lint:innerhtml
> node scripts/check-innerhtml.mjs
> [email protected] lint:assets
> node scripts/check-asset-references.mjs
[lint:assets] Missing dist/asset-manifest.json. Skipping asset reference check (build required).
> [email protected] lint:sw-compat
> node scripts/check-sw-compat.mjs
[sw-compat] Skipping check: unable to determine HEAD^ or git history unavailable.
[sw-compat] No commit delta found; skipping compatibility check.
-29
View File
@@ -1,29 +0,0 @@
Title: `Audit Report — 2026-02-24 (unstable)`
**Summary**
* Date: 2026-02-24
**Metrics**
* Grandfathered oversized files: 43 files (total excess lines: 45288)
* New oversized files: 0 files (total excess lines: 0)
* Total innerHTML assignments: 37 (across 28 files)
* Top offenders:
1. js/ui/dm/DMSettingsModalController.js — 3
1. js/ui/loginModalController.js — 3
1. js/ui/views/VideoListView.js — 3
1. js/viewManager.js — 3
1. js/utils/qrcode.js — 2
* Lint failures: 0
**Delta vs previous (2026-02-21)**
* Grandfathered: +0 files, +72 excess lines
* innerHTML: +0 total assignments
* lint: +0 failures
**High-priority items**
**Artifacts**
* file-size-report.json
* innerhtml-report.json
* lint-report.json
* raw logs
-20
View File
@@ -1,20 +0,0 @@
# CI Health Report - 2026-02-21 (Evening Run)
## Summary
- **Agent:** ci-health-agent
- **Command:** `npm run test:unit`, `npm run test:dm:unit`, `npm run test:dm:integration`
- **Status:** PASS (with one timeout)
- **Flakes Detected:** 0 (Reliable reproduction failed)
## Details
Executed the unit test suite 2 times locally:
- **Run 1:** Passed successfully.
- **Run 2:** Timed out after 400s. The log ended during `tests/nostr/nip46Connector.test.mjs`.
Targeted execution of `tests/nostr/nip46Connector.test.mjs` (10 times) passed reliably and quickly (~30ms per run). The timeout in Run 2 is attributed to environmental load (running multiple suites in parallel or resource contention) rather than a code flake.
DM tests (`test:dm:unit`, `test:dm:integration`) passed successfully.
## Recommendations
- Monitor `tests/nostr/nip46Connector.test.mjs` in CI for potential hangs, though none were reproduced in isolation.
- `tests/visual/overlay-layers.spec.ts` contains potential timing issues (`waitForTimeout`) but was not modified as visual tests cannot be verified in the current environment.
-1
View File
@@ -1 +0,0 @@
{"dependencies":[],"devDependencies":["autoprefixer","cross-env","postcss","prettier","serve","stylelint","tailwindcss"],"missing":{"@scure/base":["/app/vendor/crypto-helpers.entry.js","/app/tests/zap-split.test.mjs"],"https:":["/app/js/nostrToolsBootstrap.js"]},"using":{"playwright":["/app/debug_sidebar.mjs","/app/tests/embed_playback_check.spec.mjs"],"@playwright/test":["/app/playwright.config.ts","/app/tests/visual/embed-layout.spec.ts","/app/tests/visual/kitchen-sink.spec.ts","/app/tests/visual/moderation.spec.ts","/app/tests/visual/overlay-layers.spec.ts","/app/tests/visual/reduced-motion.spec.ts","/app/tests/e2e/popover.spec.ts","/app/tests/e2e/repro_issue.spec.ts","/app/tests/e2e/toast-service.spec.ts","/app/tests/e2e/ui-modals.spec.ts","/app/tests/e2e/video-modal-share-bug.spec.ts","/app/tests/e2e/webseed-playback.spec.ts","/app/tests/e2e/helpers/uiTestUtils.ts","/app/examples/reproducers/playwright.config.ts","/app/examples/reproducers/issue-sidebar-layout/repro.spec.ts","/app/examples/reproducers/issue-popover-viewport/repro.spec.ts","/app/examples/reproducers/issue-moderation-visibility/repro.spec.ts","/app/examples/reproducers/issue-moderation-ui/playwright.config.ts","/app/examples/reproducers/issue-moderation-ui/repro.spec.ts","/app/examples/reproducers/issue-1-moderation-ui/playwright.config.ts","/app/examples/reproducers/issue-1-moderation-ui/repro.spec.ts","/app/examples/reproducers/issue-003-popover-ref-error/repro.spec.ts","/app/examples/reproducers/issue-002-login-modal-nsec/repro.spec.ts","/app/examples/reproducers/003-video-modal-reg/repro.spec.ts","/app/examples/reproducers/002-sidebar-layout/repro.spec.ts","/app/examples/reproducers/001-popover-404/repro.spec.ts"],"prettier-plugin-tailwindcss":["/app/prettier.config.cjs"],"@tailwindcss/typography":["/app/tailwind.config.cjs"],"@scure/base":["/app/vendor/crypto-helpers.entry.js","/app/tests/zap-split.test.mjs"],"@noble/hashes":["/app/vendor/crypto-helpers.entry.js"],"jsdom":["/app/tests/design-system-metrics.test.mjs","/app/tests/discussion-count-service.test.mjs","/app/tests/edit-modal-submit-state.test.mjs","/app/tests/login-modal-controller.test.mjs","/app/tests/media-loader.test.mjs","/app/tests/modal-accessibility.test.mjs","/app/tests/nip71-form-manager.test.mjs","/app/tests/position-floating-panel.test.mjs","/app/tests/profile-modal-controller.test.mjs","/app/tests/subscriptions-manager.test.mjs","/app/tests/test-setup.mjs","/app/tests/video-card-source-visibility.test.mjs","/app/tests/video-modal-accessibility.test.mjs","/app/tests/ui/app-chrome-controller.test.mjs","/app/tests/ui/hashtag-strip-helper-bounce.test.mjs","/app/tests/ui/popoverEngine.test.mjs","/app/tests/ui/profile-modal-moderation-settings.test.mjs","/app/tests/ui/tag-pill-list.test.mjs","/app/tests/ui/tag-preference-menu.test.mjs","/app/tests/ui/url-health-controller.test.mjs","/app/tests/ui/video-list-view-popular-tags.test.mjs","/app/tests/ui/video-list-view-sorting.test.mjs","/app/tests/ui/helpers/jsdom-test-helpers.mjs","/app/tests/torrent/style-helpers.test.mjs","/app/tests/torrent/toast-service.test.mjs","/app/tests/services/link-preview-service.test.mjs","/app/tests/moderation/video-card.test.mjs","/app/tests/app/channel-profile-moderation.test.mjs","/app/tests/app/hash-change-handler.test.mjs","/app/tests/app/hydrate-sidebar-navigation.test.mjs","/app/examples/reproducers/issue-channel-moderation-test-crash/repro.mjs","/app/examples/reproducers/issue-001-video-card-logic/repro.mjs"],"fake-indexeddb":["/app/tests/dm-db.test.mjs","/app/tests/dm-normalization.test.mjs","/app/tests/nostr-session-actor.test.mjs","/app/tests/storage-service.test.mjs","/app/tests/ui/storageService.test.mjs","/app/tests/services/link-preview-service.test.mjs","/app/tests/nostr/dm-direct-message-flow.test.mjs","/app/tests/nostr/session-actor.test.mjs","/app/scripts/agent/smoke-test.mjs"],"nostr-tools":["/app/tests/dm-decryptor.test.mjs","/app/tests/nostr-private-key-signer.test.mjs","/app/tests/nostr-publish-rejection.test.mjs","/app/tests/nostr-send-direct-message.test.mjs","/app/tests/nostr/adapters.test.mjs","/app/tests/nostr/dm-direct-message-flow.test.mjs","/app/tests/nostr/dmSignalEvents.test.mjs","/app/tests/nostr/integration-remote-flow.test.mjs","/app/tests/nostr/nip46Client.test.js","/app/tests/e2e/repro_issue.spec.ts","/app/scripts/agent/interop-test.mjs","/app/scripts/agent/load-test-relay.mjs","/app/scripts/agent/load-test.mjs","/app/scripts/agent/simple-relay.mjs","/app/scripts/agent/smoke-test.mjs","/app/js/nostrToolsBootstrap.js"],"pixelmatch":["/app/tests/visual/kitchen-sink.spec.ts"],"pngjs":["/app/tests/visual/kitchen-sink.spec.ts"],"ws":["/app/tests/e2e/repro_issue.spec.ts","/app/scripts/agent/interop-test.mjs","/app/scripts/agent/load-test-relay.mjs","/app/scripts/agent/load-test.mjs","/app/scripts/agent/setup-test-env.js","/app/scripts/agent/simple-relay.mjs","/app/scripts/agent/smoke-test.mjs"],"esbuild":["/app/scripts/build-beacon.mjs"],"@floating-ui/domLine truncated
-33
View File
@@ -1,33 +0,0 @@
# Dependency Report - 2026-02-20
## Vulnerabilities
### HIGH (3)
- **minimatch**: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
- Path: Direct dependency? No
- Fix Available: true
- **serve**: ajv, serve-handler
- Path: Direct dependency? Yes
- Fix Available: {"name":"serve","version":"6.5.8","isSemVerMajor":true}
- **serve-handler**: minimatch
- Path: Direct dependency? No
- Fix Available: true
### MODERATE (1)
- **ajv**: ajv has ReDoS when using `$data` option
## Outdated Packages
### Major Updates (Risky)
- **pixelmatch** (undefined): 5.3.0 -> 7.1.0
- **postcss-import** (undefined): 15.1.0 -> 16.1.1
- **prettier-plugin-tailwindcss** (undefined): 0.6.14 -> 0.7.2
- **stylelint-config-standard** (undefined): 36.0.1 -> 40.0.0
- **tailwindcss** (undefined): 3.4.19 -> 4.2.0
### Minor Updates (Safe-ish)
- **nostr-tools** (undefined): 2.19.4 -> 2.23.1 (Latest: 2.23.1)
- **stylelint** (undefined): 16.12.0 -> 16.26.1 (Latest: 17.3.0)
### Patch Updates (Safe)
## Triage & Actions
- [ ] **HIGH**: Check for safe upgrades for minimatch, serve, serve-handler.
- [ ] **Safe Candidates**: nostr-tools, stylelint
+67 -6
View File
@@ -1,13 +1,74 @@
[
{
"fingerprint": "00257328",
"title": "Load Test Bottleneck: Cryptographic Bottleneck (Avg Sign Time 5.87ms > 5ms)",
"fingerprint": "56489eaa",
"title": "handleModerationBlock requests a block, clears overrides, and refreshes hidden state",
"count": 6,
"sources": [
"unit-test:test_unit_debug_2.log",
"unit-test:test_unit_debug_3.log",
"unit-test:test_unit_pre_commit.log",
"unit-test:test_unit_retry.log",
"unit-test:test_unit_retry_3.log",
"unit-test:test_unit_retry_4.log"
],
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:228:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async Test.processPendingSubtests (node:internal/test_runner/test:744:7)\n ...\n# Subtest: handleModerationBlock returns false when viewer is logged out",
"owner": "QA Team"
},
{
"fingerprint": "bcbb97f7",
"title": "handleModerationOverride resumes deferred playback",
"count": 2,
"sources": [
"unit-test:test_unit_retry_2.log",
"unit-test:test_unit_retry_3.log"
],
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:104:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async Test.processPendingSubtests (node:internal/test_runner/test:744:7)\n ...\n# Subtest: handleModerationBlock requests a block, clears overrides, and refreshes hidden state",
"owner": "QA Team"
},
{
"fingerprint": "80a22b69",
"title": "handleModerationBlock requests a block, clears overrides, and refreshes hidden state",
"count": 1,
"sources": [
"load-test:load-report-20260204.json"
"unit-test:test_unit_debug_4.log"
],
"severity": "Medium",
"stack": "Bottleneck: Cryptographic Bottleneck (Avg Sign Time 5.87ms > 5ms)\nRemediation: Client-side event signing is slow. Review cryptographic library (nostr-tools) usage or client hardware capabilities.",
"owner": "P2P Team"
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:229:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async Test.processPendingSubtests (node:internal/test_runner/test:744:7)\n ...\n# Subtest: handleModerationBlock returns false when viewer is logged out",
"owner": "QA Team"
},
{
"fingerprint": "5e159618",
"title": "handleModerationBlock requests a block, clears overrides, and refreshes hidden state",
"count": 1,
"sources": [
"unit-test:test_unit_final.log"
],
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:232:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async Test.processPendingSubtests (node:internal/test_runner/test:744:7)\n ...\n# Subtest: handleModerationBlock returns false when viewer is logged out",
"owner": "QA Team"
},
{
"fingerprint": "4a2440b4",
"title": "handleModerationOverride decorates stored and current videos then refreshes UI",
"count": 1,
"sources": [
"unit-test:test_unit_retry_2.log"
],
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:67:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async startSubtestAfterBootstrap (node:internal/test_runner/harness:296:3)\n ...\n# Subtest: handleModerationOverride resumes deferred playback",
"owner": "QA Team"
},
{
"fingerprint": "a879eb91",
"title": "handleModerationBlock requests a block, clears overrides, and refreshes hidden state",
"count": 1,
"sources": [
"unit-test:test_unit_retry_2.log"
],
"severity": "High",
"stack": "TestContext.<anonymous> (file://$REPO/tests$REPO/moderation-overrides.test.mjs:202:10)\n async Test.run (node:internal/test_runner/test:1054:7)\n async Test.processPendingSubtests (node:internal/test_runner/test:744:7)\n ...\n# Subtest: handleModerationBlock returns false when viewer is logged out",
"owner": "QA Team"
}
]
-25
View File
@@ -1,25 +0,0 @@
# todo: Investigate why visibility check fails in fixture environment
Found TODOs in `tests/visual/moderation.spec.ts` related to Playwright test failures in headless mode.
## Context
Several tests in `tests/visual/moderation.spec.ts` have commented-out assertions and interactions due to visibility checks failing or clicks timing out when running in the fixture environment (headless).
## TODOs
- `// TODO: Investigate why visibility check fails in fixture environment (headless)`
- `// TODO: Investigate why click times out in fixture environment (headless)`
- `// TODO: Investigate visibility check failure`
- `// TODO: Investigate click timeout failure`
## Code Excerpt
```typescript
// TODO: Investigate why visibility check fails in fixture environment (headless)
// await expect(showAnywayButton).toBeVisible();
await expect(restoreButtonQuery).toHaveCount(0);
// TODO: Investigate why click times out in fixture environment (headless)
// await showAnywayButton.click({ force: true });
```
## Suggested Next Step
Investigate the `tests/visual/moderation.spec.ts` execution in headless mode. It might be related to rendering timing, fixture loading state, or specific CSS properties affecting visibility in the headless renderer.
File diff suppressed because it is too large. Load diff
-392
View File
@@ -1,392 +0,0 @@
{
"meta": {
"clients": 100,
"duration": 60,
"targetRatePerClient": 0.5
},
"results": {
"totalSent": 2900,
"totalReceivedByObserver": 2958,
"totalErrors": 0,
"errorRate": 0,
"avgLatencyMs": 8.5,
"maxLatencyMs": 42,
"avgSignTimeMs": 5.869976568218849,
"hot_functions": [
{
"name": "Event Signing (Client)",
"avgTimeMs": 5.869976568218849,
"calls": 2900
}
]
},
"bottlenecks": [
"Cryptographic Bottleneck (Avg Sign Time 5.87ms > 5ms)"
],
"metrics": {
"timestamps": [
"2026-02-04T19:06:10.186Z",
"2026-02-04T19:06:11.827Z",
"2026-02-04T19:06:12.831Z",
"2026-02-04T19:06:14.256Z",
"2026-02-04T19:06:15.314Z",
"2026-02-04T19:06:16.285Z",
"2026-02-04T19:06:17.281Z",
"2026-02-04T19:06:18.280Z",
"2026-02-04T19:06:19.280Z",
"2026-02-04T19:06:20.280Z",
"2026-02-04T19:06:21.281Z",
"2026-02-04T19:06:22.284Z",
"2026-02-04T19:06:23.281Z",
"2026-02-04T19:06:24.282Z",
"2026-02-04T19:06:25.282Z",
"2026-02-04T19:06:26.282Z",
"2026-02-04T19:06:27.288Z",
"2026-02-04T19:06:28.283Z",
"2026-02-04T19:06:29.290Z",
"2026-02-04T19:06:30.284Z",
"2026-02-04T19:06:31.289Z",
"2026-02-04T19:06:32.283Z",
"2026-02-04T19:06:33.288Z",
"2026-02-04T19:06:34.283Z",
"2026-02-04T19:06:35.303Z",
"2026-02-04T19:06:36.287Z",
"2026-02-04T19:06:37.287Z",
"2026-02-04T19:06:38.288Z",
"2026-02-04T19:06:39.288Z",
"2026-02-04T19:06:40.288Z",
"2026-02-04T19:06:41.288Z",
"2026-02-04T19:06:42.288Z",
"2026-02-04T19:06:43.289Z",
"2026-02-04T19:06:44.289Z",
"2026-02-04T19:06:45.289Z",
"2026-02-04T19:06:46.289Z",
"2026-02-04T19:06:47.290Z",
"2026-02-04T19:06:48.290Z",
"2026-02-04T19:06:49.290Z",
"2026-02-04T19:06:50.291Z",
"2026-02-04T19:06:51.292Z",
"2026-02-04T19:06:52.292Z",
"2026-02-04T19:06:53.292Z",
"2026-02-04T19:06:54.292Z",
"2026-02-04T19:06:55.292Z",
"2026-02-04T19:06:56.292Z",
"2026-02-04T19:06:57.292Z",
"2026-02-04T19:06:58.293Z",
"2026-02-04T19:06:59.292Z",
"2026-02-04T19:07:00.292Z",
"2026-02-04T19:07:01.293Z",
"2026-02-04T19:07:02.293Z",
"2026-02-04T19:07:03.293Z",
"2026-02-04T19:07:04.294Z",
"2026-02-04T19:07:05.293Z",
"2026-02-04T19:07:06.302Z",
"2026-02-04T19:07:07.293Z",
"2026-02-04T19:07:08.294Z"
],
"cpu": [
1.2891,
75.4605,
1.1246,
110.9914,
13.9201,
98.5274,
6.3944,
64.1486,
6.0738,
63.4177,
6.2085,
66.0653,
5.9001,
62.525,
5.7544,
69.5987,
6.6041,
60.1274,
6.8777,
66.1227,
6.6576,
61.7225,
6.5692,
62.586,
10.3549,
69.6933,
5.8595,
62.5952,
5.8479,
69.4633,
5.9227,
59.5779,
5.9434,
58.9378,
5.7777,
65.1409,
5.7253,
58.8193,
6.3755,
64.0124,
6.9732,
61.4041,
5.724,
58.3382,
5.5851,
58.7335,
6.0968,
59.5833,
5.6418,
60.6467,
5.742,
60.2272,
5.617,
59.7526,
6.6313,
63.0884,
5.8035,
61.0101
],
"memory": [
14.21099853515625,
12.053665161132812,
13.577583312988281,
11.293220520019531,
13.9764404296875,
13.597808837890625,
12.902915954589844,
17.456069946289062,
15.924842834472656,
13.108901977539062,
11.620040893554688,
16.124671936035156,
14.659011840820312,
11.750862121582031,
17.709686279296875,
14.97283935546875,
15.023307800292969,
17.9583740234375,
18.069061279296875,
13.631416320800781,
13.709136962890625,
16.736785888671875,
16.66020965576172,
12.300872802734375,
19.781394958496094,
15.29693603515625,
13.89215087890625,
18.39887237548828,
16.973892211914062,
14.178886413574219,
12.703651428222656,
17.223411560058594,
15.726631164550781,
12.830970764160156,
18.700477600097656,
15.878158569335938,
14.343246459960938,
18.87677764892578,
17.446983337402344,
14.474784851074219,
13.017341613769531,
17.500404357910156,
16.13226318359375,
13.164146423339844,
19.092933654785156,
16.134384155273438,
14.735084533691406,
19.123802185058594,
17.696151733398438,
14.804244995117188,
13.346839904785156,
17.821983337402344,
16.359207153320312,
13.470359802246094,
19.442214965820312,
16.46966552734375,
15.026473999023438,
19.590980529785156
],
"latency": [
12,
10,
11,
11,
42,
11,
6,
7,
6,
7,
7,
10,
6,
7,
6,
6,
11,
7,
14,
8,
13,
6,
12,
7,
23,
6,
7,
7,
6,
7,
7,
6,
6,
7,
7,
6,
7,
6,
7,
7,
7,
7,
7,
7,
6,
7,
7,
7,
7,
6,
7,
6,
6,
6,
7,
15,
6,
7
],
"throughput": [
1,
101,
1,
101,
11,
91,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93,
9,
93
],
"avgSignTime": [
0,
6.090444670000015,
0,
10.09357892,
10.334544000000195,
9.704539101123578,
5.840137249999998,
5.749988358695646,
5.691442000000279,
5.735636086956576,
5.9182750000002216,
5.890629923913069,
5.588866250000137,
5.850060869565309,
5.676161750001484,
5.6353527065217035,
5.762921555554688,
5.728557747252825,
6.10907399999956,
5.90219461538456,
5.862068444444351,
5.8458819999998,
5.776876333333348,
5.937595384615213,
9.20721633333354,
6.482018351648579,
5.615201250000155,
5.785851652173891,
5.64396275000081,
5.771455956521964,
5.550119749998885,
5.582937739129746,
5.7709488749997035,
5.643515130434737,
5.749425124999107,
6.210867510869914,
5.636921000000257,
5.659433999999949,
6.089611750000586,
5.987438336956668,
6.957270124999013,
5.891856141305059,
5.555353749998176,
5.548610880434985,
5.590769124999497,
5.557453586956794,
5.865140124999016,
5.646670826087163,
5.6239324999996825,
5.723344728261272,
5.6432206250010495,
5.7358725434777345,
5.5553546250012005,
5.647155880434224,
5.598165125001287,
5.917939250000058,
5.63759575000131,
5.651182891304653
]
},
"remediation": [
"Client-side event signing is slow. Review cryptographic library (nostr-tools) usage or client hardware capabilities."
],
"requiresSecurityReview": true
}
-129
View File
@@ -1,129 +0,0 @@
{
"config": {
"clients": 1000,
"duration": 60,
"rate": 0.2,
"relay": null,
"outputDir": "artifacts"
},
"timestamp": "2026-02-12T19:10:35.621Z",
"durationSec": 63.068,
"throughput": 158.78099828756262,
"totalSent": 10014,
"totalAccepted": 10014,
"totalRejected": 0,
"totalErrors": 0,
"latency": {
"p50": 0,
"p95": 1,
"p99": 1,
"min": 0,
"max": 6,
"avg": 0.2518474136209307
},
"signingTime": {
"avg": 0.7027462706211202,
"max": 3.145286999999371
},
"resources": [
{
"time": 7994,
"cpuUser": 2231161,
"cpuSystem": 437532,
"rss": 119869440,
"heapTotal": 55013376,
"heapUsed": 28269464
},
{
"time": 12994,
"cpuUser": 3142379,
"cpuSystem": 522268,
"rss": 122753024,
"heapTotal": 56848384,
"heapUsed": 26284072
},
{
"time": 17994,
"cpuUser": 3977010,
"cpuSystem": 616834,
"rss": 125243392,
"heapTotal": 58683392,
"heapUsed": 24239504
},
{
"time": 22993,
"cpuUser": 4886434,
"cpuSystem": 708145,
"rss": 128258048,
"heapTotal": 60256256,
"heapUsed": 35053272
},
{
"time": 27993,
"cpuUser": 5695214,
"cpuSystem": 818451,
"rss": 131010560,
"heapTotal": 62328832,
"heapUsed": 32881992
},
{
"time": 32994,
"cpuUser": 6598049,
"cpuSystem": 901079,
"rss": 133763072,
"heapTotal": 64163840,
"heapUsed": 29520680
},
{
"time": 37994,
"cpuUser": 7410460,
"cpuSystem": 1001266,
"rss": 135860224,
"heapTotal": 65212416,
"heapUsed": 40101552
},
{
"time": 42994,
"cpuUser": 8255994,
"cpuSystem": 1088486,
"rss": 138219520,
"heapTotal": 67047424,
"heapUsed": 36800544
},
{
"time": 47994,
"cpuUser": 9094489,
"cpuSystem": 1172380,
"rss": 141234176,
"heapTotal": 68882432,
"heapUsed": 34655312
},
{
"time": 52994,
"cpuUser": 9929570,
"cpuSystem": 1275658,
"rss": 143724544,
"heapTotal": 69898240,
"heapUsed": 36593096
},
{
"time": 57995,
"cpuUser": 10749951,
"cpuSystem": 1294454,
"rss": 143724544,
"heapTotal": 69898240,
"heapUsed": 33902488
}
],
"topHotFunctions": [
{
"function": "finalizeEvent (client signing)",
"avgTime": "0.70ms",
"impact": "Low/Moderate CPU usage"
}
],
"errors": 0,
"proposedRemediation": [
"Signing speed is good (<10ms). Focus on network I/O."
]
}
+8 -108
View File
@@ -1,122 +1,22 @@
{
"auditReportVersion": 2,
"vulnerabilities": {
"ajv": {
"name": "ajv",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113214,
"name": "ajv",
"dependency": "ajv",
"title": "ajv has ReDoS when using `$data` option",
"url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<8.18.0"
}
],
"effects": [
"serve"
],
"range": "<8.18.0",
"nodes": [
"node_modules/ajv"
],
"fixAvailable": {
"name": "serve",
"version": "6.5.8",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113296,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<10.2.1"
}
],
"effects": [
"serve-handler"
],
"range": "<10.2.1",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"serve": {
"name": "serve",
"severity": "high",
"isDirect": true,
"via": [
"ajv",
"serve-handler"
],
"effects": [],
"range": ">=7.0.0",
"nodes": [
"node_modules/serve"
],
"fixAvailable": {
"name": "serve",
"version": "6.5.8",
"isSemVerMajor": true
}
},
"serve-handler": {
"name": "serve-handler",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/serve-handler"
],
"fixAvailable": true
}
},
"vulnerabilities": {},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 3,
"moderate": 0,
"high": 0,
"critical": 0,
"total": 4
"total": 0
},
"dependencies": {
"prod": 111,
"dev": 340,
"optional": 53,
"prod": 50,
"dev": 291,
"optional": 27,
"peer": 0,
"peerOptional": 0,
"total": 477
"total": 340
}
}
}
+15 -22
View File
@@ -1,10 +1,17 @@
{
"nostr-tools": {
"current": "2.19.4",
"wanted": "2.23.1",
"latest": "2.23.1",
"cross-env": {
"current": "7.0.3",
"wanted": "7.0.3",
"latest": "10.1.0",
"dependent": "app",
"location": "/app/node_modules/nostr-tools"
"location": "/app/node_modules/cross-env"
},
"esbuild": {
"current": "0.25.12",
"wanted": "0.25.12",
"latest": "0.27.2",
"dependent": "app",
"location": "/app/node_modules/esbuild"
},
"pixelmatch": {
"current": "5.3.0",
@@ -13,13 +20,6 @@
"dependent": "app",
"location": "/app/node_modules/pixelmatch"
},
"postcss-import": {
"current": "15.1.0",
"wanted": "15.1.0",
"latest": "16.1.1",
"dependent": "app",
"location": "/app/node_modules/postcss-import"
},
"prettier-plugin-tailwindcss": {
"current": "0.6.14",
"wanted": "0.6.14",
@@ -28,23 +28,16 @@
"location": "/app/node_modules/prettier-plugin-tailwindcss"
},
"stylelint": {
"current": "16.12.0",
"current": "16.26.1",
"wanted": "16.26.1",
"latest": "17.3.0",
"latest": "17.0.0",
"dependent": "app",
"location": "/app/node_modules/stylelint"
},
"stylelint-config-standard": {
"current": "36.0.1",
"wanted": "36.0.1",
"latest": "40.0.0",
"dependent": "app",
"location": "/app/node_modules/stylelint-config-standard"
},
"tailwindcss": {
"current": "3.4.19",
"wanted": "3.4.19",
"latest": "4.2.0",
"latest": "4.1.18",
"dependent": "app",
"location": "/app/node_modules/tailwindcss"
}
+9
View File
@@ -0,0 +1,9 @@
js/ui/profileModalController.js:203: "Formats npub strings for display using the canonical short representation (npubXXXX…XXXX).",
tests/visual/moderation.spec.ts:89: // TODO: Investigate why visibility check fails in fixture environment (headless)
tests/visual/moderation.spec.ts:93: // TODO: Investigate why click times out in fixture environment (headless)
tests/visual/moderation.spec.ts:166: // TODO: Investigate visibility check failure
tests/visual/moderation.spec.ts:170: // TODO: Investigate click timeout failure
tests/visual/moderation.spec.ts:219: // TODO: Investigate visibility check failure
tests/visual/moderation.spec.ts:223: // TODO: Investigate click timeout failure
Note: The TODOs in tests/visual/moderation.spec.ts are already tracked in issues/todo-moderation-tests.md. No other actionable TODOs found.
Binary file not shown.

After

Width:  |  Height:  |  Size: 160 KiB

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M12,0C5.373,0 0,5.373 0,12C0,18.627 5.373,24 12,24C18.627,24 24,18.627 24,12C24,5.373 18.627,0 12,0ZM9.967,16.01C10.531,14.221 11.599,12.078 11.788,11.536C12.061,10.749 11.577,10.4 10.048,11.745L9.708,11.105C11.452,9.208 15.043,8.779 13.821,11.718C13.058,13.553 12.512,14.792 12.2,15.748C11.745,17.141 12.894,16.576 14.019,15.537C14.172,15.787 14.222,15.868 14.375,16.156C11.877,18.534 9.104,18.744 9.967,16.01ZM14.709,7.841C14.177,8.294 13.389,8.284 12.948,7.819C12.507,7.354 12.581,6.611 13.112,6.158C13.644,5.705 14.432,5.716 14.873,6.18C15.312,6.646 15.24,7.389 14.709,7.841Z" fill="#5C6F8A" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 1.1 KiB

+1
View File
@@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M17.374 20.235c2.444-2.981 6.626-8.157 6.626-8.157l-3.846-3.092s-2.857 3.523-6.571 8.097c-4.312 5.312-11.881-2.41-6.671-6.671 4.561-3.729 8.097-6.57 8.097-6.57l-3.092-3.842s-5.173 4.181-8.157 6.621c-2.662 2.175-3.76 4.749-3.76 7.24 0 5.254 4.867 10.139 10.121 10.139 2.487 0 5.064-1.095 7.253-3.765zm4.724-7.953l-1.699 2.111-1.74-1.397 1.701-2.114 1.738 1.4zm-10.386-10.385l1.4 1.738-2.113 1.701-1.397-1.74 2.11-1.699z"/></svg>

After

Width:  |  Height:  |  Size: 519 B

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M23.334,11.96C22.621,11.234 22.462,10.131 22.941,9.233C23.283,8.593 23.307,7.832 23.005,7.171C22.704,6.511 22.112,6.029 21.404,5.869C20.413,5.644 19.682,4.802 19.601,3.788C19.542,3.065 19.15,2.41 18.539,2.018C17.93,1.625 17.172,1.54 16.489,1.789C15.533,2.136 14.463,1.821 13.847,1.013C13.407,0.437 12.723,0.098 11.997,0.098C11.272,0.098 10.588,0.437 10.148,1.013C9.535,1.822 8.465,2.137 7.509,1.79C6.827,1.542 6.069,1.627 5.459,2.019C4.849,2.411 4.456,3.066 4.398,3.789C4.316,4.803 3.586,5.646 2.595,5.87C1.887,6.03 1.295,6.512 0.994,7.172C0.693,7.832 0.717,8.594 1.059,9.233C1.538,10.13 1.379,11.234 0.667,11.96C0.158,12.477 -0.08,13.202 0.023,13.92C0.126,14.638 0.559,15.267 1.193,15.62C2.081,16.115 2.545,17.13 2.337,18.125C2.19,18.835 2.381,19.573 2.856,20.121C3.332,20.67 4.036,20.965 4.758,20.919C5.774,20.856 6.711,21.459 7.075,22.408C7.334,23.086 7.895,23.603 8.592,23.807C9.287,24.011 10.039,23.879 10.623,23.45C11.442,22.847 12.559,22.847 13.377,23.45C13.961,23.88 14.713,24.012 15.408,23.807C16.105,23.603 16.666,23.085 16.926,22.408C17.289,21.459 18.227,20.855 19.242,20.919C19.966,20.965 20.669,20.67 21.144,20.121C21.619,19.573 21.811,18.835 21.663,18.125C21.456,17.13 21.919,16.115 22.808,15.62C23.441,15.266 23.873,14.638 23.977,13.92C24.081,13.202 23.842,12.477 23.334,11.96ZM10.75,17.39L6.25,13.026L8.107,11.169L10.75,13.675L16.393,7.891L18.25,9.748L10.75,17.39Z" fill="#5C6F8A" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 1.8 KiB

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M12,6.453L21,14.828L21,24L15,24L15,18L9,18L9,24L3,24L3,14.828L12,6.453ZM24,12.148L12,1L0,12.133L1.361,13.598L12,3.73L22.639,13.613L24,12.148Z" fill="#5C6F8A" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 642 B

+16
View File
@@ -0,0 +1,16 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<g id="iconmonstr-weather-64.svg" transform="matrix(1,0,0,1,12,12)">
<g id="iconmonstr-whats-hot-1.svg" transform="matrix(1,0,0,1,-12,-12)">
<clipPath id="_clip1">
<rect x="0" y="0" width="24" height="24"/>
</clipPath>
<g clip-path="url(#_clip1)">
<path d="M8.625,0C9.235,7.189 3,9.664 3,15.996C3,20.297 6.069,23.968 12,24C17.931,24.032 21,19.586 21,15.044C21,10.903 18.938,6.998 15.048,4.57C15.972,7.177 14.742,9.558 13.547,10.378C13.617,7.041 12.422,2.089 8.625,0ZM13.336,13C17.091,16.989 14.785,22 11.769,22C9.934,22 8.99,20.735 9,19.423C9.019,16.99 11.737,16.988 13.336,13Z" fill="#5C6F8A"/>
</g>
</g>
<g id="iconmonstr-whats-hot-1.svg1" serif:id="iconmonstr-whats-hot-1.svg">
</g>
</g>
</svg>

After

Width:  |  Height:  |  Size: 1.2 KiB

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M21.337,0.458L17.4,4.394C14.951,2.928 11.73,3.25 9.62,5.36L5.359,9.622C3.249,11.732 2.926,14.953 4.391,17.402L0.456,21.337C-0.153,21.946 -0.153,22.934 0.456,23.544C1.065,24.154 2.054,24.153 2.663,23.544L6.598,19.609C9.047,21.074 12.268,20.753 14.378,18.642L18.639,14.381C20.749,12.271 21.072,9.05 19.607,6.6L23.543,2.664C24.152,2.055 24.152,1.067 23.543,0.457C22.934,-0.153 21.946,-0.152 21.337,0.458ZM16.475,12.215L12.214,16.476C11.319,17.37 10.038,17.645 8.904,17.303L10.536,15.671C11.145,15.062 11.145,14.074 10.536,13.464C9.927,12.854 8.938,12.855 8.329,13.464L6.698,15.096C6.355,13.963 6.631,12.681 7.524,11.787L11.785,7.526C12.68,6.632 13.961,6.357 15.095,6.699L13.464,8.329C12.855,8.938 12.855,9.926 13.464,10.536C14.073,11.146 15.062,11.145 15.671,10.536L17.301,8.906C17.644,10.039 17.368,11.321 16.475,12.215Z" fill="#5C6F8A" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 1.3 KiB

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M22,16.75C22,16.336 21.664,16 21.25,16L2.75,16C2.336,16 2,16.336 2,16.75C2,17.164 2.336,17.5 2.75,17.5L21.25,17.5C21.664,17.5 22,17.164 22,16.75ZM22,11.75C22,11.336 21.664,11 21.25,11L2.75,11C2.336,11 2,11.336 2,11.75C2,12.164 2.336,12.5 2.75,12.5L21.25,12.5C21.664,12.5 22,12.164 22,11.75ZM22,6.75C22,6.336 21.664,6 21.25,6L2.75,6C2.336,6 2,6.336 2,6.75C2,7.164 2.336,7.5 2.75,7.5L21.25,7.5C21.664,7.5 22,7.164 22,6.75Z" fill="#111827" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 921 B

+5
View File
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="100%" height="100%" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2">
<path d="M23.961,8.429C23.13,9.411 22.347,10.347 22,12.204L22,18.887L18,21.366L18,12.205C17.653,10.348 16.87,9.412 16.039,8.43C15.131,7.355 14,6.019 14,3.801L14.019,3.456L12,2L6.455,6L0,2L0,20L6.455,24L12,20L17.545,24L24,20L24,8.382L23.961,8.429ZM11,18.255L7,21.14L7,8.073L11,5.187L11,18.255ZM20,0C17.9,0 16,1.702 16,3.801C16,6.922 19.188,7.252 20,12C20.812,7.252 24,6.922 24,3.801C24,1.702 22.1,0 20,0ZM20,5.5C19.172,5.5 18.5,4.829 18.5,4C18.5,3.171 19.172,2.5 20,2.5C20.828,2.5 21.5,3.171 21.5,4C21.5,4.829 20.828,5.5 20,5.5Z" fill="#5C6F8A" fill-rule="nonzero"/>
</svg>

After

Width:  |  Height:  |  Size: 1019 B

+1
View File
@@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M5 7c2.761 0 5 2.239 5 5s-2.239 5-5 5-5-2.239-5-5 2.239-5 5-5zm11.122 12.065c-.073.301-.122.611-.122.935 0 2.209 1.791 4 4 4s4-1.791 4-4-1.791-4-4-4c-1.165 0-2.204.506-2.935 1.301l-5.488-2.927c-.23.636-.549 1.229-.943 1.764l5.488 2.927zm7.878-15.065c0-2.209-1.791-4-4-4s-4 1.791-4 4c0 .324.049.634.122.935l-5.488 2.927c.395.535.713 1.127.943 1.764l5.488-2.927c.731.795 1.77 1.301 2.935 1.301 2.209 0 4-1.791 4-4z"/></svg>

After

Width:  |  Height:  |  Size: 513 B

+1
View File
@@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="currentColor"><path d="M19.35 10.04C18.67 6.59 15.64 4 12 4 9.11 4 6.6 5.64 5.35 8.04 2.34 8.36 0 10.91 0 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96zM14 13v4h-4v-4H7l5-5 5 5h-3z"/></svg>

After

Width:  |  Height:  |  Size: 301 B

-16
View File
@@ -1,16 +0,0 @@
# Audit Report (Unstable Branch)
## File Size
- **Grandfathered Oversized Files:** 44
- **Total Excess Lines:** 54,278 (sum of lines exceeding the 1000-line limit for each file)
## innerHTML Usage
- **Total Assignments:** 125
## Lint Status
- **Failures:** None
- `lint:assets` skipped (build required)
- `lint:sw-compat` skipped (git history unavailable)
## Comparison
No previous report found in the repository for comparison.
-55
View File
@@ -1,55 +0,0 @@
import { performance } from "perf_hooks";
// Mock IndexedDB if running in Node
if (!globalThis.indexedDB) {
const { indexedDB, IDBKeyRange } = await import("fake-indexeddb");
globalThis.indexedDB = indexedDB;
globalThis.IDBKeyRange = IDBKeyRange;
}
// Mock console to suppress logs
const originalConsoleWarn = console.warn;
console.warn = () => {};
// Import after mocking console
const { writeMessages, clearDmDb } = await import("../js/storage/dmDb.js");
async function runBenchmark() {
await clearDmDb();
const iterations = 1000;
const messages = [];
for (let i = 0; i < iterations; i++) {
messages.push({
id: `msg-${i}`,
conversation_id: "conv-1",
sender_pubkey: "sender",
receiver_pubkey: "receiver",
created_at: Date.now(),
kind: 4,
content: `Message ${i}`,
});
}
console.log(`Starting benchmark with ${iterations} writes...`);
const start = performance.now();
// Simulate N+1 writes
for (const msg of messages) {
await writeMessages(msg);
}
const end = performance.now();
const duration = end - start;
console.log(`Total time: ${duration.toFixed(2)}ms`);
console.log(`Average time per write: ${(duration / iterations).toFixed(2)}ms`);
// Restore console
console.warn = originalConsoleWarn;
}
runBenchmark().catch(console.error);
-85
View File
@@ -1,85 +0,0 @@
import { decryptDM } from "../js/dmDecryptor.js";
// Valid 64-char hex strings
const WRAP_PUBKEY = "0000000000000000000000000000000000000000000000000000000000000001";
const SEAL_PUBKEY = "0000000000000000000000000000000000000000000000000000000000000002";
const SENDER_PUBKEY = "0000000000000000000000000000000000000000000000000000000000000003";
const RECIPIENT_PUBKEY = "0000000000000000000000000000000000000000000000000000000000000004";
const sealEvent = {
id: "seal-event",
pubkey: SEAL_PUBKEY,
content: "seal-ciphertext",
created_at: Math.floor(Date.now() / 1000),
};
const rumorEvent = {
id: "rumor-event",
pubkey: SENDER_PUBKEY,
content: "Hello World",
created_at: Math.floor(Date.now() / 1000),
tags: [["p", RECIPIENT_PUBKEY]],
};
const wrapEvent = {
kind: 1059,
pubkey: WRAP_PUBKEY,
content: "wrap-ciphertext",
created_at: Math.floor(Date.now() / 1000),
tags: [["p", RECIPIENT_PUBKEY]],
};
const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
const createDecryptor = (name, shouldFail, delayMs) => {
return {
scheme: "nip44",
supportsGiftWrap: true,
decrypt: async (pubkey, ciphertext, context) => {
await delay(delayMs);
if (shouldFail) {
throw new Error(`${name} failed`);
}
// If we are unwrapping the outer wrap, return the seal
if (context.stage === "wrap") {
return JSON.stringify(sealEvent);
}
// If we are unwrapping the seal, return the rumor
if (context.stage === "seal") {
return JSON.stringify(rumorEvent);
}
return "";
},
};
};
async function runBenchmark() {
console.log("Running DM Decrypt Benchmark...");
const decryptors = [
createDecryptor("D1", true, 100),
createDecryptor("D2", true, 100),
createDecryptor("D3", false, 50),
];
const context = {
actorPubkey: RECIPIENT_PUBKEY,
decryptors: decryptors,
};
const start = performance.now();
const result = await decryptDM(wrapEvent, context);
const end = performance.now();
console.log(`Result OK: ${result.ok}`);
if (!result.ok) {
const errorMessages = result.errors.map(e => ({stage: e.stage, message: e.error.message}));
console.log("Errors:", JSON.stringify(errorMessages, null, 2));
}
console.log(`Time taken: ${(end - start).toFixed(2)}ms`);
}
runBenchmark();
-76
View File
@@ -1,76 +0,0 @@
import { createFeedEngine } from "../js/feedEngine/index.js";
import { performance } from "perf_hooks";
// Mock logger
const logger = {
log: () => {},
warn: () => {},
error: () => {},
};
// Polyfill localStorage to silence errors
if (typeof globalThis.localStorage === "undefined") {
globalThis.localStorage = {
getItem: () => null,
setItem: () => {},
removeItem: () => {},
};
}
async function runBenchmark() {
const engine = createFeedEngine({ logger });
const feedName = "bench-feed";
// Create items
const itemCount = 100000;
const items = [];
for (let i = 0; i < itemCount; i++) {
items.push({
video: { id: `v${i}`, created_at: Date.now() },
metadata: { some: "data" },
});
}
// Define stages
const stages = [];
// 10 stages that return null (no change) - STRICT PASS THROUGH
for (let i = 0; i < 10; i++) {
stages.push(async (items) => {
return null;
});
}
// 10 stages that return the same items array (identity) - STRICT PASS THROUGH
for (let i = 0; i < 10; i++) {
stages.push(async (items) => {
return items;
});
}
engine.registerFeed(feedName, {
source: async () => [...items],
stages: stages,
});
console.log(`Starting benchmark with ${itemCount} items and ${stages.length} stages...`);
const iterations = 50;
const start = performance.now();
for (let i = 0; i < iterations; i++) {
await engine.runFeed(feedName);
if (i % 5 === 0) process.stdout.write(".");
}
const end = performance.now();
const totalTime = end - start;
const avgTime = totalTime / iterations;
console.log("\n");
console.log(`Total time: ${totalTime.toFixed(2)}ms`);
console.log(`Average time per run: ${avgTime.toFixed(2)}ms`);
}
runBenchmark().catch(console.error);
-81
View File
@@ -1,81 +0,0 @@
import { normalizeHashtag } from "../js/utils/hashtagNormalization.js";
import { getVideoTags } from "../js/feedEngine/utils.js";
// Mock video object
function createMockVideo(tagCount) {
const tags = [];
for (let i = 0; i < tagCount; i++) {
tags.push(["t", `tag${i}`]);
}
return {
id: "video-" + Math.random(),
tags: tags,
nip71: {
hashtags: ["extra1", "extra2"]
}
};
}
// Legacy Uncached collectVideoTags (for comparison)
function collectVideoTags(video) {
const videoTags = new Set();
if (Array.isArray(video.tags)) {
for (const tag of video.tags) {
if (Array.isArray(tag) && tag[0] === "t" && typeof tag[1] === "string") {
const normalized = normalizeHashtag(tag[1]);
if (normalized) {
videoTags.add(normalized);
}
}
}
}
if (Array.isArray(video.nip71?.hashtags)) {
for (const tag of video.nip71.hashtags) {
if (typeof tag === "string") {
const normalized = normalizeHashtag(tag);
if (normalized) {
videoTags.add(normalized);
}
}
}
}
return videoTags;
}
// Benchmark
const VIDEOS_COUNT = 10000;
const TAGS_PER_VIDEO = 10;
const ITERATIONS = 100;
const videos = [];
for (let i = 0; i < VIDEOS_COUNT; i++) {
videos.push(createMockVideo(TAGS_PER_VIDEO));
}
console.log(`Benchmarking with ${VIDEOS_COUNT} videos, ${ITERATIONS} iterations.`);
console.time("Uncached (collectVideoTags)");
for (let i = 0; i < ITERATIONS; i++) {
for (const video of videos) {
collectVideoTags(video);
}
}
console.timeEnd("Uncached (collectVideoTags)");
console.time("Cached (getVideoTags) - First Run");
for (const video of videos) {
getVideoTags(video);
}
console.timeEnd("Cached (getVideoTags) - First Run");
console.time("Cached (getVideoTags) - Second Run");
for (let i = 0; i < ITERATIONS - 1; i++) {
for (const video of videos) {
getVideoTags(video);
}
}
console.timeEnd("Cached (getVideoTags) - Second Run");
-63
View File
@@ -1,63 +0,0 @@
// benchmarks/kids_scoring_bench.js
import { createKidsScorerStage } from "../js/feedEngine/kidsScoring.js";
import { performance } from "perf_hooks";
async function runBenchmark() {
const itemCount = 200000;
const items = [];
// Create mock items with diverse data to exercise different paths
for (let i = 0; i < itemCount; i++) {
items.push({
video: {
id: `v${i}`,
pubkey: `pubkey${i % 100}`,
duration: 300 + (i % 600), // 5 to 15 minutes
tags: [
["t", "kids"],
["t", "learning"],
["t", i % 2 === 0 ? "preschool" : "science"],
],
viewCount: i * 10,
created_at: Date.now() / 1000 - (i % 10000),
moderation: { trustedCount: i % 5 },
},
metadata: {},
});
}
const context = {
runtime: {
ageGroup: "preschool",
trustedAuthors: ["pubkey1", "pubkey2"],
},
addWhy: () => {}, // Mock addWhy
};
const scorer = createKidsScorerStage();
console.log(`Starting kids scoring benchmark with ${itemCount} items...`);
// Warmup
await scorer([...items.slice(0, 1000)], context);
const iterations = 100;
let totalTime = 0;
for (let i = 0; i < iterations; i++) {
// Reset metadata for each run to be cleaner
items.forEach(item => item.metadata = {});
const start = performance.now();
await scorer(items, context);
const end = performance.now();
totalTime += (end - start);
if (i % 5 === 0) process.stdout.write(".");
}
const avgTime = totalTime / iterations;
console.log(`\nAverage time per run: ${avgTime.toFixed(4)}ms`);
}
runBenchmark().catch(console.error);
-121
View File
@@ -1,121 +0,0 @@
// Mock Globals BEFORE imports
global.localStorage = {
getItem: () => null,
setItem: () => {},
removeItem: () => {},
clear: () => {}
};
global.window = { localStorage: global.localStorage };
// Dynamic imports to ensure globals are set first
const { ModerationService } = await import('../js/services/moderationService.js');
const { createModerationStage } = await import('../js/feedEngine/stages.js');
const { performance } = await import('node:perf_hooks');
// Mock Dependencies
const mockClient = {
pool: {},
ensurePool: async () => {},
pubkey: 'viewer-pubkey',
};
const mockLogger = {
log: () => {},
dev: { log: () => {}, debug: () => {} },
user: { warn: () => {}, info: () => {} }
};
const service = new ModerationService({
nostrClient: mockClient,
logger: mockLogger,
});
// Helper to generate valid hex
function makeHex(prefix, index) {
return `${prefix}${index.toString(16).padStart(64 - prefix.length, '0')}`;
}
// Setup Data
const AUTHOR_COUNT = 500;
const MUTERS_PER_AUTHOR = 100;
const now = Date.now() / 1000;
console.log(`Populating ${AUTHOR_COUNT} authors with ${MUTERS_PER_AUTHOR} muters each...`);
for (let i = 0; i < AUTHOR_COUNT; i++) {
const author = makeHex('abc', i);
const muters = new Map();
const categories = new Map();
for (let j = 0; j < MUTERS_PER_AUTHOR; j++) {
const muter = makeHex('def', j);
muters.set(muter, now); // Not expired
}
// Add some categories
const catMuters = new Map();
const firstMuter = makeHex('def', 0);
catMuters.set(firstMuter, now);
categories.set('spam', catMuters);
// We manually inject into internal map to bypass setter logic
service.trustedMutedAuthors.set(author, {
muters,
categories,
count: muters.size,
lastPrunedAt: 0 // Force prune check
});
}
// Prepare items for stage
const ITEM_COUNT = 5000;
const items = [];
for (let i = 0; i < ITEM_COUNT; i++) {
const authorIndex = i % AUTHOR_COUNT;
const author = makeHex('abc', authorIndex);
items.push({
video: {
id: makeHex('123', i),
pubkey: author,
kind: 30078,
moderation: {}
},
metadata: {}
});
}
const context = {
runtime: {
moderationThresholds: {
autoplayBlockThreshold: 1,
blurThreshold: 1,
trustedSpamHideThreshold: 1,
trustedMuteHideThresholds: {}
},
isAuthorBlocked: () => false
},
log: () => {},
addWhy: () => {}
};
async function runBenchmark() {
console.log('Running Moderation Stage Benchmark (Sequential Lookups)...');
const moderationStage = createModerationStage({
service: service,
stageName: 'bench-moderation-sequential'
});
// Warmup
await moderationStage(items.slice(0, 100), context);
// Measure
const start = performance.now();
await moderationStage(items, context);
const end = performance.now();
console.log(`Time: ${(end - start).toFixed(2)}ms`);
}
runBenchmark().catch(console.error);
-74
View File
@@ -1,74 +0,0 @@
import { ModerationService } from '../js/services/moderationService.js';
import { performance } from 'perf_hooks';
// Mock dependencies
const mockClient = {
pool: {},
};
const mockLogger = {
log: () => {},
dev: { log: () => {} },
user: { warn: () => {}, info: () => {} }
};
const service = new ModerationService({
nostrClient: mockClient,
logger: mockLogger,
});
async function runBenchmark() {
console.log('Starting Moderation Service Stress Benchmark...');
// Setup Data
// 100 authors, each having 500 muters (spam scenario).
// 50 muters are expired.
const AUTHOR_COUNT = 100;
const MUTERS_PER_AUTHOR = 500;
const now = Date.now() / 1000;
const expiredTime = now - (61 * 24 * 60 * 60);
console.log(`Populating ${AUTHOR_COUNT} authors with ${MUTERS_PER_AUTHOR} muters each...`);
for (let i = 0; i < AUTHOR_COUNT; i++) {
const author = `author-${i}`.padEnd(64, '0');
const muters = new Map();
for (let j = 0; j < MUTERS_PER_AUTHOR; j++) {
const muter = `muter-${j}`.padEnd(64, '0');
// 10% expired
const timestamp = (j % 10 === 0) ? expiredTime : now;
muters.set(muter, timestamp);
}
service.trustedMutedAuthors.set(author, {
muters,
categories: new Map(),
count: muters.size
});
}
// Benchmark Read
console.log('Benchmarking getActiveTrustedMutersForAuthor (Read + Prune)...');
const READ_ITERATIONS = 10000; // 10k reads
const start = performance.now();
for (let i = 0; i < READ_ITERATIONS; i++) {
const authorIndex = i % AUTHOR_COUNT;
const author = `author-${authorIndex}`.padEnd(64, '0');
// This call triggers pruneTrustedMuteAggregates EVERY time
service.getActiveTrustedMutersForAuthor(author);
}
const end = performance.now();
const totalTime = end - start;
const avgTime = totalTime / READ_ITERATIONS;
console.log('---------------------------------------------------');
console.log(`Total time: ${totalTime.toFixed(2)}ms`);
console.log(`Average time per call: ${(avgTime * 1000).toFixed(4)}µs`);
console.log('---------------------------------------------------');
}
runBenchmark().catch(console.error);
-150
View File
@@ -1,150 +0,0 @@
import { createModerationStage } from '../js/feedEngine/stages.js';
import { performance } from 'perf_hooks';
// Mock Logger
const logger = {
log: () => {},
dev: { log: () => {}, debug: () => {} },
user: { warn: () => {}, info: () => {} }
};
// Realistic Mock Service
const mutedAuthors = new Set();
const reportedVideos = new Map();
// Seed data
for (let i = 0; i < 100; i++) {
if (Math.random() < 0.1) {
mutedAuthors.add(`pubkey-${i}`);
}
}
// Simulate pruning cost
function pruneSimulation() {
const map = new Map();
for(let i=0; i<5; i++) map.set(i, Date.now()); // Simulate 5 muters
for(const [k,v] of map) {
if (v < 0) map.delete(k);
}
}
const mockService = {
refreshViewerFromClient: async () => {},
setActiveEventIds: async () => {},
getAdminListSnapshot: () => ({
whitelist: new Set(),
whitelistHex: new Set(),
blacklist: new Set(),
blacklistHex: new Set()
}),
getAccessControlStatus: (pubkey) => ({
hex: pubkey,
whitelisted: false,
blacklisted: false
}),
getTrustedReportSummary: (id) => {
if (reportedVideos.has(id)) {
return reportedVideos.get(id);
}
return null;
},
trustedReportCount: (id) => {
const summary = reportedVideos.get(id);
return summary ? summary.totalTrusted : 0;
},
getTrustedReporters: (id) => [],
isAuthorMutedByTrusted: (pubkey) => {
// Simulate the real service logic which calls prune
pruneSimulation();
return mutedAuthors.has(pubkey);
},
getTrustedMutersForAuthor: (pubkey) => {
// Simulate prune here too if called
pruneSimulation();
if (mutedAuthors.has(pubkey)) {
return ['trusted-muter-1', 'trusted-muter-2'];
}
return [];
},
getTrustedMuteCountsForAuthor: (pubkey) => {
pruneSimulation();
if (mutedAuthors.has(pubkey)) {
return { total: 2, categories: { nudity: 1, spam: 1 } };
}
return { total: 0, categories: {} };
},
isAuthorMutedByViewer: (pubkey) => false,
};
async function runBenchmark() {
console.log('Starting Moderation Stage Benchmark (with prune cost)...');
const ITEM_COUNT = 10000;
const items = [];
for (let i = 0; i < ITEM_COUNT; i++) {
const videoId = `video-${i}`;
const pubkey = `pubkey-${i % 100}`;
// Simulate some reported videos
if (Math.random() < 0.05) {
reportedVideos.set(videoId, {
eventId: videoId,
totalTrusted: 2,
types: { nudity: { trusted: 2, total: 5, latest: Date.now() } },
updatedAt: Date.now()
});
}
items.push({
video: {
id: videoId,
pubkey: pubkey,
kind: 30078,
tags: []
},
metadata: {}
});
}
const context = {
runtime: {
moderationThresholds: {
autoplayBlockThreshold: 1,
blurThreshold: 1,
trustedSpamHideThreshold: 1,
trustedMuteHideThresholds: {}
},
isAuthorBlocked: () => false
},
log: logger.dev.log,
addWhy: () => {}
};
const moderationStage = createModerationStage({
service: mockService,
stageName: 'bench-moderation'
});
// Warmup
console.log('Warming up...');
await moderationStage(items.slice(0, 100), context);
// Run
console.log(`Processing ${ITEM_COUNT} items with ~10% muted authors and prune simulation...`);
const start = performance.now();
const result = await moderationStage(items, context);
const end = performance.now();
const totalTime = end - start;
const avgTime = totalTime / ITEM_COUNT;
console.log('---------------------------------------------------');
console.log(`Total time: ${totalTime.toFixed(2)}ms`);
console.log(`Average time per item: ${(avgTime * 1000).toFixed(4)}µs`);
console.log(`Items processed: ${result.length}`);
console.log('---------------------------------------------------');
}
runBenchmark().catch(console.error);
-28
View File
@@ -1,28 +0,0 @@
import { normalizeNip46CiphertextPayload } from "../js/nostr/nip46Client.js";
const ITERATIONS = 100;
const ARRAY_SIZE = 200;
function runBenchmark() {
const largeArray = Array.from({ length: ARRAY_SIZE }, (_, i) => `string_${i}`);
// Wrap in a structure that triggers the recursive coerce and then the array handling
const payload = {
data: largeArray
};
const start = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
normalizeNip46CiphertextPayload(payload);
}
const end = performance.now();
const duration = end - start;
console.log(`Time taken for ${ITERATIONS} iterations with array size ${ARRAY_SIZE}: ${duration.toFixed(2)}ms`);
console.log(`Average time per iteration: ${(duration / ITERATIONS).toFixed(2)}ms`);
}
runBenchmark();
-88
View File
@@ -1,88 +0,0 @@
import { profileCache } from "../js/state/profileCache.js";
class LegacyProfileCache {
constructor() {
this.memoryCache = new Map();
}
set(pubkey, section, data) {
this.memoryCache.set(`${pubkey}:${section}`, data);
}
clearMemoryCache(pubkey) {
const prefix = `${pubkey}:`;
for (const key of this.memoryCache.keys()) {
if (key.startsWith(prefix)) {
this.memoryCache.delete(key);
}
}
}
}
function generatePubkey(i) {
return i.toString(16).padStart(64, '0');
}
function runBenchmark() {
const legacy = new LegacyProfileCache();
// Clean actual cache just in case
profileCache.memoryCache.clear();
const PUBKEY_COUNT = 1000;
const SECTIONS_PER_PUBKEY = 20;
const TARGET_PUBKEY = generatePubkey(500); // Middle one
console.log(`Setting up caches with ${PUBKEY_COUNT} pubkeys x ${SECTIONS_PER_PUBKEY} sections...`);
// Populate
for (let i = 0; i < PUBKEY_COUNT; i++) {
const pubkey = generatePubkey(i);
for (let s = 0; s < SECTIONS_PER_PUBKEY; s++) {
const section = `section-${s}`;
const data = { value: `data-${i}-${s}` };
// Legacy
legacy.set(pubkey, section, data);
// Actual (Optimized)
// We use setMemoryDataForPubkey to bypass storage/logic overhead
profileCache.setMemoryDataForPubkey(pubkey, section, data);
}
}
console.log(`Total entries: ${PUBKEY_COUNT * SECTIONS_PER_PUBKEY}`);
// Measure Legacy
const startLegacy = performance.now();
legacy.clearMemoryCache(TARGET_PUBKEY);
const endLegacy = performance.now();
const timeLegacy = endLegacy - startLegacy;
// Measure Optimized
const startOptimized = performance.now();
profileCache.clearMemoryCache(TARGET_PUBKEY);
const endOptimized = performance.now();
const timeOptimized = endOptimized - startOptimized;
console.log(`\nResults:`);
console.log(`Legacy (Linear Scan): ${timeLegacy.toFixed(4)} ms`);
console.log(`Optimized (Nested Map): ${timeOptimized.toFixed(4)} ms`);
if (timeLegacy > timeOptimized) {
const factor = timeLegacy / (timeOptimized || 0.001); // avoid div by zero
console.log(`Improvement: ~${factor.toFixed(1)}x faster`);
} else {
console.log("No improvement detected (dataset might be too small or optimized code has overhead)");
}
// Verification
if (profileCache.memoryCache.has(TARGET_PUBKEY)) {
console.error("FAIL: Optimized cache did not clear the pubkey!");
process.exit(1);
} else {
console.log("PASS: Optimized cache cleared successfully.");
}
}
runBenchmark();
-66
View File
@@ -1,66 +0,0 @@
import { profileCache } from "../js/state/profileCache.js";
// Polyfill localStorage
const store = new Map();
global.localStorage = {
getItem: (key) => store.get(key) || null,
setItem: (key, value) => store.set(key, value),
removeItem: (key) => store.delete(key),
clear: () => store.clear(),
};
// Polyfill requestIdleCallback
global.requestIdleCallback = (cb) => setTimeout(() => {
cb({
timeRemaining: () => 50,
didTimeout: false
});
}, 0);
// Polyfill window (might be needed by logger or others)
if (typeof window === 'undefined') {
global.window = global;
}
function generateLargeData() {
const data = [];
// Generate roughly 2MB of JSON data
for (let i = 0; i < 20000; i++) {
data.push({ id: i, content: "x".repeat(100) });
}
return data;
}
async function runBenchmark() {
const pubkey = "0".repeat(64);
const section = "watchHistory";
const data = generateLargeData();
// Set active profile to ensure logic runs
profileCache.setActiveProfile(pubkey);
console.log("Benchmarking setProfileData with large payload...");
// Warmup
profileCache.setProfileData(pubkey, section, [{id: 1}]);
const start = performance.now();
// We call it multiple times to amplify the effect, but a single call with 2MB is enough to show blocking
profileCache.setProfileData(pubkey, section, data);
const end = performance.now();
console.log(`Execution time (Synchronous part): ${(end - start).toFixed(4)} ms`);
// Wait for idle callback
await new Promise(resolve => setTimeout(resolve, 50));
// Verify data is "stored"
const stored = localStorage.getItem(profileCache.getStorageKey(pubkey, section));
if (stored) {
console.log("Data successfully stored in localStorage (length: " + stored.length + ")");
} else {
console.log("Data NOT found in localStorage");
}
}
runBenchmark();
-50
View File
@@ -1,50 +0,0 @@
import { listVideoReactions } from '../js/nostr/reactionEvents.js';
import { RELAY_BACKGROUND_CONCURRENCY } from '../js/nostr/relayConstants.js';
const NUM_RELAYS = 20;
const DELAY_MS = 100;
const mockRelays = Array.from({ length: NUM_RELAYS }, (_, i) => `wss://mock-relay-${i}.com`);
let activeRequests = 0;
let peakRequests = 0;
const mockPool = {
list: async (relays, filters) => {
activeRequests++;
if (activeRequests > peakRequests) {
peakRequests = activeRequests;
}
// Simulate network delay
await new Promise(resolve => setTimeout(resolve, DELAY_MS));
activeRequests--;
return []; // Return empty events for now
}
};
const mockClient = {
pool: mockPool,
relays: mockRelays, // Allow these relays
ensurePool: async () => mockPool
};
async function runBenchmark() {
console.log(`Starting benchmark with ${NUM_RELAYS} relays...`);
console.log(`Expected concurrency limit (after fix): ${RELAY_BACKGROUND_CONCURRENCY}`);
const start = performance.now();
await listVideoReactions(mockClient, { id: 'test-video-id' }, { relays: mockRelays });
const end = performance.now();
console.log('---------------------------------------------------');
console.log(`Total time: ${(end - start).toFixed(2)}ms`);
console.log(`Peak concurrent requests: ${peakRequests}`);
console.log('---------------------------------------------------');
}
runBenchmark().catch(console.error);
-101
View File
@@ -1,101 +0,0 @@
import { NostrClient } from "../js/nostr/client.js";
import { pMap } from "../js/utils/asyncUtils.js";
// Mock globals for Node environment
globalThis.WebSocket = class MockWebSocket {};
globalThis.localStorage = {
getItem: () => null,
setItem: () => {},
removeItem: () => {},
clear: () => {}
};
globalThis.indexedDB = {
open: () => ({
result: {
createObjectStore: () => {},
transaction: () => ({ objectStore: () => ({ get: () => {}, put: () => {} }) })
},
onupgradeneeded: () => {},
onsuccess: () => {}
})
};
// Mock dependencies
class MockPool {
constructor() {
this.activeRequests = 0;
this.maxConcurrent = 0;
}
async list(relays, filters) {
this.activeRequests++;
if (this.activeRequests > this.maxConcurrent) {
this.maxConcurrent = this.activeRequests;
}
// Simulate network delay
await new Promise(resolve => setTimeout(resolve, 50));
this.activeRequests--;
return [];
}
async get(relays, filter) {
return null;
}
}
async function runBenchmark() {
console.log("Starting Relay Concurrency Benchmark...");
const client = new NostrClient();
const mockPool = new MockPool();
client.pool = mockPool;
// Simulate 20 relays
const relays = Array.from({ length: 20 }, (_, i) => `wss://relay${i}.example.com`);
client.relays = relays;
client.readRelays = relays;
// 1. Benchmark fetchAndCacheNip71Metadata
console.log("\nTesting fetchAndCacheNip71Metadata with 20 relays...");
mockPool.maxConcurrent = 0;
const pointerMap = new Map();
pointerMap.set("e:123", { type: "e", value: "123", relays: [] });
await client.fetchAndCacheNip71Metadata(pointerMap, ["e:123"]);
console.log(`Max concurrent requests: ${mockPool.maxConcurrent}`);
if (mockPool.maxConcurrent > 5) {
console.log("FAIL: Concurrency is unbounded!");
} else {
console.log("PASS: Concurrency is bounded.");
}
// 2. Benchmark hydrateVideoHistory
console.log("\nTesting hydrateVideoHistory with 20 relays...");
mockPool.maxConcurrent = 0;
const video = {
id: "v1",
videoRootId: "root1",
tags: [["d", "d1"]],
pubkey: "pub1"
};
// Prime local cache to force relay fetch
// We need to simulate that we found <= 1 version locally
client.allEvents.set("v1", video);
await client.hydrateVideoHistory(video);
console.log(`Max concurrent requests: ${mockPool.maxConcurrent}`);
if (mockPool.maxConcurrent > 5) {
console.log("FAIL: Concurrency is unbounded!");
} else {
console.log("PASS: Concurrency is bounded.");
}
}
runBenchmark().catch(console.error);
-71
View File
@@ -1,71 +0,0 @@
// benchmarks/render_loop_overhead_bench.js
class WatchHistoryTelemetry {
persistMetadataForVideo(video, pointerInfo) {
// Deprecated - effectively a no-op in real code
}
}
class ModalCoordinator {
constructor() {
this.watchHistoryTelemetry = new WatchHistoryTelemetry();
}
persistWatchHistoryMetadataForVideo(video, pointerInfo) {
if (this.watchHistoryTelemetry) {
this.watchHistoryTelemetry.persistMetadataForVideo(video, pointerInfo);
return;
}
}
}
class App {
constructor() {
this._modal = new ModalCoordinator();
this._coordinatorsReady = true; // Simulating initialized state
}
_initCoordinators() {
if (this._coordinatorsReady) return;
this._coordinatorsReady = true;
}
persistWatchHistoryMetadataForVideo(...args) {
this._initCoordinators();
return this._modal.persistWatchHistoryMetadataForVideo(...args);
}
}
const app = new App();
const video = { id: "test", title: "test" };
const pointerInfo = { key: "test" };
const ITERATIONS = 100_000_000;
console.log(`Benchmarking overhead for ${ITERATIONS.toLocaleString()} iterations...`);
const startWithCall = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
if (
pointerInfo &&
typeof app?.persistWatchHistoryMetadataForVideo === "function"
) {
app.persistWatchHistoryMetadataForVideo(video, pointerInfo);
}
}
const endWithCall = performance.now();
const durationWithCall = endWithCall - startWithCall;
const startWithoutCall = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
// Simulating the removal of the call
if (false) { // Condition becomes false or code is removed
// Removed
}
}
const endWithoutCall = performance.now();
const durationWithoutCall = endWithoutCall - startWithoutCall;
console.log(`With call: ${durationWithCall.toFixed(2)}ms`);
console.log(`Without call: ${durationWithoutCall.toFixed(2)}ms`);
console.log(`Improvement: ${(durationWithCall - durationWithoutCall).toFixed(2)}ms`);
console.log(`Relative improvement: ${(durationWithCall / durationWithoutCall).toFixed(2)}x`);
-61
View File
@@ -1,61 +0,0 @@
import { performance } from 'perf_hooks';
// Mock data
const NUM_HEADINGS = 100;
const SCROLL_EVENTS = 10000;
const headings = [];
for (let i = 0; i < NUM_HEADINGS; i++) {
headings.push({
id: `heading-${i}`,
// Mock getBoundingClientRect
getBoundingClientRect: () => ({
top: (i * 100) - currentScrollY, // Simple layout simulation
})
});
}
let currentScrollY = 0;
let activeId = "";
// The function to benchmark (copied/adapted from js/docsView.js)
const updateActiveFromScroll = () => {
const offset = 96;
let nextId = headings[0]?.id || "";
// In the real code, this runs on every scroll (throttled by rAF)
// We simulate the logic here.
for (const heading of headings) {
const top = heading.getBoundingClientRect().top - offset;
if (top <= 0) {
nextId = heading.id;
} else {
break;
}
}
if (nextId && nextId !== activeId) {
activeId = nextId;
// setActiveSection logic (simplified)
}
};
console.log(`Benchmarking legacy scroll spy logic...`);
console.log(`Headings: ${NUM_HEADINGS}`);
console.log(`Scroll events simulated: ${SCROLL_EVENTS}`);
const start = performance.now();
for (let i = 0; i < SCROLL_EVENTS; i++) {
// Simulate scrolling down
currentScrollY += 5;
updateActiveFromScroll();
}
const end = performance.now();
const duration = end - start;
console.log(`Total execution time: ${duration.toFixed(2)}ms`);
console.log(`Average time per scroll event: ${(duration / SCROLL_EVENTS).toFixed(4)}ms`);
console.log(`Note: This benchmark only measures JS execution time. Real browser performance is worse due to layout thrashing (getBoundingClientRect).`);
-52
View File
@@ -1,52 +0,0 @@
import { finalizeEvent as pureFinalize, generateSecretKey, getPublicKey, getEventHash } from "nostr-tools";
import { finalizeEvent as wasmFinalize, setNostrWasm } from "nostr-tools/wasm";
import { initNostrWasm } from "nostr-wasm";
async function main() {
const secretKey = generateSecretKey();
const pubkey = getPublicKey(secretKey);
const ITERATIONS = 1000;
const baseEvent = {
kind: 1,
created_at: Math.floor(Date.now() / 1000),
tags: [["t", "nostr"], ["t", "benchmark"]],
content: "Hello world, this is a benchmark event.",
pubkey: pubkey,
};
console.log(`Running signing benchmark with ${ITERATIONS} iterations...`);
// 1. Pure JS baseline (finalizeEvent)
{
console.log("Pure JS finalizeEvent...");
const start = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
const event = { ...baseEvent, created_at: baseEvent.created_at + i };
pureFinalize(event, secretKey);
}
const end = performance.now();
const time = end - start;
console.log(`Pure JS time: ${time.toFixed(2)}ms (${(ITERATIONS/time*1000).toFixed(2)} ops/sec)`);
}
// 2. WASM
console.log("Initializing WASM...");
const wasm = await initNostrWasm();
setNostrWasm(wasm);
{
console.log("WASM finalizeEvent...");
const start = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
const event = { ...baseEvent, created_at: baseEvent.created_at + i };
wasmFinalize(event, secretKey);
}
const end = performance.now();
const time = end - start;
console.log(`WASM time: ${time.toFixed(2)}ms (${(ITERATIONS/time*1000).toFixed(2)} ops/sec)`);
}
}
main().catch(console.error);
-45
View File
@@ -1,45 +0,0 @@
import { createExploreDiversitySorter } from "../js/feedEngine/sorters.js";
const NUM_ITEMS = 1000; // Large enough to see the difference between N^3 and N^2
const TAG_POOL = ["cats", "dogs", "nostr", "bitcoin", "art", "music", "news", "tech", "coding", "python", "javascript", "react", "vue", "angular", "svelte", "deno", "node", "linux", "macos", "windows"];
function randomTags() {
const count = Math.floor(Math.random() * 5) + 1;
const tags = new Set();
while (tags.size < count) {
tags.add(TAG_POOL[Math.floor(Math.random() * TAG_POOL.length)]);
}
return Array.from(tags).map(t => ["t", t]);
}
function buildItem(i) {
return {
video: {
id: `vid-${i}`,
tags: randomTags(),
rootCreatedAt: 1000 + i,
},
metadata: {
exploreScore: Math.random(),
},
};
}
async function runBenchmark() {
const items = [];
for (let i = 0; i < NUM_ITEMS; i++) {
items.push(buildItem(i));
}
const sorter = createExploreDiversitySorter({ lambda: 0.7 });
console.log(`Sorting ${NUM_ITEMS} items...`);
const start = performance.now();
await sorter(items, { addWhy: () => {} });
const end = performance.now();
console.log(`Time: ${(end - start).toFixed(2)}ms`);
}
runBenchmark();
-58
View File
@@ -1,58 +0,0 @@
import { createChronologicalSorter } from "../js/feedEngine/sorters.js";
import { performance } from "perf_hooks";
const NUM_ITEMS = 100000;
function buildItem(i) {
return {
video: {
id: `vid-${i}`,
rootCreatedAt: 1000 + i,
},
metadata: {},
};
}
async function runBenchmark() {
const items = [];
for (let i = 0; i < NUM_ITEMS; i++) {
items.push(buildItem(i));
}
// Mock context with hooks to trigger the candidate lookup loop
const context = {
hooks: {
timestamps: {
getKnownVideoPostedAt: () => null,
getKnownPostedAt: () => null,
getVideoPostedAt: () => null,
resolveVideoPostedAt: () => null,
}
}
};
const sorter = createChronologicalSorter({ direction: "desc" });
console.log(`Sorting ${NUM_ITEMS} items with hooks...`);
const iterations = 20; // Increased iterations for stability
let totalTime = 0;
// Warmup
for (let i = 0; i < 5; i++) sorter(items, context);
for (let i = 0; i < iterations; i++) {
const start = performance.now();
sorter(items, context);
const end = performance.now();
totalTime += (end - start);
if (i % 5 === 0) process.stdout.write(".");
}
const avgTime = totalTime / iterations;
console.log("\n");
console.log(`Average time per sort: ${avgTime.toFixed(2)}ms`);
}
runBenchmark();
-69
View File
@@ -1,69 +0,0 @@
import { createWatchHistoryManager } from "../js/nostr/watchHistory.js";
async function main() {
console.log("Starting WatchHistoryManager benchmark...");
// Mock dependencies
const mockSigner = {
signEvent: async (event) => {
// Simulate signing latency
await new Promise(resolve => setTimeout(resolve, 10));
return { ...event, sig: "mock-sig" };
},
nip04Encrypt: async (pubkey, plaintext) => {
await new Promise(resolve => setTimeout(resolve, 5));
return "mock-ciphertext";
}
};
const mockPool = {
publish: (relays, event) => {
return {
on: (status, cb) => {
if (status === 'ok') {
// Simulate network latency
setTimeout(cb, 50);
}
}
}
}
};
const deps = {
ensureNostrTools: async () => ({
nip04: { encrypt: async () => "encrypted" },
utils: { hexToBytes: () => new Uint8Array(32) }
}),
getCachedNostrTools: () => ({
nip04: { encrypt: async () => "encrypted" },
utils: { hexToBytes: () => new Uint8Array(32) }
}),
getActivePubkey: () => "00".repeat(32),
getSessionActor: () => null,
resolveActiveSigner: () => mockSigner,
getPool: () => mockPool,
signEventWithPrivateKey: async () => {
await new Promise(resolve => setTimeout(resolve, 10));
return { sig: "mock-sig" };
},
shouldRequestExtensionPermissions: () => false,
};
const manager = createWatchHistoryManager(deps);
// Create records for 12 months
const records = {};
for (let i = 1; i <= 12; i++) {
const month = `2023-${String(i).padStart(2, '0')}`;
records[month] = [{ type: 'e', value: `item-${i}`, watchedAt: 1672531200 + i * 100 }];
}
const start = Date.now();
await manager.publishRecords(records, { actorPubkey: "00".repeat(32) });
const duration = Date.now() - start;
console.log(`Published 12 months in ${duration}ms`);
}
main().catch(console.error);
@@ -1,100 +0,0 @@
import { Worker } from "worker_threads";
import { performance } from "perf_hooks";
const WORKER_CODE = `
const { parentPort } = require('worker_threads');
parentPort.on('message', (data) => {
parentPort.postMessage('pong');
});
`;
// Implementation of toLightweightVideo to verify performance
function toLightweightVideo(video) {
if (!video || typeof video !== "object") {
return null;
}
const lightweight = {
id: video.id,
kind: video.kind,
pubkey: video.pubkey,
nip71: video.nip71,
tags: [],
};
if (Array.isArray(video.tags)) {
for (const t of video.tags) {
if (Array.isArray(t) && t.length >= 2) {
const type = t[0];
if (type === "d" || type === "t") {
lightweight.tags.push(t);
}
}
}
}
return lightweight;
}
async function runBenchmark() {
const worker = new Worker(WORKER_CODE, { eval: true });
// Create a large list of full video objects
const listSize = 10000;
const fullVideos = [];
for (let i = 0; i < listSize; i++) {
fullVideos.push({
id: `key-${i}`,
content: "some content ".repeat(20), // ~200 chars
tags: [["t", "tag1"], ["t", "tag2"], ["p", "pubkey"], ["d", "identifier"], ["zap", "zapdata"]],
created_at: Date.now(),
pubkey: "some-pubkey",
sig: "some-sig",
kind: 30078,
nip71: { hashtags: ["tag3"], t: ["tag4"] },
relays: ["wss://relay1", "wss://relay2"],
otherBigField: "x".repeat(100),
});
}
console.log(`List size: ${listSize}`);
// Warmup
await new Promise((resolve) => {
worker.once('message', resolve);
worker.postMessage({ type: 'ping', payload: [] });
});
// Measure Full Transfer
let start = performance.now();
for (let i = 0; i < 10; i++) {
await new Promise((resolve) => {
worker.once('message', resolve);
worker.postMessage({ type: 'ping', payload: fullVideos });
});
}
let end = performance.now();
const fullTime = (end - start);
console.log(`Full Transfer (10 runs): ${fullTime.toFixed(2)}ms`);
// Measure Lightweight Transfer (using helper)
start = performance.now();
for (let i = 0; i < 10; i++) {
const lightweightVideos = fullVideos.map(toLightweightVideo);
await new Promise((resolve) => {
worker.once('message', resolve);
worker.postMessage({ type: 'ping', payload: lightweightVideos });
});
}
end = performance.now();
const lightTime = (end - start);
console.log(`Lightweight Transfer + Map Overhead (10 runs): ${lightTime.toFixed(2)}ms`);
const improvement = ((fullTime - lightTime) / fullTime) * 100;
console.log(`Improvement: ${improvement.toFixed(2)}%`);
worker.terminate();
}
runBenchmark().catch(console.error);
-17
View File
@@ -1,17 +0,0 @@
const fs = require('fs');
const content = fs.readFileSync('file_size.log', 'utf8');
const lines = content.split('\n');
let totalExcess = 0;
let count = 0;
lines.forEach(line => {
const match = line.match(/\((\d+) lines\)/);
if (match) {
const lines = parseInt(match[1], 10);
if (lines > 1000) {
totalExcess += (lines - 1000);
count++;
}
}
});
console.log('Count:', count);
console.log('Total Excess:', totalExcess);
-17
View File
@@ -1,17 +0,0 @@
import { readFileSync } from 'node:fs';
const content = readFileSync('file_size.log', 'utf8');
const lines = content.split('\n');
let totalExcess = 0;
let count = 0;
lines.forEach(line => {
const match = line.match(/\((\d+) lines\)/);
if (match) {
const lines = parseInt(match[1], 10);
if (lines > 1000) {
totalExcess += (lines - 1000);
count++;
}
}
});
console.log('Count:', count);
console.log('Total Excess:', totalExcess);
-108
View File
@@ -1,108 +0,0 @@
<div
id="dmSettingsModal"
class="bv-modal hidden"
role="dialog"
aria-modal="true"
aria-labelledby="dmSettingsTitle"
tabindex="-1"
data-ds="new"
>
<div class="bv-modal-backdrop"></div>
<div
class="bv-modal__panel w-full max-w-2xl h-auto max-h-modal-shell rounded-xl border border-border/50 bg-surface shadow-2xl overflow-hidden flex flex-col"
tabindex="-1"
>
<!-- Modal Header -->
<div class="modal-header border-b border-border/60 p-4 flex items-center justify-between bg-surface-2">
<h2 id="dmSettingsTitle" class="text-lg font-bold text-text">DM Settings</h2>
<button id="closeDmSettingsModal" class="modal-close btn-ghost btn-icon p-1 rounded-md text-muted hover:text-text focus-ring">
<svg
xmlns="http://www.w3.org/2000/svg"
class="h-6 w-6"
fill="none"
viewBox="0 0 24 24"
stroke="currentColor"
>
<path
stroke-linecap="round"
stroke-linejoin="round"
stroke-width="2"
d="M6 18L18 6M6 6l12 12"
/>
</svg>
</button>
</div>
<!-- Modal Body -->
<div class="flex-1 overflow-y-auto p-6 space-y-8 bg-surface">
<!-- Privacy Settings -->
<section class="space-y-4">
<h3 class="text-base font-semibold text-text">Privacy</h3>
<div class="card p-4 space-y-4">
<label class="flex items-center justify-between gap-3 cursor-pointer">
<div class="space-y-1">
<span class="block text-sm font-medium text-text">Read receipts</span>
<span class="block text-xs text-muted">Let others know when you’ve seen their messages.</span>
</div>
<input type="checkbox" id="dmSettingsReadReceipts" class="toggle" />
</label>
<div class="h-px bg-border/40"></div>
<label class="flex items-center justify-between gap-3 cursor-pointer">
<div class="space-y-1">
<span class="block text-sm font-medium text-text">Typing indicators</span>
<span class="block text-xs text-muted">Show when you’re typing a message.</span>
</div>
<input type="checkbox" id="dmSettingsTypingIndicators" class="toggle" />
</label>
</div>
</section>
<!-- Relay Hints -->
<section class="space-y-4">
<div class="space-y-1">
<h3 class="text-base font-semibold text-text">NIP-17 Relay List</h3>
<p class="text-sm text-muted">
Publish your NIP-17 relay list for direct messages as <span class="font-medium">kind:10050</span> events. Use WSS-only relay URLs so encrypted DM delivery stays secure.
</p>
</div>
<div class="card p-5 space-y-5">
<div class="flex flex-col gap-3 sm:flex-row sm:items-end">
<label class="flex-1 text-sm text-muted-strong" for="dmSettingsRelayInput">
<span class="mb-2 block font-medium">Add a NIP-17 relay</span>
<input
id="dmSettingsRelayInput"
type="text"
inputmode="url"
autocomplete="off"
class="input"
placeholder="wss://relay.example.com"
/>
</label>
<button id="dmSettingsRelayAddBtn" type="button" class="btn focus-ring">
Add relay
</button>
</div>
<div class="space-y-2">
<div class="flex items-center justify-between">
<span class="text-xs font-medium text-muted-strong uppercase tracking-wider">Your list</span>
</div>
<ul id="dmSettingsRelayList" class="grid-stack space-y-2" data-orientation="vertical"></ul>
<p id="dmSettingsRelayEmpty" class="text-sm text-muted italic hidden">No NIP-17 relays configured.</p>
</div>
<div class="flex flex-wrap items-center justify-between gap-3 pt-2 border-t border-border/40">
<span id="dmSettingsRelayStatus" class="text-xs text-muted" role="status" aria-live="polite"></span>
<button id="dmSettingsRelayPublishBtn" type="button" class="btn-ghost focus-ring text-xs">
Publish relay list
</button>
</div>
</div>
</section>
</div>
</div>
</div>
+570 -54
View File
@@ -57,14 +57,492 @@
</div>
</div>
<!-- Hashtags (kept from the old NIP-71 section: they feed bitvid's hashtag
feeds and the NIP-71 mirror; everything else in that section fed the
disabled FEATURE_PUBLISH_NIP71 path and was removed for a cleaner UI.
Existing videos' extra NIP-71 metadata is preserved on save. -->
<div class="space-y-4 rounded-lg border border-border/70 bg-overlay-black/30 p-4">
<!-- NOTE: Keep this NIP-71 markup in sync with the upload and revert modals. -->
<div
class="space-y-4 rounded-lg border border-border/70 bg-overlay-black/30 p-4"
id="editNip71EventDetails"
data-nip71-section="event-details"
>
<fieldset
id="editNip71KindFieldset"
class="space-y-2"
data-nip71-fieldset="kind"
>
<legend class="text-sm font-semibold text-text">
NIP-71 event type
</legend>
<p class="text-xs text-muted">
Choose the video format. <span class="font-medium text-muted-strong">Kind 21</span> is a full video, while
<span class="font-medium text-muted-strong">Kind 22</span> is a short.
</p>
<div
class="form-control"
role="radiogroup"
aria-labelledby="editNip71KindFieldset"
>
<div class="menu sm:flex-row sm:flex-wrap sm:py-0" role="presentation">
<label class="menu__item gap-3 px-0 py-0" for="editNip71KindLong">
<input
type="radio"
name="editNip71Kind"
id="editNip71KindLong"
value="21"
checked
data-nip71-input="kind"
class="h-4 w-4 border-border bg-panel text-info focus:ring-info"
/>
<span class="text-sm text-text">Normal video (kind 21)</span>
</label>
<label class="menu__item gap-3 px-0 py-0" for="editNip71KindShort">
<input
type="radio"
name="editNip71Kind"
id="editNip71KindShort"
value="22"
data-nip71-input="kind"
class="h-4 w-4 border-border bg-panel text-info focus:ring-info"
/>
<span class="text-sm text-text">Short video (kind 22)</span>
</label>
</div>
</div>
</fieldset>
<div class="grid gap-4 md:grid-cols-2" data-nip71-grid="metadata">
<div class="space-y-2">
<label for="editNip71PublishedAt" class="block text-sm font-medium text-text">
Published at
</label>
<input
type="datetime-local"
id="editNip71PublishedAt"
data-nip71-input="published_at"
class="input"
/>
<p class="text-xs text-muted">
Set the canonical publish time for cross-client ordering.
</p>
</div>
<div class="space-y-2">
<label for="editNip71AltText" class="block text-sm font-medium text-text">
Alt text
</label>
<input
type="text"
id="editNip71AltText"
data-nip71-input="alt"
placeholder="Describe the visuals for screen readers"
class="input"
/>
<p class="text-xs text-muted">
Plain-language fallback shown when the media cannot load.
</p>
</div>
<div class="space-y-2">
<label for="editNip71Duration" class="block text-sm font-medium text-text">
Duration (seconds)
</label>
<input
type="number"
id="editNip71Duration"
min="0"
step="0.001"
data-nip71-input="duration"
class="input"
/>
<p class="text-xs text-muted">
Optional legacy fallback in seconds (fractions allowed) for clients that expect a top-level duration.
</p>
</div>
<div class="space-y-2">
<label for="editNip71ContentWarning" class="block text-sm font-medium text-text">
Content warning
</label>
<input
type="text"
id="editNip71ContentWarning"
data-nip71-input="content-warning"
placeholder="e.g., Flashing lights"
class="input"
/>
<p class="text-xs text-muted">
Leave blank if the video is safe for all audiences.
</p>
</div>
</div>
<div class="space-y-2">
<label for="editNip71Summary" class="block text-sm font-medium text-text">
Summary
</label>
<textarea
id="editNip71Summary"
rows="3"
data-nip71-input="summary"
class="textarea"
placeholder="Short synopsis used as the Nostr content field"
></textarea>
<p class="text-xs text-muted">
This becomes the event content. Keep it concise for Nostr readers.
</p>
</div>
</div>
<fieldset
id="editNip71TagsFieldset"
class="space-y-6 rounded-lg border border-border/70 bg-overlay-black/30 p-4"
data-nip71-section="tags"
>
<legend class="relative text-sm font-semibold text-text">
<span class="inline-block -ml-2 rounded px-2 bg-overlay-black/30">NIP-71 tags</span>
</legend>
<p class="text-xs text-muted">
Use the controls below to describe media variants, captions, chapters, participants, and references.
</p>
<section class="space-y-4" aria-labelledby="editNip71ImetaLabel" data-nip71-repeater="imeta">
<div class="flex items-center justify-between">
<h3 id="editNip71ImetaLabel" class="text-sm font-medium text-text">Image metadata (imeta)</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
data-nip71-add="imeta"
aria-describedby="editNip71ImetaHelp"
>
Add variant
</button>
</div>
<p id="editNip71ImetaHelp" class="text-xs text-muted">
Provide dimensions, MIME type, and resource links for each variant. Nested repeaters let you attach multiple
<code>image</code>, <code>fallback</code>, or <code>service</code> values.
</p>
<div id="editNip71ImetaList" class="space-y-4" data-nip71-list="imeta"></div>
<template id="editNip71ImetaTemplate" data-nip71-template="imeta">
<article class="card space-y-3 bg-surface/60 p-4" data-nip71-entry="imeta">
<div class="grid gap-3 md:grid-cols-2">
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
MIME type (<code>m</code>)
</label>
<input
type="text"
data-nip71-field="m"
placeholder="video/mp4"
class="input"
/>
<p class="text-3xs text-muted">RFC 2046 media type for this encoding.</p>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
Pixel dimensions (<code>dim</code>)
</label>
<input
type="text"
data-nip71-field="dim"
placeholder="1920x1080"
class="input"
/>
<p class="text-3xs text-muted">Formatted as widthxheight.</p>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
Streaming URL (<code>url</code>)
</label>
<input
type="url"
data-nip71-field="url"
placeholder="https://cdn.example.com/variant.m3u8"
class="input"
/>
<p class="text-3xs text-muted">HTTPS variant URL shared across clients.</p>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
Magnet (<code>x</code>)
</label>
<input
type="text"
data-nip71-field="x"
placeholder="magnet:?xt=urn:btih:..."
class="input"
/>
<p class="text-3xs text-muted">Optional magnet pointer if the variant is seeded via P2P.</p>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
Duration seconds (<code>duration</code>)
</label>
<input
type="number"
data-nip71-field="duration"
min="0"
step="0.001"
placeholder="29.97"
class="input"
/>
<p class="text-3xs text-muted">Fractional seconds supported; clients use this for precise timelines.</p>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">
Bitrate bps (<code>bitrate</code>)
</label>
<input
type="number"
data-nip71-field="bitrate"
min="0"
step="1"
placeholder="3500000"
class="input"
/>
<p class="text-3xs text-muted">Average bits per second for this variant.</p>
</div>
</div>
<div class="space-y-3" data-nip71-nested="image">
<div class="flex items-center justify-between">
<h4 class="text-xs font-semibold uppercase tracking-wide text-muted">Image values</h4>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-nested-add="image"
>
Add image URL
</button>
</div>
<div class="space-y-2" data-nip71-nested-list="image"></div>
<template data-nip71-nested-template="image">
<div class="flex items-center gap-2" data-nip71-nested-entry="image">
<input
type="url"
placeholder="https://cdn.example.com/poster.jpg"
data-nip71-nested-field="image"
class="flex-1 input"
/>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="nested"
aria-label="Remove image URL"
>
Remove
</button>
</div>
</template>
</div>
<div class="space-y-3" data-nip71-nested="fallback">
<div class="flex items-center justify-between">
<h4 class="text-xs font-semibold uppercase tracking-wide text-muted">Fallback URLs</h4>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-nested-add="fallback"
>
Add fallback
</button>
</div>
<div class="space-y-2" data-nip71-nested-list="fallback"></div>
<template data-nip71-nested-template="fallback">
<div class="flex items-center gap-2" data-nip71-nested-entry="fallback">
<input
type="url"
placeholder="https://cdn.backup.net/video.mp4"
data-nip71-nested-field="fallback"
class="flex-1 input"
/>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="nested"
aria-label="Remove fallback URL"
>
Remove
</button>
</div>
</template>
</div>
<div class="space-y-3" data-nip71-nested="service">
<div class="flex items-center justify-between">
<h4 class="text-xs font-semibold uppercase tracking-wide text-muted">Services</h4>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-nested-add="service"
>
Add service
</button>
</div>
<div class="space-y-2" data-nip71-nested-list="service"></div>
<template data-nip71-nested-template="service">
<div class="flex items-center gap-2" data-nip71-nested-entry="service">
<input
type="text"
placeholder="https://api.example.com"
data-nip71-nested-field="service"
class="flex-1 input"
/>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="nested"
aria-label="Remove service entry"
>
Remove
</button>
</div>
</template>
</div>
<div class="flex justify-end">
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="imeta"
>
Remove variant
</button>
</div>
</article>
</template>
</section>
<section class="space-y-4" aria-labelledby="editNip71TextTracksLabel" data-nip71-repeater="text-track">
<div class="flex items-center justify-between">
<h3 id="editNip71TextTracksLabel" class="text-sm font-medium text-text">
Caption &amp; subtitle tracks (text-track)
</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
data-nip71-add="text-track"
aria-describedby="editNip71TextTracksHelp"
>
Add track
</button>
</div>
<p id="editNip71TextTracksHelp" class="text-xs text-muted">
Supply caption or subtitle URLs along with file type and language so players can surface accessibility features.
</p>
<div id="editNip71TextTrackList" class="space-y-4" data-nip71-list="text-track"></div>
<template id="editNip71TextTrackTemplate" data-nip71-template="text-track">
<article class="card space-y-3 bg-surface/60 p-4" data-nip71-entry="text-track">
<div class="grid gap-3 md:grid-cols-3">
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Track URL</label>
<input
type="url"
data-nip71-field="url"
placeholder="https://cdn.example.com/subs.vtt"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Type</label>
<input
type="text"
data-nip71-field="type"
placeholder="text/vtt"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Language</label>
<input
type="text"
data-nip71-field="language"
placeholder="en"
class="input"
/>
</div>
</div>
<div class="flex justify-end">
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="text-track"
>
Remove track
</button>
</div>
</article>
</template>
</section>
<section class="space-y-4" aria-labelledby="editNip71SegmentsLabel" data-nip71-repeater="segment">
<div class="flex items-center justify-between">
<h3 id="editNip71SegmentsLabel" class="text-sm font-medium text-text">Chapters &amp; segments (segment)</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
data-nip71-add="segment"
aria-describedby="editNip71SegmentsHelp"
>
Add segment
</button>
</div>
<p id="editNip71SegmentsHelp" class="text-xs text-muted">
Outline chapters with start and end times, titles, and optional thumbnails.
</p>
<div id="editNip71SegmentList" class="space-y-4" data-nip71-list="segment"></div>
<template id="editNip71SegmentTemplate" data-nip71-template="segment">
<article class="card space-y-3 bg-surface/60 p-4" data-nip71-entry="segment">
<div class="grid gap-3 md:grid-cols-2">
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Start (seconds)</label>
<input
type="number"
data-nip71-field="start"
min="0"
step="1"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">End (seconds)</label>
<input
type="number"
data-nip71-field="end"
min="0"
step="1"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Title</label>
<input
type="text"
data-nip71-field="title"
placeholder="Chapter title"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Thumbnail URL</label>
<input
type="url"
data-nip71-field="thumbnail"
placeholder="https://cdn.example.com/frame.jpg"
class="input"
/>
</div>
</div>
<div class="flex justify-end">
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="segment"
>
Remove segment
</button>
</div>
</article>
</template>
</section>
<section class="space-y-4" aria-labelledby="editNip71HashtagsLabel" data-nip71-repeater="t">
<div class="flex items-center justify-between">
<h3 id="editNip71HashtagsLabel" class="text-sm font-medium text-text">Hashtags</h3>
<h3 id="editNip71HashtagsLabel" class="text-sm font-medium text-text">Hashtags (<code>t</code>)</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
@@ -74,7 +552,7 @@
</button>
</div>
<p class="text-xs text-muted">
Tag your video so it shows up in hashtag feeds. Leading <code>#</code> characters are stripped automatically.
Enter keywords; leading <code>#</code> characters are stripped automatically when saving.
</p>
<div id="editNip71HashtagList" class="space-y-2" data-nip71-list="t"></div>
<template id="editNip71HashtagTemplate" data-nip71-template="t">
@@ -95,7 +573,85 @@
</div>
</template>
</section>
</div>
<section class="space-y-4" aria-labelledby="editNip71ParticipantsLabel" data-nip71-repeater="p">
<div class="flex items-center justify-between">
<h3 id="editNip71ParticipantsLabel" class="text-sm font-medium text-text">Participants (<code>p</code>)</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
data-nip71-add="p"
>
Add participant
</button>
</div>
<div id="editNip71ParticipantList" class="space-y-3" data-nip71-list="p"></div>
<template id="editNip71ParticipantTemplate" data-nip71-template="p">
<article class="card space-y-3 bg-surface/60 p-4" data-nip71-entry="p">
<div class="grid gap-3 md:grid-cols-2">
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Participant pubkey</label>
<input
type="text"
data-nip71-field="pubkey"
placeholder="npub1... or hex"
class="input"
/>
</div>
<div class="space-y-2">
<label class="block text-xs font-medium text-muted-strong">Relay hint</label>
<input
type="text"
data-nip71-field="relay"
placeholder="wss://relay.example.com"
class="input"
/>
</div>
</div>
<div class="flex justify-end">
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="p"
>
Remove participant
</button>
</div>
</article>
</template>
</section>
<section class="space-y-4" aria-labelledby="editNip71ReferencesLabel" data-nip71-repeater="r">
<div class="flex items-center justify-between">
<h3 id="editNip71ReferencesLabel" class="text-sm font-medium text-text">Reference links (<code>r</code>)</h3>
<button
type="button"
class="btn-ghost focus-ring text-xs font-semibold"
data-nip71-add="r"
>
Add reference
</button>
</div>
<div id="editNip71ReferenceList" class="space-y-2" data-nip71-list="r"></div>
<template id="editNip71ReferenceTemplate" data-nip71-template="r">
<div class="flex items-center gap-2" data-nip71-entry="r">
<input
type="url"
data-nip71-field="url"
placeholder="https://example.com/context"
class="flex-1 input"
/>
<button
type="button"
class="btn-ghost focus-ring text-3xs font-medium"
data-nip71-remove="r"
>
Remove
</button>
</div>
</template>
</section>
</fieldset>
<div class="space-y-1">
<label for="editVideoUrl" class="block text-sm font-medium text-text">
@@ -116,39 +672,19 @@
Edit field
</button>
</div>
<div class="flex items-center gap-2 flex-wrap">
<input type="file" id="editVideoFile" accept="video/*" class="hidden" />
<button
type="button"
id="editVideoFileBtn"
class="btn-ghost focus-ring text-xs"
>
Replace video file…
</button>
<p
id="editVideoUploadStatus"
class="text-2xs text-muted empty:hidden"
role="status"
aria-live="polite"
></p>
</div>
<p class="text-xs text-muted">
Uploading a new file replaces the URL, magnet, and torrent hints.
Requires unlocked storage.
</p>
</div>
<div class="space-y-1">
<label for="editVideoWs" class="block text-sm font-medium text-text">
Web seeds (ws=, one per line)
Web seed (ws=)
</label>
<div class="flex flex-col gap-2 sm:flex-row">
<textarea
<input
type="url"
id="editVideoWs"
rows="2"
class="flex-1 textarea"
placeholder="https://cdn.example.com/video.mp4&#10;https://backup.example.com/video.mp4"
></textarea>
class="flex-1 input"
placeholder="https://cdn.example.com/video.mp4"
/>
<button
type="button"
class="btn-ghost focus-ring hidden text-xs font-semibold uppercase tracking-wide"
@@ -157,10 +693,6 @@
Edit field
</button>
</div>
<p class="text-xs text-muted">
Add a backup origin so the swarm keeps streaming if the primary is
overloaded. Each must serve the exact same file.
</p>
</div>
<div class="space-y-1">
@@ -224,22 +756,6 @@
Edit field
</button>
</div>
<div class="flex items-center gap-2 flex-wrap">
<input type="file" id="editThumbnailFile" accept="image/*" class="hidden" />
<button
type="button"
id="editThumbnailFileBtn"
class="btn-ghost focus-ring text-xs"
>
Replace thumbnail file…
</button>
<p
id="editThumbnailUploadStatus"
class="text-2xs text-muted empty:hidden"
role="status"
aria-live="polite"
></p>
</div>
</div>
<div class="space-y-1">
@@ -9,8 +9,6 @@
<link rel="stylesheet" href="../../css/tailwind.generated.css" />
<!-- Load nostr‑tools v2.17.0 -->
<script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/nostr.bundle.min.js"></script>
<!-- Shared anti-spam npub validation (sets window.validateNpubHex) -->
<script type="module" src="../../js/utils/validateNpub.js"></script>
</head>
<body class="iframe-form" data-ds="new">
<div class="container">
@@ -279,12 +277,11 @@
// Set the recipient's NPUB (your personal NPUB) here.
const recipientNpub =
"npub15jnttpymeytm80hatjqcvhhqhzrhx6gxp8pq0wn93rhnu8s9h9dsha32lx";
"npub13yarr7j6vjqjjkahd63dmr27curypehx45ucue286ac7sft27y0srnpmpe";
const RELAYS = [
"wss://relay.snort.social",
"wss://relay.damus.io",
"wss://relay.primal.net",
"wss://nos.lol",
];
const pool = new SimplePool();
@@ -298,21 +295,6 @@
const applicantNpub = document
.getElementById("applicantNpub")
.value.trim();
// Anti-spam: the application identifier must be a valid npub.
const applicantPubHex =
typeof window.validateNpubHex === "function"
? window.validateNpubHex(applicantNpub)
: null;
if (!applicantPubHex) {
log(
"Please enter a valid Nostr public key (npub1…) before submitting. Your application was not sent.",
"error"
);
document.getElementById("applicantNpub")?.focus();
return;
}
const contactMethod = document
.getElementById("contactMethod")
.value.trim();
@@ -371,7 +353,6 @@
**1. Applicant Information**
- **Nostr Public Key (npub):** ${applicantNpub}
- **Pubkey (hex):** ${applicantPubHex}
- **Preferred Contact Method:** ${contactMethod || "N/A"}
- **Username or Alias:** ${username || "N/A"}
@@ -438,27 +419,23 @@ For further questions, contact us through bitvid’s Nostr support channels.
const ephemeralPubHex = getPublicKey(ephemeralPriv);
log("Ephemeral pubkey: " + ephemeralPubHex.slice(0, 16) + "...");
// Build a structured bitvid submission (kind 30083, PUBLIC — no
// encryption). Published from the ephemeral key; the admin's
// Submissions tab lists these and can approve → add to whitelist.
// Encrypt the application content.
log("Encrypting application content (nip04)...");
const ciphertext = await nip04.encrypt(
ephemeralPriv,
targetPubHex,
applicationContent
);
log("[DEBUG] Ciphertext: " + ciphertext);
log("Encryption done.");
// Build the Nostr event template.
const now = Math.floor(Date.now() / 1000);
const submissionId =
"sub-" +
now.toString(36) +
"-" +
Math.random().toString(36).slice(2, 10);
const eventTemplate = {
kind: 30083,
kind: 4,
created_at: now,
tags: [
["d", submissionId],
["k", "application"],
["applicant", applicantNpub],
["p", targetPubHex],
["t", "bitvid-submission"],
["client", "bitvid"],
],
content: applicationContent,
tags: [["p", targetPubHex]],
content: ciphertext,
};
log(
"[DEBUG] Event template before finalizing: " +
@@ -478,7 +455,7 @@ For further questions, contact us through bitvid’s Nostr support channels.
for (const url of RELAYS) {
log("Connecting to " + url + " for subscription...");
const relay = await Relay.connect(url);
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [30083] }], {
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [4] }], {
onEvent(foundEvent) {
if (foundEvent.id === event.id) {
log(
@@ -8,8 +8,6 @@
<link rel="stylesheet" href="../../css/tailwind.generated.css" />
<!-- Load nostr‑tools v2.17.0 -->
<script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/nostr.bundle.min.js"></script>
<!-- Shared anti-spam npub validation (sets window.validateNpubHex) -->
<script type="module" src="../../js/utils/validateNpub.js"></script>
</head>
<body class="iframe-form" data-ds="new">
<div class="container">
@@ -261,12 +259,11 @@
// Set the recipient's NPUB (your personal NPUB)
const recipientNpub =
"npub15jnttpymeytm80hatjqcvhhqhzrhx6gxp8pq0wn93rhnu8s9h9dsha32lx";
"npub13yarr7j6vjqjjkahd63dmr27curypehx45ucue286ac7sft27y0srnpmpe";
const RELAYS = [
"wss://relay.snort.social",
"wss://relay.damus.io",
"wss://relay.primal.net",
"wss://nos.lol",
];
const pool = new SimplePool();
@@ -278,22 +275,6 @@
try {
// Section 1: User Information
const userNpub = document.getElementById("userNpub").value.trim();
// Anti-spam: npub is optional here, but if provided it must be a
// valid npub so the submission can't carry free-text garbage.
if (
userNpub &&
(typeof window.validateNpubHex !== "function" ||
!window.validateNpubHex(userNpub))
) {
log(
"That Nostr public key isn't valid. Enter a valid npub1… or leave it blank. Your submission was not sent.",
"error"
);
document.getElementById("userNpub")?.focus();
return;
}
const roleNodes = document.querySelectorAll(
'input[name="userRole"]:checked'
);
@@ -418,31 +399,23 @@ For urgent issues, contact us through bitvid’s Nostr support channels.
const ephemeralPubHex = getPublicKey(ephemeralPriv);
log("Ephemeral pubkey: " + ephemeralPubHex.slice(0, 16) + "...");
// Build a structured bitvid submission (kind 30083, PUBLIC — no
// encryption). Published from the ephemeral key.
const now = Math.floor(Date.now() / 1000);
const submissionId =
"sub-" +
now.toString(36) +
"-" +
Math.random().toString(36).slice(2, 10);
const tags = [
["d", submissionId],
["k", "bug"],
];
if (userNpub) {
tags.push(["applicant", userNpub]);
}
tags.push(
["p", targetPubHex],
["t", "bitvid-submission"],
["client", "bitvid"]
// Encrypt the bug report content.
log("Encrypting bug report content (nip04)...");
const ciphertext = await nip04.encrypt(
ephemeralPriv,
targetPubHex,
bugReportContent
);
log("[DEBUG] Ciphertext: " + ciphertext);
log("Encryption done.");
// Build the event template.
const now = Math.floor(Date.now() / 1000);
const eventTemplate = {
kind: 30083,
kind: 4,
created_at: now,
tags,
content: bugReportContent,
tags: [["p", targetPubHex]],
content: ciphertext,
};
log(
"[DEBUG] Event template before finalizing: " +
@@ -462,7 +435,7 @@ For urgent issues, contact us through bitvid’s Nostr support channels.
for (const url of RELAYS) {
log("Connecting to " + url + " for subscription...");
const relay = await Relay.connect(url);
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [30083] }], {
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [4] }], {
onEvent(foundEvent) {
if (foundEvent.id === event.id) {
log(
@@ -45,18 +45,6 @@
placeholder="Enter the magnet link"
/>
<label for="eventPointer">Blocked video link or event ID:</label>
<input
class="form-control"
type="text"
id="eventPointer"
placeholder="Paste the video's share link, nevent1…, note1…, or 64-char event id"
/>
<p class="form-hint">
Required — open the blocked video's ⋯ menu, choose “Copy link”, and
paste it here so a moderator can locate and unblock the exact video.
</p>
<label for="submissionDate">Date of Content Submission:</label>
<input class="form-control" type="date" id="submissionDate" />
@@ -205,46 +193,15 @@
// Set the recipient's NPUB (your personal NPUB) here.
const recipientNpub =
"npub15jnttpymeytm80hatjqcvhhqhzrhx6gxp8pq0wn93rhnu8s9h9dsha32lx";
"npub13yarr7j6vjqjjkahd63dmr27curypehx45ucue286ac7sft27y0srnpmpe";
const RELAYS = [
"wss://relay.snort.social",
"wss://relay.damus.io",
"wss://relay.primal.net",
"wss://nos.lol",
];
const pool = new SimplePool();
// Validate + normalize the blocked-video reference to a 64-char hex
// event id. Accepts a bitvid share link (which embeds an nevent), a raw
// nevent1…/note1… pointer, or a bare hex id. Returns "" when nothing
// valid is found so the caller can block submission.
const HEX_EVENT_ID = /^[0-9a-f]{64}$/i;
function extractEventHex(input) {
const trimmed = String(input || "").trim();
if (!trimmed) {
return "";
}
if (HEX_EVENT_ID.test(trimmed)) {
return trimmed.toLowerCase();
}
// Pull an nevent/note token out of a URL or free text.
const match = trimmed.match(/(nevent1[0-9a-z]+|note1[0-9a-z]+)/i);
const token = match ? match[1] : trimmed;
try {
const decoded = nip19.decode(token);
if (decoded.type === "nevent" && HEX_EVENT_ID.test(decoded.data?.id || "")) {
return decoded.data.id.toLowerCase();
}
if (decoded.type === "note" && HEX_EVENT_ID.test(decoded.data || "")) {
return decoded.data.toLowerCase();
}
} catch (err) {
// not a decodable pointer
}
return "";
}
document
.getElementById("dm-form")
.addEventListener("submit", async (ev) => {
@@ -263,17 +220,6 @@
const magnetLink = document
.getElementById("magnetLink")
.value.trim();
const eventPointer = document
.getElementById("eventPointer")
.value.trim();
const targetEventHex = extractEventHex(eventPointer);
if (!targetEventHex) {
log(
"Please paste a valid video share link, nevent1…, note1…, or 64-char event id so a moderator can locate the blocked video.",
"error"
);
return;
}
const submissionDate = document
.getElementById("submissionDate")
.value.trim();
@@ -315,7 +261,6 @@
**2. Content Details**
- **Title of the Video:** ${videoTitle}
- **Magnet Link:** ${magnetLink}
- **Blocked Event ID:** ${targetEventHex}
- **Date of Content Submission:** ${submissionDate}
**3. Reason for Appeal**
@@ -370,27 +315,23 @@ For further questions, reach out through bitvid’s Nostr support channels.
const ephemeralPubHex = getPublicKey(ephemeralPriv);
log("Ephemeral pubkey: " + ephemeralPubHex.slice(0, 16) + "...");
// Build a structured bitvid submission (kind 30083, PUBLIC — no
// encryption). Published from the ephemeral key.
log("Building appeal submission (kind 30083, public)...");
// Encrypt the appeal content.
log("Encrypting appeal content (nip04)...");
const ciphertext = await nip04.encrypt(
ephemeralPriv,
targetPubHex,
appealContent
);
log("[DEBUG] Ciphertext: " + ciphertext);
log("Encryption done.");
// Build the event template.
const now = Math.floor(Date.now() / 1000);
const submissionId =
"sub-" +
now.toString(36) +
"-" +
Math.random().toString(36).slice(2, 10);
const eventTemplate = {
kind: 30083,
kind: 4,
created_at: now,
tags: [
["d", submissionId],
["k", "appeal"],
["p", targetPubHex],
["e", targetEventHex],
["t", "bitvid-submission"],
["client", "bitvid"],
],
content: appealContent,
tags: [["p", targetPubHex]],
content: ciphertext,
};
log(
"[DEBUG] Event template before finalizing: " +
@@ -410,7 +351,7 @@ For further questions, reach out through bitvid’s Nostr support channels.
for (const url of RELAYS) {
log("Connecting to " + url + " for subscription...");
const relay = await Relay.connect(url);
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [30083] }], {
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [4] }], {
onEvent(foundEvent) {
if (foundEvent.id === event.id) {
log(
@@ -8,8 +8,6 @@
<link rel="stylesheet" href="../../css/tailwind.generated.css" />
<!-- Load nostr‑tools v2.17.0 -->
<script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/nostr.bundle.min.js"></script>
<!-- Shared anti-spam npub validation (sets window.validateNpubHex) -->
<script type="module" src="../../js/utils/validateNpub.js"></script>
</head>
<body class="iframe-form" data-ds="new">
<div class="container">
@@ -197,12 +195,11 @@
// Set the recipient's NPUB (your personal NPUB)
const recipientNpub =
"npub15jnttpymeytm80hatjqcvhhqhzrhx6gxp8pq0wn93rhnu8s9h9dsha32lx";
"npub13yarr7j6vjqjjkahd63dmr27curypehx45ucue286ac7sft27y0srnpmpe";
const RELAYS = [
"wss://relay.snort.social",
"wss://relay.damus.io",
"wss://relay.primal.net",
"wss://nos.lol",
];
const pool = new SimplePool();
@@ -215,22 +212,6 @@
try {
// Section 1: User Information
const userNpub = document.getElementById("userNpub").value.trim();
// Anti-spam: npub is optional here, but if provided it must be a
// valid npub so the submission can't carry free-text garbage.
if (
userNpub &&
(typeof window.validateNpubHex !== "function" ||
!window.validateNpubHex(userNpub))
) {
log(
"That Nostr public key isn't valid. Enter a valid npub1… or leave it blank. Your submission was not sent.",
"error"
);
document.getElementById("userNpub")?.focus();
return;
}
const roleNodes = document.querySelectorAll(
'input[name="userRole"]:checked'
);
@@ -319,31 +300,21 @@ For additional discussions, reach out via bitvid’s Nostr support channels.
// Encrypt the feedback content.
log("Encrypting feedback content (nip04)...");
// Build a structured bitvid submission (kind 30083, PUBLIC — no
// encryption). Published from the ephemeral key.
const now = Math.floor(Date.now() / 1000);
const submissionId =
"sub-" +
now.toString(36) +
"-" +
Math.random().toString(36).slice(2, 10);
const tags = [
["d", submissionId],
["k", "feedback"],
];
if (userNpub) {
tags.push(["applicant", userNpub]);
}
tags.push(
["p", targetPubHex],
["t", "bitvid-submission"],
["client", "bitvid"]
const ciphertext = await nip04.encrypt(
ephemeralPriv,
targetPubHex,
feedbackContent
);
log("[DEBUG] Ciphertext: " + ciphertext);
log("Encryption done.");
// Build the event template.
const now = Math.floor(Date.now() / 1000);
const eventTemplate = {
kind: 30083,
kind: 4,
created_at: now,
tags,
content: feedbackContent,
tags: [["p", targetPubHex]],
content: ciphertext,
};
log(
"[DEBUG] Event template before finalizing: " +
@@ -363,7 +334,7 @@ For additional discussions, reach out via bitvid’s Nostr support channels.
for (const url of RELAYS) {
log("Connecting to " + url + " for subscription...");
const relay = await Relay.connect(url);
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [30083] }], {
relay.subscribe([{ authors: [ephemeralPubHex], kinds: [4] }], {
onEvent(foundEvent) {
if (foundEvent.id === event.id) {
log(
Loaded 100 of 1697 files, more files were not shown because too many files have changed in this diff. Show more