@christianirack/brainllm-runtime 0.1.0 → 0.4.0

package/brain-router.js

@@ -13,6 +13,7 @@
 // `false` and redirects with `redirect('/login')` (thrown or returned) or a string. The server runs the same guard,
 // so a redirect it answers (fetch ends on another URL) is reflected in the address bar. A guard that throws anything
 // else → full page load: the server decides.
+import { prefetchPage } from './brain-prefetch-shared.js'
 const G = globalThis
 // Base path (<meta name="brain-base" content="/app/">, §23 #148): links in the HTML already carry it; guards and
 // routes work with app paths (strip), and app paths given to go()/navigate()/redirect() get it (app). '/' when absent.
@@ -33,7 +34,9 @@ const app = u => {
 // guards run); without a router it is a normal page load.
 let active = null
 export function navigate(to, o = {}) {
-  const u = app(String(to))
+  const raw = String(to)
+  if (/[\\\x00-\x20\x7f]/.test(raw)) throw Error('Invalid navigation target')
+  const u = app(raw)
   if (active) return active.go(u, o.replace ? 'replace' : true)
   o.replace ? location.replace(u) : location.assign(u)
 }
@@ -89,7 +92,9 @@ const outcome = v =>
 export function router(o = {}) {
   const region = o.region || 'main'
   const parse = o.parse || (h => new DOMParser().parseFromString(h, 'text/html'))
+  const fullLoad = new Set(Array.isArray(o.fullLoad) ? o.fullLoad.map(p => { try { return new URL(p, location.href).pathname.replace(/\/+$/, '') || '/' } catch { return null } }).filter(Boolean) : [])
   let seq = 0, through = null, stale = false
+  const ahead = predict(o, u => same(u, true))
   // Build signature (§35.7): the page's <meta name="brain-build">. A navigation response from another build, or the
   // service worker announcing one, turns client navigation into full loads so old and new code never mix.
   const build = () => {
@@ -97,7 +102,7 @@ export function router(o = {}) {
     return m ? m.getAttribute('content') : null
   }
   const sw = G.navigator && navigator.serviceWorker
-  const onMsg = e => typeof e.data === 'string' && e.data.startsWith('brain:build ') && build() && e.data.slice(12) !== build() && (stale = true)
+  const onMsg = e => typeof e.data === 'string' && e.data.startsWith('brain:build ') && build() && e.data.slice(12) !== build() && (stale = true, ahead.stop())
   if (sw && sw.addEventListener) sw.addEventListener('message', onMsg)
   // a guard is a function, or the URL of its `_guard.jsbrain` chunk (BUILD #220): loaded the first time a navigation
   // reaches that folder, then cached by the module map; its default export runs with the same ctx
@@ -110,24 +115,30 @@ export function router(o = {}) {
     const url = new URL(u, location.href), path = strip(url.pathname) // guards see app paths (no base)
     for (const [pre, g] of gs) {
       if (!(path === pre || path.startsWith(pre.endsWith('/') ? pre : pre + '/'))) continue
-      let v
+      // The browser has no session (the cookie is HttpOnly): a guard that reads ctx.user cannot decide here. If it would
+      // stop the navigation, the server decides on a full load instead (F12b: `ctx.user ? true : redirect('/login')`
+      // used to send a signed-in user to /login on every client navigation).
+      let v, asked = false
+      const ctx = { url, path, query: Object.fromEntries(url.searchParams) }
+      Object.defineProperty(ctx, 'user', { enumerable: true, get: () => ((asked = true), undefined) })
       try {
-        v = await g({ url, path, query: Object.fromEntries(url.searchParams) })
+        v = await g(ctx)
       } catch (e) {
+        if (asked) return null
         return e && typeof e === 'object' && (R in e || 'redirect' in e) ? outcome(e) : null
       }
       v = outcome(v)
-      if (v !== true) return v
+      if (v !== true) return asked ? null : v
     }
     return true
   }
 
   // _loading.brain (#235): when the next page takes longer than 150 ms, the nearest loading view of the target route
-  // (`loading: [{ rx, view }]`, most specific first, emitted by the build with the `core` URL) is mounted in the
+  // (`loading: [{ rx: string | string[], view }]`, most specific first, emitted by the build with the `core` URL) is mounted in the
   // region until the page arrives; fast navigations never show it, so nothing flickers.
   const loads = o.loading || []
   function waiting(url, my) {
-    const path = strip(new URL(url, location.href).pathname), l = loads.find(x => new RegExp(x.rx).test(path))
+    const path = strip(new URL(url, location.href).pathname), l = loads.find(x => (Array.isArray(x.rx) ? x.rx : [x.rx]).some(rx => new RegExp(rx).test(path)))
     const w = { done: false, t: 0 }
     if (!l || !o.core) return w
     w.t = setTimeout(() => {
@@ -154,7 +165,7 @@ export function router(o = {}) {
       G.dispatchEvent && G.dispatchEvent(new Event('brain:navigate'))
     } catch {}
     try {
-      r = await fetch(url, { headers: { 'x-brain-nav': '1' } })
+      r = (await ahead.take(url)) || (await fetch(url, { headers: { 'x-brain-nav': '1' } }))
       const b = r.headers && r.headers.get && r.headers.get('x-brain-build')
       if (b && build() && b !== build()) return void (my === seq && hard(url)) // a new deploy: load it whole
       const ct = (r.headers && r.headers.get && r.headers.get('content-type')) || 'text/html'
@@ -216,6 +227,10 @@ export function router(o = {}) {
       if (pb && document.head) document.head.appendChild(document.adoptNode ? document.adoptNode(pb) : pb)
       routed()
       current()
+      const oldPlan = document.getElementById('brain-next'), newPlan = doc.querySelector('#brain-next')
+      if (oldPlan) oldPlan.remove()
+      if (newPlan) document.body.appendChild(document.adoptNode ? document.adoptNode(newPlan) : newPlan)
+      ahead.scan()
     }
     if (document.startViewTransition) {
       const vt = document.startViewTransition(swap)
@@ -225,11 +240,11 @@ export function router(o = {}) {
   }
   // a full load must not be intercepted again (Navigation API): `through` lets that one navigation pass
   const hard = url => ((through = new URL(url, location.href).href), (o.hard || (u => location.assign(u)))(url))
-  const same = u => {
+  const same = (u, prefetch = false) => {
     try {
       const x = new URL(u, location.href), b = base()
       // same origin and inside the app's base path (§23 #148); anything else is a full load
-      return x.origin === location.origin && (x.pathname + '/').startsWith(b) && !(o.skip && o.skip(x))
+      return x.origin === location.origin && (x.pathname + '/').startsWith(b) && !(o.skip && o.skip(x)) && (prefetch || !fullLoad.has(x.pathname.replace(/\/+$/, '') || '/'))
     } catch {
       return false
     }
@@ -243,6 +258,7 @@ export function router(o = {}) {
       if (!e.canIntercept || e.hashChange || e.downloadRequest || e.formData || !same(e.destination.url)) return
       if (e.cancelable && !leave()) return e.preventDefault()
       const to = e.destination.url, from = nav.currentEntry && nav.currentEntry.url
+      if (G.__brainURLOnly?.(from || location.href, to)) return e.intercept({ handler: () => G.__brainURLRestore?.() })
       if (!gs.length) return e.intercept({ handler: () => load(to) }) // scroll + focus reset handled by the browser
       let g
       e.intercept({
@@ -261,10 +277,11 @@ export function router(o = {}) {
       })
     }
     nav.addEventListener('navigate', h)
+    ahead.scan()
     return (active = {
       go: (u, how) => nav.navigate(app(u), how === 'replace' ? { history: 'replace' } : undefined),
       check,
-      stop: () => ((active = null), nav.removeEventListener('navigate', h), sw && sw.removeEventListener && sw.removeEventListener('message', onMsg)),
+      stop: () => ((active = null), ahead.stop(), nav.removeEventListener('navigate', h), sw && sw.removeEventListener && sw.removeEventListener('message', onMsg)),
     })
   }
 
@@ -273,6 +290,7 @@ export function router(o = {}) {
   let here = location.href
   const go = async (u, push = true, hops = 0) => {
     if (!hops && !leave()) return push || history.pushState(history.state, '', here) // stay (back/forward: restore the URL)
+    if (!same(u)) return hard(u)
     const g = gs.length ? await check(u) : true
     if (g === null || hops > 5) return hard(u)
     if (g === false) return push || history.pushState(history.state, '', here) // back/forward blocked: stay
@@ -295,7 +313,10 @@ export function router(o = {}) {
     e.preventDefault()
     go(u.href)
   }
-  const pop = () => go(location.href, false)
+  const pop = () => {
+    if (G.__brainURLOnly?.(here, location.href)) { here = location.href; G.__brainURLRestore?.(); return }
+    return go(location.href, false)
+  }
   const focusMain = () => {
     const m = document.querySelector(region), h = m && (m.querySelector('h1') || m)
     if (h && h.focus) {
@@ -305,13 +326,208 @@ export function router(o = {}) {
   }
   document.addEventListener('click', click)
   G.addEventListener && G.addEventListener('popstate', pop)
+  ahead.scan()
   return (active = {
     go: (u, push = true) => go(app(u), push),
     check,
-    stop: () => ((active = null), document.removeEventListener('click', click), G.removeEventListener && G.removeEventListener('popstate', pop)),
+    stop: () => ((active = null), ahead.stop(), document.removeEventListener('click', click), G.removeEventListener && G.removeEventListener('popstate', pop)),
   })
 }
 
+// Predictive prefetch (§19, 2026-10-29): no dead time during a visit. Every internal link that scrolls into view is
+// fetched in the background while the browser is idle (at most 2 at a time, 12 per page), and hovering, focusing or
+// touching a link moves it to the front of the queue. The fetched page is kept in memory and the next navigation to it
+// swaps without waiting for the network; its module chunks get `<link rel=modulepreload>` so the view mounts at once.
+// The current view never waits: requests run at low priority and only when idle. Skipped: Save-Data and 2G (only
+// intent prefetches there, and never with Save-Data), `data-prefetch="false"` on the link or an ancestor, download or
+// target links, files (`.pdf`, `.zip`…), `/api/` and `/auth/`, action-style paths (log out, unsubscribe, confirm,
+// verify), URLs carrying a token in the query, and everything with `router({ prefetch: false })` or
+// `<meta name="brain-prefetch" content="off">`. Private/no-store and dynamic no-cache HTML is never reused; static
+// pages and explicitly cacheable public HTML stay in bounded tab memory for at most 5 min,
+// and any write empties the memory first: a form submit, a `brain:write` (brain-data writes, every server function
+// call, log-out included), so the next view never shows data from before the write or another session. Each fetch says
+// `x-brain-prefetch: 1` (`ctx.prefetch` in the server's `load`), so a server can tell it apart from a click.
+const FRESH = 300000, MAX_PAGE = 12, MAX_KEPT = 24, PARALLEL = 2
+const NOPE = /(^|\/)(log-?out|sign-?out|logoff|unsubscribe|confirm|verify|api|auth|_brain|_r)(\.html?)?(\/|$)/i
+const FILE = /\.(?!html?$)[a-z0-9]{2,5}$/i
+const SECRET = /(^|[?&])(token|code|key|sig|signature|auth|otp|state)=/i
+export function predict(o = {}, same = () => false) {
+  const off = { scan() {}, stop() {}, take: async () => null }
+  const meta = G.document && document.querySelector && document.querySelector('meta[name=brain-prefetch]')
+  if (o.prefetch === false || (meta && /^(off|false|0)$/i.test(meta.getAttribute('content') || '')) || !G.document || !G.fetch) return off
+  const net = G.navigator && navigator.connection
+  const thin = () => !!net && (net.saveData || /(^|-)2g$/.test(net.effectiveType || ''))
+  const cache = new Map(), queue = [], pre = new Map(), running = new Map(), pending = new Map(), planned = new Map()
+  let seen = new WeakSet(), busy = 0, count = 0, io = null, idle = 0, epoch = 0, dead = false, bytes = 0, worker = null, serial = 0
+  const key = h => {
+    try { const u = new URL(h, location.href); u.hash = ''; return u.href } catch { return null }
+  }
+  const safe = k => {
+    if (!k || !same(k) || k === key(location.href)) return false
+    const u = new URL(k)
+    return !NOPE.test(u.pathname) && !FILE.test(u.pathname) && !SECRET.test(u.search)
+  }
+  const ok = a => {
+    if (!a || !a.getAttribute || !a.getAttribute('href') || a.getAttribute('target') || a.hasAttribute('download')) return null
+    for (let n = a; n && n.getAttribute; n = n.parentNode) if (n.getAttribute('data-prefetch') === 'false') return null
+    const k = key(a.href || a.getAttribute('href'))
+    return safe(k) ? k : null
+  }
+  const warm = list => {
+    if (!document.head || dead) return
+    let n = 0
+    for (const href of list) {
+      const u = key(href)
+      if (!u || pre.has(u) || !same(u) || !new URL(u).pathname.includes('/_b/') || ++n > 8) continue
+      const l = document.createElement('link')
+      l.setAttribute('rel', /\.(js|jsbrain)(\?|$)/.test(u) ? 'modulepreload' : 'prefetch')
+      l.setAttribute('href', u)
+      l.setAttribute('fetchpriority', 'low')
+      document.head.appendChild(l)
+      pre.set(u, l)
+      while (pre.size > 48) { const [k, node] = pre.entries().next().value; node.remove(); pre.delete(k) }
+    }
+  }
+  const remove = k => { const c = cache.get(k); if (c) bytes -= c.bytes || 0; cache.delete(k) }
+  const prune = () => {
+    for (const [k, c] of cache) if (Date.now() - c.at > FRESH) remove(k)
+    while (cache.size > MAX_KEPT || bytes > 4 * 1024 * 1024) remove(cache.keys().next().value)
+  }
+  const crashed = () => {
+    worker && worker.terminate(); worker = null
+    for (const p of pending.values()) { clearTimeout(p.timer); p.resolve(null) }
+    pending.clear()
+  }
+  if (G.Worker && typeof o.prefetchWorker === 'string') {
+    try {
+      const url = new URL(o.prefetchWorker, location.href)
+      if (url.origin === location.origin) {
+        worker = new Worker(url.href, { type: 'module' })
+        worker.onmessage = e => {
+          const m = e.data, p = m && pending.get(m.id)
+          if (!p) return
+          clearTimeout(p.timer); pending.delete(m.id); p.resolve(m.ok ? m : null)
+        }
+        worker.onerror = crashed
+        worker.onmessageerror = crashed
+      }
+    } catch { crashed() }
+  }
+  const background = (k, controller) => {
+    if (worker) return new Promise(resolve => {
+      const id = ++serial
+      const done = () => { const p = pending.get(id); if (p) { clearTimeout(p.timer); pending.delete(id); resolve(null); worker && worker.postMessage({ id, cancel: true }) } }
+      const timer = setTimeout(done, 6500)
+      pending.set(id, { resolve, timer })
+      controller.signal.addEventListener('abort', done, { once: true })
+      try { worker.postMessage({ id, url: k }) } catch { done(); crashed() }
+    })
+    return prefetchPage(k, controller.signal)
+  }
+
+  const get = k => {
+    const own = epoch, controller = new AbortController(), at = Date.now()
+    running.set(k, controller)
+    const timer = setTimeout(() => controller.abort(), 6000)
+    const c = { at, epoch: own, bytes: 0, p: null }
+    c.p = background(k, controller).then(m => {
+      if (!m || dead || own !== epoch || controller.signal.aborted) { if (cache.get(k) === c) remove(k); return null }
+      const headers = Array.isArray(m.headers) ? new Headers(m.headers) : m.headers
+      const cc = headers.get('cache-control') || '', freshness = /(?:^|,)\s*(?:s-maxage|max-age)=(\d+)/i.exec(cc)
+      if (m.assets) warm(m.assets)
+      if (planned.has(k)) warm(planned.get(k))
+      // Personalized and dynamically revalidated HTML always goes back through the server on navigation.
+      // Speculation still warms its immutable code/assets; it never reuses another tab's prior session data.
+      if (/private|no-store/i.test(cc) || /no-cache/i.test(cc) && headers.get('x-brain-static') !== '1') { if (cache.get(k) === c) remove(k); return null }
+      // Transient page memory belongs to this tab and write epoch, never to CacheStorage or the worker.
+      c.bytes = m.text.length * 2
+      if (cache.get(k) === c) bytes += c.bytes
+      prune()
+      return { ok: m.ok, status: m.status, redirected: false, url: m.url, headers, text: async () => m.text, ttl: Math.min(FRESH, freshness ? +freshness[1] * 1000 : FRESH) }
+    }).catch(() => null).finally(() => { clearTimeout(timer); if (running.get(k) === controller) running.delete(k) })
+    cache.set(k, c); prune()
+    return c.p
+  }
+  const pump = () => {
+    if (dead || document.hidden || net && net.saveData) return
+    while (busy < PARALLEL && queue.length) {
+      const k = queue.shift()
+      if (cache.has(k)) continue
+      busy++
+      get(k).finally(() => { busy--; pump() })
+    }
+  }
+  const later = f => G.requestIdleCallback ? G.requestIdleCallback(f, { timeout: 2000 }) : setTimeout(f, 200)
+  const cancelIdle = () => { if (idle) { G.cancelIdleCallback ? G.cancelIdleCallback(idle) : clearTimeout(idle); idle = 0 } }
+  const want = (k, now) => {
+    if (!k || dead || cache.has(k) || count >= (now ? MAX_KEPT : MAX_PAGE)) return
+    const i = queue.indexOf(k)
+    if (i >= 0) queue.splice(i, 1); else count++
+    if (now) { queue.unshift(k); pump() }
+    else { queue.push(k); if (!idle) idle = later(() => { idle = 0; pump() }) }
+  }
+  const intent = e => {
+    if (net && net.saveData) return
+    let a = e.target
+    while (a && a.tagName !== 'A') a = a.parentNode
+    want(ok(a), true)
+  }
+  const evs = ['pointerover', 'focusin', 'touchstart']
+  for (const t of evs) document.addEventListener(t, intent, { passive: true, capture: true })
+  const forget = () => {
+    epoch++; cancelIdle(); queue.length = 0; cache.clear(); bytes = 0; count = 0
+    for (const c of running.values()) c.abort()
+    running.clear()
+  }
+  document.addEventListener('submit', forget, { capture: true })
+  if (G.addEventListener) G.addEventListener('brain:write', forget)
+  const visible = () => { if (!document.hidden) pump() }
+  document.addEventListener('visibilitychange', visible)
+  if (G.IntersectionObserver) io = new IntersectionObserver(es => {
+    for (const e of es) if (e.isIntersecting) { io.unobserve(e.target); if (!thin()) want(ok(e.target), false) }
+  }, { rootMargin: '200px' })
+  return {
+    scan() {
+      if (dead) return
+      count = 0; cancelIdle(); queue.length = 0; planned.clear(); seen = new WeakSet(); io && io.disconnect()
+      const anchors = document.querySelectorAll('a[href]'), allowed = new Set()
+      for (const a of anchors) { const k = ok(a); if (k) allowed.add(k); if (io && !seen.has(a)) { seen.add(a); io.observe(a) } }
+      // Compiler-generated graph, validated against the current DOM: hidden/opted-out links cannot sneak in.
+      const plan = document.getElementById && document.getElementById('brain-next')
+      if (plan && !thin()) {
+        try {
+          const map = JSON.parse(plan.textContent)
+          if (map.v === 1 && Array.isArray(map.next)) for (const item of map.next.slice(0, MAX_PAGE)) {
+            const k = key(item.url)
+            if (allowed.has(k) && safe(k)) { if (Array.isArray(item.assets)) planned.set(k, item.assets.slice(0, 16)); want(k, false) }
+          }
+        } catch {}
+      }
+    },
+    stop() {
+      if (dead) return
+      forget(); dead = true; crashed(); io && io.disconnect()
+      for (const t of evs) document.removeEventListener(t, intent, { capture: true })
+      document.removeEventListener('submit', forget, { capture: true })
+      document.removeEventListener('visibilitychange', visible)
+      G.removeEventListener && G.removeEventListener('brain:write', forget)
+      for (const l of pre.values()) l.remove()
+      pre.clear()
+    },
+    async take(u) {
+      const k = key(u), c = k && cache.get(k)
+      if (!c) return null
+      remove(k)
+      // A click must not inherit a slow speculative request's six-second deadline.
+      let timer
+      const r = await Promise.race([c.p, new Promise(resolve => { timer = setTimeout(() => resolve(null), 150) })])
+      clearTimeout(timer)
+      if (!r) { const controller = running.get(k); controller && controller.abort() }
+      return r && !dead && c.epoch === epoch && Date.now() - c.at < r.ttl ? r : null
+    },
+  }
+}
+
 const HOLD = ['click', 'submit']
 function hold(el) {
   if (el.$hold) el.$hold() // a newer navigation drops what the previous page held

package/brain-rpc.js

@@ -10,6 +10,9 @@ export async function rpc(id, a, oops, base) {
     j = t ? JSON.parse(t) : undefined
   } catch (e) {
     throw (oops(e, null, 'rpc'), e)
+  } finally {
+    // a server function may write or change the session: pages the router prefetched may be stale (§19)
+    if (globalThis.dispatchEvent && globalThis.Event) globalThis.dispatchEvent(new Event('brain:write'))
   }
   if (r.ok) return j
   const e = Object.assign(Error((j && j.error) || 'rpc ' + id + ': ' + r.status), { code: 'rpc', status: r.status, id, errors: j && j.errors })

package/brain-schema.js

@@ -3,67 +3,142 @@
 // Per field: `str num bool email url date` + `!` required + `<=N >=N` (length for str and lists, value for num) + `[T]`
 // list of T, or a nested schema object.
 const RX_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+const G = globalThis
+
+// Validation messages (§14, §37): the app's dictionary wins when it has the key (`"form.required": "Obligatorio"` in
+// i18n/<locale>.json; plural objects allowed for keys with `{n}`), else the English text. The table is read directly
+// (globalThis.__brainDict, filled by brain-i18n.js `add`) so a page that only validates does not load brain-i18n.js.
+// Keys: form.required form.list form.min_items form.max_items form.item form.number form.min form.max form.email
+// form.url form.date form.text form.boolean form.min_chars form.max_chars.
+export function msg(key, en, vars) {
+  const D = G.__brainDict
+  if (D) {
+    const h = G.document && G.document.documentElement
+    const loc = G.__brainLocale || (h && h.getAttribute('lang')) || 'en'
+    const def = (h && h.getAttribute('data-default-lang')) || 'en'
+    let m = (D[loc] && D[loc][key]) ?? (D[def] && D[def][key])
+    if (m != null) {
+      if (typeof m === 'object') {
+        const n = vars && vars.n
+        m = m['=' + n] ?? m[new Intl.PluralRules(loc).select(+n || 0)] ?? m.other ?? en
+      }
+      return vars ? String(m).replace(/\{(\w+)\}/g, (s, k) => (k in vars ? String(vars[k]) : s)) : String(m)
+    }
+  }
+  return en
+}
 
 // 'str!<=80' → { t: 'str', req: true, min, max, list: false }
-export function rule(s) {
-  if (typeof s === 'object') return { t: 'obj', s, req: false }
-  const req = s.includes('!'), r = { t: '', req, list: false, min: null, max: null }
-  let x = s.replace(/!/g, '')
-  const m = /^(\[?)(\w+)\]?((?:[<>]=-?\d+(?:\.\d+)?)*)$/.exec(x)
-  if (!m) throw Error(`form: invalid rule '${s}' (use str num bool email url date, ! required, <=N >=N, [T])`)
-  r.list = !!m[1]
-  r.t = m[2]
-  for (const [, op, n] of m[3].matchAll(/([<>])=(-?\d+(?:\.\d+)?)/g)) r[op === '<' ? 'max' : 'min'] = +n
+const TYPES = new Set(['str', 'num', 'bool', 'email', 'url', 'date'])
+function scalarRule(s) {
+  if (typeof s !== 'string' || s.length > 256) throw Error('form: invalid rule (use str num bool email url date, ! required, <=N >=N, [T])')
+  const m = /^(?:([a-z]+)(!)?|\[([a-z]+)(!)?\](!)?)((?:[<>]=-?\d+(?:\.\d+)?)*)$/.exec(s)
+  if (!m || m[4] && m[5]) throw Error(`form: invalid rule '${s}' (use str num bool email url date, ! required, <=N >=N, [T])`)
+  const r = { t: m[1] || m[3], req: !!(m[2] || m[4] || m[5]), list: !!m[3], min: null, max: null }
+  if (!TYPES.has(r.t)) throw Error(`form: unknown type '${r.t}'`)
+  for (const [, op, n] of m[6].matchAll(/([<>])=(-?\d+(?:\.\d+)?)/g)) {
+    const key = op === '<' ? 'max' : 'min', value = Number(n)
+    if (r[key] != null || !Number.isFinite(value) || (!r.list && r.t === 'bool') || ((r.list || r.t !== 'num') && (!Number.isSafeInteger(value) || value < 0))) throw Error(`form: invalid bounds in rule '${s}'`)
+    r[key] = value
+  }
+  if (r.min != null && r.max != null && r.min > r.max) throw Error(`form: invalid bounds in rule '${s}'`)
   return r
 }
+function schemaRules(schema, seen, budget, depth) {
+  if (!schema || Array.isArray(schema) || typeof schema !== 'object' || ![null, Object.prototype].includes(Object.getPrototypeOf(schema)) || seen.has(schema) || depth > 16) throw Error('form: invalid nested schema')
+  seen.add(schema)
+  for (const key of Object.keys(schema)) {
+    const field = Object.getOwnPropertyDescriptor(schema, key)
+    if (++budget.n > 4096 || ['__proto__', 'prototype', 'constructor'].includes(key) || !field || !('value' in field)) throw Error('form: invalid schema field')
+    if (field.value && typeof field.value === 'object') schemaRules(field.value, seen, budget, depth + 1)
+    else scalarRule(field.value)
+  }
+  seen.delete(schema)
+}
+export function rule(s) {
+  if (s && typeof s === 'object') {
+    schemaRules(s, new Set(), { n: 0 }, 0)
+    return { t: 'obj', s, req: false }
+  }
+  return scalarRule(s)
+}
+const empty = v => v == null || typeof v === 'string' && v.trim() === '' || Array.isArray(v) && !v.length
+const NUMBER = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/
+// Check calendar fields directly; Date.parse may normalize impossible days or accept locale-specific formats.
+function calendarDate(s) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})(?:T([01]\d|2[0-3]):([0-5]\d)(?::([0-5]\d)(?:\.\d{1,9})?)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)?)?$/.exec(s)
+  if (!m) return false
+  const year = +m[1], month = +m[2], day = +m[3]
+  const days = [31, year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]
+  return year > 0 && month > 0 && month <= 12 && day > 0 && day <= days[month - 1]
+}
 
-const empty = v => v == null || v === '' || (Array.isArray(v) && !v.length)
 const plural = (n, w) => `${n} ${w}${n === 1 ? '' : 's'}`
 
+// Compiler-only validators for proven unbounded scalars. Separate entry points let
+// text-only forms omit numeric syntax and boolean validation from their dependency graph.
+export function checkText(r, value) {
+  if (Array.isArray(value)) return msg('form.text', 'Enter text')
+  if (empty(value)) return r.req ? msg('form.required', 'Required') : ''
+  if (r.t === 'email' && (typeof value !== 'string' || !RX_EMAIL.test(value))) return msg('form.email', 'Enter a valid email')
+  return typeof value === 'string' ? '' : msg('form.text', 'Enter text')
+}
+export function checkScalar(r, value) {
+  if (r.t !== 'bool' && r.t !== 'num') return checkText(r, value)
+  if (Array.isArray(value)) return msg(r.t === 'num' ? 'form.number' : 'form.boolean', r.t === 'num' ? 'Enter a number' : 'Choose true or false')
+  if (empty(value)) return r.req ? msg('form.required', 'Required') : ''
+  if (r.t === 'bool') return typeof value !== 'boolean' ? msg('form.boolean', 'Choose true or false') : r.req && !value ? msg('form.required', 'Required') : ''
+  return Number.isFinite(typeof value === 'number' ? value : typeof value === 'string' && NUMBER.test(value.trim()) ? Number(value) : NaN) ? '' : msg('form.number', 'Enter a number')
+}
+
 // Message for one value, or '' when valid.
 export function check(r, v) {
   if (r.list) {
-    if (empty(v)) return r.req || r.min > 0 ? (r.req && !r.min ? 'Required' : `Choose at least ${r.min}`) : ''
-    if (!Array.isArray(v)) return 'Must be a list'
-    if (r.min != null && v.length < r.min) return `Choose at least ${r.min}`
-    if (r.max != null && v.length > r.max) return `At most ${plural(r.max, 'item')}`
+    if (v != null && !Array.isArray(v)) return msg('form.list', 'Must be a list')
+    if (empty(v)) return r.req || r.min > 0 ? (r.req && !r.min ? msg('form.required', 'Required') : msg('form.min_items', `Choose at least ${r.min}`, { n: r.min })) : ''
+    if (!Array.isArray(v)) return msg('form.list', 'Must be a list')
+    if (r.min != null && v.length < r.min) return msg('form.min_items', `Choose at least ${r.min}`, { n: r.min })
+    if (r.max != null && v.length > r.max) return msg('form.max_items', `At most ${plural(r.max, 'item')}`, { n: r.max })
     const one = { ...r, list: false, req: true, min: null, max: null }
     for (let i = 0; i < v.length; i++) {
-      const e = check(one, v[i])
-      if (e) return `Item ${i + 1}: ${e}`
+      const e = r.t === 'bool' ? typeof v[i] === 'boolean' ? '' : msg('form.boolean', 'Choose true or false') : check(one, v[i])
+      if (e) return msg('form.item', `Item ${i + 1}: ${e}`, { n: i + 1, error: e })
     }
     return ''
   }
-  if (r.t === 'bool') return r.req && v !== true ? 'Required' : ''
-  if (empty(v)) return r.req ? 'Required' : ''
-  const s = String(v)
+  if (Array.isArray(v)) return msg(r.t === 'num' ? 'form.number' : r.t === 'bool' ? 'form.boolean' : 'form.text', r.t === 'num' ? 'Enter a number' : r.t === 'bool' ? 'Choose true or false' : 'Enter text')
+  if (empty(v)) return r.req ? msg('form.required', 'Required') : ''
+  if (r.t === 'bool') return typeof v !== 'boolean' ? msg('form.boolean', 'Choose true or false') : r.req && !v ? msg('form.required', 'Required') : ''
+  const s = typeof v === 'string' ? v : ''
   switch (r.t) {
     case 'num': {
-      const n = typeof v === 'number' ? v : s.trim() === '' ? NaN : Number(s)
-      if (!Number.isFinite(n)) return 'Enter a number'
-      if (r.min != null && n < r.min) return `Must be at least ${r.min}`
-      if (r.max != null && n > r.max) return `Must be at most ${r.max}`
+      const n = typeof v === 'number' ? v : typeof v === 'string' && NUMBER.test(s.trim()) ? Number(s) : NaN
+      if (!Number.isFinite(n)) return msg('form.number', 'Enter a number')
+      if (r.min != null && n < r.min) return msg('form.min', `Must be at least ${r.min}`, { n: r.min })
+      if (r.max != null && n > r.max) return msg('form.max', `Must be at most ${r.max}`, { n: r.max })
       return ''
     }
     case 'email':
-      if (!RX_EMAIL.test(s)) return 'Enter a valid email'
+      if (typeof v !== 'string' || !RX_EMAIL.test(s)) return msg('form.email', 'Enter a valid email')
       break
     case 'url':
+      if (typeof v !== 'string') return msg('form.url', 'Enter a valid URL')
       try {
-        if (!/^https?:$/.test(new URL(s).protocol)) return 'Enter a valid URL'
+        if (!/^https?:$/.test(new URL(s).protocol)) return msg('form.url', 'Enter a valid URL')
       } catch {
-        return 'Enter a valid URL'
+        return msg('form.url', 'Enter a valid URL')
       }
       break
     case 'date':
-      if (Number.isNaN(Date.parse(s))) return 'Enter a valid date'
-      return ''
+      if (typeof v !== 'string' || !calendarDate(s)) return msg('form.date', 'Enter a valid date')
+      break
     case 'str':
+      if (typeof v !== 'string') return msg('form.text', 'Enter text')
       break
     default:
       throw Error(`form: unknown type '${r.t}'`)
   }
-  if (r.min != null && s.length < r.min) return `At least ${plural(r.min, 'character')}`
-  if (r.max != null && s.length > r.max) return `At most ${plural(r.max, 'character')}`
+  if (r.min != null && s.length < r.min) return msg('form.min_chars', `At least ${plural(r.min, 'character')}`, { n: r.min })
+  if (r.max != null && s.length > r.max) return msg('form.max_chars', `At most ${plural(r.max, 'character')}`, { n: r.max })
   return ''
 }