@christianirack/brainllm-runtime 0.3.1 → 0.5.0

package/brain-worker.js

@@ -3,17 +3,34 @@
 // plus `const parseCsv = (...a) => w.call('parseCsv', a)`. Messages use structured clone: { id, name, args } →
 // { id, ok } | { id, err: { message, name, stack } }. The worker starts on the first call; a remote error is rethrown
 // in the page as an Error with the same message and name (its stack in `remoteStack`).
+const TRANSFER = Symbol('brain-transfer')
+export function transfer(value, list) {
+  if (!Array.isArray(list) || list.length > 32 || new Set(list).size !== list.length) throw new TypeError('transfer: provide at most 32 distinct transferable objects')
+  return { [TRANSFER]:true, value, list }
+}
 
 // Worker side. `name` may be a path into the map ('default.mean'); the result may be a promise.
 export function serve(map, scope = globalThis) {
+  if ('onconnect' in scope) {
+    scope.onconnect = event => {
+      for (const port of event.ports || []) { serve(map,port); port.start() }
+    }
+    return
+  }
   scope.onmessage = async e => {
     const { id, name, args } = e.data || {}
     try {
+      if (!Number.isSafeInteger(id) || id < 1 || typeof name !== 'string' || name.length > 256 || !Array.isArray(args)) throw new TypeError('worker: invalid RPC envelope')
       let f = map, self
-      for (const k of String(name).split('.')) (self = f), (f = f == null ? undefined : f[k])
+      for (const k of name.split('.')) {
+        if (!k || /^(?:__proto__|prototype|constructor)$/.test(k)) throw new TypeError('worker: unsafe export path')
+        self = f
+        f = f == null ? undefined : Object.getOwnPropertyDescriptor(f, k)?.value
+      }
       if (typeof f !== 'function') throw new TypeError(`worker: \`${name}\` is not an exported function`)
       const ok = await f.apply(self, args || [])
-      scope.postMessage({ id, ok }) // throws DataCloneError for a result that cannot be cloned → reported below
+      if (ok?.[TRANSFER]) scope.postMessage({id,ok:ok.value},ok.list)
+      else scope.postMessage({ id, ok }) // throws DataCloneError for a result that cannot be cloned → reported below
     } catch (x) {
       scope.postMessage({ id, err: { message: (x && x.message) || String(x), name: (x && x.name) || 'Error', stack: x && x.stack } })
     }
@@ -21,39 +38,109 @@ export function serve(map, scope = globalThis) {
 }
 
 // Page side.
-export function worker(url) {
-  let w = null, n = 0
+export function worker(url, options = {}) {
+  let w = null, n = 0, inFlight = 0, idle = null
   const wait = new Map()
+  const timeout = Math.max(10, Math.min(60000, Number(options.timeout) || 15000))
+  const capacity = Math.max(1, Math.min(256, Number(options.capacity) || 64))
+  const maxBytes = Math.max(1024, Math.min(67108864, Number(options.maxBytes) || 4194304))
+  const maxInFlight = Math.max(maxBytes, Math.min(67108864, Number(options.maxInFlightBytes) || 8388608))
+  function size(value) {
+    const seen = new Set(), stack = [[value, 0]]
+    let bytes = 0, nodes = 0
+    const push = (value, depth) => {
+      if (nodes + stack.length >= 4096) throw Object.assign(new Error('worker: payload structure exceeds its budget; transfer a bounded ArrayBuffer instead'), {code:'B0911'})
+      stack.push([value, depth])
+    }
+    while (stack.length) {
+      const [v, depth] = stack.pop()
+      if (++nodes > 4096 || depth > 24) throw Object.assign(new Error('worker: payload structure exceeds its budget; transfer a bounded ArrayBuffer instead'), { code: 'B0911' })
+      if (typeof v === 'string') bytes += v.length * 2
+      else if (v && typeof v === 'object' && !seen.has(v)) {
+        seen.add(v)
+        if (ArrayBuffer.isView(v)) push(v.buffer, depth + 1)
+        else if (v instanceof ArrayBuffer || (typeof SharedArrayBuffer === 'function' && v instanceof SharedArrayBuffer)) bytes += v.byteLength
+        else if (v instanceof Map) for (const [a,b] of v) { push(a,depth+1); push(b,depth+1) }
+        else if (v instanceof Set) for (const a of v) push(a,depth+1)
+        else for (const k in v) {
+          const d = Object.getOwnPropertyDescriptor(v,k)
+          if (!d) continue
+          if (!('value' in d)) throw new DOMException('Worker payload accessors are not supported', 'DataCloneError')
+          bytes += k.length * 2; push(d.value,depth+1)
+        }
+      } else bytes += 8
+      if (bytes > maxBytes) throw Object.assign(new Error('worker: payload byte budget exceeded; reduce the batch or configure a bounded larger budget'), { code: 'B0911' })
+    }
+    return bytes
+  }
   const failAll = err => {
-    for (const [, p] of wait) p[1](err)
+    clearTimeout(idle); idle = null
+    const old = w
+    w = null
+    if (old) old.terminate()
+    for (const [, p] of wait) { p.clean(); p.fail(err) }
     wait.clear()
-    w = null // the next call starts a fresh worker
   }
   const start = () => {
-    w = new Worker(url, { type: 'module' })
+    if (globalThis.location) {
+      const resolved = new URL(url,location.href)
+      if (resolved.origin !== location.origin || resolved.username || resolved.password) throw new TypeError('worker: use a same-origin compiled module URL')
+    }
+    if (options.shared) {
+      if (!globalThis.SharedWorker) throw new Error('SharedWorker is unavailable; use a dedicated worker or explicit tab coordination fallback')
+      const shared = new SharedWorker(url, {type:'module',name:options.name}), port = shared.port
+      const bridge = { postMessage:(m,t) => port.postMessage(m,t), terminate:() => port.close() }
+      port.onmessage = e => bridge.onmessage?.(e)
+      port.onmessageerror = e => bridge.onmessageerror?.(e)
+      shared.onerror = e => bridge.onerror?.(e)
+      port.start()
+      w = bridge
+    } else w = new Worker(url, { type: 'module' })
+    const instance = w
     w.onmessage = e => {
+      if (w !== instance) return
       const { id, ok, err } = e.data || {}
       const p = wait.get(id)
       if (!p) return
       wait.delete(id)
-      if (err) p[1](Object.assign(new Error(err.message), { name: err.name, remoteStack: err.stack }))
-      else p[0](ok)
+      p.clean()
+      if (!wait.size) {
+        idle = setTimeout(() => { if (w === instance && !wait.size) failAll(new Error('worker idle')) }, 30000)
+        idle.unref?.()
+      }
+      if (err) p.fail(Object.assign(new Error(err.message), { name: err.name, remoteStack: err.stack }))
+      else p.ok(ok)
     }
     w.onerror = e => {
+      if (w !== instance) return
       if (e && e.preventDefault) e.preventDefault()
       failAll(new Error('worker failed: ' + ((e && e.message) || url)))
     }
+    w.onmessageerror = () => { if (w === instance) failAll(new Error('worker: response could not be decoded')) }
   }
   return {
-    call(name, args) {
-      if (!w) start()
+    call(name, args = [], o = {}) {
+      if (o.signal?.aborted) return Promise.reject(Object.assign(new Error('worker call aborted'), { name: 'AbortError', kind: 'aborted' }))
+      if (wait.size >= capacity) return Promise.reject(Object.assign(new Error('worker: pending call capacity exceeded; await existing work'), { code: 'B0911' }))
+      if (typeof name !== 'string' || name.length > 256 || !Array.isArray(args)) return Promise.reject(new TypeError('worker: invalid call'))
+      let bytes
+      try { bytes = size(args) } catch (e) { return Promise.reject(e) }
+      if (inFlight + bytes > maxInFlight) return Promise.reject(Object.assign(new Error('worker: in-flight byte capacity exceeded; await pending work'), { code:'B0911' }))
+      try { if (!w) start() } catch (e) { return Promise.reject(e) }
+      clearTimeout(idle); idle = null
       const id = ++n
       return new Promise((ok, fail) => {
-        wait.set(id, [ok, fail])
+        const abort = () => failAll(Object.assign(new Error('worker call aborted; shared pending calls cancelled'), { name: 'AbortError', kind: 'aborted' }))
+        const timer = setTimeout(() => failAll(Object.assign(new Error('worker: deadline exceeded; move bounded work into smaller batches'), { code: 'B0910' })), timeout)
+        inFlight += bytes
+        const clean = () => { inFlight -= bytes; clearTimeout(timer); o.signal?.removeEventListener('abort', abort) }
+        wait.set(id, { ok, fail, clean })
+        o.signal?.addEventListener('abort', abort, { once: true })
         try {
-          w.postMessage({ id, name, args })
+          w.postMessage({ id, name, args }, o.transfer || [])
         } catch (x) {
           wait.delete(id)
+          clean()
           fail(x) // DataCloneError: an argument cannot cross to the worker (functions, DOM nodes…)
         }
       })
@@ -64,3 +151,8 @@ export function worker(url) {
     },
   }
 }
+
+export function sharedWorker(url, options = {}) {
+  if (typeof options.name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,79}$/.test(options.name)) throw new TypeError('sharedWorker: provide a stable public name of at most 80 characters')
+  return worker(url, { ...options, shared:true })
+}

package/brain.js

@@ -5,14 +5,14 @@
 // · r run · q clean · n unlink · d dispose. Short names: brain-min does not rename properties.
 
 // L tracker · O owner · Q pending effects · B batch depth · P flush scheduled · H dev hook · E error hook · V provider (brain-ch)
-let L = null, O = null, Q = [], B = 0, P = 0, H = null, E = null, V, A = null
+let L = null, O = null, Q = [], B = 0, P = 0, H = null, E = null, V, A = null, U
 // Errors (INTERNALS §18): fx, drv and handlers are caught and the app keeps running. E (brain-err.js, _err) records
 // them and applies per-component fallbacks; without it, console.error.
 // Errors go to the rich catcher (brain-err) or the console, then to the nearest component boundary (§42, brain-guard.js):
 // up the owner chain for fx/drv, up the DOM for handlers.
 const oops = (e, x, w) => {
   if (e && e.kind == 'aborted') return // a cancelled request (brain-data): never an error to report or show
-  E ? E(e, x, w) : globalThis.reportError ? reportError(e) : console.error(e) // reportError: window error listeners (the dev client) see it
+  E ? E(e, x, w) : H ? globalThis.reportError ? reportError(e) : console.error(e) : console.error('BRAIN_ERROR: Operation failed. Try again.')
   for (let o = x; o; o = o.nodeType ? o.parentNode : o.p) {
     const g = o.$g
     if (g) return g(e, w)
@@ -155,7 +155,7 @@ function flush() {
   }
 }
 
-export const sig = (v, k) => (k && H ? H(new N(v, null, 0), k) : new N(v, null, 0))
+export const sig = (v, k) => (U && U('signals', O, 1), k && H ? H(new N(v, null, 0), k) : new N(v, null, 0))
 export const drv = f => new N(undefined, f, 0)
 export const fx = f => {
   const n = new N(undefined, f, 1)
@@ -201,7 +201,7 @@ export const rpc = (id, a) => import('./brain-rpc.js').then(m => m.rpc(id, a, oo
 // Internals for sibling modules (brain-err, brain-ch): root, current owner and node helpers; _err installs the hook;
 // brain-ch passes its provider for `mount(C, t, props, { provide })`.
 // Optimistic writes (brain-data) and the circuit breaker (brain-guard) wrap N's prototype instead of a core hook (#288).
-export const _rt = p => ((V = V || p), { root, owner: () => O, nodes, rm, oops, guard: (o, g) => (o.$g = g), adopt: a => (A = a), dev: (a, b) => H && H(a, b) })
+export const _rt = p => ((V = V || p), { root, owner: () => O, nodes, rm, oops, guard: (o, g) => (o.$g = g), adopt: a => (A = a), dev: (a, b) => H && H(a, b), development: () => !!H, budget: f => (U = f) })
 export const _err = h => ((E = h), _rt())
 
 // ---------- DOM ----------
@@ -351,6 +351,7 @@ export function list(p, f, key, render, end, empty) {
   let rows = new Map(), order = [], emp = null
   fx(() => {
     const items = f() || [], me = O
+    if (U) U('rows', me, items.length)
     untrack(() => {
       // Large updates (>500 rows, some already on screen) create new rows in ≤16 ms slices (one frame; QA #302: 5 ms
       // split a 1,000-row update into extra frames): the rest is skipped and this fx re-runs after a yield (INP). A first render (no rows yet) is built at once: slicing it only re-walks the list.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {
@@ -8,6 +8,50 @@
     "./*": "./*"
   },
   "sideEffects": false,
+  "keywords": [
+    "runtime",
+    "zero-dependency",
+    "dom",
+    "router",
+    "llm",
+    "ai",
+    "ai-agents",
+    "coding-agent",
+    "agentic",
+    "claude-code",
+    "cursor",
+    "mcp",
+    "model-context-protocol",
+    "frontend",
+    "front-end",
+    "backend",
+    "back-end",
+    "fullstack",
+    "full-stack",
+    "cli",
+    "command-line",
+    "developer-tools",
+    "design-system",
+    "css",
+    "testing",
+    "e2e",
+    "postgresql",
+    "jwt",
+    "web-framework",
+    "framework",
+    "compiler",
+    "rust",
+    "fast",
+    "performance",
+    "react-alternative",
+    "vite-alternative",
+    "signals",
+    "reactive",
+    "components",
+    "ssr",
+    "spa",
+    "web"
+  ],
   "license": "MIT",
   "author": "Christian Irack Flores Maldonado <christian@irack.mx> (https://ingenieria.dev)",
   "repository": {

package/server/native-sockets.mjs

@@ -0,0 +1,156 @@
+// Fixed loopback Upgrade transport. Rust owns WebSocket frames, authentication and per-delivery policy.
+import {request} from 'node:http'
+import {createHash, randomUUID} from 'node:crypto'
+
+const PROTOCOL = 'brain.v1'
+const LIMITS = Object.freeze({connections:32, headers:16384, credentials:16384, head:4096, upstreamHead:8192, queued:262144, bytes:64*1024*1024, handshake:5000, write:2000, idle:70000, lifetime:15*60*1000, close:1000})
+const SINGLE = new Set(['host','origin','authorization','cookie','upgrade','sec-websocket-key','sec-websocket-version','sec-websocket-protocol'])
+const installed = new WeakSet()
+const connectionUpgrade = value => typeof value === 'string' && value.toLowerCase().split(/\s*,\s*/).includes('upgrade')
+const unique = (headers, names) => {
+  const seen = new Set()
+  for (let i=0;i<headers.length;i+=2) {
+    const name = headers[i].toLowerCase()
+    if (names.has(name) && seen.has(name)) return false
+    seen.add(name)
+  }
+  return true
+}
+
+export function installNativeSockets(server, {target, base='/', cookie, log}) {
+  if (installed.has(server)) throw Error('The native socket bridge is already installed')
+  if (typeof target !== 'string' || target.length>2048) throw Error('Native sockets require a fixed loopback HTTP backend')
+  let origin
+  try { origin = new URL(target) } catch { throw Error('Native sockets require a fixed loopback HTTP backend') }
+  if (origin.protocol !== 'http:' || !['127.0.0.1','localhost','[::1]'].includes(origin.hostname) || origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash) throw Error('Native sockets require a fixed loopback HTTP backend')
+  if (origin.hostname === 'localhost') origin.hostname = '127.0.0.1'
+  if (typeof base !== 'string' || base.length>2048 || !base.startsWith('/') || !base.endsWith('/') || /[\\?#\s]/.test(base) || base.includes('//') || new URL(base,'http://brain.invalid').pathname !== base) throw Error('Native sockets require a canonical application base path')
+  if (typeof cookie !== 'function' || typeof log !== 'function') throw Error('Native socket bridge callbacks are required')
+  const path = (base === '/' ? '' : base.slice(0,-1)) + '/_brain/socket'
+  const owned = new Set()
+  let stopped = false, window = 0, reports = 0
+  // Fixed fields only: never log target URLs, credentials, frames, request headers or exception messages.
+  const report = (code,rid) => {
+    const current = Math.floor(Date.now()/60000)
+    if (window !== current) { window=current; reports=0 }
+    if (reports++ >= 16) return
+    try { log('warn','native socket unavailable',{code,rid,fix:'Check native socket activation, the trusted Origin, authentication and backend availability; reconnect after correcting the cause'}) } catch {}
+  }
+  const reject = (socket,status,rid,code) => {
+    report(code,rid)
+    if (socket.destroyed) return
+    socket.setTimeout(LIMITS.close,()=>socket.destroy())
+    socket.end(`HTTP/1.1 ${status} Socket unavailable\r\nConnection: close\r\nCache-Control: no-store\r\nX-Request-Id: ${rid}\r\nContent-Length: 0\r\n\r\n`,()=>socket.destroy())
+  }
+  const upgrade = (incoming,browser,head) => {
+    const ownedPath=typeof incoming.url === 'string' && incoming.url.split(/[?#]/,1)[0] === path
+    // Other trusted listeners own their endpoints. If this is the only listener, reject unknown upgrades promptly
+    // instead of retaining a raw socket with no owner. Queries on our exact endpoint always remain ours to reject.
+    if (!ownedPath && server.listenerCount('upgrade')>1) return
+    if (browser.destroyed) return
+    const rid = randomUUID()
+    // A socket error can precede admission, including while a rejected response is flushing.
+    browser.on('error',()=>{})
+    if (stopped || server.draining) return reject(browser,503,rid,'NATIVE_SOCKET_DRAINING')
+    if (incoming.method !== 'GET') return reject(browser,405,rid,'NATIVE_SOCKET_METHOD')
+    if (incoming.url !== path) return reject(browser,400,rid,'NATIVE_SOCKET_PATH')
+    const headerBytes = incoming.rawHeaders.reduce((bytes,value)=>bytes+Buffer.byteLength(value)+2,0)
+    if (headerBytes>LIMITS.headers || !unique(incoming.rawHeaders,SINGLE)) return reject(browser,431,rid,'NATIVE_SOCKET_HEADERS')
+    if (head.length>LIMITS.head || incoming.headers['content-length'] && incoming.headers['content-length'] !== '0' || incoming.headers['transfer-encoding']) return reject(browser,400,rid,'NATIVE_SOCKET_BODY')
+    let site
+    try { site=new URL(incoming.headers.origin) } catch { return reject(browser,403,rid,'NATIVE_SOCKET_ORIGIN') }
+    if (!['http:','https:'].includes(site.protocol) || site.origin !== incoming.headers.origin || site.origin.length>2048) return reject(browser,403,rid,'NATIVE_SOCKET_ORIGIN')
+    const key = incoming.headers['sec-websocket-key']
+    if (incoming.headers.upgrade?.toLowerCase() !== 'websocket' || !connectionUpgrade(incoming.headers.connection) || incoming.headers['sec-websocket-version'] !== '13' || incoming.headers['sec-websocket-protocol'] !== PROTOCOL || typeof key !== 'string' || !/^[A-Za-z0-9+/]{22}==$/.test(key) || Buffer.from(key,'base64').toString('base64') !== key) return reject(browser,400,rid,'NATIVE_SOCKET_HANDSHAKE')
+    let credentials
+    try { credentials=cookie(incoming) } catch { return reject(browser,400,rid,'NATIVE_SOCKET_CREDENTIALS') }
+    const authorization = incoming.headers.authorization
+    if (typeof credentials !== 'string' || authorization !== undefined && typeof authorization !== 'string' || Buffer.byteLength(credentials)+Buffer.byteLength(authorization || '')>LIMITS.credentials) return reject(browser,431,rid,'NATIVE_SOCKET_CREDENTIALS')
+    if (owned.size>=LIMITS.connections) return reject(browser,503,rid,'NATIVE_SOCKET_CAPACITY')
+    browser.pause()
+    let outgoing, upstream, handshake, lifetime, closing, bytes=0, done=false, upgraded=false
+    const writes=new Set()
+    const finish = (code,status) => {
+      if (done) return
+      done=true
+      clearTimeout(handshake); clearTimeout(lifetime); clearTimeout(closing); owned.delete(finish)
+      for (const timer of writes) clearTimeout(timer)
+      writes.clear()
+      browser.setTimeout(0)
+      if (upstream) { upstream.setTimeout(0); browser.unpipe(upstream); upstream.unpipe(browser); upstream.destroy() }
+      outgoing?.destroy()
+      if (status && !upgraded) reject(browser,status,rid,code)
+      else { if (code) report(code,rid); browser.destroy() }
+    }
+    const relay = (source,destination) => {
+      let blocked
+      destination.on('drain',()=>{if(blocked){clearTimeout(blocked);writes.delete(blocked);blocked=undefined}})
+      source.on('data',chunk=>{
+        bytes+=chunk.length
+        if (bytes>LIMITS.bytes || destination.writableLength+chunk.length>LIMITS.queued) finish('NATIVE_SOCKET_WRITE_BUDGET')
+      })
+      source.once('end',()=>{
+        if (done) return
+        closing ??= setTimeout(()=>finish('NATIVE_SOCKET_HALF_CLOSE'),LIMITS.close)
+        closing.unref?.()
+        destination.once('finish',()=>finish())
+      })
+      // Native pipe honors write(false)/drain. highWaterMark alone is a threshold, so the explicit queued cap above
+      // also stops a future/custom stream chunk that exceeds the admitted write budget.
+      source.pipe(destination)
+      // Observe after pipe's synchronous write so an unresponsive destination cannot retain its bounded queue
+      // until the much longer idle/lifetime limits. There is at most one stalled-write timer per direction.
+      source.on('data',()=>{
+        if (!done && destination.writableNeedDrain && !blocked) {
+          blocked=setTimeout(()=>finish('NATIVE_SOCKET_WRITE_TIMEOUT'),LIMITS.write)
+          blocked.unref?.();writes.add(blocked)
+        }
+      })
+    }
+    owned.add(finish)
+    browser.once('error',()=>finish('NATIVE_SOCKET_CLIENT_ERROR'))
+    browser.once('close',()=>finish())
+    browser.setTimeout(LIMITS.idle,()=>finish('NATIVE_SOCKET_IDLE'))
+    handshake=setTimeout(()=>finish('NATIVE_SOCKET_HANDSHAKE_TIMEOUT',504),LIMITS.handshake)
+    handshake.unref?.()
+    try {
+      outgoing=request(new URL('/_brain/socket',origin),{
+        method:'GET',agent:false,maxHeaderSize:8192,
+        headers:{host:origin.host,origin:site.origin,connection:'Upgrade',upgrade:'websocket','sec-websocket-version':'13','sec-websocket-key':key,'sec-websocket-protocol':PROTOCOL,'x-request-id':rid,...(credentials ? {cookie:credentials} : {}),...(authorization !== undefined ? {authorization} : {})},
+      })
+      outgoing.once('error',()=>finish('NATIVE_SOCKET_UPSTREAM_UNAVAILABLE',502))
+      outgoing.once('response',response=>{
+        response.destroy()
+        finish('NATIVE_SOCKET_UPSTREAM_REJECTED',[400,401,403,404,429,503].includes(response.statusCode) ? response.statusCode : 502)
+      })
+      outgoing.once('upgrade',(response,socket,buffered)=>{
+        if (done) { socket.destroy(); return }
+        upstream=socket
+        socket.on('error',()=>finish('NATIVE_SOCKET_UPSTREAM_ERROR'))
+        socket.once('close',()=>finish())
+        const expected=createHash('sha1').update(key+'258EAFA5-E914-47DA-95CA-C5AB0DC85B11').digest('base64')
+        if (response.statusCode !== 101 || !unique(response.rawHeaders,new Set(['upgrade','sec-websocket-accept','sec-websocket-protocol'])) || response.headers.upgrade?.toLowerCase() !== 'websocket' || !connectionUpgrade(response.headers.connection) || response.headers['sec-websocket-accept'] !== expected || response.headers['sec-websocket-protocol'] !== PROTOCOL || response.headers['sec-websocket-extensions'] || buffered.length>LIMITS.upstreamHead) return finish('NATIVE_SOCKET_BAD_UPSTREAM_HANDSHAKE',502)
+        clearTimeout(handshake)
+        lifetime=setTimeout(()=>finish('NATIVE_SOCKET_LIFETIME'),LIMITS.lifetime)
+        lifetime.unref?.()
+        socket.setTimeout(LIMITS.idle,()=>finish('NATIVE_SOCKET_IDLE'))
+        upgraded=true
+        browser.write(`HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: ${expected}\r\nSec-WebSocket-Protocol: ${PROTOCOL}\r\nCache-Control: no-store\r\nX-Request-Id: ${rid}\r\n\r\n`)
+        bytes=buffered.length+head.length
+        if (buffered.length) browser.write(buffered)
+        if (head.length) socket.write(head)
+        relay(browser,socket); relay(socket,browser); browser.resume()
+      })
+      outgoing.end()
+    } catch { finish('NATIVE_SOCKET_UPSTREAM_UNAVAILABLE',502) }
+  }
+  const closeOwned = () => { for (const finish of [...owned]) finish() }
+  const stop = () => { if (stopped) return; stopped=true; closeOwned() }
+  installed.add(server)
+  server.on('upgrade',upgrade)
+  server.once('close',()=>{stop();server.removeListener('upgrade',upgrade)})
+  const originalClose=server.close, originalAll=server.closeAllConnections
+  server.close=function(...args){stop();return originalClose.apply(this,args)}
+  if (originalAll) server.closeAllConnections=function(...args){closeOwned();return originalAll.apply(this,args)}
+  return stop
+}