npm - @christianirack/brainllm-runtime - Versions diffs - 0.5.0 → 0.6.1 - Mend

@christianirack/brainllm-runtime 0.5.0 → 0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/server/server.mjs CHANGED Viewed

@@ -6,9 +6,9 @@
 //
 // It serves, in this order:
 //   GET  /_health                → 200 {"ok":true,"build":"<sig>"}
-//   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC, 64 KB, rate limit, 10 s)
+//   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC; body, rate and time limits from brain.json `server`)
 //   GET  routes in the manifest  → SSR: load(ctx) → render the view on the DOM shim → page with props and SEO head
-//   GET  files in dist/          → static (precompressed .br/.gz when accepted; /_b/* immutable), clean URLs
+//   GET  files in dist/          → static (the smallest accepted .zst/.br/.gz sibling; /_b/* immutable), clean URLs
 //   anything else                → 404 page
 // Every response carries the security headers; every HTML response gets a fresh CSP nonce on each <script>.
 //
@@ -21,6 +21,7 @@ import { createServer as http, STATUS_CODES, request as httpRequest, Agent as Ht
 import net from 'node:net'
 import { installNativeSockets } from './native-sockets.mjs'
 import { Readable } from 'node:stream'
+import zlib from 'node:zlib'
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'
 import { existsSync, readFileSync, realpathSync, statSync, lstatSync } from 'node:fs'
 import * as Module from 'node:module'
@@ -67,6 +68,8 @@ const b64u = b => Buffer.from(b).toString('base64url')
 const tag = s => createHash('sha1').update(s).digest('base64url').slice(0, 22)
 // Errors a server function may throw on purpose: { errors: { field: msg } } → 422; { status, message } with 4xx → that
+const LIST_OPTIONS = ['search','limit','offset','filter','sort','cursor','after','include','aggregate','count']
+const FILTER_OPS = ['eq','ne','gt','gte','lt','lte','between','in','exists','prefix','iprefix','has']
 export class HttpError extends Error {
   constructor(status, message, extra) {
     super(message)
@@ -82,7 +85,20 @@ function intendedStatus(error) {
   const plain = Object.getPrototypeOf(error) === Object.prototype || Object.getPrototypeOf(error) === null
   return Number.isInteger(status) && STATUS_CODES[status] && (error instanceof HttpError && status >= 400 && status <= 599 || plain && status >= 400 && status < 500) ? status : null
 }
+// A deliberate public failure → { status, message } for f.error: a plain `{ message }` without a status (400) or an
+// author's Error subclass with a 4xx `status`. Plain `{ status, message }` keeps its message private (driver detail);
+// built-in errors and bare `Error` messages stay private too.
+const BUILTIN_ERRORS = new Set([Error, TypeError, RangeError, SyntaxError, ReferenceError, EvalError, URIError, AggregateError].map(c => c.prototype))
+function publicError(error) {
+  if (!error || typeof error !== 'object' || error instanceof HttpError) return null
+  const proto = Object.getPrototypeOf(error), plain = proto === Object.prototype || proto === null
+  const typed = error instanceof Error && !BUILTIN_ERRORS.has(proto)
+  const status = plain ? (error.status === undefined ? 400 : 0) : error.status, message = error.message
+  if (!(plain || typed) || typeof message !== 'string' || !message || message.length > 500) return null
+  return Number.isInteger(status) && status >= 400 && status < 500 && STATUS_CODES[status] ? { status, message } : null
+}
 const REDIRECT_CODES = new Set([301, 302, 303, 307, 308])
+const NOINDEX = 'noindex, nofollow'
 function safeLocation(value) {
   if (typeof value !== 'string' || value.length > 8192 || !value.startsWith('/') || value.startsWith('//') || /[\\\x00-\x20\x7f]/.test(value) || /^\/%2f/i.test(value) || /%(?:0[0-9a-f]|1[0-9a-f]|5c|7f)/i.test(value) || /%20/i.test(value.split(/[?#]/,1)[0])) throw new HttpError(500, 'Invalid same-site redirect location')
   return value
@@ -120,8 +136,11 @@ function defaultError(status, rid, home = '/') {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex,nofollow"><title>${status} — ${esc(title)}</title></head><body><main><h1>${status} — ${esc(title)}</h1><p>The request could not be completed. Try again or contact support with this reference.</p><p>Reference: <code>${esc(rid)}</code></p><a href="${esc(home)}">Return home</a></main></body></html>`
 }
-// Coding weights are transport preferences, not substring matches (br;q=0 explicitly forbids Brotli).
-export function acceptedEncodings(header = '') {
+// Coding weights are transport preferences, not substring matches (br;q=0 explicitly forbids Brotli). Ties keep the
+// server order: static files prefer their max-level .br, dynamic bodies prefer zstd (fastest at a Brotli-like ratio).
+// zstd is offered only where node:zlib has it (Node 22.15+).
+const ZSTD = typeof zlib.zstdCompressSync === 'function'
+export function acceptedEncodings(header = '', order = ['br', 'zstd', 'gzip']) {
   const values = new Map()
   for (const part of String(header).split(',')) {
     const [name, ...params] = part.trim().split(';')
@@ -132,8 +151,19 @@ export function acceptedEncodings(header = '') {
     }
     values.set(name.toLowerCase(),q)
   }
-  return ['br','gzip'].map(name => [name,values.get(name) ?? values.get('*') ?? 0]).filter(([,q]) => q > 0).sort((a,b) => b[1] - a[1]).map(([name]) => name)
+  return order.filter(name => name !== 'zstd' || ZSTD).map(name => [name,values.get(name) ?? values.get('*') ?? 0]).filter(([,q]) => q > 0).sort((a,b) => b[1] - a[1]).map(([name]) => name)
+}
+// Response compression (docs/PERFORMANCE.md): text bodies of at least 1 KiB, negotiated per request; a body that
+// already has an encoding, a `no-transform` cache policy or a status without content is sent as is.
+const COMPRESSIBLE = /^(?:text\/|image\/svg\+xml|application\/(?:json|javascript|xml|[\w.-]+\+(?:json|xml)))/i
+const DYNAMIC = ['zstd', 'br', 'gzip']
+const varyEncoding = v => (/accept-encoding/i.test(v || '') ? v : [v, 'Accept-Encoding'].filter(Boolean).join(', '))
+function bodyEncoding(req, status, headers) {
+  if (status < 200 || status === 204 || status === 206 || status === 304 || headers['content-encoding'] || !COMPRESSIBLE.test(headers['content-type'] || '') || /no-transform/i.test(headers['cache-control'] || '')) return null
+  return acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] || ''
 }
+const encodeBody = (enc, buf) => enc === 'zstd' ? zlib.zstdCompressSync(buf) : enc === 'br' ? zlib.brotliCompressSync(buf, { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5, [zlib.constants.BROTLI_PARAM_SIZE_HINT]: buf.length } }) : zlib.gzipSync(buf)
+const encodeStream = enc => enc === 'zstd' ? zlib.createZstdCompress() : enc === 'br' ? zlib.createBrotliCompress({ params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5 } }) : zlib.createGzip()
 function googleSignInPage(page) {
   let head = false, templates = 0
@@ -241,7 +271,7 @@ export function nativeAuthBridge(raw) {
       let outgoing, timer, done = false, bytes = 0, requestBytes = 0, failure
       const chunks = []
       const headers = { 'x-request-id':rid }
-      for (const key of ['origin','authorization','content-type','content-length','x-brain-rpc','accept','x-brain-webhook-id','x-brain-webhook-timestamp','x-brain-webhook-signature']) {
+      for (const key of ['origin','authorization','content-type','content-length','x-brain-rpc','accept','x-brain-webhook-id','x-brain-webhook-timestamp','x-brain-webhook-signature','user-agent','dnt','sec-gpc','cf-ipcountry']) {
         const value = req.headers[key]
         if (typeof value === 'string' && value.length <= 8192) headers[key] = value
       }
@@ -296,7 +326,7 @@ export function nativeAuthBridge(raw) {
       if (typeof id !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(id)) throw new HttpError(400, 'Invalid native record identifier')
       return '/api/' + name + '/' + id
     }
-    const request = async (method, path, body) => {
+    const request = async (method, path, body, notFound) => {
       if (response.writableEnded || response.destroyed) throw new HttpError(409, 'The server request has ended')
       if (method !== 'GET' && incoming.method !== 'POST') throw new HttpError(405, 'Native writes require a server function called through POST')
       let bytes = Buffer.alloc(0)
@@ -316,6 +346,14 @@ export function nativeAuthBridge(raw) {
       let value
       try {
         await proxy(req, response, new URL(path, target), rid, (_res, status, data, headers) => {
+          if (status === 422) {
+            // the backend's own field messages (never driver text): a server function that rethrows answers 422 {errors}
+            let fields
+            try { fields = JSON.parse(data.toString('utf8'))?.error?.fields } catch {}
+            const errors = fields && typeof fields === 'object' && !Array.isArray(fields) ? Object.fromEntries(Object.entries(fields).filter(([k, v]) => typeof v === 'string' && k.length <= 128).slice(0, 64).map(([k, v]) => [k, v.slice(0, 512)])) : {}
+            throw new HttpError(422, 'Invalid input', { errors })
+          }
+          if (status === 404 && notFound) { value = notFound(); return }
           if (status < 200 || status >= 300) throw new HttpError(status >= 400 && status < 500 ? status : 503, 'Native resource request failed')
           if (status === 204) { value = null; return }
           if (!String(headers['content-type'] || '').startsWith('application/json')) throw new HttpError(502, 'Native resource response must be JSON')
@@ -325,17 +363,80 @@ export function nativeAuthBridge(raw) {
       if (response.destroyed || response.writableEnded) throw new HttpError(409, 'The server request has ended')
       return value
     }
+    const names = (value, label) => {
+      const list = typeof value === 'string' ? value.split(',') : value
+      if (!Array.isArray(list) || list.length > 16 || list.some(item => typeof item !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(item))) throw new HttpError(400, `Invalid native ${label} names`)
+      return list.join(',')
+    }
     return Object.freeze({
+      // the HTTP list contract (docs/backend/filters.md, sorting.md, pagination.md): the backend validates declared
+      // filters and sorts and answers 422 {errors}; this only rejects shapes the query string cannot express
       list(options = {}) {
-        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => !['search','limit','offset'].includes(key))) throw new HttpError(400, 'Invalid native list options')
-        const {search = '', limit = 20, offset = 0} = options
-        if (typeof search !== 'string' || Buffer.byteLength(search) > 256 || !Number.isInteger(limit) || limit < 1 || limit > 100 || !Number.isInteger(offset) || offset < 0 || offset > 10000) throw new HttpError(400, 'Invalid native list pagination or search')
-        return request('GET', '/api/' + name + '?' + new URLSearchParams({search,limit:String(limit),offset:String(offset)}))
+        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => !LIST_OPTIONS.includes(key))) throw new HttpError(400, 'Invalid native list options')
+        const {search, limit, offset, filter, sort, cursor, after, include, aggregate, count} = options
+        if ((search !== undefined && (typeof search !== 'string' || Buffer.byteLength(search) > 256)) || (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 100)) || (offset !== undefined && (!Number.isInteger(offset) || offset < 0 || offset > 10000))) throw new HttpError(400, 'Invalid native list pagination or search')
+        const q = new URLSearchParams()
+        if (filter !== undefined) {
+          if (!filter || typeof filter !== 'object' || Array.isArray(filter) || Object.keys(filter).length > 32) throw new HttpError(400, 'Invalid native list filter')
+          const scalar = value => {
+            if (typeof value === 'number' && Number.isFinite(value)) return String(value)
+            if (typeof value === 'boolean') return String(value)
+            if (typeof value === 'string' && Buffer.byteLength(value) <= 256) return value
+            throw new HttpError(400, 'Invalid native filter value')
+          }
+          for (const [field, condition] of Object.entries(filter)) {
+            if (!/^[a-z][a-z0-9_]{0,47}(?:\.[a-z][a-z0-9_]{0,47})?$/.test(field)) throw new HttpError(400, 'Invalid native list filter field')
+            const ops = condition && typeof condition === 'object' && !Array.isArray(condition) ? Object.entries(condition) : [['eq', condition]]
+            if (!ops.length) throw new HttpError(400, 'Invalid native filter value')
+            for (const [op, value] of ops) {
+              if (!FILTER_OPS.includes(op)) throw new HttpError(400, 'Invalid native filter operator')
+              let raw
+              if (op === 'in' || op === 'between' || op === 'has') {
+                const items = Array.isArray(value) ? value : [value]
+                if (!items.length || items.length > 50 || (op === 'between' && items.length !== 2)) throw new HttpError(400, 'Invalid native filter value')
+                raw = items.map(scalar)
+                if (raw.some(item => item.includes(','))) throw new HttpError(400, 'Invalid native filter value')
+                raw = raw.join(',')
+              } else raw = scalar(value)
+              q.append(op === 'eq' ? field : `${field}[${op}]`, raw)
+            }
+          }
+        }
+        if (search !== undefined) q.set('search', search)
+        if (limit !== undefined) q.set('limit', String(limit))
+        if (offset !== undefined) q.set('offset', String(offset))
+        if (sort !== undefined) {
+          const keys = typeof sort === 'string' ? sort.split(',') : sort
+          if (!Array.isArray(keys) || !keys.length || keys.length > 4 || keys.some(key => typeof key !== 'string' || !/^-?[a-z][a-z0-9_]{0,47}$/.test(key))) throw new HttpError(400, 'Invalid native list sort')
+          q.set('sort', keys.join(','))
+        }
+        if (cursor !== undefined && after !== undefined) throw new HttpError(400, 'Use either cursor or after')
+        for (const [key, value] of [['cursor', cursor], ['after', after]]) if (value !== undefined) {
+          if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,2048}$/.test(value)) throw new HttpError(400, 'Invalid native list cursor')
+          q.set(key, value)
+        }
+        for (const [key, value] of [['include', include], ['aggregate', aggregate], ['count', count]]) if (value !== undefined) q.set(key, names(value, key))
+        const query = q.toString()
+        return request('GET', '/api/' + name + (query ? '?' + query : ''))
+      },
+      get(id, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => key !== 'include')) throw new HttpError(400, 'Invalid native get options')
+        const path = idPath(id)
+        return request('GET', options.include === undefined ? path : path + '?' + new URLSearchParams({include: names(options.include, 'include')}))
       },
-      get: id => request('GET', idPath(id)),
       create: values => request('POST', '/api/' + name, values),
       update: (id, values) => request('PUT', idPath(id), values),
+      // only the sent fields change (docs/backend/patch.md); null clears an optional field
+      async patch(id, values) {
+        if (values && typeof values === 'object' && !Array.isArray(values) && !Object.keys(values).length) throw new HttpError(422, 'Send at least one field', { errors: { body: 'Send at least one field to change' } })
+        return request('PATCH', idPath(id), values)
+      },
       remove: id => request('DELETE', idPath(id)),
+      // an earlier slug of a readable record → its current slug; live, unknown or unreadable slugs → null
+      slugRedirect(slug) {
+        if (typeof slug !== 'string' || !/^[A-Za-z0-9._~-]{1,512}$/.test(slug)) throw new HttpError(400, 'Invalid native slug')
+        return request('GET', '/api/' + name + '/redirects/' + slug, undefined, () => null).then(value => typeof value?.slug === 'string' ? value.slug : null)
+      },
     })
   }
   async function login(incoming,response,rid,credentials) {
@@ -363,9 +464,16 @@ export function nativeAuthBridge(raw) {
     } finally {request.destroy();bytes.fill(0)}
     return {user}
   }
+  // ctx.backend for one server request (load, actions, RPC, dev sidecar): the same object everywhere
+  const backend = (incoming, response, rid) => Object.freeze({
+    resource: name => resource(incoming, response, rid, name),
+    slugRedirect: (name, slug) => resource(incoming, response, rid, name).slugRedirect(slug),
+    login: credentials => login(incoming, response, rid, credentials),
+  })
   return {
     proxy,
     resource,
+    backend,
     login,
     async prepare(req, res, rid) {
       if (!cookies(req, false)) { req.$nativeUser = null; req.$nativeAuth ||= Promise.resolve(); return }
@@ -400,10 +508,9 @@ export function createServer(o = {}) {
   const env = Object.freeze({ ...(o.env || ENV) }) // ctx.env: what the supervisor passed, read-only
   const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL)
   if (o.nativeSockets !== undefined && typeof o.nativeSockets !== 'boolean') throw Error('nativeSockets must be an explicit boolean')
-  const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? 10000)
-  const LIMIT = +(o.rateLimit ?? env.BRAIN_RPC_LIMIT ?? 60) // per IP + function, per minute
-  const MAX_BODY = 64 * 1024
+  const SITEMAP_BYTES = +(o.sitemapBytes ?? 50 * 1024 * 1024) // protocol: 50 MB uncompressed per sitemap file
   const secret = o.secret ?? env.BRAIN_SECRET ?? ''
+  const COMPRESS = o.compress !== false && env.BRAIN_COMPRESS !== 'off' // a proxy that already compresses can opt out
   const sink = o.log || ((level, msg, extra) => console[level === 'error' ? 'error' : 'log'](json({ t: new Date().toISOString(), level, msg, ...extra })))
   const log = (level, msg, extra = {}) => {
     const safe = { ...extra }
@@ -418,10 +525,35 @@ export function createServer(o = {}) {
       safe.private = true; safe.valuesCaptured = false
       safe.fix = kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
     }
+    // a compiler budget failure (brain-budget.js) keeps its own code, limit, source position and fix
+    const b = safe.budgetFailure
+    delete safe.budgetFailure
+    if (b) Object.assign(safe, b)
     if (typeof safe.path === 'string') safe.path = safe.path.split(/[?#]/, 1)[0].slice(0, 2048)
     sink(level, msg, safe)
   }
+  // log fields for a thrown value: its stack (sanitized by log) plus, for B09xx budget failures, the typed fields only
+  const trace = e => {
+    const out = { stack: String((e && e.stack) || e) }
+    if (e && e.kind === 'budget' && /^B09\d\d$/.test(e.code) && typeof e.budget === 'string' && /^[a-zA-Z]{1,16}$/.test(e.budget)) {
+      const str = (v, n) => typeof v === 'string' ? v.slice(0, n) : null, pos = v => Number.isSafeInteger(v) && v > 0 ? v : null
+      out.budgetFailure = { code: e.code, budget: e.budget, limit: Number.isFinite(e.limit) ? e.limit : null, file: str(e.file, 256), component: str(e.component, 80), line: pos(e.line), column: pos(e.column), fix: str(e.fix, 200) || 'Bound the work or move it to an owned worker.' }
+    }
+    return out
+  }
   const mf = readManifest(dist)
+  // brain.json `server` (§11.1), written into the manifest by the build; createServer options and env still win
+  const SL = mf.server || {}
+  const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? SL.timeoutMs ?? 10000)
+  const LIMIT = +(o.rateLimit ?? env.BRAIN_RPC_LIMIT ?? SL.rpcPerMinute ?? 60) // per IP + function, per minute
+  const BODY_KB = +(o.maxBodyKB ?? env.BRAIN_MAX_BODY_KB ?? SL.maxBodyKB ?? 1024)
+  if (!Number.isInteger(BODY_KB) || BODY_KB < 1 || BODY_KB > 65536) throw Error('brain.json server.maxBodyKB must be an integer from 1 to 65536 (KB)')
+  const MAX_BODY = BODY_KB * 1024 // RPC and form bodies; bounded reads never buffer more
+  const TOO_BIG = `Body larger than ${BODY_KB} KB; raise brain.json server.maxBodyKB`
+  // a streamed route holds its 200 head this long for load() (#232): a load that settles in time still answers its
+  // real status (303 redirect, 404 notFound, deliberate 4xx, 500); a slower one streams and handles them inline
+  const STREAM_HOLD = +(o.streamHoldMs ?? 200)
+  const tooBig = (rid, path) => (log('warn', 'body too large', { rid, path, limitKB: BODY_KB, fix: 'Raise brain.json server.maxBodyKB (or BRAIN_MAX_BODY_KB), up to 65536' }), TOO_BIG)
   const hasManifestSockets = Object.hasOwn(mf,'nativeSockets')
   if (hasManifestSockets && typeof mf.nativeSockets !== 'boolean') throw Error('Manifest nativeSockets must be an explicit boolean')
   const nativeSockets = o.nativeSockets === undefined ? hasManifestSockets && mf.nativeSockets : o.nativeSockets
@@ -434,6 +566,7 @@ export function createServer(o = {}) {
   // Base path (§23 #148): the app lives under mf.base ("/app/"); routes, files and functions are matched on the app
   // path (base stripped); redirects the app gives as app paths get it back.
   const BASE = mf.base || '/'
+  const analyticsTag = native && (o.analytics ?? env.BRAIN_ANALYTICS) !== 'off' && o.analytics !== false ? `<script type="module" async src="${BASE}_brain/analytics.js"></script>` : ''
   const RD = mf.redirects || {}, RDX = (RD.patterns || []).map(p => ({ re: new RegExp(p.re), to: p.to, status: p.status || 301 }))
   // `/old/` and `/old` are the same source (brain-seo normalizes the trailing slash)
   const redirectOf = path => {
@@ -447,6 +580,28 @@ export function createServer(o = {}) {
     return null
   }
   const withBase = u => (typeof u === 'string' && BASE !== '/' && u.startsWith('/') && !u.startsWith('//') && !(u + '/').startsWith(BASE) ? BASE + u.slice(1) : u)
+  // §33 crawler-safe URLs: the redirect rule, the trailing-slash policy (brain.json seo.trailingSlash, default "never")
+  // and the canonical host (seo.canonicalHost → site) are folded into ONE hop; loopback hosts are never redirected
+  // (a proxy that does not forward Host, local runs). The query is kept unless a rule's target has its own.
+  const SLASH = RD.slash || 'never', HOST = typeof RD.host === 'string' && /^https?:\/\//.test(RD.host) ? new URL(RD.host) : null
+  const loopback = h => !h || /^(?:localhost|127(?:\.\d+){3}|\[::1\])(?::\d+)?$/i.test(h)
+  const canonicalOf = (req, url) => {
+    let path = url.pathname, query = url.search, status = 301, moved = false
+    const to = redirectOf(path)
+    if (to) {
+      if (/^https?:\/\//.test(to[0])) return [to[0], to[1], true]
+      const q = to[0].indexOf('?')
+      path = q < 0 ? to[0] : to[0].slice(0, q)
+      if (q >= 0) query = to[0].slice(q)
+      status = to[1]
+      moved = true
+    }
+    if (path !== '/' && SLASH === 'never' && path.endsWith('/')) path = path.replace(/\/+$/, '') || '/'
+    else if (path !== '/' && SLASH === 'always' && !path.endsWith('/') && !/\.[^/]*$/.test(path)) path += '/'
+    const host = HOST && !loopback(req.headers.host) && req.headers.host.toLowerCase() !== HOST.host
+    if (!moved && !host && path === url.pathname) return null
+    return [(host ? HOST.origin : '') + withBase(path) + query, status, host]
+  }
   hook(distURL, BASE)
   // ---------- helpers ----------
@@ -483,6 +638,16 @@ export function createServer(o = {}) {
         delete headers['content-length']; delete headers['content-encoding']; delete headers.etag
       }
     }
+    const enc = COMPRESS ? bodyEncoding(res.req, status, headers) : null
+    if (enc != null) {
+      headers = { ...headers, vary: varyEncoding(headers.vary) }
+      const size = body ? Buffer.byteLength(body) : 0
+      if (enc && size >= 1024 && res.req.method !== 'HEAD') {
+        body = encodeBody(enc, Buffer.isBuffer(body) ? body : Buffer.from(body))
+        headers['content-encoding'] = enc
+        delete headers['content-length']
+      }
+    }
     res.writeHead(status, { ...SECURITY, ...(server.draining ? { connection: 'close' } : {}), ...headers })
     res.end(res.req.method === 'HEAD' || status === 204 || status === 205 || status === 304 ? undefined : body)
   }
@@ -495,13 +660,18 @@ export function createServer(o = {}) {
       if (inm && inm.split(',').some(t => t.trim().replace(/^W\//, '') === etag.replace(/^W\//, ''))) return send(res, 304, '', headers)
     }
     const nonce = randomBytes(16).toString('base64')
+    // behavior analytics (docs/backend/analytics.md): with a native backend every page loads its collector as an async
+    // module served by that backend, outside the build and the route budgets; BRAIN_ANALYTICS=off skips the tag
+    if (analyticsTag && !page.includes(analyticsTag)) page = page.includes('</head>') ? page.replace('</head>', analyticsTag + '</head>') : page + analyticsTag
     const body = page.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
     send(res, status, body, { 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache', ...(googleSignInPage(page) ? { 'cross-origin-opener-policy': 'same-origin-allow-popups' } : {}), ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...headers })
   }
   const notFound = (req, res) => failPage(res, 404, res.getHeader('x-request-id'))
+  // `gone()` from load (§33): 410 tells crawlers the URL was removed for good; views/410.brain, else the 404 page
+  const missing = (req, res, x) => (x && x.gone === true ? failPage(res, 410, res.getHeader('x-request-id')) : notFound(req, res))
   const failPage = (res, status, rid) => {
     if (!wantsHtml(res.req)) return send(res, status, json({ schemaVersion: 1, status, rid, error: STATUS_CODES[status] || 'Request failed' }), { 'content-type': MIME['.json'] })
-    const custom = (status === 404 && mf.notFound) || (mf.errors && mf.errors[status]) || `${status}.html`
+    const custom = (status === 404 && mf.notFound) || (mf.errors && mf.errors[status]) || (status === 410 && !file('410.html') ? mf.notFound : `${status}.html`)
     const path = typeof custom === 'string' && file(custom)
     return html(res, status, path ? readFileSync(path, 'utf8') : defaultError(status, rid, BASE))
   }
@@ -528,7 +698,7 @@ export function createServer(o = {}) {
     const { user, session: ses } = native ? { user: req.$nativeUser ?? null, session: native.session(req, res, res.getHeader('x-request-id')) } : sessionFrom(cookies, secret)
     return {
       url, query: Object.fromEntries(url.searchParams), cookies, user, session: ses, env,
-      ...(native ? { backend: Object.freeze({resource: name => native.resource(req, res, res.getHeader('x-request-id'), name),login:credentials=>native.login(req,res,res.getHeader('x-request-id'),credentials)}) } : {}),
+      ...(native ? { backend: native.backend(req, res, res.getHeader('x-request-id')) } : {}),
       // `prefetch`: the router fetched this page ahead of a click (§19); a `load` with side effects can skip them
       prefetch: req.headers['x-brain-prefetch'] === '1',
       req: { method: req.method, headers: req.headers, ip: ipOf(req) }, ...extra,
@@ -608,38 +778,42 @@ export function createServer(o = {}) {
         for (const m of route.middleware || []) middleware.push(await load(m))
         r = await runChain({ guards, middleware, ctx })
       } catch (e) {
-        log('error', 'guard failed', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+        log('error', 'guard failed', { rid, path: url.pathname, ...trace(e) })
         return errorPage(req, res, route, params, url, rid)
       }
-      if (r.redirect) return send(res, r.status, '', { location: withBase(redirect(r.redirect, r.status ?? 303).redirect), 'cache-control': 'no-store', ...ctx.session.headers() })
+      // a guarded page must not reach the index through its login redirect (§33): the redirect itself says noindex
+      if (r.redirect) return send(res, r.status, '', { location: withBase(redirect(r.redirect, r.status ?? 303).redirect), 'cache-control': 'no-store', 'x-robots-tag': NOINDEX, ...ctx.session.headers() })
       if (r.deny !== undefined) return forbidden(req, res, url, rid, r.deny)
       extra = r.headers
     }
-    if (route.stream && route.server && !fixed && !forms && status === 200 && !res.$capture) return streamed(req, res, route, params, url, rid, ctx, keep(extra || {}))
+    // what load() thrown or returned instead of props answers: redirect, notFound() (F11), deliberate status, failure
+    const loadOutcome = e => {
+      if (e && e.redirect) return send(res, e.status || 303, '', { location: withBase(redirect(e.redirect, e.status ?? 303).redirect), ...ctx.session.headers() })
+      if ((e instanceof HttpError && e.status === 404) || (e && e.notFound === true)) return missing(req, res, e) // `notFound()` 404 / `gone()` 410
+      const status = intendedStatus(e) || 500
+      log('error', 'load failed', { rid, path: url.pathname, status, ...trace(e) })
+      return status === 500 ? errorPage(req, res, route, params, url, rid) : failPage(res, status, rid)
+    }
+    if (route.stream && route.server && !fixed && !forms && status === 200 && !res.$capture) return streamed(req, res, route, params, url, rid, ctx, keep(extra || {}), loadOutcome)
     try {
       if (!fixed && route.server) {
         const m = await load(route.server)
         if (typeof m.load === 'function') props = (await withTimeout(Promise.resolve(m.load(ctx)), TIMEOUT)) ?? {}
       }
     } catch (e) {
-      if (e && e.redirect) return send(res, e.status || 303, '', { location: withBase(redirect(e.redirect, e.status ?? 303).redirect), ...ctx.session.headers() })
-      if ((e instanceof HttpError && e.status === 404) || (e && e.notFound === true)) return notFound(req, res) // `throw notFound()` (F11)
-      const status = intendedStatus(e) || 500
-      log('error', 'load failed', { rid, path: url.pathname, status, stack: String((e && e.stack) || e) })
-      return status === 500 ? errorPage(req, res, route, params, url, rid) : failPage(res, status, rid)
+      return loadOutcome(e)
     }
-    if (props && props.redirect) return send(res, props.status || 303, '', { location: withBase(redirect(props.redirect, props.status ?? 303).redirect), ...ctx.session.headers() })
-    if (props && props.notFound === true) return notFound(req, res) // `return notFound()` (F11)
+    if (props && (props.redirect || props.notFound === true)) return loadOutcome(props) // `return redirect()` / `return notFound()`
     let body, seo, failed
     try {
       const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) } // route() (§41.5)
       ;({ body, seo, failed } = await (queue = queue.then(() => render(route, props, forms, at), () => render(route, props, forms, at))))
     } catch (e) {
-      log('error', 'render failed', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+      log('error', 'render failed', { rid, path: url.pathname, ...trace(e) })
       return failPage(res, 500, rid)
     }
     // a component that failed shows its fallback inside the page (still 200); the error goes to the log with the rid
-    for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, stack: String((f.e && f.e.stack) || f.e) })
+    for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, ...trace(f.e) })
     const page = readFileSync(file(route.page), 'utf8')
       .replace('<!--brain:ssr-->', () => body)
       .replace('<!--brain:props-->', () => jsonInHtml(props))
@@ -651,19 +825,33 @@ export function createServer(o = {}) {
     html(res, status, out, keep({ ...extra, ...ctx.session.headers() }), own ? undefined : 'W/"' + tag(out) + '"')
   }
   // Streaming SSR (#232, `route.stream`: the build sets it when the view's <meta seo> is static and it has a load()):
-  // the page up to the region (head, CSS, layout shell) is sent at once, the view when load() ends. The status and
-  // headers are already out by then, so a redirect from load() becomes location.replace and a failure an inline notice
-  // with the request id (both logged); load() cannot change the session on a streamed route.
-  async function streamed(req, res, route, params, url, rid, ctx, extra) {
+  // load() starts first and the head waits up to STREAM_HOLD for it: a load that redirects, is not found or throws a
+  // status in that time gets the same answer as a non-streamed route (`outcome`). Past it, the page up to the region
+  // (head, CSS, layout shell) is sent, the view when load() ends. The status and headers are out by then, so a late
+  // redirect becomes location.replace and a late failure an inline notice with the request id (both logged); load()
+  // cannot change the session on a streamed route.
+  async function streamed(req, res, route, params, url, rid, ctx, extra, outcome) {
     const [top, bottom = ''] = readFileSync(file(route.page), 'utf8').split('<!--brain:ssr-->')
     const sm = await load(route.server)
+    const loadP = typeof sm.load === 'function' ? withTimeout(Promise.resolve().then(() => sm.load(ctx)), TIMEOUT) : Promise.resolve(null)
+    loadP.catch(() => {}) // handled below; never an unhandled rejection while the loading view renders
+    let timer
+    const early = await Promise.race([loadP.then(v => ({ v }), e => ({ e })), new Promise(r => (timer = setTimeout(r, STREAM_HOLD)))])
+    clearTimeout(timer)
+    if (early && (early.e !== undefined || (early.v && (early.v.redirect || early.v.notFound === true)))) return outcome(early.e !== undefined ? early.e : early.v)
     const seoF = sm.seo || (await load(route.view)).default.seo
     if (route.i18n) await load(route.i18n)
     const nonce = randomBytes(16).toString('base64'), n = h => h.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
+    const enc = COMPRESS && req.method !== 'HEAD' ? acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] : null
     res.writeHead(200, {
       ...SECURITY, 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache',
       ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...extra, ...ctx.session.headers(),
+      ...(COMPRESS ? { vary: varyEncoding(extra.vary) } : {}), ...(enc ? { 'content-encoding': enc } : {}),
     })
+    // each chunk is flushed through the encoder, so the head still reaches the browser before load() ends
+    const zs = enc ? encodeStream(enc) : null
+    if (zs) zs.pipe(res)
+    const write = s => (zs ? (zs.write(s), zs.flush()) : res.write(s))
     globalThis.__brainLocale = route.locale || null
     let seo0 = null
     try {
@@ -671,25 +859,22 @@ export function createServer(o = {}) {
     } finally {
       globalThis.__brainLocale = null
     }
-    // load() starts now: the loading view (#253) renders while it runs
-    const loadP = typeof sm.load === 'function' ? withTimeout(Promise.resolve().then(() => sm.load(ctx)), TIMEOUT) : Promise.resolve(null)
-    loadP.catch(() => {}) // handled below; never an unhandled rejection while the loading view renders
     const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) }
-    res.write(n(head(top, seo0, url.pathname)))
+    write(n(head(top, seo0, url.pathname)))
     // QA #253: the folder's _loading.brain goes in the region with the first chunk (SPEC: shows while load runs),
     // between two marker comments; the last chunk starts with a script that removes them and what is between
     let clear = ''
-    if (route.loading) {
+    if (route.loading && !early) { // the loading view (#253) only when load() is still running
       try {
         const lr = { ...route, view: route.loading, layouts: [], server: null }
         const { body } = await (queue = queue.then(() => render(lr, {}, null, at), () => render(lr, {}, null, at)))
-        res.write(n(`<!--brain:loading-->${body}<!--/brain:loading-->`))
+        write(n(`<!--brain:loading-->${body}<!--/brain:loading-->`))
         clear = `<script>{const s=document.currentScript;let x=0;for(const c of[...s.parentNode.childNodes]){if(c.data=='brain:loading')x=1;if(x)c.remove();if(c.data=='/brain:loading')x=0}s.remove()}</script>`
       } catch (e) {
-        log('error', 'loading view failed (streamed)', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+        log('error', 'loading view failed (streamed)', { rid, path: url.pathname, ...trace(e) })
       }
     }
-    const end = (body, props = {}, b = bottom) => res.end(n(clear + body + b.replace('<!--brain:props-->', () => jsonInHtml(props))))
+    const end = (body, props = {}, b = bottom) => (zs || res).end(n(clear + body + b.replace('<!--brain:props-->', () => jsonInHtml(props))))
     // QA #289: the page closes with the _error.brain template (its client mounts the error view with { message, rid }),
     // never with the route's own mount script, which would replace the error with the view rendered from {}. Without an
     // _error.brain the notice stays: the view's mount script is left out.
@@ -706,19 +891,20 @@ export function createServer(o = {}) {
       props = (await loadP) ?? {}
       if (props.redirect || props.notFound === true) throw props
     } catch (e) {
-      if (e && e.redirect) return end(`<script>location.replace(${jsonInHtml(withBase(redirect(e.redirect, e.status ?? 303).redirect))})</script>`)
+      // too late for a real redirect: the page says noindex so the stub never enters the index
+      if (e && e.redirect) return end(`<meta name="robots" content="noindex"><script>location.replace(${jsonInHtml(withBase(redirect(e.redirect, e.status ?? 303).redirect))})</script>`)
       // a streamed page already sent its 200 head: the region gets the not-found notice and the page is noindex
       if (e && e.notFound === true) return end(`<meta name="robots" content="noindex"><p role="alert" class="brain-fallback">Page not found.</p>`, {}, bottom.replace(/<script type="module">(?:(?!<\/script>)[\s\S])*?brain-view[\s\S]*?<\/script>/g, ''))
-      log('error', 'load failed (streamed)', { rid, path: url.pathname, status: 200, stack: String((e && e.stack) || e) }) // headers already out
+      log('error', 'load failed (streamed)', { rid, path: url.pathname, status: 200, ...trace(e) }) // headers already out
       return fail()
     }
     try {
       const { body, failed } = await (queue = queue.then(() => render(route, props, null, at), () => render(route, props, null, at)))
-      for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, stack: String((f.e && f.e.stack) || f.e) })
+      for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, ...trace(f.e) })
       const pm = params && Object.keys(params).length ? `<meta name="brain-params" content="${esc(JSON.stringify(params))}">` : ''
       end(pm + body, props)
     } catch (e) {
-      log('error', 'render failed (streamed)', { rid, path: url.pathname, status: 200, stack: String((e && e.stack) || e) })
+      log('error', 'render failed (streamed)', { rid, path: url.pathname, status: 200, ...trace(e) })
       await fail()
     }
   }
@@ -735,6 +921,7 @@ export function createServer(o = {}) {
   }
   // deny → views/403.brain (manifest `forbidden`, props.reason) or the static 403.html, always status 403
   function forbidden(req, res, url, rid, reason) {
+    res.setHeader('x-robots-tag', NOINDEX) // a members-only page never enters the index (§33)
     if (!wantsHtml(req)) return failPage(res, 403, rid)
     if (mf.forbidden) return ssr(req, res, mf.forbidden, {}, url, rid, null, 403, { reason })
     const f = file('403.html')
@@ -809,7 +996,7 @@ export function createServer(o = {}) {
     try {
       raw = await body(req, MAX_BODY)
     } catch {
-      return fail(413, 'Body larger than 64 KB')
+      return fail(413, tooBig(rid, url.pathname))
     }
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params: {} })
@@ -817,11 +1004,11 @@ export function createServer(o = {}) {
     try {
       f = (await load(modPath))[fn]
     } catch (e) {
-      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, stack: String((e && e.stack) || e) })
+      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
       return fail(500, 'Internal error', { rid })
     }
     const r = await callRpc({ fn: f, args: raw, ctx, timeout: TIMEOUT })
-    if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, stack: String((r.cause && r.cause.stack) || r.cause) })
+    if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, ...trace(r.cause) })
     const b = r.status >= 500 ? { ...r.body, rid } : r.body
     send(res, r.status, json(b), { 'content-type': MIME['.json'], 'cache-control': 'no-store', ...(r.headers || {}), ...ctx.session.headers() })
   }
@@ -849,7 +1036,7 @@ export function createServer(o = {}) {
     try {
       raw = await body(req, MAX_BODY)
     } catch {
-      return plain(413, 'Form larger than 64 KB')
+      return plain(413, tooBig(rid, url.pathname))
     }
     const id = new URLSearchParams(raw).get('_brain') || '', modPath = mf.rpc[id.split('/')[0]]
     if (!modPath) return plain(400, 'Unknown form')
@@ -859,12 +1046,13 @@ export function createServer(o = {}) {
     try {
       module = await load(modPath)
       rules = await load('_server/brain-form.js')
+      if (route.i18n) await load(route.i18n) // the page's dictionary: validation messages in its language (§37)
     } catch (e) {
-      log('error', 'form module failed to load', { rid, fn: id, stack: String((e && e.stack) || e) })
+      log('error', 'form module failed to load', { rid, fn: id, ...trace(e) })
       return failPage(res, 500, rid)
     }
-    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT })
-    if (r.cause) log('error', 'form failed', { rid, fn: id, stack: String((r.cause && r.cause.stack) || r.cause) })
+    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
+    if (r.cause) log('error', 'form failed', { rid, fn: id, ...trace(r.cause) })
     if (r.status === 303) return send(res, 303, '', { location: withBase(r.location), 'cache-control': 'no-store', ...ctx.session.headers() })
     if (r.status === 422) return ssr(req, res, route, params, url, rid, r.state, 422)
     plain(r.status, r.body.error, r.headers)
@@ -902,11 +1090,13 @@ export function createServer(o = {}) {
         for (const p of Array.isArray(list) ? list : []) {
           const path = fill(r.path, p)
           if (!path) continue
-          if (urls.length < MAX_URLS) urls.push({ loc: origin + withBase(path), lastmod: day(p.lastmod) })
+          const loc = origin + withBase(path)
+          if (loc.length > 2048) log('warn', 'sitemap(): URL longer than 2048 characters left out; fix: shorten the slug', { view: r.view, loc: loc.slice(0, 120) })
+          else if (urls.length < MAX_URLS) urls.push({ loc, lastmod: day(p.lastmod) })
           else dropped++
         }
       } catch (e) {
-        log('error', 'sitemap() failed', { view: r.view, stack: String((e && e.stack) || e) })
+        log('error', 'sitemap() failed', { view: r.view, ...trace(e) })
       }
     }
     if (dropped) log('warn', 'sitemap(): more than 50000 URLs, the rest are not listed', { dropped })
@@ -919,6 +1109,23 @@ export function createServer(o = {}) {
     if (!dynRun) dynRun = collect(origin).finally(() => (dynRun = null))
     return dynRun
   }
+  // §33 S01: every sitemap file holds at most 50 000 URLs and SITEMAP_BYTES bytes of UTF-8 XML; the dynamic URLs fill
+  // /sitemap-dynamic.xml, /sitemap-dynamic-2.xml, … in sitemap() order, so the split is deterministic
+  const SET_HEAD = '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n'
+  const SET_FOOT = '</urlset>\n'
+  const bytes = t => Buffer.byteLength(t)
+  function pages(urls) {
+    const out = [[]]
+    let size = bytes(SET_HEAD + SET_FOOT)
+    for (const u of urls) {
+      const line = `  <url><loc>${esc(u.loc)}</loc>${u.lastmod ? `<lastmod>${esc(u.lastmod)}</lastmod>` : ''}</url>\n`
+      const n = bytes(line)
+      if (out.at(-1).length && (out.at(-1).length >= MAX_URLS || size + n > SITEMAP_BYTES)) out.push([]), (size = bytes(SET_HEAD + SET_FOOT))
+      out.at(-1).push(line)
+      size += n
+    }
+    return out.map(p => p.join(''))
+  }
   async function serveSitemap(req, res, url) {
     const f = file('/sitemap.xml')
     if (!f) return false
@@ -926,22 +1133,24 @@ export function createServer(o = {}) {
     const origin = [...text.matchAll(/<loc>(https?:\/\/[^<]+)<\/loc>/g)].map(m => URL.canParse(m[1]) && new URL(m[1]).origin).find(Boolean)
     if (!origin) return false
     const index = text.includes('<sitemapindex')
-    const urls = await dynamicUrls(origin)
-    // a urlset that would pass 50 000 URLs with the dynamic ones is split: index → static file + dynamic file
-    const split = !index && (text.match(/<url>/g) || []).length + urls.length > MAX_URLS
+    const sets = pages(await dynamicUrls(origin))
+    // a urlset that would pass either limit with the dynamic URLs is split: index → static file + dynamic file(s)
+    const split = !index && (sets.length > 1 || (text.match(/<url>/g) || []).length + (sets[0].match(/<url>/g) || []).length > MAX_URLS || bytes(text) + bytes(sets[0]) > SITEMAP_BYTES)
     const xml = body => send(res, 200, req.method === 'HEAD' ? '' : body, { 'content-type': MIME['.xml'], 'cache-control': 'public, max-age=300' })
     if (url.pathname === '/sitemap-static.xml') return split ? (xml(text), true) : false
-    if (url.pathname === '/sitemap-dynamic.xml' && !index && !split) return false
+    const name = i => (i ? `/sitemap-dynamic-${i + 1}.xml` : '/sitemap-dynamic.xml')
     const child = p => `  <sitemap><loc>${esc(origin + withBase(p))}</loc></sitemap>\n`
-    const set = urls.map(u => `  <url><loc>${esc(u.loc)}</loc>${u.lastmod ? `<lastmod>${esc(u.lastmod)}</lastmod>` : ''}</url>\n`).join('')
+    const kids = sets.map((_, i) => child(name(i))).join('')
+    if (url.pathname !== '/sitemap.xml') {
+      const i = sets.findIndex((_, i) => name(i) === url.pathname)
+      return i >= 0 && (index || split) ? (xml(SET_HEAD + sets[i] + SET_FOOT), true) : false
+    }
     xml(
-      url.pathname === '/sitemap-dynamic.xml'
-        ? `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${set}</urlset>\n`
-        : index
-          ? text.replace('</sitemapindex>', `${child('/sitemap-dynamic.xml')}</sitemapindex>`)
-          : split
-            ? `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${child('/sitemap-dynamic.xml')}</sitemapindex>\n`
-            : text.replace('</urlset>', set + '</urlset>'),
+      index
+        ? text.replace('</sitemapindex>', `${kids}</sitemapindex>`)
+        : split
+          ? `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${kids}</sitemapindex>\n`
+          : text.replace('</urlset>', sets[0] + '</urlset>'),
     )
     return true
   }
@@ -970,7 +1179,7 @@ export function createServer(o = {}) {
   function serveStatic(req, res, url) {
     const p = publicStaticPath(url.pathname)
     if (p === null) return false
-    const candidates = p.endsWith('/') ? [p + 'index.html'] : [p, p + '.html', p + '/index.html']
+    const candidates = p.endsWith('/') ? [p + 'index.html', ...(p.length > 1 ? [p.slice(0, -1) + '.html'] : [])] : [p, p + '.html', p + '/index.html']
     for (const c of candidates) {
       const f = file(c)
       if (!f) continue
@@ -989,13 +1198,16 @@ export function createServer(o = {}) {
         'cache-control': p.startsWith('/_b/') ? 'public, max-age=31536000, immutable' : p === '/sw.js' ? 'no-cache' : 'public, max-age=3600',
         vary: 'accept-encoding',
       }
+      // the smallest precompressed sibling the client accepts (the build keeps only those smaller than the file)
+      let best = null
       for (const enc of acceptedEncodings(req.headers['accept-encoding'])) {
-        const suffix = enc === 'br' ? '.br' : '.gz'
-        const encoded = file(c + suffix)
-        if (encoded) {
-          send(res, 200, req.method === 'HEAD' ? '' : readFileSync(encoded), { ...headers, 'content-encoding': enc })
-          return true
-        }
+        const encoded = file(c + (enc === 'br' ? '.br' : enc === 'zstd' ? '.zst' : '.gz'))
+        const size = encoded ? statSync(encoded).size : Infinity
+        if (encoded && (!best || size < best.size)) best = { enc, encoded, size }
+      }
+      if (best) {
+        send(res, 200, req.method === 'HEAD' ? '' : readFileSync(best.encoded), { ...headers, 'content-encoding': best.enc })
+        return true
       }
       send(res, 200, req.method === 'HEAD' ? '' : readFileSync(f), headers)
       return true
@@ -1025,12 +1237,9 @@ export function createServer(o = {}) {
       req.$brainPath = url.pathname
       if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
       // redirects.json (manifest `redirects`, brain-seo server_json): exact sources first, then patterns, on the app path;
-      // same-site targets get the base, the query is kept when the target has none
-      const to = redirectOf(url.pathname)
-      if (to && (req.method === 'GET' || req.method === 'HEAD')) {
-        const loc = /^https?:\/\//.test(to[0]) ? to[0] : withBase(to[0]) + (to[0].includes('?') ? '' : url.search)
-        return send(res, to[1], '', { location: loc, 'cache-control': to[1] === 301 || to[1] === 308 ? 'public, max-age=3600' : 'no-store' }, true)
-      }
+      // same-site targets get the base, the query is kept when the target has none; slash policy and host in the same hop
+      const to = (req.method === 'GET' || req.method === 'HEAD') && canonicalOf(req, url)
+      if (to) return send(res, to[1], '', { location: to[0], 'cache-control': to[1] === 301 || to[1] === 308 ? 'public, max-age=3600' : 'no-store' }, to[2])
       const r = /^\/_r\/([\w-]+)\/([\w$]+)$/.exec(url.pathname)
       if (r) return await rpc(req, res, r[1], r[2], url, rid)
       if (url.pathname.startsWith('/_r/')) return send(res, 404, json({ error: 'Unknown function' }), { 'content-type': MIME['.json'] })
@@ -1046,11 +1255,11 @@ export function createServer(o = {}) {
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
-      if (DYN.length && (url.pathname === '/sitemap.xml' || url.pathname === '/sitemap-dynamic.xml' || url.pathname === '/sitemap-static.xml') && (await serveSitemap(req, res, url))) return
+      if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return
       if (serveStatic(req, res, url)) return
       notFound(req, res)
     } catch (e) {
-      log('error', 'unhandled', { rid, path: req.url, stack: String((e && e.stack) || e) })
+      log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
       if (!res.headersSent) failPage(res, intendedStatus(e) || 500, rid)
       else res.end()
     }
@@ -1204,6 +1413,8 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return { status: 422, body: { error: e.message || 'Invalid input', errors: e.errors } }
     if (e instanceof HttpError && e.status === 504) return { status: 504, body: { error: 'Timeout' }, cause: e }
+    const pub = publicError(e)
+    if (pub) return { status: pub.status, body: { error: pub.message } }
     const deliberate = intendedStatus(e)
     if (deliberate && deliberate < 500) return { status: deliberate, body: { error: e instanceof HttpError ? e.message : STATUS_CODES[deliberate] } }
     if (deliberate) return {status:deliberate,body:{error:STATUS_CODES[deliberate]},cause:e}
@@ -1213,7 +1424,10 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
 // A form posted without JS (§38) → { status: 303, location } | { status: 422, state } | { status, body } (400/429).
 // `module` exports the function and `$forms`; `rules` = { rule, check } (brain-schema / brain-form). `state` is what the
 // page re-renders with: { '<hash>/<fn>': { values, errors, error } }.
-export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000 }) {
+// `locale` (§37): the page's language, so the schema messages (`form.*`) and the generic error come from its dictionary
+// (globalThis.__brainDict, filled by the page's chunk) like form() in the browser. It is set only around the synchronous
+// validation, so concurrent requests in other languages never see it.
+export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000, locale }) {
   const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = id.split('/')[1] || ''
   if (key) {
     const ra = overLimit(key, limit)
@@ -1221,7 +1435,16 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   }
   if (!/^[A-Za-z_$][\w$]*$/.test(fn) || typeof (module && module[fn]) !== 'function') return { status: 400, body: { error: 'Unknown form' } }
   const schema = module.$forms && module.$forms[fn]
-  const { values, errors } = schema ? coerce(rules, schema, q) : { values: Object.fromEntries([...q].filter(([k]) => k !== '_brain')), errors: {} }
+  const G = globalThis, had = '__brainLocale' in G, prev = G.__brainLocale
+  let values, errors, generic
+  if (locale) G.__brainLocale = locale
+  try {
+    ;({ values, errors } = schema ? coerce(rules, schema, q) : { values: Object.fromEntries([...q].filter(([k]) => k !== '_brain')), errors: {} })
+    const D = G.__brainDict, m = locale && D && D[locale] && D[locale]['form.error']
+    generic = typeof m === 'string' ? m : 'Something went wrong. Try again.'
+  } finally {
+    if (locale) had ? (G.__brainLocale = prev) : delete G.__brainLocale
+  }
   const again = (errs, error, cause) => ({ status: 422, state: { [id]: { values, errors: errs, error } }, cause })
   if (Object.keys(errors).length) return again(errors, '')
   let r
@@ -1230,10 +1453,12 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return again(e.errors, '')
     if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message)
+    const pub = publicError(e)
+    if (pub) return again({}, pub.message)
     const deliberate = intendedStatus(e)
     if (deliberate && deliberate < 500) return {status:deliberate,body:{error:STATUS_CODES[deliberate]}}
     if (deliberate) return {status:deliberate,body:{error:STATUS_CODES[deliberate]},cause:e}
-    return again({}, 'Something went wrong. Try again.', e)
+    return again({}, generic, e)
   }
   if (r && r.errors) return again(r.errors, '')
   const to = r && r.redirect != null ? safeLocation(r.redirect) : ctx.url.pathname + ctx.url.search
@@ -1292,7 +1517,7 @@ function body(req, max) {
     // past the limit the rest is drained without keeping it (so the 413 reaches the client); far past it, cut
     req.on('data', c => {
       n += c.length
-      if (n > 16 * max) req.destroy()
+      if (n > max + Math.min(15 * max, 16 << 20)) req.destroy() // at most 16 MB of drain for a large limit
       else if (n <= max) parts.push(c)
     })
     req.on('end', () => (n > max ? fail(new Error('too large')) : ok(Buffer.concat(parts).toString('utf8'))))