@christianirack/brainllm-runtime 0.7.0 → 0.8.0

package/brain-data.js

@@ -380,10 +380,11 @@ async function once(u, M, body, sg, pri, up) {
   if (st === 401 && P.login && G.location && !location.pathname.endsWith(P.login)) location.assign(appBase() + P.login + '?next=' + encodeURIComponent(location.pathname + location.search))
   const native = j && j.schemaVersion === 1 && j.error && typeof j.error === 'object' && typeof j.error.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(j.error.code)
   const fields = native && st === 422 ? j.error.fields : j && j.errors
-  // "highlighted fields" only when there are fields to highlight: else the backend's own fix, or a plain sentence
-  const generic = st === 401 ? 'Authentication failed. Sign in again.' : st === 403 ? 'You do not have permission to continue.' : st === 422 ? (fields && Object.keys(fields).length ? 'Check the highlighted fields.' : (native && typeof j.error.fix === 'string' && j.error.fix.slice(0, 512)) || 'The server rejected this request. Check it and try again.') : st === 429 ? 'Too many requests. Wait before trying again.' : `Request failed (${st}).`
+  // "highlighted fields" only when there are fields to highlight. The backend's `fix` is for the developer (error.fix),
+  // never visitor text: it is English and names what the app should change.
+  const generic = st === 401 ? 'Authentication failed. Sign in again.' : st === 403 ? 'You do not have permission to continue.' : st === 422 ? (fields && Object.keys(fields).length ? 'Check the highlighted fields.' : 'The server rejected this request. Check it and try again.') : st === 429 ? 'Too many requests. Wait before trying again.' : `Request failed (${st}).`
   const message = !native && st < 500 && typeof j?.error === 'string' && j.error.length <= 512 && !/[\r\n]|(?:TypeError|ReferenceError|SyntaxError|Error):/.test(j.error) ? j.error : generic
-  throw new ApiError('http', message, { status: st, errors: fields, retryAfter, id: h('x-request-id') || undefined, ...(native ? { backendCode: j.error.code, fix: typeof j.error.fix === 'string' ? j.error.fix.slice(0,1024) : undefined } : {}) })
+  throw new ApiError('http', message, { status: st, errors: fields, retryAfter, id: h('x-request-id') || undefined, plain: message === generic, ...(native ? { backendCode: j.error.code, fix: typeof j.error.fix === 'string' ? j.error.fix.slice(0,1024) : undefined } : {}) })
 }
 
 // multipart upload with progress (fetch has no upload progress)

package/brain-form.js

@@ -1,7 +1,7 @@
 // BRAINLLM forms (INTERNALS §14). `let f = form(schema, { submit: async (v) => … })` →
 //   bind:value={f.v.email} · {f.err.email} · f.busy · f.error (form-level) · f.ok · on:submit={f.submit}
-// Schema mini-language per field: `str num bool email url date` + `!` required + `<=N >=N` (length for str and lists,
-// value for num) + `[T]` list of T, or a nested schema object (a type from types.jsbrain).
+// Schema mini-language per field: `str num bool email url date tel file` + `!` required + `<=N >=N` (length for str and
+// lists, value for num, bytes for file) + `[T]` list of T, or a nested schema object (a type from types.jsbrain).
 // Validation: a field is validated when it loses focus and every field on submit; errors show only after that.
 // The element of each field is found without ids: the control that has focus while its value is written (the
 // `bind:` input handler), or on submit `form.elements[name]`. On it the runtime keeps `aria-invalid` and, when the
@@ -42,7 +42,7 @@ if (globalThis.addEventListener && !globalThis.__brainDirtyHook) {
   })
 }
 const empty = v => v == null || typeof v === 'string' && v.trim() === '' || Array.isArray(v) && !v.length
-const init0 = r => (r.list ? [] : r.t === 'bool' ? false : '')
+const init0 = r => (r.list ? [] : r.t === 'bool' ? false : r.t === 'file' ? null : '')
 const out = (r, v) => {
   if (r.list) {
     if (!Array.isArray(v)) return []
@@ -277,9 +277,10 @@ function createForm(schema, o, readRule, validateRule, remote) {
         shown.v++
       })
       if (o.validate && !first) {
-        const cross = o.validate(values()) // cross-field rules: { field: msg }
-        if (cross && Object.keys(cross).length) {
-          mark(cross)
+        const cross = o.validate(values()) // cross-field rules: { field: msg }; an empty message means valid
+        const failed = cross && Object.fromEntries(Object.entries(cross).filter(([, message]) => message))
+        if (failed && Object.keys(failed).length) {
+          mark(failed)
           return void aim()
         }
       }
@@ -303,8 +304,9 @@ function createForm(schema, o, readRule, validateRule, remote) {
       } catch (x) {
         if (x?.errors) mark(x.errors)
         // a server failure reads the same as without JS: 4xx and the author's own errors keep their message; 5xx and a
-        // TypeError (the network dropped, or a bug) get the generic one
-        else if (x?.kind !== 'aborted') error.v = (!(x?.status >= 500) && x?.name !== 'TypeError' && x?.message) || msg('form.error', GENERIC)
+        // TypeError (the network dropped, or a bug) get the generic one; the runtime's own English sentence (`plain`) gives
+        // way to the app's translated form.rejected
+        else if (x?.kind !== 'aborted') error.v = (!(x?.status >= 500) && x?.name !== 'TypeError' && (x?.plain ? msg('form.rejected', x.message) : x?.message)) || msg('form.error', GENERIC)
       } finally {
         busy.v = false
         if (fm) fm.removeAttribute('aria-busy')

package/brain-observe.js

@@ -0,0 +1,120 @@
+// Dev observability panel. `brain run` loads this file; builds never contain it. Alt+Shift+O or `?brain-observe` opens it.
+// It shows what the running page does: Web Vitals, requests, long frames, errors and live components, and "Pick" names
+// the component and source file of an element. `__brainObserve.snapshot()` returns the same data as JSON for an agent.
+import { live } from './brain-dev.js'
+import { sub } from './brain-err.js'
+import { vitals } from './brain-vitals.js'
+
+const LIMIT = 40
+const data = { vitals: {}, requests: [], frames: [], errors: 0, updates: 0 }
+const keep = (list, item) => { list.unshift(item); if (list.length > LIMIT) list.pop() }
+let host, box, on = false, timer, picking = null
+
+const CSS = `:host{all:initial;position:fixed;left:16px;bottom:16px;z-index:2147483646;font:12px/1.45 system-ui,-apple-system,sans-serif;color:#1a1a1a}
+.p{width:min(420px,calc(100vw - 32px));max-height:min(70vh,560px);overflow:auto;box-sizing:border-box;border-radius:16px;padding:12px 14px;background:rgba(255,255,255,.76);
+-webkit-backdrop-filter:blur(20px) saturate(1.6);backdrop-filter:blur(20px) saturate(1.6);border:1px solid rgba(0,0,0,.08);
+box-shadow:0 1px 3px rgba(16,24,40,.08),0 12px 32px rgba(16,24,40,.14)}@supports not (backdrop-filter:blur(1px)){.p{background:#fff}}
+@media (prefers-color-scheme:dark){:host{color:#f2f2f2}.p{background:rgba(28,28,30,.84);border-color:rgba(255,255,255,.1)}}
+.h{display:flex;justify-content:space-between;align-items:center;gap:8px;font-weight:600}h3{margin:10px 0 4px;font-size:11px;font-weight:600;opacity:.65}
+.v{display:flex;flex-wrap:wrap;gap:6px;font-variant-numeric:tabular-nums}.v span{padding:2px 7px;border-radius:8px;background:rgba(127,127,127,.14)}
+.good{color:#0a7d32}.needs-improvement{color:#a85b00}.poor,.bad{color:#d70015}
+.r{display:flex;gap:8px;font-variant-numeric:tabular-nums}.r b{font-weight:500;min-width:30px}.r i{flex:1;font-style:normal;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.e{opacity:.6}
+button{font:inherit;padding:3px 10px;border-radius:8px;border:1px solid rgba(127,127,127,.35);background:transparent;color:inherit;cursor:pointer}`
+
+const el = (tag, cls, text) => Object.assign(document.createElement(tag), cls ? { className: cls } : {}, text === undefined ? {} : { textContent: text })
+const fileOf = i => i.C?.f ?? null
+const nameOf = i => i.C?.C?.name || i.C?.name || i.h
+
+export function components() {
+  const rows = []
+  for (const [hash, set] of live) if (set.size) { const i = set.values().next().value; rows.push({ name: nameOf(i), file: fileOf(i), hash, instances: set.size }) }
+  return rows.sort((a, b) => b.instances - a.instances)
+}
+// The innermost live component: brain-dev marks each root element of an instance with `$i`.
+export function componentOf(node) {
+  for (let n = node; n; n = n.parentNode ?? n.host) {
+    const i = n.$i
+    if (i) return { name: nameOf(i), file: fileOf(i), hash: i.h }
+  }
+  return null
+}
+export const snapshot = () => ({ path: location.pathname, vitals: { ...data.vitals }, requests: data.requests.slice(), longFrames: data.frames.slice(), errors: data.errors, hotUpdates: data.updates, components: components() })
+
+function section(title, rows, empty) {
+  const out = [el('h3', '', title)]
+  if (!rows.length) out.push(el('div', 'e', empty))
+  return out.concat(rows)
+}
+function draw() {
+  if (!box) return
+  const pick = el('button', '', picking ? 'Picking… Esc cancels' : 'Pick')
+  pick.onclick = () => (picking ? stopPick() : startPick())
+  const head = el('div', 'h', 'brain observe')
+  head.append(pick)
+  const metrics = el('div', 'v')
+  for (const [name, m] of Object.entries(data.vitals)) metrics.append(el('span', m.rating, `${name} ${m.value}${name === 'CLS' ? '' : ' ms'}`))
+  const row = (a, b, c, cls) => { const r = el('div', 'r' + (cls ? ' ' + cls : '')); r.append(el('b', '', a), el('i', '', b), el('span', '', c)); return r }
+  box.replaceChildren(
+    head,
+    ...section('Web Vitals', metrics.childElementCount ? [metrics] : [], 'Waiting for the browser to report.'),
+    ...section(`Requests (${data.requests.length})`, data.requests.slice(0, 8).map(r => row(String(r.status ?? '…'), `${r.method ?? ''} ${r.url}`, `${r.ms ?? '?'} ms`, r.status >= 400 ? 'bad' : '')), 'No api() request yet.'),
+    ...section(`Long frames (${data.frames.length}) · errors ${data.errors} · hot updates ${data.updates}`, data.frames.slice(0, 4).map(f => row(`${f.ms}`, f.source || 'unattributed', 'ms')), 'No frame over 50 ms.'),
+    ...section(`Components (${live.size})`, components().slice(0, 8).map(c => row(`×${c.instances}`, c.file ?? c.name, '')), 'None mounted.'),
+  )
+}
+function toggle(force) {
+  on = force ?? !on
+  try { on ? sessionStorage.setItem('brain:observe', '1') : sessionStorage.removeItem('brain:observe') } catch {}
+  if (!on) { stopPick(); clearInterval(timer); host?.remove(); return on }
+  if (!host) {
+    host = document.createElement('brain-observe')
+    const root = host.attachShadow({ mode: 'open' })
+    root.append(el('style', '', CSS))
+    box = root.appendChild(el('div', 'p'))
+  }
+  document.body.append(host)
+  draw()
+  timer = setInterval(draw, 1000)
+  return on
+}
+function startPick() {
+  const mark = el('div')
+  mark.style.cssText = 'position:fixed;z-index:2147483645;pointer-events:none;outline:2px solid #0071e3;background:rgba(0,113,227,.08);border-radius:3px'
+  const tip = el('div')
+  tip.style.cssText = 'position:fixed;z-index:2147483645;pointer-events:none;padding:2px 8px;border-radius:6px;background:#111;color:#fff;font:12px ui-monospace,monospace'
+  document.body.append(mark, tip)
+  const move = ev => {
+    if (ev.target === host) return
+    const r = ev.target.getBoundingClientRect(), c = componentOf(ev.target)
+    Object.assign(mark.style, { left: r.left + 'px', top: r.top + 'px', width: r.width + 'px', height: r.height + 'px' })
+    Object.assign(tip.style, { left: r.left + 'px', top: Math.max(0, r.top - 24) + 'px' })
+    tip.textContent = c ? c.file ?? c.name : 'outside any component'
+  }
+  const click = ev => {
+    if (ev.target === host) return
+    ev.preventDefault(); ev.stopPropagation()
+    const c = componentOf(ev.target)
+    if (c) console.info('brain:observe', c)
+    dispatchEvent(new CustomEvent('brain:observe-pick', { detail: c }))
+    stopPick()
+  }
+  const key = ev => ev.key === 'Escape' && stopPick()
+  addEventListener('mousemove', move, true); addEventListener('click', click, true); addEventListener('keydown', key, true)
+  picking = () => { removeEventListener('mousemove', move, true); removeEventListener('click', click, true); removeEventListener('keydown', key, true); mark.remove(); tip.remove() }
+  draw()
+}
+function stopPick() { picking?.(); picking = null; draw() }
+
+export function start() {
+  vitals(m => { data.vitals[m.name] = m })
+  addEventListener('brain:net', ev => keep(data.requests, ev.detail))
+  addEventListener('brain:hmr', () => data.updates++)
+  sub.add(() => data.errors++)
+  if (PerformanceObserver.supportedEntryTypes?.includes('long-animation-frame'))
+    new PerformanceObserver(list => { for (const e of list.getEntries()) keep(data.frames, { ms: Math.round(e.duration), source: e.scripts?.[0]?.sourceURL ? new URL(e.scripts[0].sourceURL, location.href).pathname : '' }) }).observe({ type: 'long-animation-frame', buffered: true })
+  addEventListener('keydown', ev => { if (ev.altKey && ev.shiftKey && ev.code === 'KeyO') { ev.preventDefault(); toggle() } })
+  globalThis.__brainObserve = { snapshot, toggle, componentOf }
+  let saved = false
+  try { saved = sessionStorage.getItem('brain:observe') === '1' } catch {}
+  if (saved || new URLSearchParams(location.search).has('brain-observe')) toggle(true)
+}

package/brain-router.js

@@ -36,6 +36,7 @@ export function navigate(to, o = {}) {
   if (/[\\\x00-\x20\x7f]/.test(raw)) throw Error('Invalid navigation target')
   const u = app(raw)
   if (active) return active.go(u, o.replace ? 'replace' : true)
+  if (G.__brainDevGo) return G.__brainDevGo(u, o.replace)
   o.replace ? location.replace(u) : location.assign(u)
 }
 G.__brainNavigate = navigate // brain-form follows a server function's { redirect } without importing the router

package/brain-schema.js

@@ -1,7 +1,7 @@
 // BRAINLLM schema mini-language (INTERNALS §14, §15): shared by form() (brain-form.js), api() validation
 // (brain-data.js) and server.mjs, so a page that only fetches data does not load the form module.
-// Per field: `str num bool email url date` + `!` required + `<=N >=N` (length for str and lists, value for num) + `[T]`
-// list of T, or a nested schema object.
+// Per field: `str num bool email url date tel file` + `!` required + `<=N >=N` (length for str and lists, value for num,
+// bytes for file) + `[T]` list of T, or a nested schema object. `file(image/*,.pdf)` names the accepted types.
 const RX_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 const G = globalThis
 
@@ -9,7 +9,8 @@ const G = globalThis
 // i18n/<locale>.json; plural objects allowed for keys with `{n}`), else the English text. The table is read directly
 // (globalThis.__brainDict, filled by brain-i18n.js `add`) so a page that only validates does not load brain-i18n.js.
 // Keys: form.required form.list form.min_items form.max_items form.item form.number form.min form.max form.email
-// form.url form.date form.text form.boolean form.min_chars form.max_chars.
+// form.url form.date form.text form.boolean form.min_chars form.max_chars form.tel form.file form.file_type
+// form.file_min form.file_max.
 export function msg(key, en, vars) {
   const D = G.__brainDict
   if (D) {
@@ -29,14 +30,21 @@ export function msg(key, en, vars) {
 }
 
 // 'str!<=80' → { t: 'str', req: true, min, max, list: false }
-const TYPES = new Set(['str', 'num', 'bool', 'email', 'url', 'date'])
+const TYPES = new Set(['str', 'num', 'bool', 'email', 'url', 'date', 'tel', 'file'])
+const ACCEPT = /^(?:\.[a-z0-9]+|[a-z]+\/(?:\*|[a-z0-9.+-]+))$/
 function scalarRule(s) {
-  if (typeof s !== 'string' || s.length > 256) throw Error('form: invalid rule (use str num bool email url date, ! required, <=N >=N, [T])')
-  const m = /^(?:([a-z]+)(!)?|\[([a-z]+)(!)?\](!)?)((?:[<>]=-?\d+(?:\.\d+)?)*)$/.exec(s)
-  if (!m || m[4] && m[5]) throw Error(`form: invalid rule '${s}' (use str num bool email url date, ! required, <=N >=N, [T])`)
-  const r = { t: m[1] || m[3], req: !!(m[2] || m[4] || m[5]), list: !!m[3], min: null, max: null }
+  const syntax = '(use str num bool email url date tel file, file(image/*,.pdf), ! required, <=N >=N, [T])'
+  if (typeof s !== 'string' || s.length > 256) throw Error(`form: invalid rule ${syntax}`)
+  const m = /^(?:([a-z]+)(?:\(([^()]*)\))?(!)?|\[([a-z]+)(?:\(([^()]*)\))?(!)?\](!)?)((?:[<>]=-?\d+(?:\.\d+)?)*)$/.exec(s)
+  if (!m || m[6] && m[7]) throw Error(`form: invalid rule '${s}' ${syntax}`)
+  const r = { t: m[1] || m[4], req: !!(m[3] || m[6] || m[7]), list: !!m[4], min: null, max: null }
   if (!TYPES.has(r.t)) throw Error(`form: unknown type '${r.t}'`)
-  for (const [, op, n] of m[6].matchAll(/([<>])=(-?\d+(?:\.\d+)?)/g)) {
+  const accept = m[2] ?? m[5]
+  if (accept != null) {
+    r.accept = accept.split(',').map(a => a.trim().toLowerCase())
+    if (r.t !== 'file' || !r.accept.every(a => ACCEPT.test(a))) throw Error(`form: invalid rule '${s}' ${syntax}`)
+  }
+  for (const [, op, n] of m[8].matchAll(/([<>])=(-?\d+(?:\.\d+)?)/g)) {
     const key = op === '<' ? 'max' : 'min', value = Number(n)
     if (r[key] != null || !Number.isFinite(value) || (!r.list && r.t === 'bool') || ((r.list || r.t !== 'num') && (!Number.isSafeInteger(value) || value < 0))) throw Error(`form: invalid bounds in rule '${s}'`)
     r[key] = value
@@ -73,6 +81,24 @@ function calendarDate(s) {
   return year > 0 && month > 0 && month <= 12 && day > 0 && day <= days[month - 1]
 }
 
+// A phone as people write it: optional leading +, digits with single separators, 7 to 15 digits (E.164's maximum).
+function validTel(s) {
+  const t = s.trim()
+  if (!/^\+?\(?\d(?:[ .()-]{0,2}\d)*$/.test(t)) return false
+  const digits = t.replace(/\D/g, '').length
+  return digits >= 7 && digits <= 15
+}
+// The browser's File/Blob shape. The type and name come from the client: the server has to verify the content again.
+const isFile = v => !!v && typeof v === 'object' && typeof v.size === 'number' && typeof v.type === 'string'
+const accepted = (r, f) => r.accept.some(a => a[0] === '.' ? String(f.name || '').toLowerCase().endsWith(a) : a.endsWith('/*') ? f.type.toLowerCase().startsWith(a.slice(0, -1)) : f.type.toLowerCase() === a)
+function checkFile(r, f) {
+  if (!isFile(f)) return msg('form.file', 'Choose a file')
+  if (r.accept && !accepted(r, f)) return msg('form.file_type', 'This file type is not allowed')
+  if (r.min != null && f.size < r.min) return msg('form.file_min', `The file must be at least ${r.min} bytes`, { n: r.min })
+  if (r.max != null && f.size > r.max) return msg('form.file_max', `The file must be at most ${r.max} bytes`, { n: r.max })
+  return ''
+}
+
 const plural = (n, w) => `${n} ${w}${n === 1 ? '' : 's'}`
 
 // Compiler-only validators for proven unbounded scalars. Separate entry points let
@@ -106,6 +132,7 @@ export function check(r, v) {
     }
     return ''
   }
+  if (r.t === 'file' && !empty(v)) return checkFile(r, v)
   if (Array.isArray(v)) return msg(r.t === 'num' ? 'form.number' : r.t === 'bool' ? 'form.boolean' : 'form.text', r.t === 'num' ? 'Enter a number' : r.t === 'bool' ? 'Choose true or false' : 'Enter text')
   if (empty(v)) return r.req ? msg('form.required', 'Required') : ''
   if (r.t === 'bool') return typeof v !== 'boolean' ? msg('form.boolean', 'Choose true or false') : r.req && !v ? msg('form.required', 'Required') : ''
@@ -132,9 +159,14 @@ export function check(r, v) {
     case 'date':
       if (typeof v !== 'string' || !calendarDate(s)) return msg('form.date', 'Enter a valid date')
       break
+    case 'tel':
+      if (typeof v !== 'string' || !validTel(s)) return msg('form.tel', 'Enter a valid phone number')
+      break
     case 'str':
       if (typeof v !== 'string') return msg('form.text', 'Enter text')
       break
+    case 'file':
+      return msg('form.file', 'Choose a file')
     default:
       throw Error(`form: unknown type '${r.t}'`)
   }

package/brain-vitals.js

@@ -0,0 +1,60 @@
+// Core Web Vitals, opt-in: `vitals(report)` measures in this page and `reportVitals(url)` sends the final values.
+// Nothing is emitted unless an app imports this module. Metrics a browser lacks are never reported, so read them as
+// optional: LCP and INP do not exist in every engine. Thresholds are the published web.dev good/poor limits.
+const LIMITS = { LCP: [2500, 4000], CLS: [0.1, 0.25], INP: [200, 500], FCP: [1800, 3000], TTFB: [800, 1800] }
+const rate = (name, value) => (value <= LIMITS[name][0] ? 'good' : value <= LIMITS[name][1] ? 'needs-improvement' : 'poor')
+
+export function vitals(report, env = globalThis) {
+  const PO = env.PerformanceObserver
+  const types = PO?.supportedEntryTypes ?? []
+  const stops = []
+  const send = (name, value) => report({ name, value: name === 'CLS' ? +value.toFixed(4) : Math.round(value), rating: rate(name, value) })
+  const watch = (type, options, read) => {
+    if (!types.includes(type)) return
+    const po = new PO(list => read(list.getEntries()))
+    po.observe({ type, buffered: true, ...options })
+    stops.push(() => po.disconnect())
+  }
+  const nav = env.performance?.getEntriesByType?.('navigation')?.[0]
+  if (nav?.responseStart > 0) send('TTFB', nav.responseStart)
+  watch('paint', {}, list => { for (const e of list) if (e.name === 'first-contentful-paint') send('FCP', e.startTime) })
+  watch('largest-contentful-paint', {}, list => { const last = list[list.length - 1]; if (last) send('LCP', last.startTime) })
+  // CLS: the worst session window (gap under 1 s, at most 5 s long), without shifts caused by recent input.
+  let worst = 0, sum = 0, first = 0, previous = 0
+  watch('layout-shift', {}, list => {
+    for (const e of list) {
+      if (e.hadRecentInput) continue
+      if (sum && e.startTime - previous < 1000 && e.startTime - first < 5000) sum += e.value
+      else { sum = e.value; first = e.startTime }
+      previous = e.startTime
+      if (sum > worst) { worst = sum; send('CLS', worst) }
+    }
+  })
+  // INP: the slowest interaction, one in 50 discarded as an outlier, as the metric's definition says.
+  const slow = new Map()
+  let inp = -1
+  watch('event', { durationThreshold: 40 }, list => {
+    for (const e of list) if (e.interactionId) slow.set(e.interactionId, Math.max(slow.get(e.interactionId) ?? 0, e.duration))
+    const all = [...slow.values()].sort((a, b) => b - a)
+    const value = all[Math.min(all.length - 1, Math.floor(all.length / 50))]
+    if (value !== undefined && value !== inp) send('INP', (inp = value))
+    if (slow.size > 500) for (const key of [...slow.keys()].slice(0, 250)) slow.delete(key)
+  })
+  return () => { for (const stop of stops) stop() }
+}
+
+// One beacon each time the page is hidden, with what changed since the last one; the query string is never sent.
+export function reportVitals(url, env = globalThis) {
+  if (typeof url !== 'string' || !url.startsWith('/')) throw new TypeError('reportVitals(url): pass a same-origin path, such as "/api/vitals"')
+  const doc = env.document
+  const fresh = new Map()
+  const stop = vitals(metric => fresh.set(metric.name, metric), env)
+  const flush = () => {
+    if (doc.visibilityState !== 'hidden' || !fresh.size) return
+    const body = JSON.stringify({ path: env.location.pathname, metrics: [...fresh.values()] })
+    if (env.navigator.sendBeacon?.(url, new Blob([body], { type: 'application/json' }))) fresh.clear()
+  }
+  doc.addEventListener('visibilitychange', flush)
+  env.addEventListener('pagehide', flush)
+  return () => { stop(); doc.removeEventListener('visibilitychange', flush); env.removeEventListener('pagehide', flush) }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/llm.mjs

@@ -0,0 +1,199 @@
+// Server LLM module (INTERNALS §51): `ctx.llm`, one provider-neutral call for Anthropic and OpenAI. Zero dependencies.
+// Provider contracts reviewed 2026-10-31 against the official documentation:
+// - Anthropic: platform.claude.com/docs/en/api/messages, /api/versioning, /api/errors, /build-with-claude/streaming.
+//   API version 2026-10-21 rejects temperature, top_p and top_k with a 400, so the neutral API has no sampling options.
+// - OpenAI: developers.openai.com/api/reference/resources/responses/methods/create, /api/docs/guides/streaming-responses
+//   and the event schemas of github.com/openai/openai-openapi (Responses API, stored off with `store: false`).
+// Keys come only from the server environment. An error never carries a key; provider text stays in `detail`, redacted.
+const LLM_PROVIDERS = {
+  anthropic: { key: 'ANTHROPIC_API_KEY', model: 'ANTHROPIC_MODEL', base: 'ANTHROPIC_BASE_URL', origin: 'https://api.anthropic.com' },
+  openai: { key: 'OPENAI_API_KEY', model: 'OPENAI_MODEL', base: 'OPENAI_BASE_URL', origin: 'https://api.openai.com' },
+}
+const LLM_ANTHROPIC_VERSION = '2026-10-21'
+const LLM_DEFAULT_TIMEOUT = 60000, LLM_MAX_TIMEOUT = 600000, LLM_DEFAULT_MAX_TOKENS = 1024
+const LLM_MAX_BODY = 32 * 1024 * 1024, LLM_MAX_LINE = 4 * 1024 * 1024, LLM_MAX_DETAIL = 500
+
+export class LlmError extends Error {
+  constructor(code, status, message, fix, extra = {}) {
+    super(message)
+    this.name = 'LlmError'
+    this.code = code
+    this.status = status
+    this.fix = fix
+    Object.assign(this, extra)
+  }
+}
+const llmConfig = (message, fix) => new LlmError('B0921', 503, message, fix)
+const llmFailure = (status, message, extra) => new LlmError('B0922', status, message, 'Inspect err.provider, err.providerStatus and err.detail on the server', extra)
+
+function llmResolve(env, o) {
+  if (!o || typeof o !== 'object') throw llmConfig('ctx.llm needs an options object', 'Pass { messages: [{ role: "user", content: "…" }] } or { prompt: "…" }')
+  const requested = o.provider ?? env.BRAIN_LLM_PROVIDER
+  if (requested != null && requested !== '' && !Object.hasOwn(LLM_PROVIDERS, requested)) throw llmConfig(`Unknown LLM provider "${String(requested).slice(0, 40)}"`, 'Use "anthropic" or "openai"')
+  const present = Object.keys(LLM_PROVIDERS).filter(name => env[LLM_PROVIDERS[name].key])
+  const provider = requested || (present.length === 1 ? present[0] : null)
+  if (!provider) throw llmConfig(present.length ? 'Both LLM provider keys are set and none is selected' : 'No LLM provider key is set', present.length ? 'Pass { provider } or set BRAIN_LLM_PROVIDER in .brain_env' : 'Set ANTHROPIC_API_KEY or OPENAI_API_KEY in .brain_env (never with PUBLIC_)')
+  const p = LLM_PROVIDERS[provider], key = env[p.key]
+  if (!key) throw llmConfig(`${p.key} is not set`, `Set ${p.key} in .brain_env (never with PUBLIC_)`)
+  const model = o.model ?? env[p.model]
+  if (typeof model !== 'string' || !model) throw llmConfig(`No model selected for ${provider}`, `Pass { model } or set ${p.model} in .brain_env; BRAINLLM pins no model`)
+  let base
+  try { base = new URL(env[p.base] || p.origin) } catch { throw llmConfig(`${p.base} is not a URL`, `Set ${p.base} to an https address`) }
+  const loopback = base.hostname === '127.0.0.1' || base.hostname === 'localhost' || base.hostname === '[::1]'
+  if (base.protocol !== 'https:' && !(base.protocol === 'http:' && loopback)) throw llmConfig(`${p.base} must use https`, 'Only a loopback address may use plain http')
+  if (base.username || base.password) throw llmConfig(`${p.base} must not carry credentials`, `Keep the key in ${p.key}`)
+  const messages = o.messages ?? (typeof o.prompt === 'string' ? [{ role: 'user', content: o.prompt }] : null)
+  if (!Array.isArray(messages) || !messages.length) throw new LlmError('B0921', 400, 'ctx.llm needs messages or prompt', 'Pass { messages: [{ role: "user", content: "…" }] }')
+  for (const m of messages) if (!m || (m.role !== 'user' && m.role !== 'assistant') || typeof m.content !== 'string') throw new LlmError('B0921', 400, 'Each message needs role "user" or "assistant" and text content', 'The system prompt goes in { system }')
+  if (o.system != null && typeof o.system !== 'string') throw new LlmError('B0921', 400, 'system must be text', 'Pass { system: "…" }')
+  const maxTokens = o.maxTokens ?? LLM_DEFAULT_MAX_TOKENS
+  if (!Number.isSafeInteger(maxTokens) || maxTokens < 1) throw new LlmError('B0921', 400, 'maxTokens must be a positive integer', `Omit it for ${LLM_DEFAULT_MAX_TOKENS}`)
+  const timeoutMs = o.timeoutMs ?? LLM_DEFAULT_TIMEOUT
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > LLM_MAX_TIMEOUT) throw new LlmError('B0921', 400, `timeoutMs must be between 1 and ${LLM_MAX_TIMEOUT}`, `Omit it for ${LLM_DEFAULT_TIMEOUT}`)
+  return { provider, key, model, root: base.href.replace(/\/+$/, ''), messages, system: o.system ?? null, maxTokens, timeoutMs, signal: o.signal }
+}
+
+function llmRequest(r, stream) {
+  if (r.provider === 'anthropic') return {
+    url: r.root + '/v1/messages',
+    headers: { 'x-api-key': r.key, 'anthropic-version': LLM_ANTHROPIC_VERSION, 'content-type': 'application/json' },
+    body: { model: r.model, max_tokens: r.maxTokens, messages: r.messages, ...(r.system ? { system: r.system } : {}), ...(stream ? { stream: true } : {}) },
+  }
+  return {
+    url: r.root + '/v1/responses',
+    headers: { authorization: 'Bearer ' + r.key, 'content-type': 'application/json' },
+    body: { model: r.model, max_output_tokens: r.maxTokens, input: r.messages, store: false, ...(r.system ? { instructions: r.system } : {}), ...(stream ? { stream: true } : {}) },
+  }
+}
+
+const llmStop = reason => ({ end_turn: 'end', stop_sequence: 'end', completed: 'end', max_tokens: 'length', max_output_tokens: 'length', content_filter: 'filter', refusal: 'filter' })[reason] || 'other'
+const llmRedact = (text, key) => String(text ?? '').split(key).join('[key]').slice(0, LLM_MAX_DETAIL)
+
+function llmParsed(r, json, requestId) {
+  if (r.provider === 'anthropic') {
+    if (!Array.isArray(json?.content)) throw llmFailure(502, 'The model provider sent an unexpected answer', { provider: r.provider })
+    return { provider: r.provider, model: json.model ?? r.model, text: json.content.filter(b => b?.type === 'text').map(b => b.text).join(''), stopReason: llmStop(json.stop_reason), usage: { inputTokens: json.usage?.input_tokens ?? null, outputTokens: json.usage?.output_tokens ?? null }, requestId }
+  }
+  if (json?.status === 'failed') throw llmFailure(502, 'The model provider could not complete the request', { provider: r.provider, detail: llmRedact(json.error?.message, r.key) })
+  if (!Array.isArray(json?.output)) throw llmFailure(502, 'The model provider sent an unexpected answer', { provider: r.provider })
+  const text = json.output.filter(i => i?.type === 'message').flatMap(i => i.content || []).filter(c => c?.type === 'output_text').map(c => c.text).join('')
+  return { provider: r.provider, model: json.model ?? r.model, text, stopReason: llmStop(json.incomplete_details?.reason ?? json.status), usage: { inputTokens: json.usage?.input_tokens ?? null, outputTokens: json.usage?.output_tokens ?? null }, requestId }
+}
+
+async function llmStatusError(r, res) {
+  let detail = ''
+  try { const raw = await res.text(); try { const j = JSON.parse(raw); detail = j?.error?.message ?? raw } catch { detail = raw } } catch {}
+  const providerStatus = res.status, extra = { provider: r.provider, providerStatus, detail: llmRedact(detail, r.key) }
+  if (providerStatus === 429) return llmFailure(429, 'The model provider is rate limiting requests; try again shortly', { ...extra, retryAfter: res.headers.get('retry-after') })
+  if (providerStatus === 401 || providerStatus === 403) return new LlmError('B0921', 503, `The model provider refused the key in ${LLM_PROVIDERS[r.provider].key}`, 'Check the key and its permissions', extra)
+  return llmFailure(providerStatus === 504 || providerStatus === 408 ? 504 : 502, 'The model provider could not complete the request', extra)
+}
+
+async function llmFetch(r, stream, fallback) {
+  const deadline = AbortSignal.timeout(r.timeoutMs)
+  const signal = AbortSignal.any([deadline, ...(fallback ? [fallback] : []), ...(r.signal ? [r.signal] : [])])
+  const q = llmRequest(r, stream)
+  const failed = e => deadline.aborted ? llmFailure(504, 'The model provider did not answer in time', { provider: r.provider }) : signal.aborted ? llmFailure(499, 'The LLM call was cancelled', { provider: r.provider, cancelled: true }) : e instanceof LlmError ? e : llmFailure(502, 'The model provider could not be reached', { provider: r.provider })
+  let res
+  try { res = await fetch(q.url, { method: 'POST', headers: q.headers, body: JSON.stringify(q.body), signal, redirect: 'error' }) } catch (e) { throw failed(e) }
+  return { res, failed, requestId: res.headers.get('request-id') ?? res.headers.get('x-request-id') }
+}
+
+async function llmReadAll(res) {
+  const reader = res.body.getReader(), parts = []
+  let total = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    total += value.length
+    if (total > LLM_MAX_BODY) { await reader.cancel(); throw llmFailure(502, 'The model provider answer is too large') }
+    parts.push(value)
+  }
+  return Buffer.concat(parts).toString('utf8')
+}
+
+// One `data:` payload per server-sent event; the event name is repeated inside each payload by both providers.
+async function* llmEvents(res) {
+  const decoder = new TextDecoder(), reader = res.body.getReader()
+  let buffer = '', data = []
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) return
+      buffer += decoder.decode(value, { stream: true })
+      if (buffer.length > LLM_MAX_LINE) throw llmFailure(502, 'The model provider sent an oversized event')
+      for (let at; (at = buffer.indexOf('\n')) >= 0;) {
+        const line = buffer.slice(0, at).replace(/\r$/, '')
+        buffer = buffer.slice(at + 1)
+        if (line === '') { if (data.length) { const raw = data.join('\n'); data = []; let e; try { e = JSON.parse(raw) } catch { throw llmFailure(502, 'The model provider sent an unreadable event') } yield e } }
+        else if (line.startsWith('data:')) data.push(line.slice(5).trimStart())
+      }
+    }
+  } finally { await reader.cancel().catch(() => {}) }
+}
+
+function llmStream(r, parent) {
+  let settle, reject
+  const result = new Promise((a, b) => { settle = a; reject = b })
+  result.catch(() => {}) // reading `.result` is optional; the iterator throws the same failure
+  const run = async function* () {
+    let opened
+    try { opened = await llmFetch(r, true, parent) } catch (e) { reject(e); throw e }
+    const { res, failed, requestId } = opened
+    const out = { provider: r.provider, model: r.model, text: '', stopReason: 'other', usage: { inputTokens: null, outputTokens: null }, requestId }
+    let finished = false
+    try {
+      if (!res.ok) throw await llmStatusError(r, res)
+      for await (const e of llmEvents(res)) {
+        let piece = ''
+        if (r.provider === 'anthropic') {
+          if (e.type === 'error') throw e.error?.type === 'rate_limit_error' ? llmFailure(429, 'The model provider is rate limiting requests; try again shortly', { provider: r.provider, detail: llmRedact(e.error?.message, r.key) }) : llmFailure(502, 'The model provider failed during the answer', { provider: r.provider, detail: llmRedact(e.error?.message, r.key) })
+          if (e.type === 'message_start') { out.model = e.message?.model ?? out.model; out.usage.inputTokens = e.message?.usage?.input_tokens ?? null; out.usage.outputTokens = e.message?.usage?.output_tokens ?? null }
+          else if (e.type === 'content_block_delta' && e.delta?.type === 'text_delta') piece = e.delta.text
+          else if (e.type === 'message_delta') { out.stopReason = llmStop(e.delta?.stop_reason); if (e.usage?.output_tokens != null) out.usage.outputTokens = e.usage.output_tokens }
+          else if (e.type === 'message_stop') finished = true
+        } else {
+          if (e.type === 'error') throw llmFailure(502, 'The model provider failed during the answer', { provider: r.provider, detail: llmRedact(e.message, r.key) })
+          if (e.type === 'response.failed') throw llmFailure(502, 'The model provider could not complete the request', { provider: r.provider, detail: llmRedact(e.response?.error?.message, r.key) })
+          if (e.type === 'response.output_text.delta') piece = e.delta
+          else if (e.type === 'response.completed' || e.type === 'response.incomplete') {
+            finished = true
+            out.model = e.response?.model ?? out.model
+            out.stopReason = llmStop(e.response?.incomplete_details?.reason ?? e.response?.status)
+            out.usage = { inputTokens: e.response?.usage?.input_tokens ?? null, outputTokens: e.response?.usage?.output_tokens ?? null }
+          }
+        }
+        if (piece) { out.text += piece; yield piece }
+      }
+      if (!finished) throw llmFailure(502, 'The model provider ended the answer early', { provider: r.provider })
+      settle(out)
+    } catch (e) { const f = failed(e); reject(f); throw f }
+  }
+  const iterator = run()
+  // Leaving the loop early closes the provider connection; `.result` then rejects as cancelled.
+  const stop = iterator.return.bind(iterator)
+  return {
+    result,
+    [Symbol.asyncIterator]() { return this },
+    next: () => iterator.next(),
+    return: value => { reject(llmFailure(499, 'The LLM stream was closed before its end', { provider: r.provider, cancelled: true })); return stop(value) },
+  }
+}
+
+// ctx.llm for one request: `signal` is ctx.signal, so a closed client or a passed deadline stops the provider call.
+export function llmClient(env, signal) {
+  return {
+    async complete(o) {
+      const r = llmResolve(env, o)
+      const { res, failed, requestId } = await llmFetch(r, false, signal)
+      try {
+        if (!res.ok) throw await llmStatusError(r, res)
+        let json
+        try { json = JSON.parse(await llmReadAll(res)) } catch (e) { if (e instanceof LlmError) throw e; if (e instanceof SyntaxError) throw llmFailure(502, 'The model provider sent an unreadable answer', { provider: r.provider }); throw e }
+        return llmParsed(r, json, requestId)
+      } catch (e) { throw failed(e) }
+    },
+    // Validates now, connects on the first read. `for await (const text of s)`, then `await s.result`.
+    stream(o) { return llmStream(llmResolve(env, o), signal) },
+  }
+}

package/server/server.mjs

@@ -6,6 +6,7 @@
 //
 // It serves, in this order:
 //   GET  /_health                → 200 {"ok":true,"build":"<sig>"}
+//   GET  /health[/live|/ready]   → forwarded to the native backend, or 200 {"ok":true} without one
 //   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC; body, rate and time limits from brain.json `server`)
 //   GET  routes in the manifest  → SSR: load(ctx) → render the view on the DOM shim → page with props and SEO head
 //   GET  files in dist/          → static (the smallest accepted .zst/.br/.gz sibling; /_b/* immutable), clean URLs
@@ -21,6 +22,7 @@ import { createServer as http, STATUS_CODES, request as httpRequest, Agent as Ht
 import { AsyncLocalStorage } from 'node:async_hooks'
 import net from 'node:net'
 import { installNativeSockets } from './native-sockets.mjs'
+import { llmClient } from './llm.mjs'
 import { BlockList, isIP } from 'node:net'
 import { Readable } from 'node:stream'
 import zlib from 'node:zlib'
@@ -550,7 +552,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report) {
             try { answer = JSON.parse(data.toString('utf8'))?.error } catch {}
             const code = typeof answer?.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(answer.code) ? answer.code : undefined
             const fix = code && typeof answer.fix === 'string' ? answer.fix.slice(0, 512) : undefined
-            throw new HttpError(status >= 400 && status < 500 ? status : 503, 'Native resource request failed', { code, fix })
+            throw new HttpError(status >= 400 && status < 500 ? status : 503, NATIVE_FAILED, { code, fix })
           }
           if (status === 204) { value = null; return }
           if (!String(headers['content-type'] || '').startsWith('application/json')) throw new HttpError(502, 'Native resource response must be JSON')
@@ -852,6 +854,8 @@ export function createServer(o = {}) {
   const SL = mf.server || {}
   const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? SL.timeoutMs ?? 10000)
   const LIMIT = +(o.rateLimit ?? env.BRAIN_RPC_LIMIT ?? SL.rpcPerMinute ?? 60) // per IP + function, per minute
+  // Off by default: nginx below 1.29 takes a 103 as the final response, and the real one reaches the client as body bytes.
+  const EARLY_HINTS = o.earlyHints ?? (env.BRAIN_EARLY_HINTS ? env.BRAIN_EARLY_HINTS === '1' : SL.earlyHints === true)
   const BODY_KB = +(o.maxBodyKB ?? env.BRAIN_MAX_BODY_KB ?? SL.maxBodyKB ?? 1024)
   if (!Number.isInteger(BODY_KB) || BODY_KB < 1 || BODY_KB > 65536) throw Error('brain.json server.maxBodyKB must be an integer from 1 to 65536 (KB)')
   const MAX_BODY = BODY_KB * 1024 // RPC and form bodies; bounded reads never buffer more
@@ -863,7 +867,7 @@ export function createServer(o = {}) {
   const hasManifestSockets = Object.hasOwn(mf,'nativeSockets')
   if (hasManifestSockets && typeof mf.nativeSockets !== 'boolean') throw Error('Manifest nativeSockets must be an explicit boolean')
   const nativeSockets = o.nativeSockets === undefined ? hasManifestSockets && mf.nativeSockets : o.nativeSockets
-  if (nativeSockets && !native) throw Error('Native sockets require a configured native backend')
+  if (nativeSockets && !native) throw Error('Native sockets require a configured native backend; fix: run `brain backend serve` and set BRAIN_BACKEND_URL to its loopback URL')
   // the build's single route table (#187): already in match order, each with its RegExp source (named groups = params)
   const routes = mf.routes.map(r => ({ ...r, rx: r.rx ? new RegExp(r.rx) : exact(r.path) }))
   // The address RPC and form limits key on, ctx.req.ip and the logs: a client header counts only through a trusted proxy.
@@ -1025,12 +1029,13 @@ export function createServer(o = {}) {
   const context = (req, res, url, extra) => {
     const cookies = parseCookies(req.headers.cookie)
     const { user, session: ses } = nativeSession ? { user: req.$nativeUser ?? null, session: sessionSecrets(native.session(req, res, res.getHeader('x-request-id')), cookies, secret) } : sessionFrom(cookies, secret)
+    const signal = lifetime(res)
     return {
       url, query: Object.fromEntries(url.searchParams), cookies, user, session: ses, env,
       ...(native ? { backend: native.backend(req, res, res.getHeader('x-request-id')) } : {}),
       // `prefetch`: the router fetched this page ahead of a click (§19); a `load` with side effects can skip them
-      prefetch: req.headers['x-brain-prefetch'] === '1',
-      req: { method: req.method, headers: req.headers, ip: ipOf(req) }, signal: lifetime(res), ...extra,
+      prefetch: req.headers['x-brain-prefetch'] === '1' || /\bprefetch\b/.test(req.headers['sec-purpose'] ?? ''),
+      req: { method: req.method, headers: req.headers, ip: ipOf(req) }, signal, llm: llmClient(env, signal), ...extra,
     }
   }
 
@@ -1084,12 +1089,17 @@ export function createServer(o = {}) {
   const anonymous = req => req.method === 'GET' && !req.headers.authorization && !req.headers.cookie
 
   async function ssr(req, res, route, params, url, rid, forms = null, status = 200, fixed = null, nocache = false) {
-    // 103 Early Hints (#232): the route's preloads (the same Link values as _headers) before any work, once
-    if (route.links && route.links.length && res.writeEarlyHints && !res.$capture && !res.$hinted) {
+    // the route's preloads (the same Link values as _headers): on the response, where hosts turn them into early hints,
+    // capped so a long list cannot trip a proxy's header buffer. A 103 (#232) only when opted in, and never to HTTP/1.0.
+    if (route.links && route.links.length && !res.$capture && !res.$hinted) {
       res.$hinted = true
-      try {
-        res.writeEarlyHints({ link: route.links })
-      } catch {}
+      const link = route.links.join(', ')
+      if (link.length <= 2048 && !res.headersSent) res.setHeader('link', link)
+      if (EARLY_HINTS && res.writeEarlyHints && req.httpVersion !== '1.0') {
+        try {
+          res.writeEarlyHints({ link: route.links })
+        } catch {}
+      }
     }
     if (!nocache && route.cache > 0 && !forms && !fixed && status === 200 && anonymous(req)) return cached(req, res, route, params, url, rid)
     if (native) await native.prepare(req, res, rid)
@@ -1147,7 +1157,9 @@ export function createServer(o = {}) {
     const page = readFileSync(file(route.page), 'utf8')
       .replace('<!--brain:ssr-->', () => body)
       .replace('<!--brain:props-->', () => jsonInHtml(props))
-    let out = head(page, seo, url.pathname)
+    // a page behind a guard passes it only for its visitor: it stays out of the index even when it renders (§33)
+    if (route.guards && route.guards.length) res.setHeader('x-robots-tag', NOINDEX)
+    let out = head(page, seo, url.pathname, url.search)
     // route params for route() in the browser (the client has no route table)
     if (params && Object.keys(params).length) out = out.replace('</head>', () => `<meta name="brain-params" content="${esc(JSON.stringify(params))}"></head>`)
     if (forms) out = out.replace('</body>', () => `<script type="application/json" id="brain-forms">${jsonInHtml(forms)}</script></body>`)
@@ -1191,7 +1203,7 @@ export function createServer(o = {}) {
       globalThis.__brainLocale = null
     }
     const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) }
-    write(n(head(top, seo0, url.pathname)))
+    write(n(head(top, seo0, url.pathname, url.search)))
     // QA #253: the folder's _loading.brain goes in the region with the first chunk (SPEC: shows while load runs),
     // between two marker comments; the last chunk starts with a script that removes them and what is between
     let clear = ''
@@ -1326,7 +1338,8 @@ export function createServer(o = {}) {
     let raw
     try {
       raw = await body(req, MAX_BODY)
-    } catch {
+    } catch (e) {
+      if (e.aborted) return
       return fail(413, tooBig(rid, url.pathname))
     }
     if (native) await native.prepare(req, res, rid)
@@ -1366,7 +1379,8 @@ export function createServer(o = {}) {
     let raw
     try {
       raw = await body(req, MAX_BODY)
-    } catch {
+    } catch (e) {
+      if (e.aborted) return
       return plain(413, tooBig(rid, url.pathname))
     }
     const id = new URLSearchParams(raw).get('_brain') || '', modPath = mf.rpc[id.split('/')[0]]
@@ -1546,6 +1560,17 @@ export function createServer(o = {}) {
     return false
   }
 
+  // /health is reserved for the backend (B0735), so an app cannot declare it and deploy gates ask this port for it. An app
+  // page at that path still wins: this only runs where the answer would have been a 404. Nothing here names the backend.
+  const isProbe = path => path === '/health' || path === '/health/live' || path === '/health/ready'
+  const answerProbe = async (req, res, url, rid) => {
+    const headers = { 'content-type': MIME['.json'], 'cache-control': 'no-store' }
+    if (req.method !== 'GET' && req.method !== 'HEAD') return notFound(req, res)
+    if (!native) return send(res, 200, json({ ok: true }), headers)
+    try { await native.proxy(req, res, new URL(url.pathname, url), rid, send) }
+    catch { if (!res.headersSent) send(res, 503, json({ ok: false }), headers) }
+  }
+
   // ---------- dispatch ----------
   const server = http(async (req, res) => {
     // Only a file upload may outlast the 30-second body budget; the dispatcher lifts this guard for that path alone.
@@ -1574,7 +1599,7 @@ export function createServer(o = {}) {
       let url = full
       if (BASE !== '/') {
         if (full.pathname === BASE.slice(0, -1)) return send(res, 301, '', { location: BASE + full.search })
-        if (!full.pathname.startsWith(BASE)) return notFound(req, res)
+        if (!full.pathname.startsWith(BASE)) return isProbe(full.pathname) ? await answerProbe(req, res, full, rid) : notFound(req, res)
         url = new URL('/' + full.pathname.slice(BASE.length) + full.search, full) // the app path
       }
       req.$brainPath = url.pathname
@@ -1609,6 +1634,7 @@ export function createServer(o = {}) {
       if (serveStatic(req, res, url)) return
       // browsers still ask for /favicon.ico: the app's SVG icon answers it
       if (url.pathname === '/favicon.ico' && file('favicon.svg')) return send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
+      if (isProbe(url.pathname)) return await answerProbe(req, res, url, rid)
       notFound(req, res)
     } catch (e) {
       log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
@@ -1877,7 +1903,7 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
     const pub = publicError(e)
     if (pub) return { status: pub.status, body: { error: pub.message } }
     const deliberate = intendedStatus(e)
-    if (deliberate && deliberate < 500) return { status: deliberate, body: { error: e instanceof HttpError ? e.message : STATUS_CODES[deliberate] } }
+    if (deliberate && deliberate < 500) return { status: deliberate, body: { error: e instanceof HttpError && e.message !== NATIVE_FAILED ? e.message : STATUS_CODES[deliberate] } }
     if (deliberate) return {status:deliberate,body:{error:STATUS_CODES[deliberate]},cause:e}
     return { status: 500, body: { error: 'Internal error' }, cause: e }
   }
@@ -1888,6 +1914,8 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
 // `locale` (§37): the page's language, so the schema messages (`form.*`) and the generic error come from its dictionary
 // (globalThis.__brainDict, filled by the page's chunk) like form() in the browser. It is set only around the synchronous
 // validation, so concurrent requests in other languages never see it.
+// English text for the server's log: a form or a server function never shows it to a visitor
+const NATIVE_FAILED = 'Native resource request failed'
 export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000, locale }) {
   const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = id.split('/')[1] || ''
   if (key) {
@@ -1914,7 +1942,7 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
     r = await withTimeout(pageLocale.run(locale, () => Promise.resolve(module[fn](ctx, values))), timeout, ctx)
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return again(e.errors, '')
-    if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message)
+    if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message === NATIVE_FAILED ? generic : e.message)
     const pub = publicError(e)
     if (pub) return again({}, pub.message)
     const deliberate = intendedStatus(e)
@@ -2004,6 +2032,7 @@ export function resolveClient(peer, forwarded, nets) {
   }
   return client
 }
+export function readBody(req, max) { return body(req, max) }
 function body(req, max) {
   return new Promise((ok, fail) => {
     let n = 0
@@ -2015,7 +2044,10 @@ function body(req, max) {
       else if (n <= max) parts.push(c)
     })
     req.on('end', () => (n > max ? fail(new Error('too large')) : ok(Buffer.concat(parts).toString('utf8'))))
-    req.on('error', fail)
+    // a disconnect or the cut above never reaches 'end': the reader settles anyway and nobody is left to answer
+    const aborted = () => fail(Object.assign(new Error('body aborted'), { aborted: true }))
+    req.on('error', aborted)
+    req.on('close', aborted)
   })
 }
 // bind:value / checked are properties; copy them into attributes so the SSR HTML shows them
@@ -2064,17 +2096,25 @@ export function prefersMarkdown(accept) {
 // SEO head from View.seo(props): title, description, canonical, og:*/twitter:*, JSON-LD and the view's <head> block
 // F5: the build writes an SSR route's canonical/og:url from its pattern (/posts/:slug); the request has the real path.
 // A view's own <head> tags replace the generated ones with the same name/property (one tag per key, SPEC «SEO»).
-function head(page, seo, path) {
+function head(page, seo, path, search = '') {
   let h = page
+  // `<meta seo query="page">`: these parameters make a different page; any other (a dialog, a tracking tag) does not
+  let identity = ''
+  h = h.replace(/<meta name="brain-query" content="([^"]*)">/, (_, keys) => {
+    const given = new URLSearchParams(search), kept = new URLSearchParams()
+    for (const key of keys.split(/[\s,]+/)) for (const value of key ? given.getAll(key) : []) kept.append(key, value)
+    if (kept.size) identity = esc('?' + kept)
+    return ''
+  })
   if (path) {
     // the attribute is already escaped HTML: only the request path that replaces a pattern is escaped
-    const real = v => v.replace(/^(https?:\/\/[^/]+)?(\/[^"]*)$/, (m, o = '', p) => (/\/[:*]/.test(p) ? o + esc(path) : m))
+    const real = v => v.replace(/^(https?:\/\/[^/]+)?(\/[^"]*)$/, (m, o = '', p) => (/\/[:*]/.test(p) ? o + esc(path) : m)) + identity
     h = h.replace(/(<link[^>]*rel=["']canonical["'][^>]*href=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
     h = h.replace(/(<meta[^>]*property=["']og:url["'][^>]*content=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
   }
   if (!seo) return h
-  const meta = (attr, key, val) => {
-    const tag = `<meta ${attr}="${esc(key)}" content="${esc(val)}">`
+  const meta = (attr, key, val, escaped) => {
+    const tag = `<meta ${attr}="${esc(key)}" content="${escaped ? val.replace(/"/g, '&quot;') : esc(val)}">`
     const rx = new RegExp(`<meta[^>]*\\b${attr}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'i')
     h = rx.test(h) ? h.replace(rx, () => tag) : h.replace('</head>', () => tag + '</head>')
   }
@@ -2090,6 +2130,17 @@ function head(page, seo, path) {
     else if (/^(og|twitter|article):/.test(k)) meta('property', k, v)
     else if (typeof v === 'string') meta('name', k, v)
   }
+  // What the build writes for a prerendered page and can only be known here: the social card of this request's values
+  // (brain-seo social::head, prerender seo_head). The view's own value always wins.
+  const shared = /<title>([\s\S]*?)<\/title>/i.exec(h)?.[1]
+  const origin = /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
+  if (typeof seo['og:image'] === 'string' && origin && /^\/(?!\/)/.test(seo['og:image'])) meta('property', 'og:image', encodeURI(origin + seo['og:image']))
+  if (seo.title != null && seo['og:title'] == null) meta('property', 'og:title', shared, true)
+  if (seo.description != null && seo['og:description'] == null) meta('property', 'og:description', seo.description)
+  if (seo['og:image'] != null) {
+    if (seo['og:image:alt'] == null) meta('property', 'og:image:alt', seo['og:title'] ?? shared, seo['og:title'] == null)
+    if (seo['twitter:card'] == null) meta('name', 'twitter:card', 'summary_large_image')
+  }
   // `<meta seo schema="Article">` without `jsonld` (§32): one node with this request's values. It replaces the node
   // the build wrote into the template from the static attributes (same @type), so the page carries exactly one.
   if (typeof seo.schema === 'string' && seo.jsonld == null && /^[A-Za-z]+$/.test(seo.schema)) {

package/shim/dom.js

@@ -34,6 +34,11 @@ export class MouseEvent extends Event {}
 
 // Minimal MutationObserver: only records for nodes connected to the document, plus takeRecords() (used by brain-inspect).
 const MOS = new Set()
+// A node's position in its parent, from a hint the walk keeps: `_at` may be stale after any mutation, so it is checked.
+const indexIn = (parent, node) => {
+  if (parent.childNodes[node._at] === node) return node._at
+  return (node._at = parent.childNodes.indexOf(node))
+}
 const rec = (type, target) => {
   if (MOS.size && target.isConnected) for (const o of MOS) o._q.push({ type, target })
 }
@@ -62,6 +67,7 @@ class Node {
     this.ownerDocument = doc
     this.parentNode = null
     this.childNodes = []
+    this._at = 0
     this._l = { cap: {}, bub: {} }
   }
   get firstChild() {
@@ -72,11 +78,19 @@ class Node {
   }
   get nextSibling() {
     const p = this.parentNode
-    return p ? p.childNodes[p.childNodes.indexOf(this) + 1] || null : null
+    if (!p) return null
+    const i = indexIn(p, this) + 1
+    const s = p.childNodes[i]
+    if (s) s._at = i
+    return s || null
   }
   get previousSibling() {
     const p = this.parentNode
-    return p ? p.childNodes[p.childNodes.indexOf(this) - 1] || null : null
+    if (!p) return null
+    const i = indexIn(p, this) - 1
+    const s = p.childNodes[i]
+    if (s) s._at = i
+    return s || null
   }
   get isConnected() {
     let n = this
@@ -85,14 +99,26 @@ class Node {
   }
   insertBefore(n, ref) {
     if (n.nodeType === 11) {
-      for (const c of [...n.childNodes]) this.insertBefore(c, ref)
+      const moved = n.childNodes
+      if (!moved.length) return n
+      const at = ref ? indexIn(this, ref) : this.childNodes.length
+      if (at < 0) throw Error('ref is not a child')
+      const kids = this.childNodes
+      const tail = kids.splice(at)
+      for (const c of moved) kids.push(c)
+      for (const c of tail) kids.push(c)
+      for (const c of moved) {
+        c.parentNode = this
+        rec('childList', this)
+      }
+      moved.length = 0
       return n
     }
     if (n.parentNode) {
       if (n.isConnected) stats.moves++
       n.parentNode.removeChild(n)
     }
-    const i = ref ? this.childNodes.indexOf(ref) : -1
+    const i = ref ? indexIn(this, ref) : -1
     if (ref && i < 0) throw Error('ref is not a child')
     i < 0 ? this.childNodes.push(n) : this.childNodes.splice(i, 0, n)
     n.parentNode = this
@@ -103,7 +129,7 @@ class Node {
     return this.insertBefore(n, null)
   }
   removeChild(n) {
-    const i = this.childNodes.indexOf(n)
+    const i = indexIn(this, n)
     if (i < 0) throw Error('not a child')
     this.childNodes.splice(i, 1)
     n.parentNode = null