@christianirack/brainllm-runtime 0.8.11 → 0.9.0

package/server/server.mjs

@@ -26,25 +26,30 @@ import { installNativeSockets } from './native-sockets.mjs'
 import { llmClient } from './llm.mjs'
 import { BlockList, isIP } from 'node:net'
 import { Readable } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
 import zlib from 'node:zlib'
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'
-import { existsSync, readFileSync, realpathSync, statSync, lstatSync } from 'node:fs'
+import { constants as FS, existsSync, readFileSync, realpathSync, statSync, lstatSync } from 'node:fs'
+import { open } from 'node:fs/promises'
 import * as Module from 'node:module'
 import { basename, dirname, extname, join, normalize, resolve, sep } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const MIME = {
   '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.mjs': 'text/javascript; charset=utf-8',
+  '.brain': 'text/html; charset=utf-8', '.jsbrain': 'text/javascript; charset=utf-8', '.cssbrain': 'text/css; charset=utf-8',
   '.css': 'text/css; charset=utf-8', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png',
   '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.avif': 'image/avif', '.gif': 'image/gif',
   '.ico': 'image/x-icon', '.woff2': 'font/woff2', '.woff': 'font/woff', '.txt': 'text/plain; charset=utf-8',
   '.xml': 'application/xml', '.webmanifest': 'application/manifest+json', '.map': 'application/json',
   '.mp4': 'video/mp4', '.webm': 'video/webm', '.pdf': 'application/pdf', '.wasm': 'application/wasm',
+  '.m3u8': 'application/vnd.apple.mpegurl', '.m3u': 'application/vnd.apple.mpegurl', '.m4s': 'video/iso.segment',
+  '.mpd': 'application/dash+xml', '.ts': 'video/mp2t', '.vtt': 'text/vtt; charset=utf-8', '.mp3': 'audio/mpeg',
   '.md': 'text/markdown; charset=utf-8', // llms.txt copies of the pages (§33), as brain start's static server sends them
 }
 // feeds are .xml files with their own type (SEO, §32)
 const FEEDS = { 'rss.xml': 'application/rss+xml; charset=utf-8', 'atom.xml': 'application/atom+xml; charset=utf-8' }
-const SECURITY = {
+const DEFAULT_SECURITY = {
   'strict-transport-security': 'max-age=63072000; includeSubDomains',
   'x-content-type-options': 'nosniff',
   'referrer-policy': 'strict-origin-when-cross-origin',
@@ -114,8 +119,10 @@ function safeLocation(value) {
 function linkTo(route, path) {
   const t = route && route.hrefs
   if (!t || typeof path !== 'string' || path[0] !== '/' || path[1] === '/') return path
-  const m = /^[^?#]*/.exec(path)[0]
-  const n = t.s[m] || (new RegExp(t.re).test(m) && (m === '/' ? t.p : t.p + m))
+  const m = /^[^?#]*/.exec(path)[0], key = m.replace(/\/+$/, '') || '/'
+  if (key === t.p || key.startsWith(t.p + '/')) return path
+  let n = t.s[key] || (new RegExp(t.re).test(key) && (key === '/' ? t.p : t.p + key))
+  if (n && key !== '/' && m.endsWith('/') && !n.endsWith('/')) n += '/'
   return n ? n + path.slice(m.length) : path
 }
 function localizeLinks(route, html) {
@@ -194,13 +201,26 @@ const cacheSearch = url => {
   return kept.size ? '?' + kept : ''
 }
 // Messages this file writes itself, safe to log as the cause; anything else in an error message may hold private data.
-const OWN_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Invalid final response status', 'Invalid configured redirect location', 'timeout'])
+const AUTH_UNAVAILABLE_CAUSES = new Set(['the backend did not answer', 'the server is shutting down', '8 session checks are already in flight', 'the backend took more than 2 s'].map(why => `Native authentication is unavailable: ${why}`))
+const BACKEND_UNAVAILABLE_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Native backend is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Native authentication response is unavailable', ...AUTH_UNAVAILABLE_CAUSES])
+const OWN_CAUSES = new Set([...BACKEND_UNAVAILABLE_CAUSES, 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Invalid same-site redirect location', 'Invalid redirect status', 'Invalid final response status', 'Invalid configured redirect location', 'Static file validators are busy; retry shortly', 'Static file validator deadline exceeded; retry shortly', 'Static file changed; retry shortly', 'Static file changed while computing its validator', 'timeout'])
 const CODE_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/
 const varyEncoding = v => (/accept-encoding/i.test(v || '') ? v : [v, 'Accept-Encoding'].filter(Boolean).join(', '))
 function bodyEncoding(req, status, headers) {
   if (status < 200 || status === 204 || status === 206 || status === 304 || headers['content-encoding'] || !COMPRESSIBLE.test(headers['content-type'] || '') || /no-transform/i.test(headers['cache-control'] || '')) return null
   return acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] || ''
 }
+// One `bytes=` span of a file of `size` bytes (RFC 9110 §14): { start, end } inclusive, false when it cannot be
+// satisfied (416), or null when the header is not one well-formed span (several, another unit, reversed): the whole
+// file is sent then, which the RFC allows.
+function byteRange(header, size) {
+  const m = /^bytes=(\d*)-(\d*)$/.exec(String(header).trim())
+  if (!m || (m[1] === '' && m[2] === '')) return null
+  if (m[1] === '') return Number(m[2]) > 0 && size > 0 ? { start: Math.max(0, size - Number(m[2])), end: size - 1 } : false
+  const start = Number(m[1])
+  if (m[2] !== '' && Number(m[2]) < start) return null
+  return start < size ? { start, end: m[2] === '' ? size - 1 : Math.min(Number(m[2]), size - 1) } : false
+}
 const encodeBody = (enc, buf) => enc === 'zstd' ? zlib.zstdCompressSync(buf) : enc === 'br' ? zlib.brotliCompressSync(buf, { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5, [zlib.constants.BROTLI_PARAM_SIZE_HINT]: buf.length } }) : zlib.gzipSync(buf)
 const encodeStream = enc => enc === 'zstd' ? zlib.createZstdCompress() : enc === 'br' ? zlib.createBrotliCompress({ params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5 } }) : zlib.createGzip()
 
@@ -220,11 +240,22 @@ function googleSignInPage(page) {
     for (const item of tag.slice(5, -1).matchAll(/([^\s=/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g)) {
       const key = item[1].toLowerCase(); if (!attrs.has(key)) attrs.set(key, item[2] ?? item[3] ?? item[4] ?? '')
     }
-    if (attrs.get('name')?.toLowerCase() === 'brain-google-signin' && attrs.get('content') === '1') return true
+    // Google's and Apple's sign-in popups both answer through window.opener.
+    if (['brain-google-signin', 'brain-apple-signin'].includes(attrs.get('name')?.toLowerCase()) && attrs.get('content') === '1') return true
   }
   return false
 }
 
+// One-use provider cookies (Google nonce, Apple nonce, LinkedIn state): relayed to the backend and cleared at logout.
+const PROVIDER_COOKIES = ['__Host-brain-google', '__Host-brain-apple', '__Host-brain-linkedin']
+// The native backend owns state, nonce and provider configuration. Only this fixed protocol destination is external.
+function providerStartRedirect(method, path, status, location) {
+  if (!['GET', 'HEAD'].includes(method) || path !== '/_brain/auth/linkedin/start' || status !== 303 || typeof location !== 'string' || /[\\\x00-\x20\x7f]/.test(location)) return false
+  try {
+    const target = new URL(location)
+    return target.origin === 'https://www.linkedin.com' && target.pathname === '/oauth/v2/authorization' && !target.username && !target.password && !target.hash
+  } catch { return false }
+}
 // One configured loopback authority. No user-controlled target, proxy, redirect, auth cache or pending queue.
 // ctx.backend.files(bucket): the same file calls as job and route handlers (docs/backend/files.md).
 function bucketClient(target, key, bucket, readBudgetMs = () => 0) {
@@ -327,7 +358,15 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
   }
   const safeUser = user => {
     if (!user || typeof user.id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(user.id) || typeof user.email !== 'string' || user.email.length > 254 || typeof user.role !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(user.role) || ['public','owner'].includes(user.role) || typeof user.verified !== 'boolean') throw new HttpError(503,'Native authentication response is unavailable')
-    return Object.freeze({id:user.id,email:user.email,role:user.role,verified:user.verified})
+    const clean = {id:user.id,email:user.email,role:user.role,verified:user.verified}
+    if (typeof user.name === 'string' && user.name.trim() && user.name.length <= 400 && [...user.name].length <= 200 && !/[\u0000-\u001f\u007f-\u009f]/.test(user.name)) clean.name = user.name.trim()
+    if (typeof user.picture === 'string' && Buffer.byteLength(user.picture) <= 2048 && !/[\u0000-\u001f\u007f-\u009f]/.test(user.picture)) {
+      try {
+        const url = new URL(user.picture)
+        if (url.protocol === 'https:' && url.hostname && !url.username && !url.password) clean.picture = user.picture
+      } catch {}
+    }
+    return Object.freeze(clean)
   }
   const unavailable = (why = 'the backend did not answer') => new HttpError(503, `Native authentication is unavailable: ${why}`)
   const call = (incoming, response, path, method, rid, origin) => {
@@ -365,7 +404,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
             for (const value of backend.headers['set-cookie'] || []) {
               if (value.length > 8192 || /[\r\n]/.test(value)) return finish(true)
               const name = value.split('=', 1)[0]
-              if (names.has(name) || name === '__Host-brain-google') cleared.push(value)
+              if (names.has(name) || PROVIDER_COOKIES.includes(name)) cleared.push(value)
             }
             finish(false, { 'set-cookie': cleared, 'clear-site-data': '"storage"' })
           })
@@ -439,14 +478,14 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
     const selected = []
     for (const part of String(req.headers.cookie || '').split(';')) {
       const name = part.trim().split('=')[0]
-      if (['__Host-brain','__Host-brain-access','__Host-brain-refresh','__Host-brain-google'].includes(name)) selected.push(part.trim())
+      if (['__Host-brain','__Host-brain-access','__Host-brain-refresh',...PROVIDER_COOKIES].includes(name)) selected.push(part.trim())
     }
     if (selected.length) headers.cookie = selected.join('; ')
     const client = forwardedFor(req)
     if (client) headers['x-forwarded-for'] = client
     return headers
   }
-  const nativeCookies = values => (values || []).filter(value => /^(?:__Host-brain(?:-access|-refresh|-google)?)=/.test(value) && value.length <= 8192).slice(0,8)
+  const nativeCookies = values => (values || []).filter(value => /^(?:__Host-brain(?:-access|-refresh|-google|-apple|-linkedin)?)=/.test(value) && value.length <= 8192).slice(0,8)
   // /_brain/files: both directions stream with backpressure. The bucket enforces its own maxBytes and access checks.
   function fileStream(req, res, url, rid) {
     if (stopped || streams >= 32) throw bridgeBusy('Backend stream capacity is unavailable')
@@ -526,7 +565,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, r
         const cookies = nativeCookies(backend.headers['set-cookie'])
         if (cookies.length) safe['set-cookie'] = cookies
         if (backend.statusCode >= 500 && !res.$capture) res.$brainCause = 'answered by the native backend'
-        try { reply(res,backend.statusCode || 502,req.method === 'HEAD' ? '' : Buffer.concat(chunks,bytes),safe); resolve() } catch (e) { reject(e) }
+        try { reply(res,backend.statusCode || 502,req.method === 'HEAD' ? '' : Buffer.concat(chunks,bytes),safe,providerStartRedirect(req.method,url.pathname,backend.statusCode,safe.location)); resolve() } catch (e) { reject(e) }
       }
       const cancel = () => { outgoing?.destroy(); finish(true) }
       const data = chunk => {
@@ -985,7 +1024,7 @@ export function createServer(o = {}) {
     // a thrown plain object, string or undefined has no stack: say what kind of value it was (never the value itself)
     if (!(e instanceof Error)) out.thrown = e === null ? 'null' : Array.isArray(e) ? 'array' : typeof e
     if (e && typeof e === 'object' && (e.temporary === true || e.status === 429 || e.status === 503)) out.temporary = true
-    if (e instanceof HttpError && (OWN_CAUSES.has(e.message) || e.message.startsWith('Native authentication is unavailable:'))) out.cause = e.message
+    if (e instanceof HttpError && OWN_CAUSES.has(e.message)) out.cause = e.message
     if (e && e.code === 'ERR_MODULE_NOT_FOUND') out.fix = 'this process runs an older build whose files are gone; restart it after brain build'
     if (e && CODE_SHAPE.test(e.transport || '')) out.transport = e.transport
     if (e && typeof e.code === 'string' && CODE_SHAPE.test(e.code)) out.backendCode = e.code
@@ -996,6 +1035,11 @@ export function createServer(o = {}) {
     return out
   }
   const mf = readManifest(dist)
+  // The build policy controls attribution independently of CSP and other security headers.
+  let compilerBranding=mf.compilerBranding!==false
+  try {const path=join(dist,'brain-build.json'),meta=lstatSync(path);if(meta.isFile()&&!meta.isSymbolicLink()&&meta.size<=16384&&JSON.parse(readFileSync(path,'utf8')).compilerBranding===false)compilerBranding=false}catch{}
+  const SECURITY={...DEFAULT_SECURITY}
+  if(!compilerBranding)delete SECURITY['x-generated-by']
   // brain.json `server` (§11.1), written into the manifest by the build; createServer options and env still win
   const SL = mf.server || {}
   const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? SL.timeoutMs ?? 10000)
@@ -1027,6 +1071,48 @@ export function createServer(o = {}) {
     }
     return resolveClient(req.socket.remoteAddress, forwarded, proxies)
   }
+  // platform.access (docs/backend/access.md): /api, /_brain and /s answer this site only. Refused sources are counted
+  // per client address (at most 512, the oldest dropped) for `brain access sources`, and logged at most 16 a minute.
+  const access = accessPolicy(o.access ?? mf.access ?? {}, mf.site || env.PUBLIC_SITE_URL)
+  const refusedSources = new Map()
+  const budgetKey = `edge ${++servers} `
+  let accessWindow = 0, accessLogs = 0, inFlight = 0, limitedWindow = 0, limited = 0, limitedLogs = 0
+  // the dynamic budget (accessBudget) and the in-flight cap: past either the answer is an immediate 429 or 503 with
+  // Retry-After, no queue, and one log line per minute sums what was turned away
+  const overBudget = (req, res, path, client) => {
+    const wait = access ? accessBudget(path, client, access, budgetKey) : 0
+    const busy = !wait && access.concurrency !== null && !ACCESS_EXEMPT.test(path) && inFlight >= access.concurrency
+    if (!wait && !busy) {
+      if (access.concurrency !== null) { inFlight++; res.once('close', () => inFlight--) }
+      return false
+    }
+    const minute = Math.floor(Date.now() / 60000)
+    if (limitedWindow !== minute) {
+      if (limited) log('warn', 'requests limited', { count: limited, minute: new Date(limitedWindow * 60000).toISOString(), fix: 'raise platform.access.perMinute or concurrency if real visitors are among them' })
+      limitedWindow = minute; limited = 0; limitedLogs = 0
+    }
+    limited++
+    if (limitedLogs++ < 4) log('warn', 'request limited', { ip: client, path: String(path).slice(0, 256), reason: busy ? 'concurrency' : 'perMinute', userAgent: typeof req.headers['user-agent'] === 'string' ? req.headers['user-agent'].slice(0, 256) : null })
+    send(res, busy ? 503 : 429, busy ? 'Busy, try again shortly' : 'Too many requests', { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store', 'retry-after': String(busy ? 2 : wait) })
+    return true
+  }
+  const accessRefused = (req, rid, path, client, reason) => {
+    const bound = v => typeof v === 'string' ? v.slice(0, 256) : null
+    const now = new Date().toISOString()
+    let entry = refusedSources.get(client)
+    if (entry) refusedSources.delete(client)
+    else {
+      if (refusedSources.size >= 512) refusedSources.delete(refusedSources.keys().next().value)
+      entry = { ip: client, count: 0, first: now, reasons: {} }
+    }
+    entry.count++; entry.last = now; entry.reasons[reason] = (entry.reasons[reason] || 0) + 1
+    Object.assign(entry, { path: bound(path), origin: bound(req.headers.origin), referer: bound(req.headers.referer), host: bound(req.headers['x-forwarded-host'] || req.headers.host), userAgent: bound(req.headers['user-agent']), country: bound(req.headers['cf-ipcountry']) })
+    refusedSources.set(client, entry)
+    const minute = Math.floor(Date.now() / 60000)
+    if (accessWindow !== minute) { accessWindow = minute; accessLogs = 0 }
+    if (accessLogs++ >= 16) return
+    log('warn', 'access refused', { code: 'B0752', reason, rid, ip: client, path: entry.path, origin: entry.origin, referer: entry.referer, secFetchSite: bound(req.headers['sec-fetch-site']), host: entry.host, userAgent: entry.userAgent, fix: 'the native API answers this site only; a page of the site, an API key, or an address in platform.access.ips passes. Run brain explain B0752' })
+  }
   // server/routes/* of the native backend, listed by the build: only these exact shapes cross the bridge
   const nativeRoutes = (Array.isArray(mf.nativeRoutes) ? mf.nativeRoutes : []).map(route => {
     if (typeof route?.path !== 'string' || !Array.isArray(route.headers)) throw Error('Manifest nativeRoutes must list path and headers')
@@ -1127,17 +1213,22 @@ export function createServer(o = {}) {
   // HTML: `no-cache` + ETag (strong for files, weak for SSR) → a repeat visit gets 304 with no body (§35); the ETag is
   // taken before the per-response nonce is injected, so it is stable
   const html = (res, status, page, headers = {}, etag) => {
+    // A 304 updates the cached document's policy too; keep it identical to its 200 without minting a CSP nonce.
+    headers = { 'cache-control': 'no-cache', ...(googleSignInPage(page) ? { 'cross-origin-opener-policy': 'same-origin-allow-popups' } : {}), ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...headers }
     if (etag && status === 200) {
       headers = { etag, ...headers }
       const inm = res.req.headers['if-none-match']
       if (inm && inm.split(',').some(t => t.trim().replace(/^W\//, '') === etag.replace(/^W\//, ''))) return send(res, 304, '', headers)
     }
+    // RFC 9111 section 4.3.5 lets HEAD update cached GET headers without replacing its body.
+    // As with 304, omit a new body-bound policy so the cached script nonce remains authorized.
+    if (res.req.method === 'HEAD') return send(res, status, '', { 'content-type': MIME['.html'], ...headers })
     const nonce = randomBytes(16).toString('base64')
     // behavior analytics (docs/backend/analytics.md): with a native backend every page loads its collector as an async
     // module served by that backend, outside the build and the route budgets; BRAIN_ANALYTICS=off skips the tag
     if (analyticsTag && !page.includes(analyticsTag)) page = page.includes('</head>') ? page.replace('</head>', analyticsTag + '</head>') : page + analyticsTag
     const body = page.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
-    send(res, status, body, { 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache', ...(googleSignInPage(page) ? { 'cross-origin-opener-policy': 'same-origin-allow-popups' } : {}), ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...headers })
+    send(res, status, body, { 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), ...headers })
   }
   const notFound = (req, res) => failPage(res, 404, res.getHeader('x-request-id'))
   // `gone()` from load (§33): 410 tells crawlers the URL was removed for good; views/410.brain, else the 404 page
@@ -1150,7 +1241,7 @@ export function createServer(o = {}) {
   }
   // `/403`, `/404.html`, `/503`…: the status when the app has that page, else 0 and the path is an ordinary one
   const reservedStatus = pathname => {
-    const m = /^\/(403|404|410|5\d\d)(?:\.html)?$/.exec(pathname)
+    const m = /^\/(403|404|410|5\d\d)(?:\.(?:html|brain))?$/.exec(pathname)
     if (!m) return 0
     const n = +m[1]
     return file(`${n}.html`) || (mf.errors && mf.errors[n]) || (n === 403 && mf.forbidden) || (n === 404 && mf.notFound) ? n : 0
@@ -1301,16 +1392,30 @@ export function createServer(o = {}) {
   }
   const anonymous = req => (req.method === 'GET' || req.method === 'HEAD') && !req.headers.authorization && !req.headers.cookie
 
+  const preloadHints = new WeakMap()
   async function ssr(req, res, route, params, url, rid, forms = null, status = 200, fixed = null, nocache = false) {
     // the route's preloads (the same Link values as _headers): on the response, where hosts turn them into early hints,
     // capped so a long list cannot trip a proxy's header buffer. A 103 (#232) only when opted in, and never to HTTP/1.0.
     if (route.links && route.links.length && !res.$capture && !res.$hinted) {
       res.$hinted = true
-      const link = route.links.join(', ')
-      if (link.length <= 2048 && !res.headersSent) res.setHeader('link', link)
-      if (EARLY_HINTS && res.writeEarlyHints && req.httpVersion !== '1.0') {
+      let selected = preloadHints.get(route)
+      if (!selected) {
+        selected = []
+        let bytes = 0
+        // Preserve graph order within a priority; render-blocking styles and fonts precede script hints.
+        const priority = value => /(?:^|;)\s*as=(?:style|font)(?:;|$)/.test(value) ? 0 : 1
+        for (const value of [...route.links].sort((a, b) => priority(a) - priority(b))) {
+          const size = Buffer.byteLength(value) + (selected.length ? 2 : 0)
+          if (bytes + size > 2048) continue
+          selected.push(value); bytes += size
+        }
+        preloadHints.set(route, selected)
+        if (selected.length < route.links.length) log('warn', 'preload hints trimmed to 2048 bytes; fix: reduce the route preload graph', { route: route.path, kept: selected.length, dropped: route.links.length - selected.length })
+      }
+      if (selected.length && !res.headersSent) res.setHeader('link', selected.join(', '))
+      if (selected.length && EARLY_HINTS && res.writeEarlyHints && req.httpVersion !== '1.0') {
         try {
-          res.writeEarlyHints({ link: route.links })
+          res.writeEarlyHints({ link: selected })
         } catch {}
       }
     }
@@ -1389,7 +1494,7 @@ export function createServer(o = {}) {
     // a page behind a guard passes it only for its visitor: it stays out of the index even when it renders (§33)
     if (route.guards && route.guards.length) res.setHeader('x-robots-tag', NOINDEX)
     // with seo.trailingSlash "ignore" both forms answer: the canonical takes the form the sitemap lists (no slash)
-    let out = head(page, seo, SLASH === 'always' || url.pathname === '/' ? url.pathname : url.pathname.replace(/\/+$/, '') || '/', url.search)
+    let out = head(page, seo, SLASH === 'always' || url.pathname === '/' ? url.pathname : url.pathname.replace(/\/+$/, '') || '/', url.search, route, BASE.slice(0, -1))
     // route params for route() in the browser (the client has no route table)
     if (params && Object.keys(params).length) out = out.replace('</head>', () => `<meta name="brain-params" content="${esc(JSON.stringify(params))}"></head>`)
     if (forms) out = out.replace('</body>', () => `<script type="application/json" id="brain-forms">${jsonInHtml(forms)}</script></body>`)
@@ -1427,9 +1532,18 @@ export function createServer(o = {}) {
     const seoF = sm.seo || (await load(route.view)).default.seo
     if (route.i18n) await load(route.i18n)
     const nonce = randomBytes(16).toString('base64'), n = h => h.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
+    globalThis.__brainLocale = route.locale || null
+    let seo0 = null
+    try {
+      seo0 = typeof seoF === 'function' ? seoF({}) : null
+    } finally {
+      globalThis.__brainLocale = null
+    }
+    const initialHead = head(top, seo0, url.pathname, url.search, route, BASE.slice(0, -1))
     const enc = COMPRESS && req.method !== 'HEAD' ? acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] : null
     res.writeHead(200, {
-      ...SECURITY, 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache',
+      ...SECURITY, 'content-type': MIME['.html'], ...(req.method === 'HEAD' ? {} : { 'content-security-policy': withNonce(mf.csp || CSP0, nonce) }), 'cache-control': 'no-cache',
+      ...(googleSignInPage(initialHead) ? { 'cross-origin-opener-policy': 'same-origin-allow-popups' } : {}),
       ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...extra, ...ctx.session.headers(),
       ...(COMPRESS ? { vary: varyEncoding(extra.vary) } : {}), ...(enc ? { 'content-encoding': enc } : {}),
     })
@@ -1437,15 +1551,8 @@ export function createServer(o = {}) {
     const zs = enc ? encodeStream(enc) : null
     if (zs) zs.pipe(res)
     const write = s => (zs ? (zs.write(s), zs.flush()) : res.write(s))
-    globalThis.__brainLocale = route.locale || null
-    let seo0 = null
-    try {
-      seo0 = typeof seoF === 'function' ? seoF({}) : null
-    } finally {
-      globalThis.__brainLocale = null
-    }
     const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) }
-    write(n(head(top, seo0, url.pathname, url.search)))
+    write(n(initialHead))
     // QA #253: the folder's _loading.brain goes in the region with the first chunk (SPEC: shows while load runs),
     // between two marker comments; the last chunk starts with a script that removes them and what is between
     let clear = ''
@@ -1723,7 +1830,9 @@ export function createServer(o = {}) {
   }
   // §33 S01: every sitemap file holds at most 50 000 URLs and SITEMAP_BYTES bytes of UTF-8 XML; the dynamic URLs fill
   // /sitemap-dynamic.xml, /sitemap-dynamic-2.xml, … in sitemap() order, so the split is deterministic
-  const SET_HEAD = '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n'
+  const XML_SIGNATURE = compilerBranding ? '<!-- by BRAINLLM https://chrisifm.github.io/BRAINLLM/ -->' : ''
+  const XML_HEADER = `<?xml version="1.0" encoding="UTF-8"?>\n${XML_SIGNATURE}\n`
+  const SET_HEAD = XML_HEADER + '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n'
   const SET_FOOT = '</urlset>\n'
   const bytes = t => Buffer.byteLength(t)
   function pages(urls) {
@@ -1741,7 +1850,9 @@ export function createServer(o = {}) {
   async function serveSitemap(req, res, url) {
     const f = file('/sitemap.xml')
     if (!f) return false
-    const text = readFileSync(f, 'utf8')
+    const original = readFileSync(f, 'utf8')
+    const declaration = original.startsWith('<?xml') ? original.indexOf('?>') + 2 : 0
+    const text = !XML_SIGNATURE || original.includes(XML_SIGNATURE) ? original : declaration > 1 ? original.slice(0, declaration) + '\n' + XML_SIGNATURE + original.slice(declaration) : XML_SIGNATURE + '\n' + original
     const origin = mf.site || [...text.matchAll(/<loc>(https?:\/\/[^<]+)<\/loc>/g)].map(m => URL.canParse(m[1]) && new URL(m[1]).origin).find(Boolean)
     if (!origin) return false
     const index = text.includes('<sitemapindex')
@@ -1761,13 +1872,47 @@ export function createServer(o = {}) {
       index
         ? text.replace('</sitemapindex>', `${kids}</sitemapindex>`)
         : split
-          ? `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${kids}</sitemapindex>\n`
+          ? `${XML_HEADER}<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${kids}</sitemapindex>\n`
           : text.replace('</urlset>', sets[0] + '</urlset>'),
     )
     return true
   }
 
   // ---------- static ----------
+  // Content validators use bounded buffers and a bounded metadata cache; a full media file never enters the heap.
+  const fileTags = new Map(), hashingFiles = new Map()
+  async function fileTag(handle, stat) {
+    const key = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`
+    if (fileTags.has(key)) return fileTags.get(key)
+    if (hashingFiles.has(key)) return hashingFiles.get(key)
+    if (hashingFiles.size >= 8) throw new HttpError(503, 'Static file validators are busy; retry shortly')
+    const task = (async () => {
+      const hash = createHash('sha256'), buf = Buffer.alloc(65536), until = performance.now() + 30000
+      let offset = 0
+      while (offset < stat.size) {
+        if (performance.now() > until) throw new HttpError(503, 'Static file validator deadline exceeded; retry shortly')
+        const { bytesRead } = await handle.read(buf, 0, Math.min(buf.length, stat.size - offset), offset)
+        if (!bytesRead) throw new HttpError(503, 'Static file changed while computing its validator')
+        hash.update(buf.subarray(0, bytesRead)); offset += bytesRead
+      }
+      const after = await handle.stat()
+      if (after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs) throw new HttpError(503, 'Static file changed; retry shortly')
+      const etag = '"' + hash.digest('base64url') + '"'
+      fileTags.set(key, etag)
+      if (fileTags.size > 256) fileTags.delete(fileTags.keys().next().value)
+      return etag
+    })()
+    hashingFiles.set(key, task)
+    try { return await task } finally { hashingFiles.delete(key) }
+  }
+  async function streamFile(req, res, handle, status, headers, span) {
+    if (req.method === 'HEAD') return send(res, status, '', headers)
+    res.writeHead(status, { ...SECURITY, ...(server.draining ? { connection: 'close' } : {}), ...headers })
+    // The descriptor stays pinned from stat and hashing through transmission, including atomic deployments.
+    const length = Number(headers['content-length'])
+    if (!length) return res.end()
+    await pipeline(handle.createReadStream({ start: 0, end: length - 1, ...span, autoClose: false }), res)
+  }
   // Never served (brain-pack private.rs holds the same list for the Rust handler and every generated host config).
   const PRIVATE_PREFIXES = ['_server', '_brain', 'server.mjs']
   const PRIVATE_FILES = ['_headers', '_redirects']
@@ -1795,7 +1940,7 @@ export function createServer(o = {}) {
   // site configured) or with a per-request pattern gets no header, so this never invents a URL.
   function twinCanonical(path) {
     const stem = path.replace(/\.md$/, '').replace(/\/+$/, '')
-    const page = file(stem ? stem + '.html' : 'index.html') || file(stem + '/index.html')
+    const page = file(stem ? stem + '.html' : 'index.html') || file(stem + '/index.html') || file(stem ? stem + '.brain' : 'index.brain') || file(stem + '/index.brain')
     if (!page) return {}
     const tag = /<link\b[^>]*\brel=["']canonical["'][^>]*>/i.exec(readFileSync(page, 'utf8'))?.[0]
     const href = tag && /\bhref="(https?:\/\/[^"<>\s]+)"/.exec(tag)?.[1].replaceAll('&amp;', '&')
@@ -1804,21 +1949,21 @@ export function createServer(o = {}) {
   // What exists whatever the routes say: generated sitemaps, built files and the icon browsers ask for by habit.
   async function serveFixed(req, res, url) {
     if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return true
-    if (serveStatic(req, res, url)) return true
+    if (await serveStatic(req, res, url)) return true
     if (url.pathname !== '/favicon.ico' || !file('favicon.svg')) return false
     send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
     return true
   }
 
-  function serveStatic(req, res, url) {
+  async function serveStatic(req, res, url) {
     const p = publicStaticPath(url.pathname)
     if (p === null) return false
-    const candidates = p.endsWith('/') ? [p + 'index.html', ...(p.length > 1 ? [p.slice(0, -1) + '.html'] : [])] : [p, p + '.html', p + '/index.html']
+    const candidates = p.endsWith('/') ? [p + 'index.html', p + 'index.brain', ...(p.length > 1 ? [p.slice(0, -1) + '.html', p.slice(0, -1) + '.brain'] : [])] : [p, p + '.html', p + '/index.html', p + '.brain', p + '/index.brain']
     for (const c of candidates) {
       const f = file(c)
       if (!f) continue
       const ext = extname(f), type = FEEDS[basename(f)] || MIME[ext] || 'application/octet-stream'
-      if (ext === '.html') {
+      if (ext === '.html' || ext === '.brain') {
         // §33: the page's Markdown twin (`/pricing` → pricing.md) when the client prefers text/markdown
         if (serveTwin(req, res, url)) return true
         const md = file(mdPath(p))
@@ -1830,21 +1975,39 @@ export function createServer(o = {}) {
         ...(ext === '.md' ? twinCanonical(p) : {}),
         'content-type': type,
         // the worker script must be revalidated on every check, or a CDN could keep an old worker for an hour (§35.7)
-        'cache-control': p.startsWith('/_b/') ? 'public, max-age=31536000, immutable' : p === '/sw.js' ? 'no-cache' : 'public, max-age=3600',
+        'cache-control': p.startsWith('/_b/') ? 'public, max-age=31536000, immutable' : p === '/sw.js' || /\.(m3u8?|mpd)$/i.test(p) ? 'no-cache' : 'public, max-age=3600',
         vary: 'accept-encoding',
       }
       // the smallest precompressed sibling the client accepts (the build keeps only those smaller than the file)
       let best = null
-      for (const enc of acceptedEncodings(req.headers['accept-encoding'])) {
+      for (const enc of req.headers.range ? [] : acceptedEncodings(req.headers['accept-encoding'])) {
         const encoded = file(c + (enc === 'br' ? '.br' : enc === 'zstd' ? '.zst' : '.gz'))
         const size = encoded ? statSync(encoded).size : Infinity
         if (encoded && (!best || size < best.size)) best = { enc, encoded, size }
       }
-      if (best) {
-        send(res, 200, req.method === 'HEAD' ? '' : readFileSync(best.encoded), { ...headers, 'content-encoding': best.enc })
-        return true
+      const selected = best ? best.encoded : f
+      const handle = await open(selected, FS.O_RDONLY | (FS.O_NOFOLLOW || 0) | (FS.O_NONBLOCK || 0))
+      try {
+        const stat = await handle.stat()
+        if (!stat.isFile()) throw new Error('Static output must be a regular file')
+        headers.etag = await fileTag(handle, stat)
+        if (res.destroyed) return true
+        if (!best) headers['accept-ranges'] = 'bytes'
+        const inm = req.headers['if-none-match']
+        if (inm && inm.split(',').some(t => t.trim() === '*' || t.trim().replace(/^W\//, '') === headers.etag)) return send(res, 304, '', headers), true
+        const span = req.headers.range && (!req.headers['if-range'] || req.headers['if-range'] === headers.etag) ? byteRange(req.headers.range, stat.size) : null
+        if (span === false) return send(res, 416, '', { ...headers, 'content-range': `bytes */${stat.size}` }), true
+        if (span) {
+          headers['content-range'] = `bytes ${span.start}-${span.end}/${stat.size}`
+          headers['content-length'] = String(span.end - span.start + 1)
+        } else {
+          headers['content-length'] = String(stat.size)
+          if (best) headers['content-encoding'] = best.enc
+        }
+        await streamFile(req, res, handle, span ? 206 : 200, headers, span)
+      } finally {
+        await handle.close()
       }
-      send(res, 200, req.method === 'HEAD' ? '' : readFileSync(f), headers)
       return true
     }
     return false
@@ -1936,6 +2099,11 @@ export function createServer(o = {}) {
       let full
       try { full = new URL(req.url, 'http://' + host) } catch { return send(res, 400, 'Bad Request') }
       // /_health stays at the root: the supervisor calls it there whatever the base
+      // refused API sources, for an operator on this machine only (a loopback socket and no forwarded hop)
+      if (full.pathname === '/_access/sources' && req.method === 'GET') {
+        if (!LOOPBACK(plainIp(req.socket.remoteAddress ?? '') || '') || req.headers['x-forwarded-for']) return notFound(req, res)
+        return send(res, 200, json({ sources: [...refusedSources.values()].sort((a, b) => b.count - a.count) }), { 'content-type': MIME['.json'], 'cache-control': 'no-store' })
+      }
       if (full.pathname === '/_health' || full.pathname === BASE + '_health') return send(res, 200, json({ ok: true, build: mf.build || null }), { 'content-type': MIME['.json'], 'cache-control': 'no-store' })
       let url = full
       if (BASE !== '/') {
@@ -1950,9 +2118,20 @@ export function createServer(o = {}) {
       const probe = brainProbe(url.pathname)
       if (probe) return await answerProbe(req, res, new URL(probe, url), rid)
       if (native && /^\/_brain\/files(?:\/|$)/.test(url.pathname)) return await native.fileStream(req,res,url,rid)
-      if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
+      if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) {
+        const client = ipOf(req), refused = accessRefusal(req, url.pathname, client, access)
+        if (refused) {
+          accessRefused(req, rid, url.pathname, client, refused)
+          return send(res, 403, json({ error: 'This API answers its own site only', code: 'B0752' }), { 'content-type': MIME['.json'], 'cache-control': 'no-store', 'x-brain-code': 'B0752' })
+        }
+        if (overBudget(req, res, url.pathname, client)) return
+        return await native.proxy(req,res,url,rid,send)
+      }
       const declaredRoute = native && nativeRoutes.find(route => route.rx.test(url.pathname))
-      if (declaredRoute) return await native.proxy(req,res,url,rid,send,undefined,declaredRoute)
+      if (declaredRoute) {
+        if (overBudget(req, res, url.pathname, ipOf(req))) return
+        return await native.proxy(req,res,url,rid,send,undefined,declaredRoute)
+      }
       // redirects.json (manifest `redirects`, brain-seo server_json): exact sources first, then patterns, on the app path;
       // same-site targets get the base, the query is kept when the target has none; slash policy and host in the same hop
       const to = (req.method === 'GET' || req.method === 'HEAD') && canonicalOf(req, url)
@@ -1964,7 +2143,7 @@ export function createServer(o = {}) {
       const post = req.method === 'POST'
       if (!post && req.method !== 'GET' && req.method !== 'HEAD') return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD, POST' })
       // a status page opened directly answers its own status: `/403` is never a 200 that a crawler or a probe can trust
-      const reserved = post ? 0 : reservedStatus(url.pathname)
+      const reserved = post ? 0 : reservedStatus(publicStaticPath(url.pathname) ?? url.pathname)
       if (reserved === 403) return forbidden(req, res, url, rid, '')
       if (reserved) {
         // Anyone can open it, so the note about it is bounded and is not an error.
@@ -1977,14 +2156,16 @@ export function createServer(o = {}) {
       for (const route of routes) {
         const m = route.rx.exec(url.pathname)
         if (!m) continue
+        const protectedRoute = route.guards?.length || route.middleware?.length
         // a form page without load is prerendered: GET serves that file (build ETag); only its POST needs the server
-        if (!post && route.forms && serveStatic(req, res, url)) return
+        if (!post && !protectedRoute && route.forms && (await serveStatic(req, res, url))) return
         // a parameter never hides a real file: `/[code]` must not swallow /favicon.svg, /sitemap.xml or a prerendered /login
-        if (!post && m.groups && (await serveFixed(req, res, url))) return
-        if (!post && serveTwin(req, res, url)) return
+        if (!post && !protectedRoute && m.groups && (await serveFixed(req, res, url))) return
+        if (!post && !protectedRoute && serveTwin(req, res, url)) return
         const paged = post ? null : pageParameter(route, url)
         if (paged === 404) return notFound(req, res)
         if (paged) return send(res, 301, '', { location: withBase(paged), 'cache-control': 'public, max-age=3600' })
+        if (overBudget(req, res, url.pathname, ipOf(req))) return
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
@@ -1994,7 +2175,7 @@ export function createServer(o = {}) {
     } catch (e) {
       const busy = e instanceof HttpError && e.code === 'BRIDGE_BUSY'
       if (busy) log('warn', 'backend bridge busy', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], fix: e.fix })
-      else if (e instanceof HttpError && OWN_CAUSES.has(e.message)) log('warn', 'backend unavailable', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], status: e.status, cause: e.message, ...(CODE_SHAPE.test(e.transport || '') ? { transport: e.transport } : {}) })
+      else if (e instanceof HttpError && e.status >= 500 && BACKEND_UNAVAILABLE_CAUSES.has(e.message)) log('warn', 'backend unavailable', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], status: e.status, cause: e.message, ...(CODE_SHAPE.test(e.transport || '') ? { transport: e.transport } : {}) })
       else log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
       try {
         if (busy && !res.headersSent) { res.setHeader('retry-after', String(e.retryAfter)); failPage(res, 503, rid, { code: e.code, message: 'Service Unavailable', fix: e.fix }) }
@@ -2203,6 +2384,7 @@ export async function runChain({ guards = [], middleware = [], ctx }) {
 // key past HITS_KEY_MAX characters is stored as its digest. The map stays ordered by window start: a new window is
 // re-inserted at the end, so the expired entries are always the first ones.
 const HITS = new Map() // key → [windowStart, count]
+let servers = 0 // each createServer keeps its own dynamic budget (accessBudget) in HITS
 export const HITS_MAX = 50000, HITS_KEY_MAX = 256
 export const rateLimitKeys = () => HITS.size
 const WINDOW = 60000
@@ -2424,6 +2606,94 @@ export function trustedProxies(list = []) {
  * The client is the right-most forwarded hop that is not a trusted proxy, and only when the TCP peer is trusted: hops
  * left of it are client-supplied and never consulted. Same walk as resolve_client (brain-backend/src/edge_http.rs).
  */
+/**
+ * platform.access (docs/backend/access.md): who may reach the dynamic answers and how much each client may take.
+ * `mode` "open" (default) lets any client in, scripts and headless browsers included; "own-host" refuses /api, /_brain
+ * and /s to anything without evidence of this site. Nothing is limited unless the app sets `perMinute` (dynamic
+ * requests per client and minute) or `concurrency` (dynamic requests in flight for the whole process). Normalizes `{ mode, perMinute, concurrency, origins, hosts, ips,
+ * local }`; `site` is the site origin (PUBLIC_SITE_URL), whose host is always one of the hosts.
+ * Same limits as the backend's parse_access (brain-backend/src/platform.rs).
+ */
+export function accessPolicy(raw = {}, site) {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw Error('platform.access must be an object')
+  for (const key of Object.keys(raw)) if (!['mode', 'perMinute', 'concurrency', 'origins', 'hosts', 'ips', 'local'].includes(key)) throw Error(`platform.access.${key} is not a setting; use mode, perMinute, concurrency, origins, hosts, ips or local`)
+  const list = (key, max) => {
+    const value = raw[key] ?? []
+    if (!Array.isArray(value) || value.length > max || value.some(v => typeof v !== 'string' || !v || v.length > 256)) throw Error(`platform.access.${key} must be an array of at most ${max} strings`)
+    return value
+  }
+  const origins = new Set()
+  for (const origin of list('origins', 32)) {
+    let parsed
+    try { parsed = new URL(origin) } catch { throw Error(`platform.access.origins entry \`${origin}\` must be an origin such as https://admin.example.com`) }
+    if (parsed.origin !== origin || !/^https?:$/.test(parsed.protocol)) throw Error(`platform.access.origins entry \`${origin}\` must be exactly scheme://host[:port], without a path or a trailing slash`)
+    origins.add(origin)
+  }
+  const hosts = new Set()
+  for (const host of list('hosts', 32)) {
+    if (!/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/.test(host)) throw Error(`platform.access.hosts entry \`${host}\` must be a lowercase host name without scheme, port or wildcard`)
+    hosts.add(host)
+  }
+  try { if (site) hosts.add(new URL(site).hostname) } catch {}
+  const ips = list('ips', 64)
+  const nets = ips.length ? trustedProxies(ips) : null
+  if (raw.local !== undefined && typeof raw.local !== 'boolean') throw Error('platform.access.local must be true or false')
+  const mode = raw.mode ?? 'open'
+  if (mode !== 'open' && mode !== 'own-host') throw Error('platform.access.mode must be "open" or "own-host"')
+  const count = (key, max) => {
+    const value = raw[key] ?? null
+    if (value !== null && (!Number.isInteger(value) || value < 1 || value > max)) throw Error(`platform.access.${key} must be a whole number from 1 to ${max}`)
+    return value
+  }
+  return Object.freeze({ mode, perMinute: count('perMinute', 100000), concurrency: count('concurrency', 10000), origins, hosts, nets, local: raw.local !== false })
+}
+// Paths a third party reaches on purpose: links, the analytics script, signed inbound webhooks and Apple's
+// server-to-server notifications. Each carries its own check.
+const ACCESS_EXEMPT = /^\/(?:s\/|_brain\/analytics\.js$|_brain\/webhooks\/in\/[a-z][a-z0-9_]{0,47}$|_brain\/auth\/apple\/notifications$)/
+const LOOPBACK = ip => /^(?:127\.|::1$)/.test(ip)
+/**
+ * Why a request to /api, /_brain or /s may not reach the backend, or null when it may. It passes with browser evidence
+ * of this site (an Origin of this host or of access.origins, Sec-Fetch-Site same-origin, a same-host Referer), a
+ * non-ambient credential the backend verifies (Authorization, X-Api-Key), a client address in access.ips, or a
+ * loopback client while access.local is on. Headers can be forged: this keeps other sites' pages, foreign hosts and
+ * plain scripts out, and the per-client rate limits bound what a forger reads.
+ */
+export function accessRefusal(req, path, client, policy) {
+  if (!policy || policy.mode !== 'own-host' || ACCESS_EXEMPT.test(path) || req.method === 'OPTIONS') return null
+  const h = req.headers
+  const host = String(h['x-forwarded-host'] || h.host || '').toLowerCase()
+  const hostname = host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '')
+  const local = policy.local && LOOPBACK(client)
+  if (policy.hosts.size && !policy.hosts.has(hostname) && !(local && ['localhost', '127.0.0.1', '::1'].includes(hostname))) return 'host'
+  if (local) return null
+  if (h.authorization || h['x-api-key']) return null
+  if (policy.nets && client !== '?' && policy.nets.check(client, isIP(client) === 4 ? 'ipv4' : 'ipv6')) return null
+  const own = value => {
+    try {
+      const url = new URL(value)
+      return url.host === host || policy.origins.has(url.origin)
+    } catch { return false }
+  }
+  if (h.origin) return own(h.origin) ? null : 'origin'
+  const site = h['sec-fetch-site']
+  const navigation = (req.method === 'GET' || req.method === 'HEAD') && h['sec-fetch-mode'] === 'navigate'
+  if (site === 'same-origin') return null
+  // a person who opened the URL, or a sign-in provider sending the browser back to its callback
+  if (navigation && (site === 'none' || path.startsWith('/_brain/auth/'))) return null
+  if (h.referer && own(h.referer)) return null
+  return site ? 'cross-site' : 'no-browser-evidence'
+}
+/**
+ * Whether a dynamic request (a page render, a form post, /api, /_brain, /s) stays inside its budget: 0, or the seconds
+ * to wait. Checked before any body is read or the backend is asked, so a refused client costs one map lookup. A
+ * loopback client while access.local is on, an address in access.ips and the exempt callbacks are not counted.
+ */
+export function accessBudget(path, client, policy, key = 'edge ') {
+  if (!policy || !policy.perMinute || ACCESS_EXEMPT.test(path)) return 0
+  if (policy.local && LOOPBACK(client)) return 0
+  if (policy.nets && client !== '?' && policy.nets.check(client, isIP(client) === 4 ? 'ipv4' : 'ipv6')) return 0
+  return overLimit(key + client, policy.perMinute)
+}
 export function resolveClient(peer, forwarded, nets) {
   const socketPeer = plainIp(peer ?? '')
   const trusted = ip => nets.check(ip, isIP(ip) === 4 ? 'ipv4' : 'ipv6')
@@ -2499,10 +2769,23 @@ export function prefersMarkdown(accept) {
   if (html < 0) (html = any), (htmlAt = Infinity) // an explicit type beats a wildcard of the same weight
   return md > 0 && (md > html || (md === html && mdAt < htmlAt))
 }
+// Root-relative image metadata follows the app base; bare references follow the canonical document URL.
+export function metadataImage(root, canonical, value) {
+  const encode = s => encodeURI(s.toWellFormed()).replaceAll('%25', '%')
+  value = value.trim()
+  if (!value) return ''
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || !root) return encode(value)
+  try {
+    const home = new URL(root.endsWith('/') ? root : root + '/')
+    const prefix = home.pathname.replace(/\/$/, '')
+    if (/^\/(?!\/)/.test(value)) value = new URL(value === prefix || value.startsWith(prefix + '/') ? value : prefix + value, home.origin).href
+    return new URL(value, canonical || home).href
+  } catch { return encode(value) }
+}
 // SEO head from View.seo(props): title, description, canonical, og:*/twitter:*, JSON-LD and the view's <head> block
 // F5: the build writes an SSR route's canonical/og:url from its pattern (/posts/:slug); the request has the real path.
 // A view's own <head> tags replace the generated ones with the same name/property (one tag per key, SPEC «SEO»).
-function head(page, seo, path, search = '') {
+function head(page, seo, path, search = '', route, base = '') {
   let h = page
   // `<meta seo query="page">`: these parameters make a different page; any other (a dialog, a tracking tag) does not
   let identity = '', query = ''
@@ -2514,11 +2797,13 @@ function head(page, seo, path, search = '') {
   })
   if (path) {
     // the attribute is already escaped HTML: only the request path that replaces a pattern is escaped
-    const real = v => v.replace(/^(https?:\/\/[^/]+)?(\/[^"]*)$/, (m, o = '', p) => (/\/[:*]/.test(p) ? o + esc(path) : m)) + identity
+    const real = v => v.replace(/^(https?:\/\/[^/]+)?(\/[^"]*)$/, (m, o = '', p) => (/\/[:*]/.test(p) ? o + esc(base + path) : m)) + identity
     h = h.replace(/(<link[^>]*rel=["']canonical["'][^>]*href=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
     h = h.replace(/(<meta[^>]*property=["']og:url["'][^>]*content=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
   }
-  if (!seo) return graph(h, path, query)
+  if (!seo) return graph(h, path ? base + path : path, query)
+  // Match prerendering: blank optional fields are absent; zero and false remain distinct values.
+  seo = Object.fromEntries(Object.entries(seo).filter(([, v]) => v != null && !(typeof v === 'string' && !v.trim())))
   const meta = (attr, key, val, escaped) => {
     const tag = `<meta ${attr}="${esc(key)}" content="${escaped ? val.replace(/"/g, '&quot;') : esc(val)}">`
     const rx = new RegExp(`<meta[^>]*\\b${attr}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'i')
@@ -2531,20 +2816,27 @@ function head(page, seo, path, search = '') {
     else if (k === 'canonical') {
       // a root-relative canonical takes the origin the build wrote into the template (PUBLIC_SITE_URL), as it does on
       // a prerendered page: a relative canonical is ignored by search engines
-      const built = /^\/(?!\/)/.test(v) && /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
-      const url = built ? built + v : v
+      const relative = base && (v + '/').startsWith(base + '/') ? v.slice(base.length) || '/' : v
+      const translated = linkTo(route, relative)
+      const local = /^\/(?!\/)/.test(translated) ? base + translated : translated
+      const built = /^\/(?!\/)/.test(local) && /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
+      const url = built ? built + local : local
       const tag = `<link rel="canonical" href="${esc(url)}">`
       h = /<link[^>]*rel=["']canonical["'][^>]*>/i.test(h) ? h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/i, () => tag) : h.replace('</head>', () => tag + '</head>')
       if (seo['og:url'] == null) meta('property', 'og:url', url) // og:url follows the canonical unless the view sets its own
     } else if (k === 'jsonld') h = h.replace('</head>', () => `<script type="application/ld+json">${jsonInHtml(v)}</script></head>`)
-    else if (/^(og|twitter|article):/.test(k)) meta('property', k, v)
+    else if (/^(og|twitter|article):/.test(k)) meta(k.startsWith('twitter:') ? 'name' : 'property', k, v)
     else if (typeof v === 'string') meta('name', k, v)
   }
   // What the build writes for a prerendered page and can only be known here: the social card of this request's values
   // (brain-seo social::head, prerender seo_head). The view's own value always wins.
   const shared = /<title>([\s\S]*?)<\/title>/i.exec(h)?.[1]
   const origin = /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
-  if (typeof seo['og:image'] === 'string' && origin && /^\/(?!\/)/.test(seo['og:image'])) meta('property', 'og:image', encodeURI(origin + seo['og:image']))
+  const canonical = /<link[^>]*rel=["']canonical["'][^>]*href="([^"]+)"/i.exec(h)?.[1].replaceAll('&amp;', '&')
+  for (const key of ['og:image', 'og:image:url', 'og:image:secure_url', 'twitter:image', 'twitter:image:src']) if (typeof seo[key] === 'string') {
+    seo[key] = metadataImage(origin ? origin + base : null, canonical, seo[key])
+    meta(key.startsWith('twitter:') ? 'name' : 'property', key, seo[key])
+  }
   if (seo.title != null && seo['og:title'] == null) meta('property', 'og:title', shared, true)
   if (seo.description != null && seo['og:description'] == null) meta('property', 'og:description', seo.description)
   if (seo['og:image'] != null) {
@@ -2560,19 +2852,21 @@ function head(page, seo, path, search = '') {
     if (seo.title != null) node[/^(Article|BlogPosting|NewsArticle|TechArticle|Report)$/.test(T) ? 'headline' : 'name'] = String(seo.title).slice(0, 110)
     if (seo.description != null) node.description = String(seo.description)
     if (canon) node.url = canon[1].replace(/&amp;/g, '&')
-    if (seo['og:image'] != null) node.image = String(seo['og:image']).replace(/^\/(?!\/)/, () => (canon && /^https?:\/\/[^/]+/.exec(node.url) || [''])[0] + '/')
+    if (seo['og:image'] != null) node.image = seo['og:image']
     if (seo.lastmod != null) node.dateModified = String(seo.lastmod)
     const own = new RegExp(`<script[^>]*type=["']application/ld\\+json["'][^>]*>\\s*\\{"@context":"https://schema\\.org","@type":"${T}"[\\s\\S]*?</script>`, 'i')
     const tag = `<script type="application/ld+json">${jsonInHtml(node)}</script>`
     h = own.test(h) ? h.replace(own, () => tag) : h.replace('</head>', () => tag + '</head>')
   }
   if (seo.$head) {
-    for (const [, attr, key] of seo.$head.matchAll(/<meta[^>]*\b(property|name)=["']([^"']+)["'][^>]*>/gi))
-      h = h.replace(new RegExp(`<meta[^>]*\\b${attr}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'gi'), '')
+    for (const [, attr, key] of seo.$head.matchAll(/<meta[^>]*\b(property|name)=["']([^"']+)["'][^>]*>/gi)) {
+      const attributes = key.startsWith('twitter:') ? '(?:property|name)' : attr
+      h = h.replace(new RegExp(`<meta[^>]*\\b${attributes}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'gi'), '')
+    }
     if (/<link[^>]*rel=["']canonical["']/i.test(seo.$head)) h = h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/gi, '')
     h = h.replace('</head>', () => seo.$head + '</head>')
   }
-  return graph(h, path, query, seo)
+  return graph(h, path ? base + path : path, query, seo)
 }
 // The WebSite + WebPage graph the build wrote into the template (brain-seo ServerHead::apply): its pattern URLs become
 // this request's, like the canonical, and the WebPage takes this request's title and description.
@@ -2588,27 +2882,32 @@ function graph(h, path, query, seo) {
       if ([node['@type']].flat().includes('WebPage')) {
         if (title && node.name == null) node.name = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, '&')
         if (seo?.description != null && node.description == null) node.description = String(seo.description)
+        if (typeof seo?.['og:image'] === 'string' && seo.jsonld == null) {
+          const image = node.primaryImageOfPage
+          if (!image || (image['@type'] === 'ImageObject' && !image['@id'])) node.primaryImageOfPage = { '@type': 'ImageObject', ...image, url: seo['og:image'] }
+        }
       }
     }
     return a + jsonInHtml(g) + b
   })
 }
-// `/_b/<hash>.js` imports inside the chunks resolve to files in dist/ (same hook as the build's prerender)
+// Only compiler-owned chunks receive the own-extension module format; ordinary Node imports keep their loader.
+function resolveChunk(s, c, next, base, app) {
+  if (app !== '/' && s.startsWith(app + '_b/')) s = s.slice(app.length - 1)
+  const mapped = s.startsWith('/_b/')
+  const url = mapped ? new URL('.' + s, base) : s.startsWith('file:') ? new URL(s) : s.startsWith('.') && c.parentURL?.startsWith('file:') ? new URL(s, c.parentURL) : null
+  const owned = new URL('_b/', base).href
+  if (url?.href.startsWith(owned) && url.pathname.endsWith('.jsbrain')) return { url: url.href, format: 'module', shortCircuit: true }
+  if (mapped) return { url: url.href, shortCircuit: true }
+  return next(s, c)
+}
 let hooked = false
 function hook(base, app = '/') {
   if (hooked) return
   hooked = true
-  // chunks import '/_b/x.js', or '/app/_b/x.js' under a base path: both are dist/_b/x.js
-  const own = s => {
-    if (app !== '/' && s.startsWith(app + '_b/')) s = s.slice(app.length - 1)
-    return s.startsWith('/_b/') && { url: new URL('.' + s, base).href, shortCircuit: true }
-  }
-  // registerHooks (Node 22.15+, in-thread) replaces the deprecated register (DEP0205)
-  if (Module.registerHooks) return void Module.registerHooks({ resolve: (s, c, next) => own(s) || next(s, c) })
-  Module.register(
-    'data:text/javascript,' +
-      encodeURIComponent(`export async function resolve(s, c, n) { const a = ${json(app)}; if (a !== '/' && s.startsWith(a + '_b/')) s = s.slice(a.length - 1); return s.startsWith('/_b/') ? { url: new URL('.' + s, ${json(base)}).href, shortCircuit: true } : n(s, c) }`)
-  )
+  // registerHooks (Node 22.15+, in-thread) and the compatibility loader share exactly the same resolver.
+  if (Module.registerHooks) return void Module.registerHooks({ resolve: (s, c, next) => resolveChunk(s, c, next, base, app) })
+  Module.register('data:text/javascript,' + encodeURIComponent(`${resolveChunk.toString()};export async function resolve(s,c,n){return resolveChunk(s,c,n,${json(base)},${json(app)})}`))
 }
 
 const LISTEN_WAIT_MS = 10000