@christianirack/brainllm-runtime 0.9.0 → 0.10.0

package/brain-analytics.js

@@ -37,7 +37,8 @@ export function start(config = {}, env = globalThis) {
   const win = env.window || env
   const nav = env.navigator || {}
   const loc = () => env.location || { pathname: '/', search: '', href: '/', origin: '' }
-  const store = env.localStorage
+  let store
+  try { store = env.localStorage } catch {} // some browsers block access to the storage object itself
   const now = () => (env.performance ? env.performance.now() : Date.now())
   if (!doc || config.enabled === false) return null
   if (nav.globalPrivacyControl === true || nav.doNotTrack === '1' || win.doNotTrack === '1' || nav.webdriver) return null
@@ -45,7 +46,9 @@ export function start(config = {}, env = globalThis) {
   const consented = () => {
     if (config.consent !== 'required') return true
     try {
-      return !!(JSON.parse(store.getItem('brain:consent')) || {}).analytics
+      const memory = env[Symbol.for('brain:consent-state')]
+      if (memory && Object.hasOwn(memory, 'analytics')) return memory.analytics === true
+      return (JSON.parse(store.getItem('brain:consent')) || {}).analytics === true
     } catch {
       return false
     }
@@ -193,9 +196,11 @@ export function start(config = {}, env = globalThis) {
   let maxScroll = 0
   let path = loc().pathname
   let stopped = false
+  let consentEpoch = 0
   const send = () => {
     clearTimeout(timer)
     timer = null
+    if (!consented()) { discardDenied(); return }
     if (!queue.length) return
     const vid = ids()
     while (queue.length) {
@@ -267,9 +272,25 @@ export function start(config = {}, env = globalThis) {
   const listen = (t, f, target = doc) => {
     if (!target.addEventListener) return
     const o = { capture: true, passive: true }
-    target.addEventListener(t, f, o)
-    off.push(() => target.removeEventListener(t, f, o))
+    const listener = /^(brain:consent|storage|popstate|visibilitychange|pagehide)$/.test(t) ? f : event => { if (consented()) f(event) }
+    target.addEventListener(t, listener, o)
+    off.push(() => target.removeEventListener(t, listener, o))
   }
+  const discardDenied = () => {
+    if (!consented()) {
+      queue.length = 0; clearTimeout(timer); timer = null; pv = 0; consentEpoch++
+      clicks.length = 0; focused.clear(); typed.clear()
+      if (hover) clearTimeout(hover.t)
+      hover = null
+    }
+  }
+  listen('brain:consent', discardDenied, win)
+  listen('storage', event => {
+    if (event.key === 'brain:consent' || event.key === null) {
+      delete env[Symbol.for('brain:consent-state')]
+      discardDenied()
+    }
+  }, win)
   const clicks = []
   let mutations = 0
   const Observer = env.MutationObserver
@@ -291,7 +312,9 @@ export function start(config = {}, env = globalThis) {
       const seen = changes()
       const href = loc().href
       const active = doc.activeElement
+      const epoch = consentEpoch
       setTimeout(() => {
+        if (epoch !== consentEpoch) return
         if (changes() === seen && loc().href === href && doc.activeElement === active) record('dead', el)
       }, DEAD_MS)
     }
@@ -357,7 +380,8 @@ export function start(config = {}, env = globalThis) {
     const el = actionable(e.target)
     if (!el || hovered.has(el) || (hover && hover.el === el)) return
     if (hover) clearTimeout(hover.t)
-    hover = { el, t: setTimeout(() => (hovered.add(el), (hover = null), record('hover', el, HOVER_MS)), HOVER_MS) }
+    const epoch = consentEpoch
+    hover = { el, t: setTimeout(() => { if (epoch === consentEpoch) { hovered.add(el); hover = null; record('hover', el, HOVER_MS) } }, HOVER_MS) }
   })
   listen('pointerout', e => {
     if (hover && actionable(e.target) === hover.el) clearTimeout(hover.t), (hover = null)

package/brain-consent.js

@@ -10,29 +10,90 @@ const TYPES = {
   functional: ['functionality_storage'],
   personal: ['personalization_storage'],
 }
-const read = () => {
+const MEMORY = Symbol.for('brain:consent-state')
+const read = (env = G) => {
+  const state = {}
   try {
-    return JSON.parse(G.localStorage.getItem(KEY)) || {}
-  } catch {
-    return {}
-  }
+    const stored = JSON.parse(env.localStorage.getItem(KEY))
+    for (const kind of Object.keys(TYPES)) if (typeof stored?.[kind] === 'boolean') state[kind] = stored[kind]
+  } catch {}
+  const memory = env[MEMORY]
+  for (const kind of Object.keys(TYPES)) if (typeof memory?.[kind] === 'boolean') state[kind] = memory[kind]
+  return state
 }
-const apply = state => {
+const apply = (state, env = G) => {
   const u = {}
-  for (const k in state) for (const t of TYPES[k] || []) u[t] = state[k] ? 'granted' : 'denied'
+  for (const k in state) for (const t of TYPES[k] || []) if (typeof state[k] === 'boolean') u[t] = state[k] ? 'granted' : 'denied'
   if (!Object.keys(u).length) return
-  if (typeof G.gtag === 'function') G.gtag('consent', 'update', u)
-  else if (G.dataLayer) G.dataLayer.push(['consent', 'update', u]) // gtag not loaded yet: queued the way gtag reads it
+  try {
+    if (typeof env.gtag === 'function') env.gtag('consent', 'update', u)
+    else if (Array.isArray(env.dataLayer)) env.dataLayer.push((function () { return arguments })('consent', 'update', u))
+  } catch {} // a blocked or broken external tag must not prevent a local privacy decision
 }
-
-export function consent(kind, granted = true) {
+const notify = env => {
+  const target = env.window || env
+  const EventType = env.Event || G.Event
+  if (target.dispatchEvent && EventType) target.dispatchEvent(new EventType('brain:consent'))
+}
+export function consent(kind, granted = true, env = G) {
   if (!TYPES[kind]) throw Error(`consent: unknown kind "${kind}" (${Object.keys(TYPES).join(', ')})`)
-  const s = { ...read(), [kind]: !!granted }
-  try {
-    G.localStorage.setItem(KEY, JSON.stringify(s))
-  } catch {}
-  apply({ [kind]: !!granted })
+  if (typeof granted !== 'boolean') throw Error('consent: granted must be true or false')
+  if (env.__brainSSR || env.__brainRoute) return
+  const s = { ...read(env), [kind]: granted }
+  env[MEMORY] = s // a current-page decision still works when browser storage is blocked
+  try { env.localStorage.setItem(KEY, JSON.stringify(s)) } catch {}
+  // Disable the bridge/Google tag before a denied update can be processed by an already-loaded tag.
+  if (!granted) notify(env)
+  apply({ [kind]: granted }, env)
+  if (granted) notify(env)
+}
+export const consented = (kind, env = G) => !env.__brainSSR && !env.__brainRoute && read(env)[kind] === true
+
+// Opt-in, non-modal controls: native buttons work with keyboard and screen readers; no custom key trap.
+// App policy wording and any additional jurisdiction-specific requirements remain the site's responsibility.
+export function consentBanner(options = {}, env = G) {
+  const doc = env.document
+  if (env.__brainSSR || env.__brainRoute || !doc?.body || options.enabled === false) return null
+  const region = doc.createElement('section'), choices = doc.createElement('div')
+  region.setAttribute('role', 'region'); region.setAttribute('aria-label', 'Privacy preferences')
+  region.setAttribute('data-brain-consent', '')
+  const message = doc.createElement('p')
+  message.textContent = 'Optional Google analytics stays off until you accept. You can change your choice here.'
+  choices.appendChild(message)
+  const button = (label, fn, parent) => {
+    const el = doc.createElement('button'); el.setAttribute('type', 'button'); el.textContent = label
+    el.addEventListener('click', fn); parent.appendChild(el); return el
+  }
+  const refresh = () => { choices.hidden = Object.hasOwn(read(env), 'analytics'); revoke.hidden = !consented('analytics', env) }
+  const choose = value => { consent('analytics', value, env); refresh(); manage.focus?.() }
+  button('Deny analytics', () => choose(false), choices)
+  button('Accept analytics', () => choose(true), choices)
+  region.appendChild(choices)
+  const manage = button('Manage privacy preferences', () => { choices.hidden = false; choices.querySelector('button')?.focus?.() }, region)
+  const revoke = button('Revoke analytics consent', () => choose(false), region)
+  const target = env.window || env
+  const storageChanged = event => { if (event.key === KEY || event.key === null) { delete env[MEMORY]; notify(env); refresh() } }
+  target.addEventListener?.('brain:consent', refresh)
+  target.addEventListener?.('storage', storageChanged)
+  refresh(); doc.body.appendChild(region)
+  return { element: region, stop() { target.removeEventListener?.('brain:consent', refresh); target.removeEventListener?.('storage', storageChanged); region.parentNode?.removeChild(region) } }
 }
-export const consented = kind => !!read()[kind]
 
 apply(read()) // a returning visitor: their earlier answer, before any tag reads the defaults
+
+// The public consent API also invalidates page-local decisions across tabs when no collector or banner is mounted.
+// One page-lifetime listener is shared by the generated bridge and separately imported consent module.
+const STORAGE_SYNC = Symbol.for('brain:consent-storage-sync')
+const consentWindow = G.window || G
+if (!G.__brainSSR && !G.__brainRoute && consentWindow.addEventListener && !G[STORAGE_SYNC]) {
+  G[STORAGE_SYNC] = true
+  consentWindow.addEventListener('storage', event => {
+    if (event.key !== KEY && event.key !== null) return
+    delete G[MEMORY]
+    notify(G)
+    const state = read()
+    const deniedMissing = {}
+    for (const kind of Object.keys(TYPES)) deniedMissing[kind] = state[kind] === true
+    apply(deniedMissing)
+  })
+}

package/brain-google.js

@@ -0,0 +1,113 @@
+const TOKEN = /^[\w.:-]{1,64}$/
+
+// Explicit basic-mode Google bridge. It runs without the first-party collector or a native backend.
+// Only declared event names cross the boundary: props, DOM text, field values, URLs and visitor ids never do.
+export function startGoogle(config = {}, env = globalThis) {
+  const doc = env.document, win = env.window || env, nav = env.navigator || {}
+  const id = config.analytics || config.tagManager
+  if (env.__brainSSR || env.__brainRoute || !doc || config.mode !== 'basic' || !id || (config.analytics && config.tagManager)) return null
+  if (config.analytics ? !/^G-[A-Z0-9]{1,32}$/.test(id) : !/^GTM-[A-Z0-9]{1,32}$/.test(id)) return null
+  if (nav.globalPrivacyControl === true || nav.doNotTrack === '1' || win.doNotTrack === '1' || nav.webdriver) return null
+  const eventName = name => typeof name === 'string' && /^[A-Za-z][A-Za-z0-9_]{0,39}$/.test(name) && !/^(google_|ga_|firebase_)/i.test(name)
+  const events = Object.create(null)
+  for (const [source, name] of Object.entries(config.events || {}).slice(0, 100)) if (TOKEN.test(source) && eventName(name)) events[source] = name
+  const funnels = Object.entries(config.funnels || {}).slice(0, 20).filter(([name, steps]) => eventName(name) && Array.isArray(steps) && steps.length >= 2 && steps.length <= 20)
+  let stopped = false, initialized = false, loaded = false, lastGranted = false, loader = null
+  const pending = new Set(), off = []
+  const allowed = () => {
+    if (stopped || nav.globalPrivacyControl === true || nav.doNotTrack === '1' || win.doNotTrack === '1') return false
+    try {
+      const memory = env[Symbol.for('brain:consent-state')]
+      if (memory && Object.hasOwn(memory, 'analytics')) return memory.analytics === true
+      return JSON.parse(env.localStorage.getItem('brain:consent'))?.analytics === true
+    } catch { return false }
+  }
+  const listen = (target, type, fn) => {
+    if (!target?.addEventListener) return
+    target.addEventListener(type, fn, true)
+    off.push(() => target.removeEventListener(type, fn, true))
+  }
+  const clearPending = () => {
+    if (Array.isArray(env.dataLayer)) for (let i = env.dataLayer.length - 1; i >= 0; i--) if (pending.has(env.dataLayer[i])) env.dataLayer.splice(i, 1)
+    pending.clear()
+  }
+  const privacy = () => {
+    let origin = 'https://example.invalid/'
+    try { const url = new URL(env.location?.origin); if (/^https?:$/.test(url.protocol)) origin = url.origin + '/' } catch {}
+    return { page_location: origin, page_referrer: '', page_title: '[redacted]', send_page_view: false, allow_google_signals: false, allow_ad_personalization_signals: false }
+  }
+  const sync = () => {
+    try {
+    const granted = allowed()
+    if (config.analytics) env['ga-disable-' + id] = !granted
+    if (!granted) {
+      clearPending()
+      if (initialized && lastGranted) env.gtag('consent', 'update', { analytics_storage: 'denied' })
+      lastGranted = false
+      return false
+    }
+    if (initialized) {
+      if (!lastGranted) env.gtag('consent', 'update', { analytics_storage: 'granted' })
+      lastGranted = true
+      return true
+    }
+    // Do not adopt a malformed/preconfigured data layer. Never overwrite another integration's queue.
+    if (env.dataLayer !== undefined && !Array.isArray(env.dataLayer)) return false
+    env.dataLayer ||= []
+    if (env.gtag !== undefined && typeof env.gtag !== 'function') return false
+    env.gtag ||= function () { env.dataLayer.push(arguments) }
+    env.gtag('consent', 'default', { analytics_storage: 'denied', ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' })
+    env.gtag('consent', 'update', { analytics_storage: 'granted', ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' })
+    if (config.analytics) { env.gtag('js', new Date()); env.gtag('config', id, privacy()) }
+    else env.dataLayer.push({ 'gtm.start': Date.now(), event: 'gtm.js' })
+    loader = doc.createElement('script')
+    loader.async = true
+    loader.onload = () => { loaded = true; pending.clear() }
+    loader.src = 'https://www.googletagmanager.com/' + (config.analytics ? 'gtag/js' : 'gtm.js') + '?id=' + id
+    const parent = doc.head || doc.documentElement
+    if (!parent) return false
+    parent.appendChild(loader)
+    initialized = lastGranted = true
+    return true
+    } catch { return false }
+  }
+  const track = source => {
+    if (typeof source !== 'string' || !Object.hasOwn(events, source) || !sync() || (!loaded && pending.size >= 128)) return false
+    const name = events[source], params = privacy()
+    delete params.send_page_view
+    // A declared funnel is a list of named steps, not an inferred conversion or a separate extra event.
+    for (const [funnel, steps] of funnels) {
+      const step = Array.isArray(steps) ? steps.indexOf(name) : -1
+      if (eventName(funnel) && step >= 0 && step < 20) { params.brain_funnel = funnel; params.brain_step = step + 1; break }
+    }
+    let message
+    if (config.analytics) {
+      params.send_to = id
+      // Arguments objects are the official gtag queue shape. Keep references so revocation drops our pending events.
+      message = (function () { return arguments })('event', name, params)
+    } else message = { event: name, ...params }
+    if (!loaded) pending.add(message)
+    try { env.dataLayer.push(message); return true } catch { pending.delete(message); return false }
+  }
+  const tracked = target => {
+    let found = null
+    for (let el = target; el?.nodeType === 1; el = el.parentNode) {
+      if (el.hasAttribute('data-private')) return null
+      if (!found && el.hasAttribute('data-track')) found = el
+    }
+    return found
+  }
+  listen(doc, 'click', e => {
+    const el = tracked(e.target)
+    if (el && el.tagName !== 'FORM') track(el.getAttribute('data-track'))
+  })
+  listen(doc, 'submit', e => {
+    const el = e.target
+    if (el?.tagName === 'FORM' && tracked(el) === el) track(el.getAttribute('data-track'))
+  })
+  listen(win, 'brain:track', e => { if (e.detail && typeof e.detail.name === 'string') track(e.detail.name) })
+  listen(win, 'brain:consent', sync)
+  listen(win, 'storage', e => { if (e.key === 'brain:consent' || e.key === null) { delete env[Symbol.for('brain:consent-state')]; sync() } })
+  sync()
+  return { track, stop() { stopped = true; clearPending(); if (config.analytics) env['ga-disable-' + id] = true; for (const fn of off) fn(); if (loader?.parentNode) loader.parentNode.removeChild(loader) } }
+}

package/brain-lazy.js

@@ -29,8 +29,11 @@ function reloadOnce() {
 function visible(el, go) {
   const box = { go }
   const io = new IntersectionObserver(es => es.some(e => e.isIntersecting) && box.go?.(), { rootMargin: '200px' })
+  const doc = el.ownerDocument || G.document
+  const hidden = () => { if (doc?.visibilityState === 'hidden') box.go?.() }
+  doc?.addEventListener('visibilitychange', hidden)
   io.observe(el)
-  return () => { box.go = null; io.disconnect() }
+  return () => { box.go = null; io.disconnect(); doc?.removeEventListener('visibilitychange', hidden) }
 }
 
 export function lazy(el, imp, mode, props = {}) {

package/brain-native-vitals.js

@@ -0,0 +1,78 @@
+// Optional initial-document performance estimates. Only declared patterns leave the browser.
+import { consented } from './brain-consent.js'
+import { vitals } from './brain-vitals.js'
+const STATE = Symbol.for('brain:native-vitals')
+const ROUTE = /^(?:\/|(?:\/(?:[A-Za-z0-9_-]+|:[a-z][a-z0-9_]*))+)$/
+const MAX = { LCP: 3600000, CLS: 1000, INP: 3600000, FCP: 3600000, TTFB: 3600000 }
+export function startNativeVitals(config, env = globalThis) {
+  if (env.__brainSSR || env.__brainRoute || !env.window || !env.document || !env.location || env[STATE]) return env[STATE]
+  if (!config || typeof config.base !== 'string' || !/^(?:\/[A-Za-z0-9_.-]+)*$/.test(config.base) || config.base.split('/').some(p => p === '.' || p === '..') || !Array.isArray(config.routes) || !config.routes.length || config.routes.length > 512 || config.routes.some(p => typeof p !== 'string' || p.length > 160 || !ROUTE.test(p)) || new Set(config.routes).size !== config.routes.length) return
+  let origin
+  try { const url = new URL(env.location.href); if (!/^https?:$/.test(url.protocol)) return; origin = url.origin } catch { return }
+  const initialPath = env.location.pathname
+  if (config.base && !initialPath.startsWith(config.base + '/')) return
+  const local = config.base ? initialPath.slice(config.base.length) : initialPath
+  const pathname = local.length > 1 && local.endsWith('/') ? local.slice(0, -1) : local
+  const parts = pathname.split('/')
+  let route, score = -1
+  for (const pattern of config.routes) {
+    const wanted = pattern.split('/')
+    if (wanted.length !== parts.length) continue
+    let matches = true, literal = 0
+    for (let i = 0; i < wanted.length; i++) {
+      if (wanted[i].startsWith(':')) { if (!parts[i]) { matches = false; break } }
+      else if (wanted[i] !== parts[i]) { matches = false; break }
+      else literal++
+    }
+    if (matches && literal > score) { route = pattern; score = literal }
+  }
+  if (!route) return
+  const target = env.window, doc = env.document, fresh = new Map()
+  let active = false, disposed = false, navigated = false, off, pending, timer, generation = 0
+  const dnt = value => value === '1' || value === 'yes' || value === true
+  const permitted = () => consented('analytics', env) && !dnt(env.navigator?.doNotTrack) && !dnt(env.navigator?.msDoNotTrack) && !dnt(env.doNotTrack) && env.navigator?.globalPrivacyControl !== true
+  const deactivate = () => {
+    active = false; generation++; off?.(); off = undefined; fresh.clear()
+    doc.removeEventListener('visibilitychange', flush); target.removeEventListener('pagehide', flush)
+    pending?.abort(); pending = undefined; env.clearTimeout?.(timer); timer = undefined
+  }
+  const navigation = () => { navigated = true; deactivate() }
+  const flush = event => {
+    if (!active || !permitted()) return deactivate()
+    if (env.location.pathname !== initialPath) return navigation()
+    if (event?.type !== 'pagehide' && doc.visibilityState !== 'hidden' || !fresh.size || pending) return
+    const body = JSON.stringify({ route, consent: true, metrics: [...fresh.values()] })
+    fresh.clear()
+    if (body.length > 4096) return
+    const controller = new env.AbortController(), epoch = generation
+    pending = controller
+    timer = env.setTimeout(() => controller.abort(), 3000)
+    Promise.resolve().then(() => active && epoch === generation && permitted() ? env.fetch(origin + config.base + '/_brain/vitals', {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body,
+      mode: 'same-origin', credentials: 'omit', referrerPolicy: 'no-referrer', redirect: 'error', cache: 'no-store', keepalive: true, signal: controller.signal,
+    }) : undefined).then(response => { if (response?.status === 404) state.stop() }).catch(() => {}).finally(() => {
+      if (pending === controller) { pending = undefined; env.clearTimeout(timer); timer = undefined }
+    })
+  }
+  const update = () => {
+    if (disposed) return
+    if (!permitted()) return deactivate()
+    if (active || navigated || env.location.pathname !== initialPath || typeof env.fetch !== 'function' || !env.AbortController) return
+    active = true
+    const epoch = generation
+    off = vitals(metric => {
+      if (!active || epoch !== generation || !permitted()) return
+      if (Object.hasOwn(MAX, metric.name) && Number.isFinite(metric.value) && metric.value >= 0 && metric.value <= MAX[metric.name]) fresh.set(metric.name, { name: metric.name, value: metric.value })
+    }, env)
+    doc.addEventListener('visibilitychange', flush); target.addEventListener('pagehide', flush)
+  }
+  const storage = event => { if (event.key === 'brain:consent' || event.key === null) { delete env[Symbol.for('brain:consent-state')]; update() } }
+  const state = { stop() { disposed = true; deactivate(); target.removeEventListener('brain:navigate', navigation); target.removeEventListener('popstate', navigation); target.removeEventListener('brain:consent', update); target.removeEventListener('storage', storage); delete env[STATE] } }
+  env[STATE] = state
+  target.addEventListener('brain:consent', update); target.addEventListener('storage', storage)
+  // Lifetime events only: no performance access or collection occurs before consent. Revocation must not
+  // erase knowledge that the original document has navigated away and returned to the same pathname.
+  target.addEventListener('brain:navigate', navigation); target.addEventListener('popstate', navigation)
+  update()
+  return state
+}

package/brain-sentry.js

@@ -0,0 +1,71 @@
+// Optional error reporting. Consent owns the entire capture lifetime; raw values never leave this function.
+import { _rt } from './brain.js'
+import { consented } from './brain-consent.js'
+
+const TYPES = new Set(['Error', 'TypeError', 'RangeError', 'ReferenceError', 'SyntaxError', 'URIError', 'EvalError', 'AggregateError'])
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
+const STATE = Symbol.for('brain:sentry')
+export function startSentry(config, env = globalThis, subscribe) {
+  if (env.__brainSSR || env.__brainRoute || !env.window || !env.location || env[STATE]) return env[STATE]
+  if (!config || !config.assets || typeof config.base !== 'string' || !/^(?:\/[a-zA-Z0-9_.-]+)*$/.test(config.base) || config.base.split('/').some(p => p === '.' || p === '..')) return
+  const assets = new Map()
+  for (const [path, id] of Object.entries(config.assets)) if (path.length <= 511 && /^(?:[a-zA-Z0-9_.-]+\/)*[a-z0-9]{8}\.(?:js|jsbrain)$/.test(path) && UUID.test(id)) assets.set('/' + path, id)
+  const target = env.window, pending = new Set(), seen = new Set()
+  let active = false, disposed = false, off, windowStart = 0, count = 0, generation = 0
+  const dnt = value => value === '1' || value === 'yes' || value === true
+  const permitted = () => consented('analytics', env) && !dnt(env.navigator?.doNotTrack) && !dnt(env.navigator?.msDoNotTrack) && !dnt(env.doNotTrack) && env.navigator?.globalPrivacyControl !== true
+  const capture = error => {
+    try {
+      if (!active || !permitted() || pending.size >= 4 || !error) return
+      const stack = error.stack
+      if (typeof stack !== 'string') return
+      const frames = []
+      for (const line of stack.slice(0, 8192).split('\n').slice(0, 41)) {
+        const m = /^\s+at (?:[^\r\n()]{1,160} \()?(https?:\/\/[^\s()]+):(\d{1,7}):(\d{1,7})\)?$/.exec(line) || /^[^\s@()]{0,160}@(https?:\/\/[^\s()]+):(\d{1,7}):(\d{1,7})$/.exec(line)
+        if (!m) continue
+        const url = new URL(m[1]), id = assets.get(url.pathname)
+        if (url.origin !== env.location.origin || url.search || url.hash || !id || +m[2] < 1 || +m[3] < 1) continue
+        frames.push({ asset: url.pathname, line: +m[2], column: +m[3], debugId: id })
+        if (frames.length >= 20) break
+      }
+      if (!frames.length) return
+      const name = error.name
+      const type = TYPES.has(name) ? name : 'Error'
+      const payload = JSON.stringify({ schemaVersion: 1, type, frames })
+      const now = Date.now()
+      if (now - windowStart >= 60000) { windowStart = now; count = 0; seen.clear() }
+      if (count >= 8 || seen.has(payload) || seen.size >= 32) return
+      count++; seen.add(payload)
+      const controller = new env.AbortController()
+      const epoch = generation
+      pending.add(controller)
+      const timer = env.setTimeout(() => controller.abort(), 3000)
+      Promise.resolve().then(() => active && epoch === generation && permitted() ? env.fetch(env.location.origin + config.base + '/_brain/sentry', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: payload,
+        mode: 'same-origin', credentials: 'omit', referrerPolicy: 'no-referrer', redirect: 'error', cache: 'no-store', signal: controller.signal,
+      }) : undefined).catch(() => {}).finally(() => { env.clearTimeout(timer); pending.delete(controller) })
+    } catch {} // reporting, including hostile accessors, never enters the app's error routing
+  }
+  const onError = event => capture(event.error)
+  const onRejection = event => capture(event.reason)
+  const deactivate = () => {
+    active = false; generation++; off?.(); off = undefined
+    target.removeEventListener('error', onError); target.removeEventListener('unhandledrejection', onRejection)
+    for (const request of pending) request.abort()
+    pending.clear(); seen.clear(); count = 0; windowStart = 0
+  }
+  const update = () => {
+    if (disposed) return
+    if (!permitted()) return deactivate()
+    if (active || typeof env.fetch !== 'function' || !env.AbortController) return
+    active = true
+    off = (subscribe || _rt().listenErrors)(capture)
+    target.addEventListener('error', onError); target.addEventListener('unhandledrejection', onRejection)
+  }
+  const storage = event => { if (event.key === 'brain:consent' || event.key === null) update() }
+  target.addEventListener('brain:consent', update); target.addEventListener('storage', storage)
+  const state = { stop() { disposed = true; deactivate(); target.removeEventListener('brain:consent', update); target.removeEventListener('storage', storage); delete env[STATE] } }
+  env[STATE] = state
+  update()
+  return state
+}

package/brain-vitals.js

@@ -45,14 +45,20 @@ export function vitals(report, env = globalThis) {
 
 // One beacon each time the page is hidden, with what changed since the last one; the query string is never sent.
 export function reportVitals(url, env = globalThis) {
-  if (typeof url !== 'string' || !url.startsWith('/')) throw new TypeError('reportVitals(url): pass a same-origin path, such as "/api/vitals"')
+  if (typeof url !== 'string' || url.length > 2048 || !url.startsWith('/') || url.startsWith('//') || /[\\\u0000-\u0020\u007f]/.test(url)) throw new TypeError('reportVitals(url): pass a same-origin path, such as "/api/vitals"')
+  let target
+  try {
+    const base = new URL(env.location.href)
+    target = new URL(url, base)
+    if (!/^https?:$/.test(base.protocol) || target.origin !== base.origin) throw new TypeError()
+  } catch { throw new TypeError('reportVitals(url): a same-origin HTTP(S) page is required') }
   const doc = env.document
   const fresh = new Map()
   const stop = vitals(metric => fresh.set(metric.name, metric), env)
   const flush = () => {
     if (doc.visibilityState !== 'hidden' || !fresh.size) return
     const body = JSON.stringify({ path: env.location.pathname, metrics: [...fresh.values()] })
-    if (env.navigator.sendBeacon?.(url, new Blob([body], { type: 'application/json' }))) fresh.clear()
+    if (env.navigator.sendBeacon?.(target.href, new Blob([body], { type: 'application/json' }))) fresh.clear()
   }
   doc.addEventListener('visibilitychange', flush)
   env.addEventListener('pagehide', flush)

package/brain.js

@@ -5,13 +5,14 @@
 // · r run · q clean · n unlink · d dispose. Short names: brain-min does not rename properties.
 
 // L tracker · O owner · Q pending effects · B batch depth · P flush scheduled · H dev hook · E error hook · V provider (brain-ch)
-let L = null, O = null, Q = [], B = 0, P = 0, H = null, E = null, V, A = null, U
+let L = null, O = null, Q = [], B = 0, P = 0, H = null, E = null, V, A = null, U, Z, Y = 0
 // Errors (INTERNALS §18): fx, drv and handlers are caught and the app keeps running. E (brain-err.js, _err) records
 // them and applies per-component fallbacks; without it, console.error.
 // Errors go to the rich catcher (brain-err) or the console, then to the nearest component boundary (§42, brain-guard.js):
 // up the owner chain for fx/drv, up the DOM for handlers.
 const oops = (e, x, w) => {
   if (e && e.kind == 'aborted') return // a cancelled request (brain-data): never an error to report or show
+  if (Z && !Y) { Y = 1; for (const f of Z.slice()) { try { f(e) } catch {} } Y = 0 }
   E ? E(e, x, w) : H ? globalThis.reportError ? reportError(e) : console.error(e) : console.error('BRAIN_ERROR: Operation failed. Try again.')
   for (let o = x; o; o = o.nodeType ? o.parentNode : o.p) {
     const g = o.$g
@@ -204,7 +205,7 @@ export const rpc = (id, a) => import('./brain-rpc.js').then(m => m.rpc(id, a, oo
 // Internals for sibling modules (brain-err, brain-ch): root, current owner and node helpers; _err installs the hook;
 // brain-ch passes its provider for `mount(C, t, props, { provide })`.
 // Optimistic writes (brain-data) and the circuit breaker (brain-guard) wrap N's prototype instead of a core hook (#288).
-export const _rt = p => ((V = V || p), { root, owner: () => O, nodes, rm, oops, guard: (o, g) => (o.$g = g), adopt: a => (A = a), dev: (a, b) => H && H(a, b), development: () => !!H, budget: f => (U = f) })
+export const _rt = p => ((V = V || p), { root, owner: () => O, nodes, rm, oops, guard: (o, g) => (o.$g = g), adopt: a => (A = a), dev: (a, b) => H && H(a, b), development: () => !!H, budget: f => (U = f), listenErrors: f => { Z ||= []; if (typeof f != 'function' || Z.length >= 8) return () => {}; Z.push(f); return () => { Z = Z.filter(x => x != f) } } })
 export const _err = h => ((E = h), _rt())
 
 // ---------- DOM ----------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {
@@ -28,11 +28,14 @@
     "back-end",
     "fullstack",
     "full-stack",
+    "javascript",
+    "nodejs",
+    "html",
+    "css",
     "cli",
     "command-line",
     "developer-tools",
     "design-system",
-    "css",
     "testing",
     "e2e",
     "postgresql",
@@ -49,6 +52,10 @@
     "reactive",
     "components",
     "ssr",
+    "ssg",
+    "static-site-generator",
+    "static-site",
+    "seo",
     "spa",
     "web"
   ],