@brust/core 2.0.0-alpha.1 → 2.0.0-alpha.11

package/src/build/compile.ts

@@ -2,10 +2,13 @@
 // `compileTree` (analysis + lowering of its whole tree). `Err` = build error; fallback and
 // warning diagnostics are logged; `outlet-outside-layout` is raised here (contract 5).
 // A component several trees reach keeps one compile, chosen by role, not by route order (F75).
-import { relative } from 'node:path'
+import { realpathSync } from 'node:fs'
+import { relative, sep } from 'node:path'
 import { type CompiledComponent, type CompiledTree, compileTree } from '../../native/index.js'
 import type { FlatRoute, Route } from '../routes'
 import { BuildError } from './errors'
+import { checkAliasAgreement, readPathAliases } from './tsconfig-paths'
+import type { PackageSources } from './pkg-src'
 
 /** `ComponentIR` as the compiler serialises it (snake_case), with the fields that are absent
  * when default (`ir/mod.rs`) normalised. The build reads it; it never rewrites it. */
@@ -17,13 +20,41 @@ export type ComponentIR = Record<string, any> & {
   tier: any
   // biome-ignore lint/suspicious/noExplicitAny: IR JSON
   jobs: any[]
-  instances: { child_id: string; k: number; loops: (string | null)[]; props: Record<string, string | null> }[]
+  instances: {
+    child_id: string
+    k: number
+    loops: (string | null)[]
+    props: Record<string, string | null>
+    literals?: Record<string, unknown>
+    exprs?: Record<string, string>
+    /** F142 R34.43: the rows of a constant enclosing list (`loops` is then `[null]`). */
+    rows_literal?: unknown[]
+  }[]
+  /** F149: inlined instances whose child job the build may run once (`decls.rs` `BuildEvalInstance`). */
+  build_eval_instances?: {
+    key: string
+    child_id: string
+    k: number
+    inputs: Record<string, unknown>
+    outputs: string[]
+    stubs?: { source: string; code: string }[]
+    /** R34.96: the job modules fused into the child's job, which it imports (`FusedEvalJob`). */
+    fused?: { child_id: string; stubs?: { source: string; code: string }[] }[]
+    line: number
+    col: number
+  }[]
   use_id_slots: number
   uses_outlet: boolean
   needs_worker: boolean
   /** `useStore(handle)` bindings (`decls.rs` `StoreUse`); `resolved` = `StoreRef`, `null` when
    * unresolved (the component falls back). `module` is root-relative (C3). */
   stores?: { handle: string; resolved: { name: string; module: string } | null }[]
+  /** A package export rendered as a React island (L22): `source` is then not a file. */
+  external?: { source: string; export: string; member?: string[] }
+  /** The binding a React island imports this component by from `source` (absent: the default export). */
+  export?: string
+  /** Child components; `nested` is set when this file passes lowered JSX children to that child, an island (shadcn S1). */
+  children?: { id: string | null; nested?: string[]; x?: string[]; holes?: string[]; [field: string]: unknown }[]
 }
 
 export interface Compiled {
@@ -33,7 +64,11 @@ export interface Compiled {
   ir: ComponentIR
   jinja: string
   serverTs?: string
+  /** Build-time evaluation module (L2): one thunk per `ir.build_eval` slot. */
+  evalTs?: string
   clientJs?: string
+  /** The compiler's diagnostics for this component (`dev.json`, L14). */
+  diagnostics?: { class: string; rule: string; message: string; line: number; col: number; remediation: string }[]
 }
 
 type Diag = NonNullable<CompiledTree['error']>
@@ -78,11 +113,31 @@ export function compileApp(opts: {
   appRoot: string
   leaves: FlatRoute[]
   componentFile: Map<Function, string>
+  /** Why a Component the scan saw has no file (named export only, outside the root); optional. */
+  componentIssue?: Map<Function, string>
   runtimeImport: string
   serverOnly: string[]
+  /** L20: every CSS Module's class map by absolute source path; `styles.x` folds to the literal class. */
+  cssMaps?: Map<string, Record<string, string>>
   log: (s: string) => void
+  /** SVG markup the build rendered for lucide icon requests (L23), by `ir.icon_requests[].key`. */
+  iconSvgs?: Record<string, { svg: string; base: string }>
+  /** The compile after icons were rendered (even if none could be): icons still components are judged as islands. */
+  iconsFinal?: boolean
+  /** Values the build computed for `ir.build_eval` slots, by key (L2): the slots become literals. */
+  slotValues?: Record<string, unknown>
+  /** F153c: the package sources this build wrote (`pkg-src.ts`); absent = package imports are islands. */
+  packages?: PackageSources
 }): { compiled: Map<string, Compiled>; routeComponent: Map<string, string> } {
   const { appRoot, leaves, componentFile } = opts
+  const iconSvgsJson = opts.iconsFinal ? JSON.stringify({ final: true, svgs: opts.iconSvgs ?? {} }) : undefined
+  const slotValuesJson = opts.slotValues && Object.keys(opts.slotValues).length > 0 ? JSON.stringify(opts.slotValues) : undefined
+  const packagesJson = opts.packages ? JSON.stringify(opts.packages) : undefined
+  // The Rust side keys each map by its path relative to the app root (`/`-separated), like an import resolves.
+  const { aliases, notes } = readPathAliases(appRoot)
+  for (const n of notes) opts.log(`warning tsconfig-paths ${n}`)
+  const pathAliasesJson = aliases.length > 0 ? JSON.stringify(aliases) : undefined
+  const cssModules = Object.fromEntries([...(opts.cssMaps ?? [])].map(([abs, map]) => [relative(realpathSync(appRoot), abs).split(sep).join('/'), map]))
   const seen = new Map<string, Seen>()
   const rootIdOfFile = new Map<string, string>()
   const routeComponent = new Map<string, string>()
@@ -90,17 +145,22 @@ export function compileApp(opts: {
   const nodes = new Map<string, Route>()
   for (const l of leaves) l.chain.forEach((r, i) => r.Component && nodes.set(l.chainIds[i]!, r))
 
+  // F158 (R34.69): the route components (pages and layouts) take request data as props, so the compiler never hands
+  // them lowered JSX from a caller. Keyed like an import resolves: relative to the app root, `/`-separated.
+  const rootRel = (f: string) => relative(appRoot, f).split(sep).join('/')
+  const routeRoots = [...new Set([...nodes.values()].flatMap((r) => componentFile.get(r.Component!) ?? []).flatMap((f) => [rootRel(f), relative(realpathSync(appRoot), realpathSync(f)).split(sep).join('/')]))]
+
   for (const [routeId, route] of nodes) {
     const file = componentFile.get(route.Component!)
     if (!file)
       throw new BuildError(
         'component-source',
-        `${route.Component!.name || '(anonymous)'} is not a default import of a .tsx file (route ${routeId})`,
+        `${opts.componentIssue?.get(route.Component!) ?? `${route.Component!.name || '(anonymous)'} is not the default export of a .tsx file in the import graph`} (route ${routeId})`,
       )
     let rootId = rootIdOfFile.get(file)
     if (!rootId) {
       const rel = relative(appRoot, file)
-      const tree = compileTree(rel, appRoot, opts.runtimeImport, opts.serverOnly)
+      const tree = compileTree(rel, appRoot, opts.runtimeImport, opts.serverOnly, slotValuesJson, cssModules, iconSvgsJson, routeRoots, pathAliasesJson, packagesJson)
       if (tree.error) throw new BuildError(tree.error.rule, `${where(rel, tree.error)} ${tree.error.message}`)
       for (const [i, c] of tree.components.entries()) {
         // A lowering Error that came back as a diagnostic is a build error too (contract 9).
@@ -122,6 +182,7 @@ export function compileApp(opts: {
     for (const d of c.diagnostics)
       if (d.class === 'fallback' || d.class === 'warning') opts.log(`warning ${d.rule} ${where(c.source, d)} ${d.message}`)
     const ir = JSON.parse(c.ir) as ComponentIR
+    if (ir.alias_imports?.length) checkAliasAgreement(appRoot, ir.alias_imports)
     ir.use_id_slots ??= 0
     ir.uses_outlet ??= false
     ir.instances ??= []
@@ -132,9 +193,18 @@ export function compileApp(opts: {
       ir,
       jinja: c.jinja,
       serverTs: c.serverTs,
+      evalTs: c.evalTs,
       clientJs: c.clientJs,
+      diagnostics: c.diagnostics.map((d) => ({ class: d.class, rule: d.rule, message: d.message, line: d.line, col: d.col, remediation: d.remediation })),
     })
   }
+  // A package export has no file of its own: bare imports in its island entries resolve from a
+  // component that uses it (the first one in build order).
+  for (const c of compiled.values()) {
+    if (!c.ir.external) continue
+    const user = [...compiled.values()].find((p) => !p.ir.external && (p.ir.children ?? []).some((ref: { id: string | null }) => ref.id === c.id))
+    c.file = user?.file ?? c.file
+  }
   for (const [routeId, route] of nodes) {
     const rootId = routeComponent.get(routeId)!
     if (compiled.get(rootId)!.ir.uses_outlet && !route.children)

package/src/build/config.ts

@@ -4,26 +4,245 @@
 // `server_only` is the app config `serverOnly` of the compiler spec (§8.2): the compiler refuses
 // such an import in client code, and every browser bundle refuses to include it.
 import { join } from 'node:path'
-import { DEFAULT_ACTION_PREFIX, DEFAULT_MAX_BODY_BYTES, prefixError } from '../actions/prefix'
+import { ACTION_CREDENTIALS, type ActionCredentials, DEFAULT_ACTION_PREFIX, DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_RESPONSE_BYTES, MAX_ACTION_BYTES, baseUrlError, prefixError } from '../actions/prefix'
+import { ADAPTER_NAMES, BUILTINS, installHint } from '../cache-adapter/load'
 import { BuildError } from './errors'
 
-// [actions] (opt-in, ruling R6): present table => actions on. Crosses napi as u32.
+// [actions] (opt-in, ruling R6): present table => actions on. Both byte caps cross napi as u32 (F82: 1..64 MiB / 256 KiB..64 MiB).
 //   [actions]
-//   entry = "actions.ts"   prefix = "/_brust/action"   max_body_bytes = 262144
-const MAX_U32 = 0xffff_ffff
+//   entry = "actions.ts"   prefix = "/_brust/action"   max_body_bytes = 1048576  max_response_bytes = 8388608   cross_site = "reject" | "allow" (F87)
+//   base_url = "https://api.example.com"  credentials = "same-origin" | "include" | "omit"   (L16: the browser client's target; runtime settings, validated here too)
+// `prefix = "/"` is accepted only for an actions-only build (L16 R16.4).
+// `ACTION_INLINE_BODY_BYTES` (Rust): the inline/heap threshold of an action body, independent of the response slot size (`slotBytes`).
+const MIN_RESPONSE_BYTES = 262_144
 
 export interface ActionsBuildConfig {
   entry: string
   prefix: string
   maxBodyBytes: number
+  maxResponseBytes: number
+  crossSite: 'reject' | 'allow'
+  /** `[actions] base_url`; with no actions file present the build is page-only (L16 R16.4b). */
+  baseUrl: string | undefined
+  credentials: ActionCredentials
+  /** `entry` was written in brust.toml (a missing file is then an error, never a page-only build). */
+  entryExplicit: boolean
+}
+
+// [cloudflare] (M4-CF; only read by `--target cloudflare`, validated always so errors surface early):
+//   name = "my-worker"  compatibility_date = "2026-10-01"  l1_capacity = 256  job_cache_capacity = 512  stats = false
+//   edge_cache = "off"  [cloudflare.alias]  "lib/db.ts" = "lib/db.cf.ts"   # app-root-relative module swaps (spec R12)
+const CF_KEYS = new Set(['name', 'compatibility_date', 'l1_capacity', 'job_cache_capacity', 'stats', 'edge_cache', 'alias'])
+export const CF_MIN_COMPAT_DATE = '2026-08-04'
+const U32_MAX = 4_294_967_295
+
+export interface CloudflareBuildConfig {
+  name: string | undefined
+  compatibilityDate: string | undefined
+  l1Capacity: number
+  jobCacheCapacity: number
+  stats: boolean
+  edgeCache: 'off'
+  /** absolute module path -> absolute replacement path */
+  alias: Record<string, string>
+}
+
+// [cache] (cache adapters, opt-in; spec §6): a shared second tier behind the in-process cache.
+//   adapter = "redis" | "dragonfly" | "cloudflare-kv" | "cloudflare-do" | "custom"   module = "lib/cache.ts" (custom)
+//   broadcast = "<built-in>"   namespace = "<package name>"   get_timeout_ms = 50 (native) / 100 (Workers)
+//   max_body_bytes = 1048576   epoch_interval_ms = 1000   [cache.redis] url = "env:REDIS_URL"   [cache.cloudflare]   [cache.options]
+const CACHE_KEYS = new Set(['adapter', 'broadcast', 'module', 'namespace', 'get_timeout_ms', 'max_body_bytes', 'epoch_interval_ms', 'redis', 'cloudflare', 'options'])
+export const MAX_L2_BODY_BYTES = 67_108_864
+
+export interface CacheBuildConfig {
+  adapter: (typeof ADAPTER_NAMES)[number]
+  /** `custom`: the module, app-root-relative as written. */
+  module: string | undefined
+  broadcast: string | undefined
+  /** The factory's options: `[cache.redis]` / `[cache.cloudflare]` for built-ins, `[cache.options]` for custom. */
+  options: Record<string, unknown>
+  broadcastOptions: Record<string, unknown> | undefined
+  namespace: string
+  /** Absent = the runtime default (native 50, Workers 100). */
+  getTimeoutMs: number | undefined
+  maxBodyBytes: number
+  epochIntervalMs: number
 }
 
 export interface BuildConfig {
   serverOnly: string[]
   actions: ActionsBuildConfig | null
+  cloudflare: CloudflareBuildConfig | null
+  cache: CacheBuildConfig | null
+  /** `[css] global` (L19, R19.1): app-root-relative stylesheets every route links first, in order. */
+  cssGlobal: string[]
+}
+
+const isTable = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v)
+
+function rangeInt(file: string, key: string, v: unknown, lo: number, hi: number, dflt: number): number {
+  if (v === undefined) return dflt
+  if (typeof v !== 'number' || !Number.isInteger(v) || v < lo || v > hi)
+    throw new BuildError('cache', `${file}: cache.${key} must be an integer in ${lo}..${hi} (got ${String(v)})`)
+  return v
+}
+
+/** `[cache.redis]`'s keys and ranges (cache-redis R10); `@brust/cache-redis` validates the same list at worker boot. */
+const REDIS_INT_KEYS: ReadonlyArray<readonly [string, number, number]> = [
+  ['connect_timeout_ms', 100, 60_000],
+  ['max_body_bytes', 1, MAX_L2_BODY_BYTES],
+  ['marker_ttl_ms', 60_000, 604_800_000],
+  ['unlink_batch', 1, 10_000],
+  ['reconnect_min_ms', 10, 60_000],
+  ['reconnect_max_ms', 10, 600_000],
+]
+const REDIS_TLS_KEYS: Record<string, string> = { reject_unauthorized: 'boolean', server_name: 'string', ca_file: 'string' }
+
+function checkRedisTable(file: string, r: Record<string, unknown>): void {
+  const known = new Set(['url', 'tls', ...REDIS_INT_KEYS.map(([k]) => k)])
+  for (const k of Object.keys(r)) if (!known.has(k)) throw new BuildError('cache', `${file}: cache.redis.${k} is not a known key`)
+  for (const [k, lo, hi] of REDIS_INT_KEYS) rangeInt(file, `redis.${k}`, r[k], lo, hi, lo)
+  if (typeof r.reconnect_min_ms === 'number' && typeof r.reconnect_max_ms === 'number' && r.reconnect_max_ms < r.reconnect_min_ms)
+    throw new BuildError('cache', `${file}: cache.redis.reconnect_max_ms must be >= cache.redis.reconnect_min_ms`)
+  const tls = r.tls
+  if (tls === undefined || typeof tls === 'boolean') return
+  if (!isTable(tls)) throw new BuildError('cache', `${file}: cache.redis.tls must be a boolean or a table`)
+  for (const [k, v] of Object.entries(tls)) {
+    const want = REDIS_TLS_KEYS[k]
+    if (!want) throw new BuildError('cache', `${file}: cache.redis.tls.${k} is not a known key`)
+    if (typeof v !== want || v === '') throw new BuildError('cache', `${file}: cache.redis.tls.${k} must be a ${want === 'string' ? 'non-empty string' : want}`)
+  }
+}
+
+/** The option table a built-in reads. */
+function builtinOptions(name: string, t: Record<string, unknown>): Record<string, unknown> {
+  const key = name === 'redis' || name === 'dragonfly' ? 'redis' : 'cloudflare'
+  return { ...((t[key] as Record<string, unknown> | undefined) ?? {}) }
+}
+
+async function packageName(appRoot: string): Promise<string | undefined> {
+  const f = Bun.file(join(appRoot, 'package.json'))
+  if (!(await f.exists())) return undefined
+  try {
+    const n = ((await f.json()) as { name?: unknown }).name
+    return typeof n === 'string' && n.trim() ? n.trim() : undefined
+  } catch {
+    return undefined
+  }
 }
 
-function parseActions(file: string, raw: unknown): ActionsBuildConfig | null {
+async function parseCache(file: string, appRoot: string, raw: unknown): Promise<CacheBuildConfig | null> {
+  if (raw === undefined) return null
+  if (!isTable(raw)) throw new BuildError('cache', `${file}: [cache] must be a table`)
+  const t = raw
+  for (const k of Object.keys(t)) if (!CACHE_KEYS.has(k)) throw new BuildError('cache', `${file}: cache.${k} is not a known key`)
+  for (const k of ['redis', 'cloudflare', 'options'] as const)
+    if (t[k] !== undefined && !isTable(t[k])) throw new BuildError('cache', `${file}: [cache.${k}] must be a table`)
+  const adapter = t.adapter
+  if (typeof adapter !== 'string' || !(ADAPTER_NAMES as readonly string[]).includes(adapter))
+    throw new BuildError('cache', `${file}: cache.adapter must be one of ${ADAPTER_NAMES.map((n) => `"${n}"`).join(', ')} (got ${JSON.stringify(adapter)})`)
+  const name = adapter as CacheBuildConfig['adapter']
+  let module: string | undefined
+  if (name === 'custom') {
+    if (typeof t.module !== 'string' || t.module.trim() === '') throw new BuildError('cache', `${file}: cache.module is required for adapter "custom"`)
+    module = t.module.trim()
+  } else if (t.module !== undefined) throw new BuildError('cache', `${file}: cache.module is only for adapter "custom"`)
+  let broadcast: string | undefined
+  if (t.broadcast !== undefined) {
+    if (typeof t.broadcast !== 'string' || !(t.broadcast in BUILTINS))
+      throw new BuildError('cache', `${file}: cache.broadcast must name a built-in adapter (${Object.keys(BUILTINS).map((n) => `"${n}"`).join(', ')})`)
+    broadcast = t.broadcast
+  }
+  // `env:` indirection only: a literal URL may carry a password, so the error never echoes the value.
+  const redis = t.redis as Record<string, unknown> | undefined
+  if (redis?.url !== undefined && (typeof redis.url !== 'string' || !/^env:[A-Za-z_][A-Za-z0-9_]*$/.test(redis.url)))
+    throw new BuildError('cache', `${file}: cache.redis.url must be "env:NAME" (a literal URL is refused: it may hold a password)`)
+  if (redis) checkRedisTable(file, redis)
+  for (const n of [name, broadcast]) {
+    if (n === undefined || n === 'custom') continue
+    try {
+      Bun.resolveSync(BUILTINS[n]!, appRoot)
+    } catch {
+      throw new BuildError('cache', `${file}: ${installHint(n)}`)
+    }
+  }
+  const options = name === 'custom' ? { ...((t.options as Record<string, unknown> | undefined) ?? {}) } : builtinOptions(name, t)
+  let namespace = (await packageName(appRoot)) ?? 'brust'
+  if (t.namespace !== undefined) {
+    if (typeof t.namespace !== 'string' || !/^[A-Za-z0-9@._/-]{1,64}$/.test(t.namespace))
+      throw new BuildError('cache', `${file}: cache.namespace must be 1..64 of [A-Za-z0-9@._/-]`)
+    namespace = t.namespace
+  }
+  return {
+    adapter: name,
+    module,
+    broadcast,
+    options,
+    broadcastOptions: broadcast ? builtinOptions(broadcast, t) : undefined,
+    namespace,
+    getTimeoutMs: t.get_timeout_ms === undefined ? undefined : rangeInt(file, 'get_timeout_ms', t.get_timeout_ms, 1, 1000, 50),
+    maxBodyBytes: rangeInt(file, 'max_body_bytes', t.max_body_bytes, 1, MAX_L2_BODY_BYTES, 1_048_576),
+    epochIntervalMs: rangeInt(file, 'epoch_interval_ms', t.epoch_interval_ms, 250, 60_000, 1000),
+  }
+}
+
+function cfCapacity(file: string, key: string, v: unknown, dflt: number): number {
+  if (v === undefined) return dflt
+  if (typeof v !== 'number' || !Number.isInteger(v) || v < 1 || v > U32_MAX)
+    throw new BuildError('config', `${file}: cloudflare.${key} must be an integer in 1..${U32_MAX} (got ${String(v)})`)
+  return v
+}
+
+function parseCloudflare(file: string, appRoot: string, raw: unknown): CloudflareBuildConfig | null {
+  if (raw === undefined) return null
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw new BuildError('config', `${file}: [cloudflare] must be a table`)
+  const t = raw as Record<string, unknown>
+  for (const k of Object.keys(t)) if (!CF_KEYS.has(k)) throw new BuildError('config', `${file}: cloudflare.${k} is not a known key`)
+  if (t.name !== undefined && (typeof t.name !== 'string' || t.name.trim() === ''))
+    throw new BuildError('config', `${file}: cloudflare.name must be a non-empty string`)
+  let compatibilityDate: string | undefined
+  if (t.compatibility_date !== undefined) {
+    const d = t.compatibility_date
+    if (typeof d !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(d)) throw new BuildError('config', `${file}: cloudflare.compatibility_date must be YYYY-MM-DD`)
+    if (d < CF_MIN_COMPAT_DATE)
+      throw new BuildError('config', `${file}: cloudflare.compatibility_date must be >= ${CF_MIN_COMPAT_DATE} (nodejs_compat is default from then)`)
+    compatibilityDate = d
+  }
+  if (t.stats !== undefined && typeof t.stats !== 'boolean') throw new BuildError('config', `${file}: cloudflare.stats must be a boolean`)
+  if (t.edge_cache !== undefined) {
+    if (t.edge_cache === 'workers-cache') throw new BuildError('config', `${file}: cloudflare.edge_cache = "workers-cache" lands with M4-CF-7`)
+    if (t.edge_cache !== 'off') throw new BuildError('config', `${file}: cloudflare.edge_cache must be "off"`)
+  }
+  const alias: Record<string, string> = {}
+  if (t.alias !== undefined) {
+    if (t.alias === null || typeof t.alias !== 'object' || Array.isArray(t.alias))
+      throw new BuildError('config', `${file}: cloudflare.alias must be a table of module paths`)
+    for (const [from, to] of Object.entries(t.alias as Record<string, unknown>)) {
+      if (typeof to !== 'string' || to.trim() === '') throw new BuildError('config', `${file}: cloudflare.alias["${from}"] must be a non-empty string`)
+      alias[resolveAlias(file, appRoot, from)] = resolveAlias(file, appRoot, to)
+    }
+  }
+  return {
+    name: t.name === undefined ? undefined : (t.name as string).trim(),
+    compatibilityDate,
+    l1Capacity: cfCapacity(file, 'l1_capacity', t.l1_capacity, 256),
+    jobCacheCapacity: cfCapacity(file, 'job_cache_capacity', t.job_cache_capacity, 512),
+    stats: (t.stats as boolean | undefined) ?? false,
+    edgeCache: 'off',
+    alias,
+  }
+}
+
+function resolveAlias(file: string, appRoot: string, p: string): string {
+  const rel = p.trim().replace(/^\.\//, '')
+  try {
+    return Bun.resolveSync(`./${rel}`, appRoot)
+  } catch {
+    throw new BuildError('config', `${file}: cloudflare.alias: cannot resolve "${p}" from the app root`)
+  }
+}
+
+function parseActions(file: string, raw: unknown, actionsOnly: boolean): ActionsBuildConfig | null {
   if (raw === undefined) return null
   if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw new BuildError('config', `${file}: [actions] must be a table`)
   const t = raw as Record<string, unknown>
@@ -34,26 +253,63 @@ function parseActions(file: string, raw: unknown): ActionsBuildConfig | null {
   }
   let prefix = DEFAULT_ACTION_PREFIX
   if (t.prefix !== undefined) {
-    const why = prefixError(t.prefix)
+    // `/` is the prefix of an actions-only deployment; a page-only build (base_url, no local app) may name it too.
+    const why = prefixError(t.prefix, actionsOnly || t.base_url !== undefined)
     if (why) throw new BuildError('config', `${file}: actions.prefix ${why}`)
     prefix = t.prefix as string
   }
   let maxBodyBytes = DEFAULT_MAX_BODY_BYTES
   if (t.max_body_bytes !== undefined) {
     const n = t.max_body_bytes
-    if (typeof n !== 'number' || !Number.isInteger(n) || n < 1 || n > MAX_U32)
-      throw new BuildError('config', `${file}: actions.max_body_bytes must be an integer in 1..${MAX_U32} (got ${String(n)})`)
+    if (typeof n !== 'number' || !Number.isInteger(n) || n < 1 || n > MAX_ACTION_BYTES)
+      throw new BuildError('config', `${file}: actions.max_body_bytes must be an integer in 1..${MAX_ACTION_BYTES} (got ${String(n)})`)
     maxBodyBytes = n
   }
-  return { entry, prefix, maxBodyBytes }
+  let maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES
+  if (t.max_response_bytes !== undefined) {
+    const n = t.max_response_bytes
+    if (typeof n !== 'number' || !Number.isInteger(n) || n < MIN_RESPONSE_BYTES || n > MAX_ACTION_BYTES)
+      throw new BuildError('config', `${file}: actions.max_response_bytes must be an integer in ${MIN_RESPONSE_BYTES}..${MAX_ACTION_BYTES} (got ${String(n)})`)
+    maxResponseBytes = n
+  }
+  let crossSite: 'reject' | 'allow' = 'reject'
+  if (t.cross_site !== undefined) {
+    if (t.cross_site !== 'reject' && t.cross_site !== 'allow') throw new BuildError('config', `${file}: actions.cross_site must be "reject" or "allow"`)
+    crossSite = t.cross_site
+  }
+  let baseUrl: string | undefined
+  if (t.base_url !== undefined) {
+    const why = baseUrlError(t.base_url)
+    if (why) throw new BuildError('config', `${file}: actions.base_url ${why}`)
+    baseUrl = t.base_url as string
+  }
+  let credentials: ActionCredentials = 'same-origin'
+  if (t.credentials !== undefined) {
+    if (typeof t.credentials !== 'string' || !ACTION_CREDENTIALS.includes(t.credentials as ActionCredentials))
+      throw new BuildError('config', `${file}: actions.credentials must be one of ${ACTION_CREDENTIALS.join(', ')} (got ${JSON.stringify(t.credentials)})`)
+    credentials = t.credentials as ActionCredentials
+  }
+  return { entry, prefix, maxBodyBytes, maxResponseBytes, crossSite, baseUrl, credentials, entryExplicit: t.entry !== undefined }
 }
 
 const DEFAULT_ENTRY = 'actions.ts'
 
-export async function loadBuildConfig(appRoot: string): Promise<BuildConfig> {
+/** `[css]`: only `global`, a list of `.css` files relative to the app root (checked to exist by the build). */
+function parseCss(file: string, raw: unknown): string[] {
+  if (raw === undefined) return []
+  if (!isTable(raw)) throw new BuildError('config', `${file}: [css] must be a table`)
+  for (const k of Object.keys(raw)) if (k !== 'global') throw new BuildError('config', `${file}: unknown key css.${k} (allowed: global)`)
+  const g = raw.global
+  if (g === undefined) return []
+  if (!Array.isArray(g) || g.some((p) => typeof p !== 'string' || !p.trim().endsWith('.css')))
+    throw new BuildError('config', `${file}: css.global must be an array of .css paths (relative to the app root)`)
+  return g.map((p: string) => p.trim())
+}
+
+export async function loadBuildConfig(appRoot: string, o: { actionsOnly?: boolean } = {}): Promise<BuildConfig> {
   const file = join(appRoot, 'brust.toml')
   const f = Bun.file(file)
-  if (!(await f.exists())) return { serverOnly: [], actions: null }
+  if (!(await f.exists())) return { serverOnly: [], actions: null, cloudflare: null, cache: null, cssGlobal: [] }
   let parsed: unknown
   try {
     parsed = Bun.TOML.parse(await f.text())
@@ -61,13 +317,16 @@ export async function loadBuildConfig(appRoot: string): Promise<BuildConfig> {
     throw new BuildError('config', `failed to parse ${file}: ${(e as Error).message}`)
   }
   const root = (parsed ?? {}) as Record<string, unknown>
-  const actions = parseActions(file, root.actions)
+  const actions = parseActions(file, root.actions, o.actionsOnly === true)
+  const cloudflare = parseCloudflare(file, appRoot, root.cloudflare)
+  const cache = await parseCache(file, appRoot, root.cache)
+  const cssGlobal = parseCss(file, root.css)
   const build = root.build
-  if (build === undefined) return { serverOnly: [], actions }
+  if (build === undefined) return { serverOnly: [], actions, cloudflare, cache, cssGlobal }
   if (build === null || typeof build !== 'object' || Array.isArray(build)) throw new BuildError('config', `${file}: [build] must be a table`)
   const so = (build as Record<string, unknown>).server_only
-  if (so === undefined) return { serverOnly: [], actions }
+  if (so === undefined) return { serverOnly: [], actions, cloudflare, cache, cssGlobal }
   if (!Array.isArray(so) || so.some((p) => typeof p !== 'string' || p.trim() === ''))
     throw new BuildError('config', `${file}: build.server_only must be an array of non-empty strings`)
-  return { serverOnly: so.map((p: string) => p.trim().replace(/^\.\//, '')), actions }
+  return { serverOnly: so.map((p: string) => p.trim().replace(/^\.\//, '')), actions, cloudflare, cache, cssGlobal }
 }