@brust/core 2.0.0-alpha.1 → 2.0.0-alpha.11

package/src/build/index.ts

@@ -4,16 +4,25 @@
 // edited by hand. An out dir that could hold the app's own sources, or a non-empty one that is not
 // a previous brust dist (no `manifest.json` / `.brust` marker; `--force` overrides), is refused
 // before anything is written or removed.
-import { cpSync, existsSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from 'node:path'
-import { BrustRouteError, validateRoutes } from '../routes'
-import { type BrowserCtx, buildActions, buildClientChunks, buildJobs, buildReactChunks, buildRuntime, storeModules } from './bundle'
-import { compileApp } from './compile'
-import { type ActionsBuildConfig, loadBuildConfig } from './config'
+import { BrustRouteError, type FlatRoute, validateRoutes } from '../routes'
+import { type BrowserCtx, setDevBuild, buildActions, buildCacheAdapter, buildClientChunks, buildJobs, buildReactChunks, buildRuntime, nestedOf, storeModules } from './bundle'
+import { runActionsOnly } from './actions-only'
+import { type CfPrepared, buildCloudflare, prepareCloudflare } from './cloudflare'
+import { renderIcons } from './build-icons'
+import { evaluateBuildSlots } from './build-eval'
+import { preparePackageSources } from './pkg-src'
+import { type Compiled, compileApp } from './compile'
+import { buildCss, CssGraph, directCss, resolveGlobals, routeCssSources } from './css'
+import { type ActionsBuildConfig, type CacheBuildConfig, loadBuildConfig } from './config'
 import { BuildError } from './errors'
-import { writeManifest } from './manifest'
+import { importsStore } from './features'
+import { type CacheRecord, type ManifestJson, needsWorkers, tierOf, writeManifest } from './manifest'
 import { scanRoutes } from './scan'
+import { type ExprReads, prepareStatic, writeStatic } from './static'
+import { writeStaticWorker } from './static-worker'
 
 export { BuildError } from './errors'
 
@@ -79,17 +88,40 @@ export async function runBuild(opts: {
   outDir: string
   /** Replace a non-empty out dir even without a previous build's marker. */
   force?: boolean
+  /** `cloudflare` also writes `<out>/cf/` (M4-CF); `static` also writes `<out>/static/` (gaps round
+   * L9); default `bun` = the unchanged build. */
+  target?: 'bun' | 'cloudflare' | 'static'
+  /** `--strict` (static): a loader that reads the request fails the build. */
+  strict?: boolean
+  /** The cache key grammar's read-set (static; tests swap it). Default: the addon. */
+  exprReads?: ExprReads
+  /** `--wasm-from-source` (cloudflare only). */
+  wasmFromSource?: boolean
+  /** `--actions-only` (L16 R16.3): no pages, only the `[actions]` app; with `bun` (default) or `cloudflare`. */
+  actionsOnly?: boolean
+  /** `brust build --dev` (L14, used by `brust dev`): also writes `dev.json` and builds the client runtime with `__BRUST_DEV__`. */
+  dev?: boolean
   log: (s: string) => void
 }): Promise<void> {
+  setDevBuild(opts.dev === true)
   const appRoot = resolve(opts.appRoot)
   const entry = resolve(appRoot, opts.entry)
   const dist = resolve(appRoot, opts.outDir)
   assertSafeOutDir(dist, appRoot, [entry, join(appRoot, 'public')])
   assertReplaceable(dist, opts.force)
-  const { serverOnly, actions } = await loadBuildConfig(appRoot)
+  const built = await loadBuildConfig(appRoot, { actionsOnly: opts.actionsOnly === true })
+  if (opts.actionsOnly)
+    return runActionsOnly({ appRoot, dist, config: built, target: opts.target, wasmFromSource: opts.wasmFromSource === true, statOk, assertSafeOutDir, log: opts.log })
+  const { serverOnly, cloudflare, cache, cssGlobal } = built
+  // L16 R16.4b: `[actions]` with a `base_url` and no actions file (the default name, not one written in the toml)
+  // is a page-only build: the app is deployed elsewhere, so nothing is bundled or mounted here.
+  const remote =
+    built.actions !== null && built.actions.baseUrl !== undefined && !built.actions.entryExplicit && !statOk(resolve(appRoot, built.actions.entry)) ? built.actions : null
+  const actions = remote ? null : built.actions
+  if (actions?.prefix === '/') throw new BuildError('config', 'actions.prefix "/" is only for an actions-only build (brust build --actions-only) or a page-only build that points at one')
 
   // Everything that can fail on the app's own input runs before a byte is written.
-  const { routes, componentFile } = await scanRoutes(entry)
+  const { routes, componentFile, componentIssue } = await scanRoutes(entry, appRoot)
   let leaves: ReturnType<typeof validateRoutes>
   try {
     leaves = validateRoutes(routes)
@@ -114,7 +146,26 @@ export async function runBuild(opts: {
       }
     }
   }
-  assertSafeOutDir(dist, appRoot, [...componentFile.values(), ...(actionsEntry ? [actionsEntry] : [])])
+  let cacheModule: string | null = null
+  if (cache?.module !== undefined) {
+    cacheModule = resolve(appRoot, cache.module)
+    const rel = relative(appRoot, cacheModule)
+    if (isAbsolute(cache.module) || rel === '..' || rel.startsWith('../') || isAbsolute(rel) || !statOk(cacheModule)) {
+      throw new BuildError('cache', `cache.module ${cache.module} is not a file inside the app`)
+    }
+  }
+  assertSafeOutDir(dist, appRoot, [...componentFile.values(), ...(actionsEntry ? [actionsEntry] : []), ...(cacheModule ? [cacheModule] : [])])
+
+  // R9.3/R9.4: every reason to refuse a static build, before any write.
+  const ssgPlan =
+    opts.target === 'static'
+      ? await prepareStatic(leaves, actions !== null, opts.exprReads ?? (await import('../native')).cacheExprReads, opts.log, cache)
+      : null
+
+  // Config, @brust/core-cf resolution and the user's wrangler file fail here, before any write.
+  // L12: a static build with `[actions]` also builds the Cloudflare worker (its Pages `_worker.js`).
+  const hybrid = ssgPlan !== null && actions !== null
+  const cf = opts.target === 'cloudflare' || hybrid ? await prepareCloudflare(appRoot, cloudflare, { fromSource: opts.wasmFromSource === true, env: process.env }) : null
 
   // Sibling of `dist` (same filesystem: the final rename is atomic), fixed name (no random bytes in
   // anything the bundler sees).
@@ -122,7 +173,13 @@ export async function runBuild(opts: {
   rmSync(tmp, { recursive: true, force: true })
   mkdirSync(tmp, { recursive: true })
   try {
-    await buildInto(tmp, { appRoot, entry, dist, leaves, componentFile, serverOnly, actions, actionsEntry, log: opts.log })
+    await buildInto(tmp, { dev: opts.dev === true, appRoot, entry, dist, leaves, componentFile, componentIssue, serverOnly, actions, actionsEntry, cache, cacheModule, cf, hybrid, cssGlobal, actionsRemote: remote?.prefix ?? null, log: opts.log })
+    if (ssgPlan) {
+      // Rendered from the finished temp dist, so a failed render leaves the previous dist untouched.
+      const version: string = (await Bun.file(join(import.meta.dir, '../../package.json')).json()).version
+      await writeStatic(tmp, { entry, appRoot, plan: ssgPlan, version, strict: opts.strict === true, log: opts.log, shownDir: join(dist, 'static') })
+      if (hybrid && cf && actions) writeStaticWorker(tmp, actions, cf, opts.log)
+    }
     rmSync(join(tmp, '.stage'), { recursive: true, force: true })
     if (existsSync(dist)) {
       const old = join(dirname(dist), `.${basename(dist)}.brust-old`)
@@ -140,48 +197,132 @@ export async function runBuild(opts: {
 async function buildInto(
   out: string,
   o: {
+    /** Write `dev.json` (L14). */
+    dev: boolean
     appRoot: string
     entry: string
     /** The final dist dir (`index.js` points at the entry relative to it). */
     dist: string
     leaves: ReturnType<typeof validateRoutes>
     componentFile: Map<Function, string>
+    componentIssue: Map<Function, string>
     serverOnly: string[]
     actions: ActionsBuildConfig | null
     /** Absolute path of the actions entry (null when `[actions]` is off). */
     actionsEntry: string | null
+    cache: CacheBuildConfig | null
+    /** Absolute path of a custom cache adapter module. */
+    cacheModule: string | null
+    cf: CfPrepared | null
+    /** `[css] global` as written (app-root relative). */
+    cssGlobal: string[]
+    /** L16 R16.4b: the prefix of an actions app deployed elsewhere (a page-only build); absent = a local app or none. */
+    actionsRemote: string | null
+    /** `--target static` with `[actions]`: the worker is built without the cache (static pages are never cached). */
+    hybrid: boolean
     log: (s: string) => void
   },
 ): Promise<void> {
   const { appRoot, entry, leaves } = o
-  const ctx: BrowserCtx = { sourceOf: new Map(), appRoot, serverOnly: o.serverOnly, serverFiles: o.actionsEntry ? [realpathSync(o.actionsEntry)] : [] }
+  // L19: every stylesheet first, so each JS build below reads one set of CSS Module class maps.
+  const graph = new CssGraph()
+  const chainFiles = (l: FlatRoute) => l.chain.flatMap((n) => (n.Component && o.componentFile.has(n.Component) ? [o.componentFile.get(n.Component)!] : []))
+  const routeCss = routeCssSources(leaves, chainFiles, resolveGlobals(appRoot, o.cssGlobal), graph)
+  const serverCss = [o.actionsEntry, o.cacheModule].flatMap((f) => (f ? graph.of(f) : []))
+  mkdirSync(join(out, 'client'), { recursive: true })
+  // Review N3: `brust dev` builds with BRUST_BUILD_MODE=development (as the JS bundles): readable, unminified CSS.
+  const css = await buildCss(out, [...new Set([...[...routeCss.values()].flat(), ...serverCss])], process.env.BRUST_BUILD_MODE !== 'development', { appRoot, log: o.log })
+  for (const c of directCss(entry))
+    o.log(`[brust] warning css ${relative(appRoot, entry)} imports ${c}: the route entry belongs to no route, so it is linked nowhere; import it from a layout, or list it in [css] global`)
+  const ctx: BrowserCtx = { sourceOf: new Map(), appRoot, serverOnly: o.serverOnly, serverFiles: o.actionsEntry ? [realpathSync(o.actionsEntry)] : [], cssMaps: css.maps }
   // The runtime first: its hashed URL is the `runtimeImport` every client chunk is compiled with.
   const runtime = await buildRuntime(out, ctx)
-  const { compiled, routeComponent } = compileApp({
+  const runtimeUrls = { core: `/_brust/${runtime.core}`, store: `/_brust/${runtime.store}` }
+  const compileOpts = {
     appRoot,
     leaves,
     componentFile: o.componentFile,
-    runtimeImport: `/_brust/${runtime}`,
+    componentIssue: o.componentIssue,
+    runtimeImport: runtimeUrls.core,
     serverOnly: o.serverOnly,
-    log: o.log,
-  })
+    cssMaps: css.maps,
+  }
+  const firstLog: string[] = []
+  let { compiled, routeComponent } = compileApp({ ...compileOpts, log: (l) => firstLog.push(l) })
+  // F153c: the packages the app imports components from are compiled from their source when they publish it (and
+  // it matches what they publish); the app is compiled again with those sources. A refused package stays the island.
+  const external = [...new Set([...compiled.values()].flatMap((c) => (c.ir.external ? [c.ir.external.source] : [])))]
+  const packages = preparePackageSources(appRoot, external)
+  if (Object.keys(packages.scopes).length > 0) {
+    firstLog.length = 0
+    ;({ compiled, routeComponent } = compileApp({ ...compileOpts, packages, log: (l) => firstLog.push(l) }))
+  }
+  // L23: lucide icons the compiler could inline are rendered here (react-dom/server); L2: slots that read
+  // nothing request- or time-dependent are computed once, here. The app is compiled again with both (an icon with
+  // no markup stays the L22 island; a slot with a value is a literal: no job, no worker). The first compile's
+  // warnings describe icons that are inline now, so when icons were rendered only the last compile's are shown.
+  const hasIcons = [...compiled.values()].some((c) => (c.ir.icon_requests ?? []).length > 0)
+  const iconSvgs = hasIcons ? await renderIcons(compiled, appRoot, o.log) : undefined
+  const slotValues = await evaluateBuildSlots(out, compiled, ctx.sourceOf, appRoot, o.log)
+  const hasSlots = Object.keys(slotValues).length > 0
+  if (hasIcons || hasSlots) {
+    if (!hasIcons) firstLog.forEach((l) => o.log(l))
+    ;({ compiled, routeComponent } = compileApp({ ...compileOpts, packages, iconSvgs, iconsFinal: hasIcons, slotValues, log: hasIcons ? o.log : () => {} }))
+  } else firstLog.forEach((l) => o.log(l))
+
+  // F158 (R34.69/70): the compiler makes a caller of a route component fall back to React, so none is a revive host;
+  // if one is, the compiler missed it, and the build stops rather than let request data near the revive.
+  const routeRoots: ReadonlySet<string> = new Set(routeComponent.values())
+  for (const id of routeRoots) {
+    if (nestedOf(compiled, id) !== undefined) throw new BuildError('revive-host-route-root', `${id} is a page or layout and also receives lowered JSX children from a caller; this is a compiler bug (F158), please report it`)
+  }
 
   mkdirSync(join(out, 'jinja'), { recursive: true })
   for (const c of compiled.values()) writeFileSync(join(out, 'jinja', `${c.id}.jinja`), c.jinja)
 
-  const runtimeUrl = `/_brust/${runtime}`
-  const chunks = new Map([...(await buildClientChunks(out, compiled, ctx, runtimeUrl)), ...(await buildReactChunks(out, compiled, ctx, runtimeUrl))])
-  const manifest = writeManifest({ leaves, routeComponent, compiled, runtime, chunks })
-  await buildJobs(out, compiled, ctx.sourceOf, appRoot, storeModules(manifest))
+  const chunks = new Map([...(await buildClientChunks(out, compiled, ctx, runtimeUrls)), ...(await buildReactChunks(out, compiled, ctx, runtimeUrls, routeRoots))])
+  const manifest = writeManifest({ leaves, routeComponent, compiled, runtime: { core: runtime.core, features: { ...runtime.features, store: runtime.store } }, chunks })
+  // L33: a component whose chunk imports the store module (directly or through a shared chunk) has the page preload it.
+  const readClient = (rel: string) => (existsSync(join(out, rel)) ? readFileSync(join(out, rel), 'utf8') : undefined)
+  for (const rec of Object.values(manifest.components)) if (rec.client && importsStore(readClient, rec.client, runtime.store)) rec.features.push('store')
+  for (const r of manifest.routes) {
+    const files = [...new Set((routeCss.get(r.id) ?? []).flatMap((s) => (css.file.has(s) ? [css.file.get(s)!] : [])))]
+    if (files.length > 0) r.css = files
+  }
+  await buildJobs(out, compiled, ctx.sourceOf, appRoot, storeModules(manifest), css.maps, routeRoots)
   manifest.actions =
     o.actions && o.actionsEntry
-      ? { entry: await buildActions(out, o.actionsEntry), prefix: o.actions.prefix, maxBodyBytes: o.actions.maxBodyBytes }
+      ? { entry: await buildActions(out, o.actionsEntry, css.maps), prefix: o.actions.prefix, maxBodyBytes: o.actions.maxBodyBytes, maxResponseBytes: o.actions.maxResponseBytes, crossSite: o.actions.crossSite }
       : null
+  if (o.actionsRemote !== null) manifest.actions_remote = { prefix: o.actionsRemote }
+  if (o.cache) manifest.cache = await cacheRecord(out, manifest, o.cache, o.cacheModule, css.maps)
+  manifest.needs_workers = needsWorkers(manifest)
   writeFileSync(join(out, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`)
+  if (o.dev) writeFileSync(join(out, 'dev.json'), `${JSON.stringify(devJson(appRoot, compiled), null, 2)}\n`)
   writeFileSync(join(out, MARKER), 'generated by `brust build`: this directory is replaced on every build\n')
 
   const pub = join(appRoot, 'public')
   if (existsSync(pub)) cpSync(pub, join(out, 'public'), { recursive: true })
+  if (o.cf) {
+    const warnings = await buildCloudflare(
+      out,
+      {
+        appRoot,
+        entry,
+        dist: o.dist,
+        compiled,
+        manifest: o.hybrid ? { ...manifest, cache: undefined } : manifest,
+        sourceOf: ctx.sourceOf,
+        actionsEntry: o.actionsEntry,
+        cacheModule: o.hybrid ? null : o.cacheModule,
+        cacheGetTimeoutMs: o.hybrid ? undefined : o.cache?.getTimeoutMs,
+        cssMaps: css.maps,
+        log: o.log,
+      },
+      o.cf,
+    )
+    for (const w of warnings) o.log(w)
+  }
   const entryRel = relative(o.dist, entry)
   writeFileSync(
     join(out, 'index.js'),
@@ -197,3 +338,66 @@ async function buildInto(
     ].join('\n'),
   )
 }
+
+/** `dev.json` (L14, R14.2): component id → source file, tier, the react reason, diagnostics. Only `brust build --dev` writes it. */
+export function devJson(appRoot: string, compiled: Map<string, Compiled>): { version: 1; components: Record<string, DevComponent> } {
+  const components: Record<string, DevComponent> = {}
+  for (const c of compiled.values()) {
+    const tier = tierOf(c.ir)
+    const t = c.ir.tier
+    components[c.id] = {
+      file: relative(appRoot, c.file),
+      tier,
+      ...(tier === 'react' && t && typeof t === 'object' && 'React' in t ? { reason: String((t as { React: { reason: string } }).React.reason) } : {}),
+      diagnostics: (c.diagnostics ?? []).map((d) => ({ class: d.class, rule: d.rule, line: d.line, col: d.col, message: d.message, remediation: d.remediation })),
+    }
+  }
+  return { version: 1, components }
+}
+
+export interface DevComponent {
+  file: string
+  tier: 'static' | 'native' | 'react'
+  /** Why the compiler chose the react tier (the IR's `React.reason`). */
+  reason?: string
+  diagnostics: { class: string; rule: string; line: number; col: number; message: string; remediation: string }[]
+}
+
+/** `manifest.cache` (R7, R8): the custom module bundled for the worker, the native defaults, and the
+ * build id every L2 key carries. */
+async function cacheRecord(out: string, manifest: ManifestJson, c: CacheBuildConfig, moduleAbs: string | null, cssMaps: Map<string, Record<string, string>>): Promise<CacheRecord> {
+  const module = moduleAbs ? await buildCacheAdapter(out, moduleAbs, cssMaps) : undefined
+  return {
+    adapter: c.adapter,
+    ...(module ? { module } : {}),
+    ...(c.broadcast ? { broadcast: c.broadcast, broadcastOptions: c.broadcastOptions ?? {} } : {}),
+    options: c.options,
+    namespace: c.namespace,
+    getTimeoutMs: c.getTimeoutMs ?? 50,
+    maxBodyBytes: c.maxBodyBytes,
+    epochIntervalMs: c.epochIntervalMs,
+    buildId: computeBuildId(out, manifest),
+  }
+}
+
+/** R7: the first 16 hex chars of sha256 over the manifest (without `cache`), every `jinja/*.jinja`
+ * (by name), `jobs.js` and `actions.js` when present: a rebuild of the same app keeps it, any change
+ * to what renders a page moves it (a deploy never serves an older build's L2 bodies). */
+export function computeBuildId(out: string, manifest: ManifestJson): string {
+  const h = new Bun.CryptoHasher('sha256')
+  const { cache: _, ...rest } = manifest
+  h.update(JSON.stringify(rest))
+  const jinja = join(out, 'jinja')
+  for (const f of (existsSync(jinja) ? readdirSync(jinja) : []).filter((f) => f.endsWith('.jinja')).sort()) {
+    h.update(`\0${f}\0`)
+    h.update(readFileSync(join(jinja, f)))
+  }
+  for (const f of ['jobs.js', 'actions.js']) {
+    const p = join(out, f)
+    if (existsSync(p)) {
+      h.update(`\0${f}\0`)
+      h.update(readFileSync(p))
+    }
+  }
+  return h.digest('hex').slice(0, 16)
+}

package/src/build/manifest.ts

@@ -6,6 +6,7 @@
 import type { FlatRoute } from '../routes'
 import type { Compiled, ComponentIR } from './compile'
 import { BuildError } from './errors'
+import { featuresOf } from './features'
 
 export interface JobCache {
   key: string | null
@@ -29,6 +30,12 @@ export interface ChildRecord {
   id: string
   instances: string
   props: Record<string, string>
+  /** F105: constant props; part of the child's job keys. */
+  literals?: Record<string, unknown>
+  /** F105: jinja over `__props` (and `__row`/`__idx` per row) the server evaluates. */
+  exprs?: Record<string, string>
+  /** F142 R34.43: the list of a `per-row-literal` instance (a constant the compiler read). */
+  rows?: unknown[]
 }
 
 export interface ComponentRecord {
@@ -40,6 +47,8 @@ export interface ComponentRecord {
   needs_worker: boolean
   use_id_slots: number
   stores: string[]
+  /** L33: the client runtime feature modules (`assets.features` keys) this component's output needs, in load order. */
+  features: string[]
 }
 
 export interface RouteRecord {
@@ -49,22 +58,62 @@ export interface RouteRecord {
   loaders: string[]
   cache: { ttl_seconds: number; prefix: string | null; bypass: true | string | null; tags: string[] } | null
   catch_all: boolean
+  /** L19 (R19.3): `client/<file>.css` in cascade order; absent when the route has none. */
+  css?: string[]
 }
 
-/** `manifest.actions` (A3): `entry` is relative to dist; `maxBodyBytes` is camelCase by contract. */
+/** `manifest.actions` (A3): `entry` is relative to dist; `maxBodyBytes`/`maxResponseBytes` are camelCase by contract. */
 export interface ActionsRecord {
   entry: string
   prefix: string
   maxBodyBytes: number
+  maxResponseBytes: number
+  crossSite: 'reject' | 'allow'
 }
 
+/** The manifest format the Rust loader accepts (`MANIFEST_VERSION` in brust-core `manifest.rs`): the one place TS names it. */
+export const MANIFEST_VERSION = 3 as const
+
 export interface ManifestJson {
-  version: 1
+  version: typeof MANIFEST_VERSION
   routes: RouteRecord[]
   components: Record<string, ComponentRecord>
-  assets: { runtime: string }
+  /** `runtime` is the core; `features` maps each feature module name to its file (L33). */
+  assets: { runtime: string; features: Record<string, string> }
   jobs_module: string
   actions: ActionsRecord | null
+  /** L16 R16.3: an actions-only build (no routes, no templates); everything but the prefix is a 404 problem+json. */
+  actions_only?: true
+  /** L16 R16.4b: a page-only build: no local actions app, `base_url` points at the deployment that has it. */
+  actions_remote?: { prefix: string }
+  /** `[cache]` (cache adapters); absent without one (the manifest is then byte-identical). */
+  cache?: CacheRecord
+  /** F165 (R40.1): `brust start` spawns its worker pool (`needsWorkers`). Read by `run.ts` only; an
+   * absent value (an older or actions-only manifest) means the pool is needed. */
+  needs_workers?: boolean
+}
+
+/** F165 (R40.1): whether any request can call a worker. Workers answer four kinds of call
+ * (worker.ts): `loader`, `jobs` (precompute and SSR), `fetch` (the local actions app) and `cache`
+ * (the adapter). Every component's jobs count, reached by a route or not (F166 prunes those later). */
+export function needsWorkers(m: Pick<ManifestJson, 'routes' | 'components' | 'actions' | 'cache'>): boolean {
+  return Object.values(m.components).some((c) => c.jobs.length > 0) || m.routes.some((r) => r.loaders.length > 0) || m.actions !== null || m.cache !== undefined
+}
+
+/** `manifest.cache` / `CONFIG.cache`: the adapter the runtime loads (`cache-adapter/load.ts`). */
+export interface CacheRecord {
+  adapter: string
+  /** `custom`: the bundled module, relative to dist. */
+  module?: string
+  broadcast?: string
+  options: Record<string, unknown>
+  broadcastOptions?: Record<string, unknown>
+  namespace: string
+  getTimeoutMs: number
+  maxBodyBytes: number
+  epochIntervalMs: number
+  /** 16 hex chars of sha256 over the build output (R7): every L2 key carries it. */
+  buildId: string
 }
 
 // biome-ignore lint/suspicious/noExplicitAny: IR JSON (externally tagged enums)
@@ -206,15 +255,23 @@ export function childRecords(c: Compiled, clientOnly: string[] = []): ChildRecor
     if (inst.loops.length > 1)
       throw new BuildError('nested-instance', `${ir.id}: child ${inst.child_id} sits in nested lists (M3)`)
     const list = inst.loops[0]
-    if (list === null)
+    const literal = list === null && Array.isArray(inst.rows_literal)
+    if (list === null && !literal)
       throw new BuildError('instance-list-path', `${ir.id}: child ${inst.child_id} sits in a list that is not a props path`)
     const props: Record<string, string> = {}
     for (const [name, path] of Object.entries(inst.props)) {
       if (path === null)
-        throw new BuildError('instance-prop-path', `${ir.id}: child ${inst.child_id} prop ${name} is not a props path`)
+        throw new BuildError(
+          'instance-prop-path',
+          `${ir.id}: child ${inst.child_id} prop ${name} is not a props path, a JSON literal or a template expression over props; compute it in a loader, or wrap the child's derived value in cache()`,
+        )
       props[name] = path
     }
-    return { id: inst.child_id, instances: list === undefined ? 'static' : `per-row:${list}`, props }
+    const rec: ChildRecord = { id: inst.child_id, instances: literal ? 'per-row-literal' : list === undefined ? 'static' : `per-row:${list}`, props }
+    if (inst.literals && Object.keys(inst.literals).length > 0) rec.literals = { ...inst.literals }
+    if (inst.exprs && Object.keys(inst.exprs).length > 0) rec.exprs = { ...inst.exprs }
+    if (literal) rec.rows = inst.rows_literal
+    return rec
   })
   for (const id of clientOnly) out.push({ id, instances: 'static', props: {} })
   return out
@@ -241,7 +298,8 @@ export function writeManifest(opts: {
   leaves: FlatRoute[]
   routeComponent: Map<string, string>
   compiled: Map<string, Compiled>
-  runtime: string
+  /** The runtime files `buildRuntime` wrote: the core and the feature modules. */
+  runtime: { core: string; features: Record<string, string> }
   /** component id → `client/<file>` (client chunk or react island chunk). */
   chunks: Map<string, string>
   actions?: ActionsRecord | null
@@ -260,7 +318,10 @@ export function writeManifest(opts: {
       needs_worker: jobs.length > 0,
       use_id_slots: c.ir.use_id_slots ?? 0,
       stores: storesOf(compiled, c.id),
+      features: featuresOf(c.id, c.jinja, tierOf(c.ir) === 'react'),
     }
+    for (const f of components[c.id]!.features)
+      if (!(f in opts.runtime.features)) throw new BuildError('runtime-feature-missing', `${c.id}: needs the client runtime feature ${f}, which the build did not ship`)
   }
   const routes: RouteRecord[] = opts.leaves.map((l) => {
     // A node without a Component (a pure path/loader group) renders nothing: not a chain entry.
@@ -282,7 +343,7 @@ export function writeManifest(opts: {
     }
   })
   linkNativeChunks(routes, compiled, components)
-  return { version: 1, routes, components, assets: { runtime: opts.runtime }, jobs_module: 'jobs.js', actions: opts.actions ?? null }
+  return { version: MANIFEST_VERSION, routes, components, assets: { runtime: opts.runtime.core, features: opts.runtime.features }, jobs_module: 'jobs.js', actions: opts.actions ?? null }
 }
 
 /** S6 amendment (F66): the server's asset injection walks only each chain component's direct