@brust/core 2.0.0-alpha.2 → 2.0.0-alpha.4

package/src/handlers.ts

@@ -0,0 +1,282 @@
+// The host-agnostic half of the worker (M4-CF lane 4): wire shapes + `makeHandlers`. No Bun, no
+// napi, no `node:*` — the Cloudflare entry imports it through `@brust/core/server-handlers`.
+// `worker.ts` re-exports everything here, so existing importers are unchanged.
+import { installServerResolver, type StoreSnapshot } from './store/core-adapter'
+import { collectSnapshot, getServerInstance, runInStoreContext, touchStores } from './store/server-context'
+import { type FlatRoute, isHttpErrorTrigger, isVerdict, type LoaderReq, type Route, type Verdict } from './routes'
+
+installServerResolver(getServerInstance)
+
+
+// ---- wire shapes (protocol.rs, camelCase) ----
+
+export interface LoaderRequest {
+  routeId: string
+  params: Record<string, string>
+  path: string
+  req: LoaderReq
+  /** M3-P P6: the chain has jobs — plan them in this call (`planJobs`). Optional to honour. */
+  plan?: boolean
+}
+
+export type LoaderResponse =
+  | { ok: true; data: Record<string, unknown>; headers?: Record<string, string>; store?: StoreSnapshot | null }
+  | { verdict: 'notFound'; data: unknown; store?: StoreSnapshot | null }
+  | { verdict: 'redirect'; location: string; status: number }
+  | { verdict: 'httpError'; status: number; body: string }
+  | { error: string }
+
+export type JobKind = 'precompute' | 'ssr'
+
+export interface JobCall {
+  /** Opaque, echoed back: `<componentId>/<jobId>[/<row>]` for a chain job,
+   * `<parentId>/<childId>_<k>/<jobId>[/<row>]` for an inlined child instance (pipeline.rs `plan_one`). */
+  id: string
+  componentId: string
+  kind: JobKind
+  // biome-ignore lint/suspicious/noExplicitAny: job inputs are arbitrary JSON
+  inputs: any
+  /** ssr: the react component to render (D6). */
+  target?: string
+  row?: number
+}
+
+export interface JobsRequest {
+  jobs: JobCall[]
+}
+
+export type JobResult = { id: string; value: unknown } | { id: string; error: string }
+
+export interface JobsResponse {
+  results: JobResult[]
+}
+
+/** The default export of `<dist>/<manifest.jobs_module>` (built by Task 6): component id → job fns. */
+// biome-ignore lint/suspicious/noExplicitAny: props are whatever the component takes
+export type JobsModule = Record<string, { precompute?: (props: any) => unknown; ssr?: (props: any) => string | Promise<string> }>
+
+/** The slice of `manifest.json` the worker reads: ssr job `literals` (S6 amendment). */
+export interface ManifestLike {
+  routes?: { id: string; chain: string[] }[]
+  components: Record<
+    string,
+    {
+      jobs: { id: string; kind?: string; target?: string; literals?: Record<string, unknown> }[]
+      children?: { id: string }[]
+      stores?: string[]
+    }
+  >
+  jobs_module?: string
+  /** `brust build` (M3-F A3): the actions entry, relative to dist. Absent/null = no actions. */
+  actions?: { entry: string; prefix: string; maxBodyBytes: number; maxResponseBytes?: number } | null
+}
+
+export function toJson(out: unknown): string {
+  try {
+    return JSON.stringify(out)
+  } catch (e) {
+    return JSON.stringify({ error: `response not serialisable: ${String(e)}` })
+  }
+}
+
+// ---- literals (S6 amendment: the worker merges an ssr job's `literals` over `call.inputs`) ----
+
+/** `"<componentId>/<jobId>"` → that job record's `literals` (only records that carry some). */
+export function literalsIndex(manifest: ManifestLike | undefined): Map<string, Record<string, unknown>> {
+  const out = new Map<string, Record<string, unknown>>()
+  for (const [cid, c] of Object.entries(manifest?.components ?? {}))
+    for (const j of c.jobs ?? []) if (j.literals && Object.keys(j.literals).length > 0) out.set(`${cid}/${j.id}`, j.literals)
+  return out
+}
+
+/** The manifest job id of a call: the segment after `componentId` in a chain id
+ * (`<cid>/<jobId>[/<row>]`), else the third segment of a child-instance id
+ * (`<parentId>/<cid>_<k>/<jobId>[/<row>]`). */
+export function jobIdOf(call: Pick<JobCall, 'id' | 'componentId'>): string | undefined {
+  const parts = call.id.split('/')
+  return parts[0] === call.componentId ? parts[1] : parts[2]
+}
+
+// ---- touched stores (M3-F D4) ----
+
+/** route id -> sorted unique union of `stores` over the route's chain, walking each component's
+ * `children[].id` and `jobs[].target` transitively. Routes with an empty union are absent. */
+export function routeStoresIndex(manifest: ManifestLike | undefined): Map<string, string[]> {
+  const out = new Map<string, string[]>()
+  const comps = manifest?.components ?? {}
+  for (const r of manifest?.routes ?? []) {
+    const acc = new Set<string>()
+    const seen = new Set<string>()
+    const walk = (id: string) => {
+      if (seen.has(id)) return
+      seen.add(id)
+      const c = comps[id]
+      if (!c) return
+      for (const p of c.stores ?? []) acc.add(p)
+      for (const k of c.children ?? []) walk(k.id)
+      for (const j of c.jobs ?? []) if (j.target) walk(j.target)
+    }
+    for (const id of r.chain ?? []) walk(id)
+    if (acc.size > 0) out.set(r.id, [...acc].sort())
+  }
+  return out
+}
+
+/** R1: `store` is assigned only when a store was touched; absent otherwise. */
+function withStore<T extends LoaderResponse>(r: T): T {
+  const s = collectSnapshot()
+  if (s) (r as { store?: StoreSnapshot | null }).store = s
+  return r
+}
+
+// ---- handlers ----
+
+/** `parent`: the data the chain merged before the verdict. A notFound renders the route's
+ * template (layouts included), so the layouts' data stays under the verdict's own keys. */
+function verdictJson(v: Verdict, parent: Record<string, unknown>): LoaderResponse {
+  if (v.status === 404) {
+    const own = v.data ?? {}
+    return { verdict: 'notFound', data: typeof own === 'object' && !Array.isArray(own) ? { ...parent, ...own } : own }
+  }
+  return { verdict: 'redirect', location: v.headers?.Location ?? '/', status: v.status }
+}
+
+/** What a loader did during a static render (gaps round R9.5) that a static file cannot honour. */
+export type SsgRecord =
+  | { kind: 'read'; routeId: string; path: string; field: 'headers' | 'cookies' | 'search'; key: string }
+  | { kind: 'headers'; routeId: string; path: string; names: string[] }
+
+/** R9.5: the request a loader sees while rendering static output: a visitor with no headers, cookies
+ * or query. Every read of `headers` / `cookies` / `search` (a key, `in`, or a listing: key `*`) is
+ * recorded, so the build can warn that the page written ignores it. */
+export function ssgRequest(req: LoaderReq, routeId: string, path: string, record: (r: SsgRecord) => void): LoaderReq {
+  const watched = (field: 'headers' | 'cookies' | 'search') => {
+    const read = (key: string) => record({ kind: 'read', routeId, path, field, key })
+    return new Proxy(Object.create(null) as Record<string, string>, {
+      get: (t, k) => {
+        if (typeof k === 'string') read(k)
+        return Reflect.get(t, k)
+      },
+      has: (t, k) => {
+        if (typeof k === 'string') read(k)
+        return Reflect.has(t, k)
+      },
+      ownKeys: (t) => {
+        read('*')
+        return Reflect.ownKeys(t)
+      },
+      getOwnPropertyDescriptor: (t, k) => {
+        if (typeof k === 'string') read(k)
+        return Reflect.getOwnPropertyDescriptor(t, k)
+      },
+    })
+  }
+  return { method: 'GET', url: req.url, headers: watched('headers'), cookies: watched('cookies'), search: watched('search') }
+}
+
+export interface Handlers {
+  loader(req: LoaderRequest): Promise<LoaderResponse>
+  jobs(req: JobsRequest): Promise<JobsResponse>
+}
+
+/** `leaves` from `flattenRoutes` (ids must match the manifest's route ids); `jobs` the jobs
+ * module; `manifest` supplies ssr `literals` (omit → no merge). */
+export function makeHandlers(opts: {
+  leaves: FlatRoute[]
+  jobs: JobsModule
+  manifest?: ManifestLike
+  /** `jobs.js` `stores` table (R2): C3 path -> module namespace. */
+  stores?: Record<string, object>
+  /** Static output (R9.5): loaders see `ssgRequest`, and what a static file drops is recorded. */
+  ssg?: (r: SsgRecord) => void
+}): Handlers {
+  const byId = new Map(opts.leaves.map((l) => [l.id, l]))
+  const literals = literalsIndex(opts.manifest)
+  const jobs = opts.jobs
+  const storeIdx = routeStoresIndex(opts.manifest)
+  const storeTable = opts.stores ?? {}
+
+  async function runJob(call: JobCall): Promise<JobResult> {
+    const owner = call.kind === 'ssr' ? (call.target ?? call.componentId) : call.componentId // D6
+    const fn = jobs[owner]?.[call.kind]
+    if (typeof fn !== 'function') return { id: call.id, error: `no ${call.kind} job for component ${owner}` }
+    try {
+      let props = call.inputs
+      if (call.kind === 'ssr') {
+        const jid = jobIdOf(call)
+        const lit = jid === undefined ? undefined : literals.get(`${call.componentId}/${jid}`)
+        if (lit) props = { ...(props ?? {}), ...lit }
+        // Precompute runs outside any scope (D8); ssr runs in a scope seeded from `__store`, which props never see.
+        const seed = (props?.__store ?? null) as StoreSnapshot | null
+        if (props && '__store' in props) {
+          const { __store: _, ...rest } = props
+          props = rest
+        }
+        const p = props
+        return { id: call.id, value: await runInStoreContext(() => fn(p), seed) }
+      }
+      return { id: call.id, value: await fn(props) }
+    } catch (e) {
+      return { id: call.id, error: String(e) }
+    }
+  }
+
+  return {
+    // 0.1.x `runNativeChainLoaders`: root → leaf, flat merge (later keys win), first verdict stops
+    // (a notFound keeps what the chain merged so far: verdictJson).
+    async loader(req) {
+      const leaf = byId.get(req.routeId)
+      if (!leaf) return { error: `unknown routeId ${req.routeId}` }
+      // One object for the whole chain: each level's keys are assigned INTO it (later keys win,
+      // first-seen key order — what `{...merged, ...r}` produced) instead of re-spreading every
+      // key once per level (M3-P P1). `merged` is fresh per call; a loader's own object is never
+      // written to. Null prototype: with no `__proto__` setter to hit, an own "__proto__" key in a
+      // loader's data is assigned as data, as the spread copied it.
+      return runInStoreContext(async () => {
+        const merged: Record<string, unknown> = Object.create(null)
+        try {
+          const touch = storeIdx.get(req.routeId)
+          if (touch) touchStores(touch, storeTable)
+          for (const node of leaf.chain) {
+            if (!node.loader) continue
+            let r: unknown
+            try {
+              const lreq = opts.ssg ? ssgRequest(req.req, req.routeId, req.path, opts.ssg) : req.req
+              r = await node.loader({ params: req.params, path: req.path, req: lreq })
+            } catch (e) {
+              if (isHttpErrorTrigger(e)) return { verdict: 'httpError', status: e.status, body: e.body } as LoaderResponse
+              throw e
+            }
+            if (isVerdict(r)) {
+              const v = verdictJson(r, merged)
+              return 'verdict' in v && v.verdict === 'notFound' ? withStore(v) : v
+            }
+            if (r && typeof r === 'object') Object.assign(merged, r)
+          }
+          const ok = withStore({ ok: true, data: merged } as LoaderResponse)
+          const headers = (ok as { headers?: Record<string, string> }).headers
+          if (opts.ssg && headers && Object.keys(headers).length > 0) opts.ssg({ kind: 'headers', routeId: req.routeId, path: req.path, names: Object.keys(headers) })
+          return ok
+        } catch (e) {
+          return { error: String(e) } as LoaderResponse
+        }
+      })
+    },
+    // One request carries every job of the page; a per-job failure keeps the other results.
+    async jobs(req) {
+      return { results: await Promise.all((req.jobs ?? []).map(runJob)) }
+    },
+  }
+}
+
+/** Wraps an async handler for a JSON-string boundary: parses, calls, serialises; NEVER rejects
+ * (a parse error or a throwing handler resolves `{"error":…}`, like `makeDispatch`). */
+export function jsonCall<Q, R>(fn: (q: Q) => Promise<R>): (json: string) => Promise<string> {
+  return async (json) => {
+    try {
+      return toJson(await fn(JSON.parse(json)))
+    } catch (e) {
+      return toJson({ error: String(e) })
+    }
+  }
+}

package/src/index.ts

@@ -1,4 +1,6 @@
+/// <reference path="./css-modules.d.ts" />
 // `@brust/core`: the app-facing API.
+export { buildTime } from './build-time'
 export { cache } from './cache'
 export { type BrustConfig, BrustConfigError, loadConfig } from './config'
 export { type RunOptions, run } from './run'
@@ -15,4 +17,4 @@ export {
   Outlet,
   redirect,
 } from './routes'
-export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, Verdict } from './routes'
+export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, RouteSsgConfig, Verdict } from './routes'

package/src/native.ts

@@ -22,6 +22,8 @@ export interface StartOptions {
   workers: number
   claimTimeoutMs?: number
   callTimeoutMs?: number
+  /** L10: the biggest loader/jobs reply that may cross the heap when it does not fit the slot; absent = 8388608. */
+  maxLoaderResponseBytes?: number
   /** tokio I/O threads; absent = one per core. */
   workerThreads?: number
   l1Capacity?: number
@@ -31,6 +33,20 @@ export interface StartOptions {
   cors?: CorsOptions
   /** The actions subtree (M3-F A3); absent = no actions. Boot error `actions: …` when invalid. */
   actions?: ActionsOptions
+  /** L16: what the page tells the browser `client()` (base URL, credentials, a non-default prefix); absent = from `actions` alone. */
+  actionsClient?: ActionsClientOptions
+  /** The cache adapter (`manifest.cache`); absent = none (byte-identical server). */
+  l2?: L2Options
+  /** `brust dev` only (L14): a request carrying this token (`x-brust-dev-token`) is traced; absent in production. */
+  devToken?: string
+}
+/** napi `NapiL2Options`; defaults 50 ms, 1048576 bytes. */
+export interface L2Options {
+  adapter: string
+  getTimeoutMs?: number
+  maxBodyBytes?: number
+  namespace: string
+  buildId: string
 }
 /** napi `NapiCorsOptions` (camelCase keys; snake_case keys are silently dropped). */
 export interface CorsOptions {
@@ -41,6 +57,12 @@ export interface CorsOptions {
   credentials?: boolean
   maxAgeSeconds?: number
 }
+/** napi `NapiActionsClient`. */
+export interface ActionsClientOptions {
+  prefix?: string
+  baseUrl?: string
+  credentials?: 'same-origin' | 'include' | 'omit'
+}
 /** napi `NapiActionsOptions`; defaults `/_brust/action`, 1048576, 8388608. */
 export interface ActionsOptions {
   prefix?: string
@@ -50,7 +72,7 @@ export interface ActionsOptions {
   /** F87: cross-site mutating requests. Default `reject`. */
   crossSite?: 'reject' | 'allow'
 }
-export type WorkerFn = (kind: 'loader' | 'jobs' | 'fetch', requestJson: string, slot: number) => Promise<number>
+export type WorkerFn = (kind: 'loader' | 'jobs' | 'fetch' | 'cache', requestJson: string, slot: number) => Promise<number>
 export interface NativeBinding {
   startServer(opts: StartOptions): void
   registerWorker(buf: Uint8Array, slots: number, f: WorkerFn): number
@@ -61,10 +83,20 @@ export interface NativeBinding {
   localAddr(): string
   /** M3-P P6 — see crates/brust-napi/src/server.rs `plan_jobs`. Never throws. */
   planJobs(slot: number, len: number): string
+  /** L10 — `planJobs` for a loader response too large for the slot: the bytes are handed over directly. Never throws. */
+  planJobsBuf(slot: number, buf: Uint8Array): string
   /** F82 — the heap request body of the in-flight `fetch` call, once; null if none. Never throws. */
   takeFetchBody(slot: number): Uint8Array | null
   /** F82 — hand Rust a response body too large for the slot; false = declined. Never throws. */
   putFetchReply(slot: number, body: Uint8Array): boolean
+  /** cache adapter R10 — a foreign broadcast event: tier 1 + the floor at `seq`; never re-published. */
+  cacheReplay(args: InvalidateArgs, seq: number | null): InvalidateResult
+  /** cache adapter R9 — bump `stats.l2[name]`; false = unknown name / no adapter / no server. Never throws. */
+  cacheL2Count(name: string): boolean
+  /** cache adapter R10 — drop both tier-1 caches (a broadcast gap); the L1 entries removed. */
+  cacheClear(): number
+  /** Static output (gaps round R9.4): the request reads of a cache key expression; throws when it does not parse. */
+  cacheExprReads(src: string): string[]
 }
 
 let binding: NativeBinding | null = null
@@ -91,5 +123,10 @@ export const cacheInvalidate = (args: InvalidateArgs): InvalidateResult => nativ
 export const cacheStats = (): string => native().cacheStats()
 export const localAddr = (): string => native().localAddr()
 export const planJobs = (slot: number, len: number): string => native().planJobs(slot, len)
+export const planJobsBuf = (slot: number, buf: Uint8Array): string => native().planJobsBuf(slot, buf)
 export const takeFetchBody = (slot: number): Uint8Array | null => native().takeFetchBody(slot)
 export const putFetchReply = (slot: number, body: Uint8Array): boolean => native().putFetchReply(slot, body)
+export const cacheReplay = (args: InvalidateArgs, seq: number | null): InvalidateResult => native().cacheReplay(args, seq)
+export const cacheL2Count = (name: string): boolean => native().cacheL2Count(name)
+export const cacheClear = (): number => native().cacheClear()
+export const cacheExprReads = (src: string): string[] => native().cacheExprReads(src)

package/src/routes.ts

@@ -1,3 +1,4 @@
+/// <reference path="./css-modules.d.ts" />
 // Route tree, ids and loader verdicts (spec S4, S7 step 4). M2 routes carry ONLY
 // `path/Component/loader/cache/children`; every other 0.1.x field fails loudly (M3).
 
@@ -29,15 +30,21 @@ export interface LoaderCtx<P = Record<string, string>> {
   req: LoaderReq
 }
 
+/** `brust build --target static` (gaps round R9.2): `params` lists the values of a dynamic route's
+ * `{name}` segments, one record per page; `false` leaves the route out of the static output. The
+ * server and Cloudflare targets ignore it. */
+export type RouteSsgConfig<P = Record<string, string>> = { params?: () => P[] | Promise<P[]> } | false
+
 export interface Route<P = Record<string, string>, D = unknown> {
   path?: string
   Component?: ComponentType<any>
   loader?: (ctx: LoaderCtx<P>) => Promise<D> | D
   cache?: RouteCacheConfig
+  ssg?: RouteSsgConfig<P>
   children?: Route<any, any>[]
 }
 
-export const ALLOWED_ROUTE_FIELDS = ['path', 'Component', 'loader', 'cache', 'children'] as const
+export const ALLOWED_ROUTE_FIELDS = ['path', 'Component', 'loader', 'cache', 'ssg', 'children'] as const
 const ALLOWED_CACHE_FIELDS = ['ttl_seconds', 'prefix', 'bypass', 'tags'] as const
 const M3_CACHE_FIELDS = ['key', 'key_ttl_seconds'] as const
 
@@ -61,6 +68,18 @@ function validate(node: Route, where: string): void {
   if (node.path !== undefined && typeof node.path !== 'string') throw new BrustRouteError(`route ${where}: path must be a string`)
   if (node.loader !== undefined && typeof node.loader !== 'function')
     throw new BrustRouteError(`route ${where}: loader must be a function`)
+  if (node.ssg !== undefined) {
+    const ssg = node.ssg as unknown
+    if (ssg !== false && (typeof ssg !== 'object' || ssg === null || Array.isArray(ssg)))
+      throw new BrustRouteError(`route ${where}: ssg must be false or { params }`)
+    if (ssg !== false) {
+      for (const k of Object.keys(ssg as object))
+        if (k !== 'params') throw new BrustRouteError(`route ${where}: unknown ssg field ssg.${k} (allowed: params)`)
+      const params = (ssg as { params?: unknown }).params
+      if (params !== undefined && typeof params !== 'function') throw new BrustRouteError(`route ${where}: ssg.params must be a function`)
+    }
+    if (node.children !== undefined) throw new BrustRouteError(`route ${where}: ssg on a layout route is not supported (put it on each leaf)`)
+  }
   if (node.cache !== undefined) {
     if (typeof node.cache !== 'object' || node.cache === null) throw new BrustRouteError(`route ${where}: cache must be an object`)
     for (const k of Object.keys(node.cache)) {

package/src/run.ts

@@ -8,38 +8,59 @@
 // does not end it, so every exit is an explicit `process.exit`.
 import { existsSync, readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
-import { type BrustConfig, loadConfig } from './config'
-import { beginDrain, type StartOptions, startServer, untilReady } from './native'
-import { SLOT_BYTES } from './worker'
+import { type BrustConfig, type ConfigOverrides, loadConfig } from './config'
+import { beginDrain, localAddr, type StartOptions, startServer, untilReady } from './native'
+import { DEFAULT_MAX_LOADER_RESPONSE_BYTES } from './worker'
 
 export interface RunOptions {
   distDir?: string
   /** The routes module the workers import (`export const routes` or default). */
   entry?: string
   /** Overrides below env (CLI flags): see config.ts (incl. `bootTimeoutMs`, default 30000). */
-  config?: Partial<BrustConfig>
+  config?: ConfigOverrides
+  /** Static output (gaps round L9): runs once every worker is ready, with the bound `host:port`;
+   * then the server drains and the process exits with the returned code. */
+  onReady?: (addr: string) => Promise<number>
 }
 
 /** The manifest fields `run` needs (build/manifest.ts owns the full shape). */
 export interface RunManifest {
   actions?: { entry: string; prefix: string; maxBodyBytes: number; maxResponseBytes?: number; crossSite?: 'reject' | 'allow' } | null
+  /** L16 R16.3: `brust build --actions-only`: no page routes and no routes entry. */
+  actions_only?: boolean
+  /** L16 R16.4b: a page-only build; the actions app is deployed elsewhere (`[actions] base_url`). */
+  actions_remote?: { prefix: string } | null
+  /** `[cache]`: the server's L2 settings (the workers load the adapter itself). */
+  cache?: { adapter: string; getTimeoutMs: number; maxBodyBytes: number; namespace: string; buildId: string } | null
 }
 
-/** Pure: the napi `StartOptions`. No actions/cors → exactly the pre-actions keys. */
-export function startOptions(cfg: BrustConfig, distDir: string, m: RunManifest, version: string): StartOptions {
+/** Pure: the napi `StartOptions`. No actions/cors/cache → exactly the pre-actions keys. */
+export function startOptions(cfg: BrustConfig, distDir: string, m: RunManifest, version: string, devToken?: string): StartOptions {
   return {
     host: cfg.host,
     port: cfg.port,
     distDir,
     workers: cfg.workers,
     callTimeoutMs: cfg.callTimeoutMs,
+    ...(cfg.maxLoaderResponseBytes !== undefined && cfg.maxLoaderResponseBytes !== DEFAULT_MAX_LOADER_RESPONSE_BYTES ? { maxLoaderResponseBytes: cfg.maxLoaderResponseBytes } : {}),
     workerThreads: cfg.ioThreads,
     generator: `brust/${version}`,
     ...(m.actions ? { actions: { prefix: m.actions.prefix, maxBodyBytes: m.actions.maxBodyBytes, ...(m.actions.maxResponseBytes !== undefined ? { maxResponseBytes: m.actions.maxResponseBytes } : {}), ...(m.actions.crossSite ? { crossSite: m.actions.crossSite } : {}) } } : {}),
+    ...(actionsClient(cfg, m) ? { actionsClient: actionsClient(cfg, m) } : {}),
     ...(cfg.cors ? { cors: cfg.cors } : {}),
+    ...(devToken ? { devToken } : {}),
+    ...(m.cache ? { l2: { adapter: m.cache.adapter, getTimeoutMs: m.cache.getTimeoutMs, maxBodyBytes: m.cache.maxBodyBytes, namespace: m.cache.namespace, buildId: m.cache.buildId } } : {}),
   }
 }
 
+/** L16: what the page tells the browser `client()` (R16.1/R16.2); absent while it would only repeat the prefix script. */
+function actionsClient(cfg: BrustConfig, m: RunManifest): NonNullable<StartOptions['actionsClient']> | undefined {
+  const credentials = cfg.actionsCredentials !== undefined && cfg.actionsCredentials !== 'same-origin' ? cfg.actionsCredentials : undefined
+  if (cfg.actionsBaseUrl === undefined && credentials === undefined && !m.actions_remote) return undefined
+  const prefix = m.actions?.prefix ?? m.actions_remote?.prefix
+  return { ...(prefix ? { prefix } : {}), ...(cfg.actionsBaseUrl !== undefined ? { baseUrl: cfg.actionsBaseUrl } : {}), ...(credentials ? { credentials } : {}) }
+}
+
 /** Every worker's response buffer, kept reachable until the process exits (see run()). */
 const workerBuffers: SharedArrayBuffer[] = []
 
@@ -60,7 +81,8 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     fail(`bad manifest ${manifest}: ${(e as Error).message}`)
   }
   const entry = resolve(process.env.BRUST_APP_ENTRY || opts.entry || 'routes.tsx')
-  if (!existsSync(entry)) fail(`routes entry ${entry} not found`)
+  // R16.3: an actions-only dist has no pages, so no routes module either.
+  if (!m.actions_only && !existsSync(entry)) fail(`routes entry ${entry} not found`)
 
   let cfg: BrustConfig
   try {
@@ -69,9 +91,11 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     fail((e as Error).message)
   }
 
+  if (m.actions_remote && cfg.actionsBaseUrl === undefined)
+    fail('this build has no local actions app: set [actions] base_url (or BRUST_ACTIONS_BASE_URL) to the deployment that serves them')
   const version: string = (await Bun.file(join(import.meta.dir, '../package.json')).json()).version
   try {
-    startServer(startOptions(cfg, distDir, m, version))
+    startServer(startOptions(cfg, distDir, m, version, process.env.BRUST_DEV_TOKEN || undefined))
   } catch (e) {
     fail((e as Error).message)
   }
@@ -84,8 +108,12 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     ...process.env,
     NODE_ENV: process.env.NODE_ENV,
     BRUST_RENDER_SLOTS: String(cfg.renderSlots),
+    BRUST_SLOT_BYTES: String(cfg.slotBytes),
+    BRUST_MAX_LOADER_RESPONSE_BYTES: String(cfg.maxLoaderResponseBytes),
     BRUST_DIST_DIR: distDir,
     BRUST_APP_ENTRY: entry,
+    // One cache-adapter origin per process: its workers' published events are not replayed here.
+    BRUST_CACHE_ORIGIN: crypto.randomUUID(),
   }
 
   let ready = false
@@ -110,7 +138,7 @@ export async function run(opts: RunOptions = {}): Promise<void> {
   for (let i = 0; i < cfg.workers; i++) {
     // The response buffer is owned HERE, for the process lifetime: the Rust dispatcher keeps a raw
     // pointer into it, so it must not be freed with the worker (crates/brust-napi dispatch.rs).
-    const sab = new SharedArrayBuffer(SLOT_BYTES * cfg.renderSlots)
+    const sab = new SharedArrayBuffer(cfg.slotBytes * cfg.renderSlots)
     workerBuffers.push(sab)
     const w = new Worker(url, { env: { ...env, BRUST_WORKER_ID: String(i) }, workerData: { sab } } as WorkerOptions)
     // No respawn in M2: a worker that fails to boot or dies later takes the process down loudly
@@ -153,5 +181,14 @@ export async function run(opts: RunOptions = {}): Promise<void> {
   }
   ready = true
   console.log(`[brust] ready (${cfg.workers} worker${cfg.workers === 1 ? '' : 's'})`)
+  if (opts.onReady) {
+    let code = 1
+    try {
+      code = await opts.onReady(localAddr())
+    } catch (e) {
+      console.error(`[brust] ${(e as Error).stack ?? String(e)}`)
+    }
+    if (!draining) drainThenExit(code)
+  }
   await new Promise<never>(() => {})
 }

package/src/server-handlers.ts

@@ -0,0 +1,32 @@
+// What the generated Cloudflare entry (`brust-app.js`) imports: the host-agnostic handler code and the
+// store-scoped action fetch. No Bun / worker_threads here; `actions-bridge`'s napi import is stubbed by the
+// CF bundle (M4-CF R8).
+import { type CfCacheBridge, type CfInstallExt, installCache } from './cache-adapter/workers'
+import type { InvalidateArgs, InvalidateResult } from './native'
+
+export { fetchInScope, noActions } from './actions-bridge'
+export { jsonCall, makeHandlers } from './handlers'
+export { flattenRoutes } from './routes'
+
+/** What the wasm side hands over at start (`#[event(start]` -> `install({ invalidate, l2Count })`, ruling 19753649). */
+export interface CfRuntime {
+  invalidate(args: InvalidateArgs): InvalidateResult
+  /** Bumps a `stats.l2` counter (cache adapters R9). */
+  l2Count?(name: string): boolean
+}
+export type { CfCacheBridge, CfInstallExt }
+
+let rt: CfRuntime | null = null
+
+/** Called by the wasm glue once at Worker start; the CF bundle's napi stub forwards `cacheInvalidate` to it.
+ * With a cache adapter (`ext`, from the generated entry) it answers the adapter bridge (R11, R14). */
+export function install(runtime: CfRuntime, ext?: CfInstallExt): { cache: CfCacheBridge | null } {
+  rt = runtime
+  return { cache: ext ? installCache(runtime, ext) : null }
+}
+
+/** The installed runtime; throws before `install` (a request cannot arrive earlier). */
+export function installedRuntime(): CfRuntime {
+  if (!rt) throw new Error('brust: the Cloudflare runtime is not installed (install(rt) was not called at start)')
+  return rt
+}