@brust/core 2.0.0-alpha.3 → 2.0.0-alpha.30

package/src/build/tailwind.ts

@@ -0,0 +1,117 @@
+// Tailwind CSS v4 for `brust build` (L32, F135, R33.1-R33.4): brust's own Bun plugin over the app's Tailwind.
+// It does what the official integrations (@tailwindcss/vite, @tailwindcss/postcss) do: `compile()` from
+// `@tailwindcss/node`, a `Scanner` from `@tailwindcss/oxide` over the compiler's sources (the app root unless the
+// stylesheet says `source(...)`, plus every `@source` / `@source not`), then `build(candidates)`. Both packages are
+// resolved from the APP, never bundled into or depended on by brust, so the compiler is the app's pinned
+// `tailwindcss` (`@tailwindcss/node` depends on its own exact `tailwindcss`; the app installs all three at one
+// version, and a mismatch is a loud warning with the command that aligns them).
+import { readFileSync } from 'node:fs'
+import { dirname, relative } from 'node:path'
+import type { BunPlugin } from 'bun'
+import { BuildError } from './errors'
+
+/** The install set (R33.2): one exact version for all three. */
+export const TAILWIND_PACKAGES = ['tailwindcss', '@tailwindcss/node', '@tailwindcss/oxide'] as const
+
+interface SourceEntry {
+  base: string
+  pattern: string
+  negated: boolean
+}
+interface Compiler {
+  root: 'none' | { base: string; pattern: string } | null
+  sources: SourceEntry[]
+  build(candidates: string[]): string
+}
+interface TailwindNode {
+  compile(css: string, o: { base: string; from?: string; shouldRewriteUrls?: boolean; onDependency: (path: string) => void }): Promise<Compiler>
+}
+interface TailwindOxide {
+  Scanner: new (o: { sources: SourceEntry[] }) => { scan(): string[] }
+}
+
+/** The `version` of `pkg` as resolved from `from` (a directory), or undefined when it does not resolve. */
+function versionFrom(pkg: string, from: string): string | undefined {
+  try {
+    return (JSON.parse(readFileSync(Bun.resolveSync(`${pkg}/package.json`, from), 'utf8')) as { version?: string }).version
+  } catch {
+    return undefined
+  }
+}
+
+/** The versions that decide what compiles (R33.3): the app's `tailwindcss`, the `tailwindcss` that
+ * `@tailwindcss/node` imports (the compiler), and the two integration packages. */
+export function tailwindVersions(appRoot: string): { app?: string; compiler?: string; node?: string; oxide?: string } {
+  let compiler: string | undefined
+  try {
+    compiler = versionFrom('tailwindcss', dirname(Bun.resolveSync('@tailwindcss/node/package.json', appRoot)))
+  } catch {}
+  return { app: versionFrom('tailwindcss', appRoot), compiler, node: versionFrom('@tailwindcss/node', appRoot), oxide: versionFrom('@tailwindcss/oxide', appRoot) }
+}
+
+/** The oldest Tailwind this plugin runs (review F1): 4.0's `compile()` has no `sources` (it takes globs), so its build
+ * would crash mid-way; 4.1.0 is the first with the API the official integrations use today. */
+export const TAILWIND_FLOOR = '4.1.0'
+/** The version brust is tested with (create-app pins the same); the command that lifts an app off an old Tailwind names it. */
+export const TAILWIND_TESTED = '4.3.3'
+
+/** `a < b` for plain `major.minor.patch` versions (a pre-release suffix counts as its base version). */
+export function versionBelow(a: string, b: string): boolean {
+  const n = (v: string) => v.split('-')[0]!.split('.').map((x) => Number(x) || 0)
+  const [x, y] = [n(a), n(b)]
+  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) < (y[i] ?? 0)
+  return false
+}
+
+const addCommand = (v: string) => `bun add -d --exact ${TAILWIND_PACKAGES.map((p) => `${p}@${v}`).join(' ')}`
+
+/** The Tailwind plugin of the CSS build, resolved from the app. Missing packages → `tailwind-missing` with the
+ * exact install command; versions that differ → one warning through `log` with the command that aligns them.
+ * `uses(file)` says whether a stylesheet needs the compiler (it, or a relative `@import` of it, uses Tailwind);
+ * other stylesheets stay Bun's. */
+export async function loadTailwind(appRoot: string, usedBy: string, uses: (file: string) => boolean, log?: (s: string) => void): Promise<BunPlugin> {
+  const v = tailwindVersions(appRoot)
+  const missing = TAILWIND_PACKAGES.filter((p) => versionFrom(p, appRoot) === undefined)
+  if (missing.length > 0)
+    throw new BuildError(
+      'tailwind-missing',
+      `${relative(appRoot, usedBy)} uses Tailwind CSS, but ${missing.join(', ')} ${missing.length > 1 ? 'are' : 'is'} not installed in the app: run \`${v.app ? addCommand(v.app) : `bun add -d ${TAILWIND_PACKAGES.map((p) => `${p}@4`).join(' ')}`}\``,
+    )
+  const old = (
+    [
+      ['tailwindcss', v.app],
+      ['the compiler tailwindcss', v.compiler],
+      ['@tailwindcss/node', v.node],
+      ['@tailwindcss/oxide', v.oxide],
+    ] as const
+  ).filter(([, ver]) => ver !== undefined && versionBelow(ver, TAILWIND_FLOOR))
+  if (old.length > 0)
+    throw new BuildError(
+      'tailwind-version',
+      `${relative(appRoot, usedBy)} uses Tailwind CSS, but ${old.map(([p, ver]) => `${p} ${ver}`).join(', ')} ${old.length > 1 ? 'are' : 'is'} older than ${TAILWIND_FLOOR}, the oldest brust builds with: run \`${addCommand(TAILWIND_TESTED)}\``,
+    )
+  if (new Set([v.app, v.compiler, v.node, v.oxide]).size > 1)
+    log?.(
+      `[brust] warning tailwind-version the app has tailwindcss ${v.app}, but the compiler is tailwindcss ${v.compiler} (@tailwindcss/node ${v.node}, @tailwindcss/oxide ${v.oxide}): install one version of all three: ${addCommand(v.app!)}`,
+    )
+  const node = (await import(Bun.resolveSync('@tailwindcss/node', appRoot))) as TailwindNode
+  const oxide = (await import(Bun.resolveSync('@tailwindcss/oxide', appRoot))) as TailwindOxide
+  return {
+    name: 'brust-tailwind',
+    setup(b) {
+      b.onLoad({ filter: /\.css$/ }, async (a) => {
+        if (!uses(a.path)) return undefined // Bun's own loader (CSS Modules included)
+        const css = readFileSync(a.path, 'utf8')
+        const compiler = await node.compile(css, { base: dirname(a.path), from: a.path, shouldRewriteUrls: true, onDependency: () => {} })
+        const root: SourceEntry[] =
+          compiler.root === 'none' ? [] : compiler.root === null ? [{ base: appRoot, pattern: '**/*', negated: false }] : [{ ...compiler.root, negated: false }]
+        const scanner = new oxide.Scanner({ sources: [...root, ...compiler.sources] })
+        let out = compiler.build(scanner.scan())
+        // `@reference "./app.css"` pulls in Tailwind's license banner too; only the file that imports Tailwind ships it
+        // (one banner per page, as before)
+        if (!/@import\s+(?:url\(\s*)?["']tailwindcss["']/.test(css)) out = out.replace(/\/\*! tailwindcss v[^*]*\*\/\s*/g, '')
+        return { contents: out, loader: 'css' }
+      })
+    },
+  }
+}

package/src/build/tsconfig-paths.ts

@@ -0,0 +1,67 @@
+// `tsconfig` `paths` aliases (shadcn S1, R34.76): `import … from "@/components/ui/button"` is a file of the app. The compiler
+// resolves the specifiers that match an alias to the relative import of the file they name, from root-relative templates
+// this module reads out of the app's own `tsconfig.json` / `jsconfig.json`. v1 reads that one file: no `extends`, no
+// `references` (a named fallback below); exact and single-`*` patterns only. The bundler resolves the same specifiers
+// natively; `checkAliasAgreement` fails the build if the two ever disagree.
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, normalize, relative, sep } from 'node:path'
+import { BuildError } from './errors'
+
+export interface PathAlias {
+  pattern: string
+  targets: string[]
+}
+
+const FILES = ['tsconfig.json', 'jsconfig.json']
+
+/** The aliases of the app's tsconfig, as root-relative `/`-separated templates; `notes` says what was left out and why. */
+export function readPathAliases(appRoot: string): { aliases: PathAlias[]; notes: string[] } {
+  const file = FILES.map((f) => join(appRoot, f)).find((f) => existsSync(f))
+  if (!file) return { aliases: [], notes: [] }
+  let json: { extends?: unknown; references?: unknown; compilerOptions?: { baseUrl?: unknown; paths?: unknown } }
+  try {
+    json = Bun.JSONC.parse(readFileSync(file, 'utf8')) as typeof json
+  } catch {
+    return { aliases: [], notes: [`${relative(appRoot, file)} could not be parsed; its \`paths\` aliases are not followed`] }
+  }
+  const notes: string[] = []
+  const paths = json?.compilerOptions?.paths
+  if (json?.extends !== undefined || json?.references !== undefined)
+    notes.push(
+      `${relative(appRoot, file)} uses \`${json.extends !== undefined ? 'extends' : 'references'}\`, which brust does not follow: \`paths\` aliases written in another tsconfig stay package imports (put \`paths\` in ${relative(appRoot, file)})`,
+    )
+  if (!paths || typeof paths !== 'object') return { aliases: [], notes }
+  const base = typeof json.compilerOptions?.baseUrl === 'string' ? json.compilerOptions.baseUrl : '.'
+  const aliases: PathAlias[] = []
+  for (const [pattern, raw] of Object.entries(paths as Record<string, unknown>)) {
+    const stars = pattern.split('*').length - 1
+    if (stars > 1 || !Array.isArray(raw)) {
+      notes.push(`the \`paths\` pattern "${pattern}" is not an exact or single-\`*\` pattern; it is not followed`)
+      continue
+    }
+    const targets: string[] = []
+    for (const t of raw) {
+      if (typeof t !== 'string' || (t.split('*').length - 1) > 1 || isAbsolute(t)) continue
+      const rel = normalize(join(base, t)).split(sep).join('/')
+      // Outside the app sources, or a package: not a file the compiler reads.
+      if (rel.startsWith('..') || rel.includes('node_modules/')) continue
+      targets.push(rel)
+    }
+    if (targets.length > 0) aliases.push({ pattern, targets })
+  }
+  return { aliases, notes }
+}
+
+/** The compiler's answer for every alias import must be the file the bundler resolves the same specifier to. */
+export function checkAliasAgreement(appRoot: string, imports: { from: string; spec: string; target: string }[]): void {
+  for (const { from, spec, target } of imports) {
+    let got: string
+    try {
+      got = realpathSync(Bun.resolveSync(spec, dirname(join(appRoot, from))))
+    } catch {
+      throw new BuildError('alias-mismatch', `${from}: the compiler resolves "${spec}" to ${target}, but the bundler cannot resolve it (check tsconfig \`paths\`)`)
+    }
+    if (got !== realpathSync(join(appRoot, target)))
+      throw new BuildError('alias-mismatch', `${from}: "${spec}" resolves to ${target} for the compiler but to ${relative(appRoot, got)} for the bundler (tsconfig \`paths\` is read differently); fix the alias or use a relative import`)
+  }
+}

package/src/build-time.ts

@@ -0,0 +1,10 @@
+// `buildTime(() => …)`: the explicit opt-in to evaluate a pure call once, at `brust build` (L2/H1).
+// The compiler recognises the call only when it is imported from `@brust/core`; the closure may be
+// `async` and may use package imports. At runtime (a per-request job, the server) it just runs the
+// closure, so behaviour is identical wherever it is not folded away at build. It is a build error
+// in code that reaches the browser.
+
+/** Runs `fn`. At build the compiler evaluates it once and bakes the result into the template. */
+export function buildTime<T>(fn: () => T): T {
+  return fn()
+}

package/src/cache-adapter/types.ts

@@ -1,4 +1,4 @@
-// The cache adapter contract (docs/design/2026-10-12-cache-adapter-design.md §3.1): a shared second
+// The cache adapter contract (cache adapter design §3.1): a shared second
 // tier behind brust's in-process cache. An adapter has two optional capabilities — a `store` of
 // rendered pages and a `broadcast` of invalidations (push `subscribe` or pull `since`) — so a store
 // without a channel (KV) can be composed with another adapter's broadcast (DO).

package/src/cf.ts

@@ -1,6 +1,9 @@
 // `@brust/core` under the `workerd` export condition (M4-CF, ruling c30e2633): the app-facing API a Worker can run.
 // Same names as `index.ts` minus what needs a host process: no `run`, no `loadConfig`. `cache.invalidate` goes through
 // the CF bundle's napi stub to the runtime the wasm glue installed at start (`server-handlers` `install`).
+export { buildTime } from './build-time'
+export { navigate } from './navigate'
+export type { NavErrorDetail, NavLoadDetail, NavigateOptions, NavSuccessDetail, NavTrigger } from './navigate'
 export { cache } from './cache'
 export type { ComponentCacheOptions, InvalidateArgs, InvalidateResult } from './cache'
 export {
@@ -15,4 +18,4 @@ export {
   Outlet,
   redirect,
 } from './routes'
-export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, Verdict } from './routes'
+export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, RouteSsgConfig, Verdict } from './routes'

package/src/cli.ts

@@ -3,13 +3,16 @@
 // Exit codes: 0 ok, 1 build/boot error (`error <rule> <message>` / `[brust] …`), 2 usage.
 import { parseArgs } from 'node:util'
 import { BuildError, runBuild } from './build'
+import { runBunDev } from './dev/bun'
 import { runDev } from './dev'
 import { run } from './run'
 
 const USAGE = `usage:
-  brust build [entry=routes.tsx] [--out-dir dist] [--force] [--target bun|cloudflare] [--wasm-from-source]
+  brust build [entry=routes.tsx] [--out-dir dist] [--force] [--target bun|cloudflare|static] [--actions-only] [--strict] [--wasm-from-source] [--dev]
+  brust dev [entry=routes.tsx] [--port N] [--workers N]    (Bun target: proxy + hot reload + inline TUI)
   brust dev [entry=routes.tsx] --target cloudflare [--out-dir dist] [--port N] [--wasm-from-source] [-- <wrangler args>]
   brust start [--port N] [--workers N] [--dist-dir dist] [--entry routes.tsx]
+  brust shadcn init [component ...] [--force] [--css <file>] [--base-color <name>] [--shadcn-version <x.y.z>]
 
 Config precedence for start: env (BRUST_ADDR, BRUST_PORT, BRUST_WORKERS, BRUST_RENDER_SLOTS,
 BRUST_DRAIN_TIMEOUT_MS, BRUST_BOOT_TIMEOUT_MS, BRUST_DIST_DIR, BRUST_APP_ENTRY) > flags
@@ -51,8 +54,14 @@ export async function main(argv: string[]): Promise<void> {
         port: { type: 'string' },
         workers: { type: 'string' },
         force: { type: 'boolean' },
+        css: { type: 'string' },
+        'base-color': { type: 'string' },
+        'shadcn-version': { type: 'string' },
+        strict: { type: 'boolean' },
         target: { type: 'string' },
         'wasm-from-source': { type: 'boolean' },
+        'actions-only': { type: 'boolean' },
+        dev: { type: 'boolean' },
         help: { type: 'boolean', short: 'h' },
       },
     })
@@ -66,7 +75,10 @@ export async function main(argv: string[]): Promise<void> {
   }
   const str = (k: string) => values[k] as string | undefined
   const target = str('target')
-  if (target !== undefined && target !== 'bun' && target !== 'cloudflare') usage(`--target must be bun or cloudflare (got ${JSON.stringify(target)})`)
+  if (target !== undefined && target !== 'bun' && target !== 'cloudflare' && target !== 'static')
+    usage(`--target must be bun, cloudflare or static (got ${JSON.stringify(target)})`)
+  if (values['actions-only'] === true && cmd !== 'build') usage('--actions-only only applies to brust build')
+  if (values.strict === true && (cmd !== 'build' || target !== 'static')) usage('--strict only applies to brust build --target static')
 
   if (cmd === 'build') {
     if (positionals.length > 1) usage(`build takes one entry (got ${positionals.join(' ')})`)
@@ -77,8 +89,11 @@ export async function main(argv: string[]): Promise<void> {
         entry: positionals[0] ?? 'routes.tsx',
         outDir: str('out-dir') ?? 'dist',
         force: values.force === true,
-        target: target as 'bun' | 'cloudflare' | undefined,
+        target: target as 'bun' | 'cloudflare' | 'static' | undefined,
+        strict: values.strict === true,
         wasmFromSource: values['wasm-from-source'] === true,
+        actionsOnly: values['actions-only'] === true,
+        dev: values.dev === true,
         log: (s) => console.log(s),
       })
     } catch (e) {
@@ -92,8 +107,12 @@ export async function main(argv: string[]): Promise<void> {
   }
   if (cmd === 'dev') {
     if (positionals.length > 1) usage(`dev takes one entry (got ${positionals.join(' ')})`)
-    if (target !== 'cloudflare') usage('brust dev: only --target cloudflare in this release')
     const port = intFlag('port', str('port'), 0)
+    if (target !== 'cloudflare') {
+      const workers = intFlag('workers', str('workers'), 1)
+      if (passthrough.length > 0) usage('brust dev: arguments after -- are for --target cloudflare (wrangler)')
+      process.exit(await runBunDev({ appRoot: process.cwd(), entry: positionals[0] ?? 'routes.tsx', ...(port !== undefined && { port }), ...(workers !== undefined && { workers }) }))
+    }
     try {
       process.exit(
         await runDev({
@@ -112,6 +131,23 @@ export async function main(argv: string[]): Promise<void> {
       process.exit(1)
     }
   }
+  if (cmd === 'shadcn') {
+    const [sub, ...components] = positionals
+    if (sub !== 'init') usage(`shadcn takes a subcommand: init (got ${sub === undefined ? 'none' : JSON.stringify(sub)})`)
+    // F252: loaded here, so no other command pays for it (it pulls in tsconfig-paths)
+    const { shadcnInit, spawnRunner } = await import('./shadcn/init')
+    const code = await shadcnInit({
+      root: process.cwd(),
+      components,
+      force: values.force === true,
+      ...(str('css') !== undefined && { css: str('css') }),
+      ...(str('base-color') !== undefined && { baseColor: str('base-color') }),
+      ...(str('shadcn-version') !== undefined && { shadcnVersion: str('shadcn-version') }),
+      run: spawnRunner,
+      out: (s) => console.log(s),
+    })
+    process.exit(code)
+  }
   if (cmd === 'start') {
     if (positionals.length > 0) usage(`start takes no positional arguments (got ${positionals.join(' ')})`)
     const port = intFlag('port', str('port'), 0)

package/src/config.ts

@@ -1,14 +1,18 @@
 // Runtime configuration (spec §8). Precedence, high → low:
 //   env (BRUST_ADDR / BRUST_PORT / BRUST_WORKERS / BRUST_RENDER_SLOTS / BRUST_DRAIN_TIMEOUT_MS /
-//        BRUST_BOOT_TIMEOUT_MS / BRUST_CALL_TIMEOUT_MS)
-//   > CLI flags (`brust start --port/--workers`)
-//   > brust.toml ([server] address / port, [workers] count)
-//   > defaults (localhost, 1337, availableParallelism(), 1, 10000, 30000, 30000).
+//        BRUST_BOOT_TIMEOUT_MS / BRUST_CALL_TIMEOUT_MS / BRUST_SLOT_BYTES / BRUST_MAX_LOADER_RESPONSE_BYTES)
+//   > CLI flags (`brust start --port/--workers`) and `run({ config })`
+//   > brust.toml ([server] address / port / max_loader_response_bytes, [workers] count / slot_bytes, [cors], [actions] base_url / credentials)
+//   > defaults (localhost, 1337, availableParallelism(), 1, 10000, 30000, 30000, 262144, 8388608).
+// L16 R16.1: `actionsBaseUrl` follows env (BRUST_ACTIONS_BASE_URL) > run({ config }) > toml `[actions] base_url`.
+// `cors` has no env layer; `run({ config: { cors } })` replaces a toml `[cors]` as a whole (never merged), and
+// `cors: null` turns a toml `[cors]` off.
 // `brust start`'s BRUST_DIST_DIR / BRUST_APP_ENTRY follow the same env > flag rule (run.ts).
 // A missing brust.toml is fine; a present one with the wrong shape is an error. Messages follow
 // 0.1.x `runtime/config.ts`.
 import { availableParallelism } from 'node:os'
 import { join } from 'node:path'
+import { ACTION_CREDENTIALS, type ActionCredentials, baseUrlError } from './actions/prefix'
 
 /** `[cors]` in brust.toml; same shape and validation as the Rust `CorsConfig` (crates/brust-server/src/config.rs). */
 export interface CorsConfig {
@@ -32,10 +36,22 @@ export interface BrustConfig {
   callTimeoutMs: number
   /** tokio threads of the HTTP runtime (renders every page); absent = one per core (server default). */
   ioThreads?: number
-  /** From brust.toml `[cors]` only (runtime config: no env / CLI layer); absent = CORS off. */
+  /** The SAB response slot of one render slot, bytes (`slot_bytes`, env BRUST_SLOT_BYTES); 64 KiB..16 MiB. */
+  slotBytes: number
+  /** The biggest loader/jobs reply that crosses by heap when it does not fit the slot (`max_loader_response_bytes`,
+   * env BRUST_MAX_LOADER_RESPONSE_BYTES); 256 KiB..64 MiB. */
+  maxLoaderResponseBytes: number
+  /** `run({ config: { cors } })` over brust.toml `[cors]` (a whole-object replace); absent = CORS off. No env layer. */
   cors?: CorsConfig
+  /** L16 R16.1: the origin the browser `client()` calls (page script `__BRUST_ACTION_BASE__`); absent = same origin. */
+  actionsBaseUrl?: string
+  /** L16 R16.2: the client's default `RequestInit.credentials` (`__BRUST_ACTION_CREDENTIALS__`); absent = `same-origin`. */
+  actionsCredentials?: ActionCredentials
 }
 
+/** What `run({ config })` / `loadConfig`'s `cli` accepts: any setting, and `cors: null` to turn a toml `[cors]` off. */
+export type ConfigOverrides = Omit<Partial<BrustConfig>, 'cors'> & { cors?: (Omit<CorsConfig, 'credentials'> & { credentials?: boolean }) | null }
+
 export class BrustConfigError extends Error {
   override name = 'BrustConfigError'
   constructor(
@@ -46,11 +62,11 @@ export class BrustConfigError extends Error {
   }
 }
 
-const DEFAULTS = { host: 'localhost', port: 1337, drainTimeoutMs: 10_000, bootTimeoutMs: 30_000, callTimeoutMs: 30_000 }
+const DEFAULTS = { host: 'localhost', port: 1337, drainTimeoutMs: 10_000, bootTimeoutMs: 30_000, callTimeoutMs: 30_000, slotBytes: 256 * 1024, maxLoaderResponseBytes: 8_388_608 }
 
 /** Ceilings: ms values cross napi as `u32` (a larger number would wrap), more than 1024 Bun
- * workers is a misconfiguration, not a deployment, and each render slot is a 256 KiB shared
- * response buffer per worker (more than 64 would only exhaust memory). */
+ * workers is a misconfiguration, not a deployment, and each render slot is a `slotBytes` (default 256 KiB)
+ * shared response buffer per worker (more than 64 would only exhaust memory). */
 export const MAX_MS = 0xffff_ffff
 /** `max_age_seconds` crosses napi as `u32`, like the ms values. */
 const MAX_U32 = 0xffff_ffff
@@ -58,8 +74,14 @@ const MAX_U32 = 0xffff_ffff
 export const MAX_IO_THREADS = 256
 export const MAX_WORKERS = 1024
 export const MAX_RENDER_SLOTS = 64
+/** `slotBytes` (L10): 64 KiB..16 MiB. */
+export const MIN_SLOT_BYTES = 64 * 1024
+export const MAX_SLOT_BYTES = 16 * 1024 * 1024
+/** `maxLoaderResponseBytes` (L10): 256 KiB..64 MiB, like the actions limits. */
+export const MIN_LOADER_RESPONSE_BYTES = 256 * 1024
+export const MAX_LOADER_RESPONSE_BYTES = 64 * 1024 * 1024
 
-export async function loadConfig(cwd: string = process.cwd(), cli: Partial<BrustConfig> = {}): Promise<BrustConfig> {
+export async function loadConfig(cwd: string = process.cwd(), cli: ConfigOverrides = {}): Promise<BrustConfig> {
   const tomlPath = join(cwd, 'brust.toml')
   let fromToml: Partial<BrustConfig> = {}
   const file = Bun.file(tomlPath)
@@ -75,6 +97,8 @@ export async function loadConfig(cwd: string = process.cwd(), cli: Partial<Brust
   }
   const env = fromEnv()
   checkCli(cli)
+  // cli (validated, normalised) over toml as a whole object (R10.2); `null` = off.
+  const cors = cli.cors === undefined ? fromToml.cors : cli.cors === null ? undefined : checkCors(cli.cors, 'config.cors', null, false)
   return {
     host: env.host ?? cli.host ?? fromToml.host ?? DEFAULTS.host,
     port: env.port ?? cli.port ?? fromToml.port ?? DEFAULTS.port,
@@ -84,11 +108,17 @@ export async function loadConfig(cwd: string = process.cwd(), cli: Partial<Brust
     drainTimeoutMs: env.drainTimeoutMs ?? cli.drainTimeoutMs ?? DEFAULTS.drainTimeoutMs,
     bootTimeoutMs: env.bootTimeoutMs ?? cli.bootTimeoutMs ?? DEFAULTS.bootTimeoutMs,
     callTimeoutMs: env.callTimeoutMs ?? cli.callTimeoutMs ?? DEFAULTS.callTimeoutMs,
+    slotBytes: env.slotBytes ?? cli.slotBytes ?? fromToml.slotBytes ?? DEFAULTS.slotBytes,
+    maxLoaderResponseBytes: env.maxLoaderResponseBytes ?? cli.maxLoaderResponseBytes ?? fromToml.maxLoaderResponseBytes ?? DEFAULTS.maxLoaderResponseBytes,
     ioThreads: env.ioThreads ?? cli.ioThreads,
-    ...(fromToml.cors !== undefined ? { cors: fromToml.cors } : {}),
+    ...(cors ? { cors } : {}),
+    ...pick('actionsBaseUrl', env.actionsBaseUrl ?? cli.actionsBaseUrl ?? fromToml.actionsBaseUrl),
+    ...pick('actionsCredentials', cli.actionsCredentials ?? fromToml.actionsCredentials),
   }
 }
 
+const pick = <K extends string, V>(k: K, v: V | undefined) => (v === undefined ? {} : ({ [k]: v } as { [P in K]: V }))
+
 /** `[cors]` of brust.toml and nothing else (no env, no cli): what the Cloudflare build ships in CONFIG.
  * Throws `BrustConfigError` on a bad table, exactly like `loadConfig`. */
 export async function loadCors(cwd: string): Promise<CorsConfig | undefined> {
@@ -106,7 +136,7 @@ export async function loadCors(cwd: string): Promise<CorsConfig | undefined> {
 }
 
 /** CLI / programmatic overrides get the same bounds as env (a CLI `--port 0` = any free port). */
-function checkCli(cli: Partial<BrustConfig>): void {
+function checkCli(cli: ConfigOverrides): void {
   const check = (name: string, v: number | undefined, min: number, max: number) => {
     if (v !== undefined && (!Number.isInteger(v) || v < min || v > max))
       throw new BrustConfigError(`${name} must be an integer in ${min}..${max} (got ${JSON.stringify(v)})`, null)
@@ -118,6 +148,14 @@ function checkCli(cli: Partial<BrustConfig>): void {
   check('bootTimeoutMs', cli.bootTimeoutMs, 1, MAX_MS)
   check('callTimeoutMs', cli.callTimeoutMs, 1, MAX_MS)
   check('ioThreads', cli.ioThreads, 1, MAX_IO_THREADS)
+  check('slotBytes', cli.slotBytes, MIN_SLOT_BYTES, MAX_SLOT_BYTES)
+  check('maxLoaderResponseBytes', cli.maxLoaderResponseBytes, MIN_LOADER_RESPONSE_BYTES, MAX_LOADER_RESPONSE_BYTES)
+  if (cli.actionsBaseUrl !== undefined) {
+    const why = baseUrlError(cli.actionsBaseUrl)
+    if (why) throw new BrustConfigError(`config.actionsBaseUrl ${why}`, null)
+  }
+  if (cli.actionsCredentials !== undefined && !ACTION_CREDENTIALS.includes(cli.actionsCredentials))
+    throw new BrustConfigError(`config.actionsCredentials must be one of ${ACTION_CREDENTIALS.join(', ')} (got ${JSON.stringify(cli.actionsCredentials)})`, null)
 }
 
 function table(v: unknown, what: string, file: string): Record<string, unknown> {
@@ -125,12 +163,21 @@ function table(v: unknown, what: string, file: string): Record<string, unknown>
   return v as Record<string, unknown>
 }
 
+function tomlInt(v: unknown, name: string, min: number, max: number, file: string): number | undefined {
+  if (v === undefined) return undefined
+  if (typeof v !== 'number' || !Number.isInteger(v) || v < min || v > max)
+    throw new BrustConfigError(`${file}: ${name} must be an integer in ${min}..${max} (got ${JSON.stringify(v)})`, file)
+  return v
+}
+
 function fromTomlTable(parsed: unknown, file: string): Partial<BrustConfig> {
   const root = table(parsed, 'top level', file)
   const out: Partial<BrustConfig> = {}
   if ('server' in root) {
     const server = table(root.server, '[server]', file)
     const { port, address } = server
+    const cap = tomlInt(server.max_loader_response_bytes, 'server.max_loader_response_bytes', MIN_LOADER_RESPONSE_BYTES, MAX_LOADER_RESPONSE_BYTES, file)
+    if (cap !== undefined) out.maxLoaderResponseBytes = cap
     if (port !== undefined) {
       if (typeof port !== 'number' || !Number.isInteger(port) || port < 1 || port > 65535)
         throw new BrustConfigError(`${file}: server.port must be an integer in 1..65535 (got ${JSON.stringify(port)})`, file)
@@ -143,7 +190,10 @@ function fromTomlTable(parsed: unknown, file: string): Partial<BrustConfig> {
     }
   }
   if ('workers' in root) {
-    const { count } = table(root.workers, '[workers]', file)
+    const w = table(root.workers, '[workers]', file)
+    const { count } = w
+    const slot = tomlInt(w.slot_bytes, 'workers.slot_bytes', MIN_SLOT_BYTES, MAX_SLOT_BYTES, file)
+    if (slot !== undefined) out.slotBytes = slot
     if (count !== undefined) {
       if (typeof count !== 'number' || !Number.isInteger(count) || count < 1 || count > MAX_WORKERS)
         throw new BrustConfigError(`${file}: workers.count must be an integer in 1..${MAX_WORKERS} (got ${JSON.stringify(count)})`, file)
@@ -151,34 +201,62 @@ function fromTomlTable(parsed: unknown, file: string): Partial<BrustConfig> {
     }
   }
   if ('cors' in root) out.cors = parseCors(root.cors, file)
+  if ('actions' in root) {
+    const a = table(root.actions, '[actions]', file)
+    if (a.base_url !== undefined) {
+      const why = baseUrlError(a.base_url)
+      if (why) throw new BrustConfigError(`${file}: actions.base_url ${why}`, file)
+      out.actionsBaseUrl = a.base_url as string
+    }
+    if (a.credentials !== undefined) {
+      if (typeof a.credentials !== 'string' || !ACTION_CREDENTIALS.includes(a.credentials as ActionCredentials))
+        throw new BrustConfigError(`${file}: actions.credentials must be one of ${ACTION_CREDENTIALS.join(', ')} (got ${JSON.stringify(a.credentials)})`, file)
+      out.actionsCredentials = a.credentials as ActionCredentials
+    }
+  }
   return out
 }
 
 function parseCors(v: unknown, file: string): CorsConfig {
-  const t = table(v, 'cors', file)
+  return checkCors(corsFromToml(table(v, 'cors', file)), `${file}: cors`, file, true)
+}
+
+/** brust.toml `[cors]` (snake_case keys) → the camelCase shape [`checkCors`] validates. Unknown toml keys are ignored, as always. */
+function corsFromToml(t: Record<string, unknown>): Record<string, unknown> {
+  return { origins: t.origins, methods: t.methods, headers: t.headers, exposeHeaders: t.expose_headers, credentials: t.credentials, maxAgeSeconds: t.max_age_seconds }
+}
+
+const CORS_KEYS = ['origins', 'methods', 'headers', 'exposeHeaders', 'credentials', 'maxAgeSeconds']
+
+/** The one `[cors]` validator (Rust `CorsConfig::validate`, verbatim), for toml (`where` = `<file>: cors`, key names in
+ * snake_case) and for `run({ config: { cors } })` (`where` = `config.cors`, camelCase; an unknown key is an error). */
+function checkCors(c: unknown, where: string, file: string | null, snake: boolean): CorsConfig {
+  const fail = (m: string) => new BrustConfigError(m, file)
+  if (c === null || typeof c !== 'object' || Array.isArray(c)) throw fail(`${where} must be ${file === null ? 'an object (or null)' : 'a table'} (got ${JSON.stringify(c)})`)
+  const t = c as Record<string, unknown>
+  if (!snake) {
+    const bad = Object.keys(t).find((k) => !CORS_KEYS.includes(k))
+    if (bad !== undefined) throw fail(`${where}.${bad} is not a cors option (expected ${CORS_KEYS.join(', ')})`)
+  }
+  const name = (k: string) => (snake ? k.replace(/[A-Z]/g, (m) => `_${m.toLowerCase()}`) : k)
   const strings = (val: unknown, key: string): string[] | undefined => {
     if (val === undefined) return undefined
-    if (!Array.isArray(val) || val.some((x) => typeof x !== 'string'))
-      throw new BrustConfigError(`${file}: cors.${key} must be an array of strings (got ${JSON.stringify(val)})`, file)
+    if (!Array.isArray(val) || val.some((x) => typeof x !== 'string')) throw fail(`${where}.${name(key)} must be an array of strings (got ${JSON.stringify(val)})`)
     return val as string[]
   }
   const origins = strings(t.origins, 'origins') ?? []
   const methods = strings(t.methods, 'methods')
   const headers = strings(t.headers, 'headers')
-  const exposeHeaders = strings(t.expose_headers, 'expose_headers')
-  if (t.credentials !== undefined && typeof t.credentials !== 'boolean')
-    throw new BrustConfigError(`${file}: cors.credentials must be a boolean (got ${JSON.stringify(t.credentials)})`, file)
+  const exposeHeaders = strings(t.exposeHeaders, 'exposeHeaders')
+  if (t.credentials !== undefined && typeof t.credentials !== 'boolean') throw fail(`${where}.credentials must be a boolean (got ${JSON.stringify(t.credentials)})`)
   const credentials = t.credentials === true
-  const age = t.max_age_seconds
+  const age = t.maxAgeSeconds
   if (age !== undefined && (typeof age !== 'number' || !Number.isInteger(age) || age < 0 || age > MAX_U32))
-    throw new BrustConfigError(`${file}: cors.max_age_seconds must be an integer in 0..${MAX_U32} (got ${JSON.stringify(age)})`, file)
+    throw fail(`${where}.${name('maxAgeSeconds')} must be an integer in 0..${MAX_U32} (got ${JSON.stringify(age)})`)
   // Rust CorsConfig::validate, verbatim.
-  if (origins.length === 0) throw new BrustConfigError(`${file}: cors.origins must be non-empty`, file)
+  if (origins.length === 0) throw fail(`${where}.origins must be non-empty`)
   if (credentials && origins.includes('*'))
-    throw new BrustConfigError(
-      `${file}: cors.credentials cannot be combined with a wildcard origin '*' (browsers reject Access-Control-Allow-Origin: * with credentials); list explicit origins instead`,
-      file,
-    )
+    throw fail(`${where}.credentials cannot be combined with a wildcard origin '*' (browsers reject Access-Control-Allow-Origin: * with credentials); list explicit origins instead`)
   return {
     origins,
     ...(methods ? { methods } : {}),
@@ -211,6 +289,14 @@ function fromEnv(): Partial<BrustConfig> {
   out.drainTimeoutMs = envInt('BRUST_DRAIN_TIMEOUT_MS', 0, MAX_MS, `an integer in 0..${MAX_MS}`)
   out.bootTimeoutMs = envInt('BRUST_BOOT_TIMEOUT_MS', 1, MAX_MS, `an integer in 1..${MAX_MS}`)
   out.callTimeoutMs = envInt('BRUST_CALL_TIMEOUT_MS', 1, MAX_MS, `an integer in 1..${MAX_MS}`)
+  out.slotBytes = envInt('BRUST_SLOT_BYTES', MIN_SLOT_BYTES, MAX_SLOT_BYTES, `an integer in ${MIN_SLOT_BYTES}..${MAX_SLOT_BYTES}`)
+  out.maxLoaderResponseBytes = envInt('BRUST_MAX_LOADER_RESPONSE_BYTES', MIN_LOADER_RESPONSE_BYTES, MAX_LOADER_RESPONSE_BYTES, `an integer in ${MIN_LOADER_RESPONSE_BYTES}..${MAX_LOADER_RESPONSE_BYTES}`)
   out.ioThreads = envInt('BRUST_WORKER_THREADS', 1, MAX_IO_THREADS, `an integer in 1..${MAX_IO_THREADS}`)
+  const base = process.env.BRUST_ACTIONS_BASE_URL
+  if (base !== undefined && base !== '') {
+    const why = baseUrlError(base)
+    if (why) throw new BrustConfigError(`BRUST_ACTIONS_BASE_URL ${why}`, null)
+    out.actionsBaseUrl = base
+  }
   return out
 }

package/src/css-modules.d.ts

@@ -0,0 +1,8 @@
+// L19 (R19.4): a `.module.css` import is its class map (the build's `cssPlugin`); any other `.css`
+// import is a side-effect import the server links (R19.3). Pulled in by a `/// <reference>` from the
+// entries apps import, so both forms typecheck.
+declare module '*.module.css' {
+  const classes: { readonly [name: string]: string }
+  export default classes
+}
+declare module '*.css' {}