@brust/core 2.0.0-alpha.3 → 2.0.0-alpha.31

package/package.json

@@ -1,11 +1,16 @@
 {
   "name": "@brust/core",
-  "version": "2.0.0-alpha.3",
+  "version": "2.0.0-alpha.31",
   "description": "brust v2 — React components compiled to Rust-rendered templates",
   "license": "MIT",
+  "homepage": "https://brust.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/AssetsArt/brust.git"
+    "url": "git+https://github.com/AssetsArt/brust.git",
+    "directory": "packages/brust"
+  },
+  "bugs": {
+    "url": "https://github.com/AssetsArt/brust/issues"
   },
   "type": "module",
   "bin": {
@@ -17,6 +22,7 @@
       "browser": "./src/browser.ts",
       "default": "./src/index.ts"
     },
+    "./build-time": "./src/build-time.ts",
     "./routes": "./src/routes.ts",
     "./server": "./src/server.ts",
     "./server-handlers": "./src/server-handlers.ts",
@@ -25,6 +31,7 @@
     "./cache-adapter/conformance": "./src/cache-adapter/conformance.ts",
     "./store": "./src/store/index.ts",
     "./store/react": "./src/store/react.ts",
+    "./navigation": "./src/navigation.ts",
     "./elysia": "./src/actions/elysia.ts",
     "./client": "./src/actions/client.ts",
     "./native": "./native/index.js"
@@ -49,13 +56,14 @@
     ]
   },
   "dependencies": {
-    "@brust/runtime-dom": "2.0.0-alpha.3"
+    "@brust/runtime-dom": "2.0.0-alpha.31",
+    "tsconfig-paths": "4.2.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "elysia": "2.0.0-beta.30",
-    "@elysia/eden": "2.0.0-beta.6"
+    "elysia": "^2.0.0-rc.0",
+    "@elysia/eden": "^2.0.0-rc.0"
   },
   "peerDependenciesMeta": {
     "elysia": {
@@ -66,11 +74,17 @@
     }
   },
   "devDependencies": {
-    "@elysia/eden": "2.0.0-beta.6",
+    "@elysia/eden": "2.0.0-rc.0",
     "@napi-rs/cli": "^3.0.0",
-    "@types/bun": "^1.4.0",
+    "@radix-ui/react-collection": "1.2.0",
+    "@radix-ui/react-id": "1.1.4",
+    "@radix-ui/react-use-layout-effect": "1.1.4",
+    "@radix-ui/react-presence": "1.1.11",
+    "@radix-ui/react-slot": "1.5.0",
+    "@types/bun": "^1.4.4",
     "@types/react": "^19.2.0",
-    "elysia": "2.0.0-beta.30",
+    "elysia": "2.0.0-rc.0",
+    "lucide-react": "1.55.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "typescript": "^7.0.2"
@@ -86,12 +100,12 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@brust/native-darwin-x64": "2.0.0-alpha.3",
-    "@brust/native-darwin-arm64": "2.0.0-alpha.3",
-    "@brust/native-linux-x64-gnu": "2.0.0-alpha.3",
-    "@brust/native-linux-arm64-gnu": "2.0.0-alpha.3",
-    "@brust/native-linux-x64-musl": "2.0.0-alpha.3",
-    "@brust/native-linux-arm64-musl": "2.0.0-alpha.3",
-    "@brust/core-cf": "2.0.0-alpha.3"
+    "@brust/native-darwin-x64": "2.0.0-alpha.31",
+    "@brust/native-darwin-arm64": "2.0.0-alpha.31",
+    "@brust/native-linux-x64-gnu": "2.0.0-alpha.31",
+    "@brust/native-linux-arm64-gnu": "2.0.0-alpha.31",
+    "@brust/native-linux-x64-musl": "2.0.0-alpha.31",
+    "@brust/native-linux-arm64-musl": "2.0.0-alpha.31",
+    "@brust/core-cf": "2.0.0-alpha.31"
   }
 }

package/src/actions/client.ts

@@ -2,11 +2,21 @@
 // elysia is type-only here. Differences from 0.1.x runtime/treaty.ts: docs/actions.md "The client".
 import { type Treaty, treaty } from '@elysia/eden/treaty2'
 import type { AnyElysia } from 'elysia'
-import { DEFAULT_ACTION_PREFIX } from './prefix'
+import { clearNavigationCache } from '../navigate-browser'
+import { type ActionCredentials, DEFAULT_ACTION_PREFIX } from './prefix'
 
 export { DEFAULT_ACTION_PREFIX }
 export type { Treaty }
 
+/** One link of the request chain (F471). `next` sends `req` (or a request you build from it) to the next link, or to
+ * the transport after the last one. Call it zero times (answer yourself), once, or many times (renew a token, then
+ * send the same request again). Every `next(r)` sends its own copy of `r`: `r` itself is never consumed, so a
+ * retry sends the same body again. Read a body through `req.clone()`. */
+export type ActionMiddleware = (
+  req: Request,
+  next: (req: Request) => Promise<Response>,
+) => Promise<Response> | Response
+
 export interface ClientOptions<Head extends Record<string, unknown> = {}>
   extends Omit<Treaty.Config<Head>, 'keepDomain' | 'fetcher' | 'fetch'> {
   /** Mount point of the actions app. Default: see resolvePrefix. */
@@ -17,9 +27,22 @@ export interface ClientOptions<Head extends Record<string, unknown> = {}>
   fetch?: typeof fetch
   /** RequestInit defaults for every call (Eden's `fetch` option), e.g. `{ credentials: 'include' }`. */
   init?: Treaty.Config<Head>['fetch']
+  /** F471: links between Eden and the transport; `middleware[0]` is the outermost. They see the request Eden built
+   * (URL, body, `headers`, `onRequest`) and return the Response Eden parses. A throw is a network failure (503). */
+  middleware?: ActionMiddleware[]
+}
+
+interface PageGlobals {
+  __BRUST_ACTION_PREFIX__?: string
+  /** L16 R16.1: injected from `[actions] base_url` / BRUST_ACTIONS_BASE_URL / run({ config: { actionsBaseUrl } }). */
+  __BRUST_ACTION_BASE__?: string
+  /** L16 R16.2: injected from `[actions] credentials`. */
+  __BRUST_ACTION_CREDENTIALS__?: ActionCredentials
 }
+const page = () => globalThis as PageGlobals
 
-/** 0.1.x runtime/treaty.ts:86-93, verbatim order. */
+/** 0.1.x runtime/treaty.ts:86-93, verbatim order. A per-call `baseUrl` keeps the default prefix; a base that comes
+ * from the page global (L16) pairs with the page's injected prefix, both being the same deployment's config. */
 export function resolvePrefix(opts?: { prefix?: string; baseUrl?: string }): string {
   if (opts?.prefix) return opts.prefix
   if (opts?.baseUrl !== undefined) return DEFAULT_ACTION_PREFIX
@@ -31,7 +54,8 @@ export function resolvePrefix(opts?: { prefix?: string; baseUrl?: string }): str
 
 /** 0.1.x runtime/treaty.ts:95-106; message names `client`. */
 export function resolveBaseUrl(opts?: { baseUrl?: string }): string {
-  const b = opts?.baseUrl
+  // R16.1 order: opts.baseUrl, the page's __BRUST_ACTION_BASE__, relative.
+  const b = opts?.baseUrl ?? page().__BRUST_ACTION_BASE__
   if (b === undefined) return ''
   if (!/^https?:\/\//.test(b))
     throw new Error(
@@ -43,12 +67,34 @@ export function resolveBaseUrl(opts?: { baseUrl?: string }): string {
 export function client<const App extends AnyElysia, Head extends Record<string, unknown> = {}>(
   opts: ClientOptions<Head> = {},
 ): Treaty.Instance<App, Head> {
-  const { prefix: _p, baseUrl: _b, fetch: fetcher, init, ...rest } = opts
+  const { prefix: _p, baseUrl: _b, fetch: fetcher, init, middleware, ...rest } = opts
+  // R16.2: the page's credentials default (`opts.init` wins); only when it differs from the browser default.
+  const creds = page().__BRUST_ACTION_CREDENTIALS__
+  const defaults = creds !== undefined && creds !== 'same-origin' && typeof init !== 'function' ? { credentials: creds } : undefined
   // keepDomain: Eden would rewrite a relative base to `https:///…` (probe kd.ts).
-  return treaty<App, Head>(resolveBaseUrl(opts) + resolvePrefix(opts), {
+  // The root prefix (an actions-only deployment) adds nothing to the base: `https://api.example.com/team`, not `//team`.
+  const base = resolveBaseUrl(opts)
+  const prefix = resolvePrefix(opts)
+  // SPA navigation design §10.1: a mutation clears the page cache, so no page read after it is served from before it
+  const transport = async (url: RequestInfo | URL, req?: RequestInit) => {
+    const res = await (fetcher ?? fetch)(url, req)
+    if (!/^(GET|HEAD)$/i.test(req?.method ?? (url instanceof Request ? url.method : 'GET'))) clearNavigationCache()
+    return res
+  }
+  // F471: Eden calls `send(url, init)`; the chain works on a Request. `next` clones what it is given, so the caller's
+  // request stays unread and can be sent again.
+  const chain = middleware?.length ? middleware : undefined
+  const send = (chain
+    ? async (url: RequestInfo | URL, init?: RequestInit) => {
+        const run = (i: number, req: Request): Promise<Response> =>
+          i < chain.length ? Promise.resolve(chain[i]!(req, (r) => run(i + 1, r.clone()))) : transport(req)
+        return run(0, new Request(url, init))
+      }
+    : transport) as typeof fetch
+  return treaty<App, Head>(base !== '' && prefix === '/' ? base : base + prefix, {
     ...rest,
     keepDomain: true,
-    ...(fetcher ? { fetcher } : {}),
-    ...(init ? { fetch: init } : {}),
+    fetcher: send,
+    ...(init || defaults ? { fetch: typeof init === 'function' ? init : { ...defaults, ...init } } : {}),
   })
 }

package/src/actions/elysia.ts

@@ -1,5 +1,5 @@
 // `@brust/core/elysia` (M3-F E2, ruling R2): the adapter an actions app is built with. Rust owns
-// HTTP; the worker drives the app with `app.fetch(request)`. Elysia 2.0.0-beta.30's adapter is
+// HTTP; the worker drives the app with `app.fetch(request)`. Elysia 2.0.0-rc.0's adapter is
 // `{ listen?, parse, response, setup? }` (elysia/adapter/types.d.ts); `name` is brust's own tag.
 import type { ElysiaAdapter } from 'elysia/adapter'
 import { WebStandardAdapter } from 'elysia/adapter/web-standard'

package/src/actions/load.ts

@@ -14,9 +14,90 @@ export function mountActions(app: unknown, prefix: string, what = 'actions entry
     throw new Error(
       `${what}: build the app with new Elysia({ adapter: brust() }) — import { brust } from '@brust/core/elysia'`,
     )
-  return new Elysia({ adapter: brust(), prefix }).use(app)
+  // L16 R16.4: the root prefix of an actions-only build is no prefix at all (`prefix: '/'` would double the slash).
+  return new Elysia({ adapter: brust(), ...(prefix === '/' ? {} : { prefix }) }).use(app)
 }
 
 export async function loadActionsApp(file: string, prefix: string): Promise<AnyElysia> {
   return mountActions((await import(file)).default, prefix, file)
 }
+
+/** One path segment of each side matches the other: equal, or either is a parameter (`:x`, `{x}`, `*`). */
+const segMatch = (a: string, b: string) => a === b || /^(:|\{|\*)/.test(a) || /^(:|\{|\*)/.test(b)
+
+/**
+ * F470: the GET actions a page or loader route under the prefix shadows (a GET there is the route's), as
+ * `GET <action path> (route <pattern>)`. Best effort, for a boot warning: segments compared, a parameter matches any.
+ */
+export function shadowedGetActions(app: AnyElysia, patterns: string[], prefix: string): string[] {
+  const under = patterns.filter((p) => p.startsWith(`${prefix}/`))
+  const out: string[] = []
+  for (const r of app.routes) {
+    if (r.method !== 'GET') continue
+    const a = r.path.split('/')
+    const hit = under.find((p) => {
+      const b = p.split('/')
+      return a.length === b.length && a.every((s, i) => segMatch(s, b[i]!))
+    })
+    if (hit) out.push(`GET ${r.path} (route ${hit})`)
+  }
+  return out
+}
+
+/** F475: the route parses nothing (`{ parse: 'none' }`): Elysia 2 keeps `'none'`, Elysia 1 kept `[{ fn: 'none' }]`. */
+function parsesNone(r: { hooks?: unknown }): boolean {
+  const p = (r.hooks as { parse?: unknown } | undefined)?.parse
+  const none = (x: unknown) => x === 'none' || (x as { fn?: unknown } | null)?.fn === 'none'
+  return Array.isArray(p) ? p.some(none) : none(p)
+}
+
+/** Same route path: segments equal, a parameter (`:x`, `{x}`) matches a parameter, `*` matches `*`. */
+function samePath(a: string, b: string): boolean {
+  const x = a.split('/')
+  const y = b.split('/')
+  const param = (s: string) => /^(:|\{)/.test(s)
+  return x.length === y.length && x.every((s, i) => s === y[i] || (param(s) && param(y[i]!)))
+}
+
+const STREAM_METHODS = new Set(['POST', 'PUT', 'PATCH'])
+/** A route answers `method`: its own, or every method (Elysia 2's `.all()` registers `*`; `ALL` too). */
+const answers = (route: string, method: string) => route === method || route === 'ALL' || route === '*'
+
+/** Could one request path match both `listed` (a stream entry, prefix included) and `route` (an Elysia path)? A
+ * parameter on either side matches any one segment; a final `*` on either side matches one or more. */
+function overlaps(listed: string, route: string): boolean {
+  const a = listed.split('/')
+  const b = route.split('/')
+  const param = (s: string) => /^(:|\{)/.test(s)
+  for (let i = 0; ; i++) {
+    const x = a[i]
+    const y = b[i]
+    if (x === undefined || y === undefined) return x === y
+    if ((x === '*' && i === a.length - 1) || (y === '*' && i === b.length - 1)) return x !== '' && y !== ''
+    if (x !== y && !param(x) && !param(y)) return false
+  }
+}
+
+/**
+ * F475: `[actions] stream` against the app. `missing`: listed entries with no `{ parse: 'none' }` route of that method and
+ * path. `parsed`: routes that parse their body although a listed entry can match their path (a static route under a
+ * `:param` or `*` entry). Both fail boot: Rust would stream those bodies up to `max_stream_bytes` into a route that parses
+ * them whole, past `max_body_bytes`. `unlisted`: `{ parse: 'none' }` POST/PUT/PATCH routes not on the list (their bodies
+ * stay buffered, capped at `max_body_bytes`).
+ */
+export function streamRouteCheck(app: AnyElysia, entries: string[], prefix: string): { missing: string[]; parsed: string[]; unlisted: string[] } {
+  const full = (p: string) => (prefix === '/' ? p : p === '/' ? prefix : prefix + p)
+  const listed = entries.map((e) => {
+    const [m, p] = e.trim().split(/ +/)
+    return { entry: e, method: m!.toUpperCase(), path: full(p!) }
+  })
+  const routes = app.routes.map((r) => ({ method: r.method.toUpperCase(), path: r.path, none: parsesNone(r) }))
+  const missing = listed.filter((l) => !routes.some((r) => r.none && answers(r.method, l.method) && samePath(r.path, l.path))).map((l) => l.entry)
+  const parsed = routes
+    .filter((r) => !r.none && listed.some((l) => answers(r.method, l.method) && overlaps(l.path, r.path)))
+    .map((r) => `${r.method} ${r.path}`)
+  const unlisted = routes
+    .filter((r) => r.none && (STREAM_METHODS.has(r.method) || answers(r.method, '')) && !listed.some((l) => answers(r.method, l.method) && samePath(r.path, l.path)))
+    .map((r) => `${r.method} ${r.path}`)
+  return { missing, parsed, unlisted }
+}

package/src/actions/prefix.ts

@@ -3,10 +3,17 @@ export const DEFAULT_ACTION_PREFIX = '/_brust/action'
 export const DEFAULT_MAX_BODY_BYTES = 1_048_576
 export const DEFAULT_MAX_RESPONSE_BYTES = 8_388_608
 export const MAX_ACTION_BYTES = 67_108_864
+/** F475: `max_stream_bytes` default (256 MiB) and hard max (4 GiB); `stream_idle_ms` / `stream_total_ms` defaults. */
+export const DEFAULT_MAX_STREAM_BYTES = 268_435_456
+export const MAX_STREAM_BYTES = 4_294_967_296
+export const DEFAULT_STREAM_IDLE_MS = 30_000
+export const DEFAULT_STREAM_TOTAL_MS = 900_000
 const SEG = /^[A-Za-z0-9._~-]+$/
 
-/** Why `p` cannot be the actions prefix, or null. Segment-safe like the server's match. */
-export function prefixError(p: unknown): string | null {
+/** Why `p` cannot be the actions prefix, or null. Segment-safe like the server's match. `root`: an actions-only
+ * build (L16 R16.4) may mount at `/`; a normal build never may (its page routes would be unreachable). */
+export function prefixError(p: unknown, root = false): string | null {
+  if (root && p === '/') return null
   if (typeof p !== 'string' || !p.startsWith('/') || p.length < 2 || p.endsWith('/'))
     return `must start with '/', be longer than '/' and have no trailing '/' (got ${JSON.stringify(p)})`
   const segs = p.slice(1).split('/')
@@ -21,3 +28,38 @@ export function prefixError(p: unknown): string | null {
     return `${p} is reserved for the server's own /_brust/ paths`
   return null
 }
+
+/** L16 R16.1: `base_url` is an absolute http(s) origin: scheme, host, optional port; no path, query, fragment or userinfo. */
+export function baseUrlError(v: unknown): string | null {
+  if (typeof v !== 'string' || !/^https?:\/\//.test(v))
+    return `must be an absolute http(s) origin such as https://api.example.com (got ${JSON.stringify(v)})`
+  let u: URL
+  try {
+    u = new URL(v)
+  } catch {
+    return `is not a valid URL (got ${JSON.stringify(v)})`
+  }
+  const authority = v.replace(/^https?:\/\//, '')
+  if (u.search !== '' || u.hash !== '' || u.username !== '' || u.password !== '' || /[/?#@\\\s]/.test(authority))
+    return `must be an origin only: no path, query, fragment or credentials (got ${JSON.stringify(v)})`
+  return null
+}
+
+/** L16 R16.2: the default `RequestInit.credentials` of the browser client. */
+export const ACTION_CREDENTIALS = ['same-origin', 'include', 'omit'] as const
+export type ActionCredentials = (typeof ACTION_CREDENTIALS)[number]
+
+/** F475: why `e` is not a `[actions] stream` entry (`"POST /upload"`, path relative to the prefix, `:name` one segment,
+ * a final `*` the rest), or null. Mirrors Rust `StreamRoute::parse`. */
+export function streamEntryError(e: unknown): string | null {
+  if (typeof e !== 'string') return `must be a string "<METHOD> <path>" (got ${JSON.stringify(e)})`
+  const m = /^\s*(\S+) +(\S+)\s*$/.exec(e)
+  if (!m) return `must be "<METHOD> <path>" (got ${JSON.stringify(e)})`
+  if (!['POST', 'PUT', 'PATCH'].includes(m[1]!.toUpperCase())) return `method must be POST, PUT or PATCH (got ${JSON.stringify(e)})`
+  const path = m[2]!
+  const segs = path.split('/').slice(1)
+  const badStar = segs.some((s, i) => s.includes('*') && (s !== '*' || i !== segs.length - 1))
+  if (!path.startsWith('/') || (path !== '/' && segs.some((s) => s === '')) || badStar)
+    return `path must start with '/', have no empty segment, and use '*' only as the last segment (got ${JSON.stringify(e)})`
+  return null
+}

package/src/actions-bridge.ts

@@ -1,7 +1,7 @@
 // The worker side of the `fetch` call kind (design E4/E5, contracts A1/A2). Rust forwards the actions prefix subtree
 // here; the app registered with `setActionsApp` (Elysia 2 via brust() — m3f-actions-elysia) answers a web Request
 // with a web Response, framed into this worker's SAB slot. No Elysia import: the app is anything with `fetch`.
-import { putFetchReply, takeFetchBody } from './native'
+import { pullFetchBody, putFetchReply, takeFetchBody } from './native'
 import type { LoaderReq } from './routes'
 import { runInStoreContext } from './store/server-context'
 
@@ -22,8 +22,10 @@ export interface FetchRequest {
   method: string
   url: string
   headers: [string, string][]
-  /** `{heap: n}` (F82): more than 262144 bytes, fetched with `takeFetchBody(slot)`. */
-  body: { text: string } | { b64: string } | { heap: number } | null
+  /** `{heap: n}` (F82): more than 262144 bytes (`ACTION_INLINE_BODY_BYTES`, independent of the slot size), fetched with `takeFetchBody(slot)`.
+   * `{stream}` (F475): a `[actions] stream` route's body, pulled chunk by chunk with `pullFetchBody(slot, token)`; `length` is the
+   * declared Content-Length, if any. */
+  body: { text: string } | { b64: string } | { heap: number } | { stream: { length: number | null; token: number } } | null
   req: LoaderReq
 }
 /** A2 meta: `status`, `headers`, and (F82) `heap` — the byte length of a response body that crossed by
@@ -39,8 +41,36 @@ export interface FetchMeta {
 export interface HeapIo {
   takeBody(slot: number): Uint8Array | null
   putReply(slot: number, body: Uint8Array): boolean
+  /** F475: the next chunk of the slot's streamed body (`pullFetchBody`); only `fetch` calls with A1 `{stream}` use it. */
+  pullBody?(slot: number, token: number): Promise<Uint8Array | string | null>
+}
+const nativeHeapIo: HeapIo = {
+  takeBody: (slot) => takeFetchBody(slot),
+  putReply: (slot, body) => putFetchReply(slot, body),
+  pullBody: (slot, token) => pullFetchBody(slot, token),
+}
+
+/** F475: what a failed pull means to the app; Rust answers 413 / 408 / 400 whatever the app then returns. */
+const STREAM_FAILED: Record<string, string> = {
+  max_stream_bytes: 'brust: the request body exceeds max_stream_bytes',
+  idle: 'brust: the request body stalled longer than stream_idle_ms',
+}
+
+/** F475: the request body as the app reads it: each read pulls one chunk from Rust, and nothing is pulled before a read
+ * (`highWaterMark: 0`), so the client is read only as fast as the app consumes. */
+export function pulledBody(pull: () => Promise<Uint8Array | string | null>): ReadableStream<Uint8Array> {
+  return new ReadableStream<Uint8Array>(
+    {
+      async pull(c) {
+        const r = await pull()
+        if (r === null) c.close()
+        else if (typeof r === 'string') c.error(new TypeError(STREAM_FAILED[r] ?? 'brust: the request body broke off or ended short'))
+        else c.enqueue(r)
+      },
+    },
+    { highWaterMark: 0 },
+  )
 }
-const nativeHeapIo: HeapIo = { takeBody: (slot) => takeFetchBody(slot), putReply: (slot, body) => putFetchReply(slot, body) }
 
 let maxResponseBytes = 8_388_608
 /** `startWorker` sets the manifest's `actions.maxResponseBytes` (R5). Default 8388608. */
@@ -68,13 +98,13 @@ const TEXT_PLAIN: [string, string][] = [['content-type', 'text/plain; charset=ut
 
 /** A1 → web Request (R8 origin: `http://<host>` when the host pair is sane, else `localhost`). Bytes, never a
  * string body, so no content-type is invented. GET/HEAD never carry a body (R4; `new Request` forbids one). */
-export function toRequest(r: FetchRequest, heapBody?: Uint8Array): Request {
+export function toRequest(r: FetchRequest, heapBody?: Uint8Array | ReadableStream<Uint8Array>): Request {
   const host = r.headers.find(([k]) => k === 'host')?.[1]
   const origin = `http://${host && HOST.test(host) ? host : 'localhost'}`
   const bodyless = r.method === 'GET' || r.method === 'HEAD'
   const b = r.body
-  const body = bodyless || !b ? undefined : 'heap' in b ? (heapBody as BodyInit | undefined) : 'text' in b ? enc.encode(b.text) : Buffer.from(b.b64, 'base64')
-  return new Request(origin + r.url, { method: r.method, headers: r.headers, body })
+  const body = bodyless || !b ? undefined : 'heap' in b || 'stream' in b ? (heapBody as BodyInit | undefined) : 'text' in b ? enc.encode(b.text) : Buffer.from(b.b64, 'base64')
+  return new Request(origin + r.url, { method: r.method, headers: r.headers, body, ...(body instanceof ReadableStream ? { duplex: 'half' } : {}) } as RequestInit)
 }
 
 /** A2 writer at `slot`'s sub-region `[slot*sub, slot*sub+sub)`, `sub = floor(view.byteLength / slots)`:
@@ -139,18 +169,23 @@ export const noActions = async (_: Request): Promise<Response> =>
   new Response('brust: actions are not configured in this worker', { status: 500, headers: { 'content-type': 'text/plain; charset=utf-8' } })
 
 /** The `fetch` call (makeDispatch). Never rejects, never writes JSON: every outcome is a frame. A body of
- * more than 262144 bytes arrives by `io.takeBody` (A1 `{heap}`); a response that does not fit the slot leaves
+ * more than 262144 bytes (`ACTION_INLINE_BODY_BYTES`, not the slot size) arrives by `io.takeBody` (A1 `{heap}`); a response that does not fit the slot leaves
  * by `io.putReply` with only status/headers/`heap` in the slot (F82), unless it exceeds `max_response_bytes`. */
 export async function runFetch(requestJson: string, view: Uint8Array, slot: number, slots: number, io: HeapIo = nativeHeapIo): Promise<number> {
   const a = app
   if (!a) return fail(view, slot, slots, 'brust: actions are not configured in this worker')
   try {
     const fr = JSON.parse(requestJson) as FetchRequest
-    let heapBody: Uint8Array | undefined
+    let heapBody: Uint8Array | ReadableStream<Uint8Array> | undefined
     if (fr.body && 'heap' in fr.body) {
       const got = io.takeBody(slot)
       if (!got || got.length !== fr.body.heap) throw new Error(`heap request body ${got ? `${got.length} != ${fr.body.heap}` : 'missing'} bytes (F82)`)
       heapBody = got
+    } else if (fr.body && 'stream' in fr.body) {
+      const { pullBody } = io
+      if (!pullBody) throw new Error('streamed request body without a pull channel (F475)')
+      const { token } = fr.body.stream
+      heapBody = pulledBody(() => pullBody(slot, token))
     }
     const req = toRequest(fr, heapBody)
     // R1/E5: one store scope around the handler AND the body read (a lazy body may still touch stores).

package/src/assets.d.ts

@@ -0,0 +1,55 @@
+// F411: an import of a font or an image (`SERVED_ASSET_EXT`) is the served URL of the file, `/_brust/client/<name>-<hash>.<ext>`,
+// the same URL a stylesheet's `url()` of it is rewritten to (the build's `cssPlugin`). Pulled in by a `/// <reference>` from the
+// entries apps import, so `import face from './fonts/face.woff2'` typechecks.
+declare module '*.woff2' {
+  const url: string
+  export default url
+}
+declare module '*.woff' {
+  const url: string
+  export default url
+}
+declare module '*.ttf' {
+  const url: string
+  export default url
+}
+declare module '*.otf' {
+  const url: string
+  export default url
+}
+declare module '*.eot' {
+  const url: string
+  export default url
+}
+declare module '*.png' {
+  const url: string
+  export default url
+}
+declare module '*.jpg' {
+  const url: string
+  export default url
+}
+declare module '*.jpeg' {
+  const url: string
+  export default url
+}
+declare module '*.gif' {
+  const url: string
+  export default url
+}
+declare module '*.webp' {
+  const url: string
+  export default url
+}
+declare module '*.avif' {
+  const url: string
+  export default url
+}
+declare module '*.svg' {
+  const url: string
+  export default url
+}
+declare module '*.ico' {
+  const url: string
+  export default url
+}

package/src/browser.ts

@@ -1,7 +1,12 @@
+/// <reference path="./css-modules.d.ts" />
+/// <reference path="./assets.d.ts" />
 // `@brust/core` under the `browser` export condition (and what every browser bundle of
 // `brust build` resolves the package root to): only the side-effect-free pieces. No `run`, no
 // config, no napi addon — a react island may import `cache` from the package root.
 import { cacheComponent } from './cache-core'
+export { buildTime } from './build-time'
+export { clearNavigationCache, navigate } from './navigate-browser'
+export type { NavErrorDetail, NavLoadDetail, NavigateOptions, NavSuccessDetail, NavTrigger } from './navigate'
 import type { InvalidateArgs, InvalidateResult } from './native'
 
 function invalidate(_args: InvalidateArgs): InvalidateResult {
@@ -26,4 +31,4 @@ export {
   Outlet,
   redirect,
 } from './routes'
-export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, Verdict } from './routes'
+export type { ComponentType, FlatRoute, HttpErrorOpts, HttpErrorTrigger, LoaderCtx, LoaderReq, Route, RouteCacheConfig, RouteSsgConfig, Verdict } from './routes'

package/src/build/actions-only.ts

@@ -0,0 +1,86 @@
+// `brust build --actions-only` (gaps round L16, R16.3/R16.4): a dist with NO page routes: the actions app behind
+// the same Rust admission (method gate, body caps, `Content-Encoding`, the cross-site guard, CORS), every other
+// path a 404 problem+json. With `--target cloudflare` it also writes `<out>/cf/`: a Worker serving only actions
+// (no Static Assets). The routes entry is neither read nor required.
+import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path'
+import { buildActions } from './bundle'
+import { type CfPrepared, buildCloudflare, prepareCloudflare } from './cloudflare'
+import type { ActionsBuildConfig, BuildConfig } from './config'
+import { BuildError } from './errors'
+import { MANIFEST_VERSION, type ManifestJson } from './manifest'
+
+const MARKER = '.brust'
+
+export async function runActionsOnly(o: {
+  appRoot: string
+  dist: string
+  config: BuildConfig
+  target: 'bun' | 'cloudflare' | 'static' | undefined
+  wasmFromSource: boolean
+  statOk: (p: string) => boolean
+  assertSafeOutDir: (dist: string, appRoot: string, keep: string[]) => void
+  log: (s: string) => void
+}): Promise<void> {
+  const { appRoot, dist, config } = o
+  const actions: ActionsBuildConfig | null = config.actions
+  if (!actions) throw new BuildError('actions-only', '--actions-only needs an [actions] table in brust.toml')
+  if (o.target === 'static') throw new BuildError('actions-only', '--actions-only builds no pages: it cannot be combined with --target static')
+  const entry = resolve(appRoot, actions.entry)
+  const rel = relative(appRoot, entry)
+  if (isAbsolute(actions.entry) || rel === '..' || rel.startsWith('../') || isAbsolute(rel) || !o.statOk(entry))
+    throw new BuildError('actions-entry', `actions.entry ${actions.entry} is not a file inside the app`)
+  o.assertSafeOutDir(dist, appRoot, [entry])
+  if (config.cache) o.log('[brust] actions-only: [cache] and route options do not apply (ignored)')
+  if (actions.baseUrl !== undefined) o.log('[brust] actions-only: [actions] base_url is for the pages that call these actions (ignored here)')
+  const cf: CfPrepared | null = o.target === 'cloudflare' ? await prepareCloudflare(appRoot, config.cloudflare, { fromSource: o.wasmFromSource, env: process.env }) : null
+
+  const tmp = join(dirname(dist), `.${basename(dist)}.brust-tmp`)
+  rmSync(tmp, { recursive: true, force: true })
+  mkdirSync(tmp, { recursive: true })
+  try {
+    const manifest: ManifestJson = {
+      version: MANIFEST_VERSION,
+      routes: [],
+      components: {},
+      assets: { runtime: '', features: {} },
+      jobs_module: 'jobs.js',
+      actions: { entry: await buildActions(tmp, entry), prefix: actions.prefix, maxBodyBytes: actions.maxBodyBytes, maxResponseBytes: actions.maxResponseBytes, crossSite: actions.crossSite, ...actions.stream },
+      actions_only: true,
+    }
+    mkdirSync(join(tmp, 'jinja'), { recursive: true })
+    writeFileSync(join(tmp, 'jobs.js'), '// generated by `brust build --actions-only`: no pages, so no jobs\nexport default {}\n')
+    writeFileSync(join(tmp, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`)
+    writeFileSync(join(tmp, MARKER), 'generated by `brust build`: this directory is replaced on every build\n')
+    writeFileSync(
+      join(tmp, 'index.js'),
+      [
+        '// generated by `brust build --actions-only` — `bun dist/index.js` serves the actions (do not edit)',
+        "process.env.BRUST_PREBUILT = '1'",
+        'process.env.BRUST_DIST_DIR = import.meta.dir',
+        "const { run } = await import('@brust/core')",
+        'await run()',
+        '',
+      ].join('\n'),
+    )
+    if (cf) {
+      const warnings = await buildCloudflare(
+        tmp,
+        { appRoot, entry, dist, compiled: new Map(), manifest, sourceOf: new Map(), actionsEntry: entry, actionsOnly: true, log: o.log },
+        cf,
+      )
+      for (const w of warnings) o.log(w)
+    }
+    rmSync(join(tmp, '.stage'), { recursive: true, force: true })
+    if (existsSync(dist)) {
+      const old = join(dirname(dist), `.${basename(dist)}.brust-old`)
+      rmSync(old, { recursive: true, force: true })
+      renameSync(dist, old)
+      renameSync(tmp, dist)
+      rmSync(old, { recursive: true, force: true })
+    } else renameSync(tmp, dist)
+  } catch (e) {
+    rmSync(tmp, { recursive: true, force: true })
+    throw e
+  }
+}