@brust/core 2.0.0-alpha.3 → 2.0.0-alpha.5

package/src/native.ts

@@ -22,6 +22,8 @@ export interface StartOptions {
   workers: number
   claimTimeoutMs?: number
   callTimeoutMs?: number
+  /** L10: the biggest loader/jobs reply that may cross the heap when it does not fit the slot; absent = 8388608. */
+  maxLoaderResponseBytes?: number
   /** tokio I/O threads; absent = one per core. */
   workerThreads?: number
   l1Capacity?: number
@@ -31,8 +33,12 @@ export interface StartOptions {
   cors?: CorsOptions
   /** The actions subtree (M3-F A3); absent = no actions. Boot error `actions: …` when invalid. */
   actions?: ActionsOptions
+  /** L16: what the page tells the browser `client()` (base URL, credentials, a non-default prefix); absent = from `actions` alone. */
+  actionsClient?: ActionsClientOptions
   /** The cache adapter (`manifest.cache`); absent = none (byte-identical server). */
   l2?: L2Options
+  /** `brust dev` only (L14): a request carrying this token (`x-brust-dev-token`) is traced; absent in production. */
+  devToken?: string
 }
 /** napi `NapiL2Options`; defaults 50 ms, 1048576 bytes. */
 export interface L2Options {
@@ -51,6 +57,12 @@ export interface CorsOptions {
   credentials?: boolean
   maxAgeSeconds?: number
 }
+/** napi `NapiActionsClient`. */
+export interface ActionsClientOptions {
+  prefix?: string
+  baseUrl?: string
+  credentials?: 'same-origin' | 'include' | 'omit'
+}
 /** napi `NapiActionsOptions`; defaults `/_brust/action`, 1048576, 8388608. */
 export interface ActionsOptions {
   prefix?: string
@@ -71,6 +83,8 @@ export interface NativeBinding {
   localAddr(): string
   /** M3-P P6 — see crates/brust-napi/src/server.rs `plan_jobs`. Never throws. */
   planJobs(slot: number, len: number): string
+  /** L10 — `planJobs` for a loader response too large for the slot: the bytes are handed over directly. Never throws. */
+  planJobsBuf(slot: number, buf: Uint8Array): string
   /** F82 — the heap request body of the in-flight `fetch` call, once; null if none. Never throws. */
   takeFetchBody(slot: number): Uint8Array | null
   /** F82 — hand Rust a response body too large for the slot; false = declined. Never throws. */
@@ -81,6 +95,8 @@ export interface NativeBinding {
   cacheL2Count(name: string): boolean
   /** cache adapter R10 — drop both tier-1 caches (a broadcast gap); the L1 entries removed. */
   cacheClear(): number
+  /** Static output (gaps round R9.4): the request reads of a cache key expression; throws when it does not parse. */
+  cacheExprReads(src: string): string[]
 }
 
 let binding: NativeBinding | null = null
@@ -107,8 +123,10 @@ export const cacheInvalidate = (args: InvalidateArgs): InvalidateResult => nativ
 export const cacheStats = (): string => native().cacheStats()
 export const localAddr = (): string => native().localAddr()
 export const planJobs = (slot: number, len: number): string => native().planJobs(slot, len)
+export const planJobsBuf = (slot: number, buf: Uint8Array): string => native().planJobsBuf(slot, buf)
 export const takeFetchBody = (slot: number): Uint8Array | null => native().takeFetchBody(slot)
 export const putFetchReply = (slot: number, body: Uint8Array): boolean => native().putFetchReply(slot, body)
 export const cacheReplay = (args: InvalidateArgs, seq: number | null): InvalidateResult => native().cacheReplay(args, seq)
 export const cacheL2Count = (name: string): boolean => native().cacheL2Count(name)
 export const cacheClear = (): number => native().cacheClear()
+export const cacheExprReads = (src: string): string[] => native().cacheExprReads(src)

package/src/routes.ts

@@ -1,3 +1,4 @@
+/// <reference path="./css-modules.d.ts" />
 // Route tree, ids and loader verdicts (spec S4, S7 step 4). M2 routes carry ONLY
 // `path/Component/loader/cache/children`; every other 0.1.x field fails loudly (M3).
 
@@ -29,15 +30,21 @@ export interface LoaderCtx<P = Record<string, string>> {
   req: LoaderReq
 }
 
+/** `brust build --target static` (gaps round R9.2): `params` lists the values of a dynamic route's
+ * `{name}` segments, one record per page; `false` leaves the route out of the static output. The
+ * server and Cloudflare targets ignore it. */
+export type RouteSsgConfig<P = Record<string, string>> = { params?: () => P[] | Promise<P[]> } | false
+
 export interface Route<P = Record<string, string>, D = unknown> {
   path?: string
   Component?: ComponentType<any>
   loader?: (ctx: LoaderCtx<P>) => Promise<D> | D
   cache?: RouteCacheConfig
+  ssg?: RouteSsgConfig<P>
   children?: Route<any, any>[]
 }
 
-export const ALLOWED_ROUTE_FIELDS = ['path', 'Component', 'loader', 'cache', 'children'] as const
+export const ALLOWED_ROUTE_FIELDS = ['path', 'Component', 'loader', 'cache', 'ssg', 'children'] as const
 const ALLOWED_CACHE_FIELDS = ['ttl_seconds', 'prefix', 'bypass', 'tags'] as const
 const M3_CACHE_FIELDS = ['key', 'key_ttl_seconds'] as const
 
@@ -61,6 +68,18 @@ function validate(node: Route, where: string): void {
   if (node.path !== undefined && typeof node.path !== 'string') throw new BrustRouteError(`route ${where}: path must be a string`)
   if (node.loader !== undefined && typeof node.loader !== 'function')
     throw new BrustRouteError(`route ${where}: loader must be a function`)
+  if (node.ssg !== undefined) {
+    const ssg = node.ssg as unknown
+    if (ssg !== false && (typeof ssg !== 'object' || ssg === null || Array.isArray(ssg)))
+      throw new BrustRouteError(`route ${where}: ssg must be false or { params }`)
+    if (ssg !== false) {
+      for (const k of Object.keys(ssg as object))
+        if (k !== 'params') throw new BrustRouteError(`route ${where}: unknown ssg field ssg.${k} (allowed: params)`)
+      const params = (ssg as { params?: unknown }).params
+      if (params !== undefined && typeof params !== 'function') throw new BrustRouteError(`route ${where}: ssg.params must be a function`)
+    }
+    if (node.children !== undefined) throw new BrustRouteError(`route ${where}: ssg on a layout route is not supported (put it on each leaf)`)
+  }
   if (node.cache !== undefined) {
     if (typeof node.cache !== 'object' || node.cache === null) throw new BrustRouteError(`route ${where}: cache must be an object`)
     for (const k of Object.keys(node.cache)) {

package/src/run.ts

@@ -8,41 +8,59 @@
 // does not end it, so every exit is an explicit `process.exit`.
 import { existsSync, readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
-import { type BrustConfig, loadConfig } from './config'
-import { beginDrain, type StartOptions, startServer, untilReady } from './native'
-import { SLOT_BYTES } from './worker'
+import { type BrustConfig, type ConfigOverrides, loadConfig } from './config'
+import { beginDrain, localAddr, type StartOptions, startServer, untilReady } from './native'
+import { DEFAULT_MAX_LOADER_RESPONSE_BYTES } from './worker'
 
 export interface RunOptions {
   distDir?: string
   /** The routes module the workers import (`export const routes` or default). */
   entry?: string
   /** Overrides below env (CLI flags): see config.ts (incl. `bootTimeoutMs`, default 30000). */
-  config?: Partial<BrustConfig>
+  config?: ConfigOverrides
+  /** Static output (gaps round L9): runs once every worker is ready, with the bound `host:port`;
+   * then the server drains and the process exits with the returned code. */
+  onReady?: (addr: string) => Promise<number>
 }
 
 /** The manifest fields `run` needs (build/manifest.ts owns the full shape). */
 export interface RunManifest {
   actions?: { entry: string; prefix: string; maxBodyBytes: number; maxResponseBytes?: number; crossSite?: 'reject' | 'allow' } | null
+  /** L16 R16.3: `brust build --actions-only`: no page routes and no routes entry. */
+  actions_only?: boolean
+  /** L16 R16.4b: a page-only build; the actions app is deployed elsewhere (`[actions] base_url`). */
+  actions_remote?: { prefix: string } | null
   /** `[cache]`: the server's L2 settings (the workers load the adapter itself). */
   cache?: { adapter: string; getTimeoutMs: number; maxBodyBytes: number; namespace: string; buildId: string } | null
 }
 
 /** Pure: the napi `StartOptions`. No actions/cors/cache → exactly the pre-actions keys. */
-export function startOptions(cfg: BrustConfig, distDir: string, m: RunManifest, version: string): StartOptions {
+export function startOptions(cfg: BrustConfig, distDir: string, m: RunManifest, version: string, devToken?: string): StartOptions {
   return {
     host: cfg.host,
     port: cfg.port,
     distDir,
     workers: cfg.workers,
     callTimeoutMs: cfg.callTimeoutMs,
+    ...(cfg.maxLoaderResponseBytes !== undefined && cfg.maxLoaderResponseBytes !== DEFAULT_MAX_LOADER_RESPONSE_BYTES ? { maxLoaderResponseBytes: cfg.maxLoaderResponseBytes } : {}),
     workerThreads: cfg.ioThreads,
     generator: `brust/${version}`,
     ...(m.actions ? { actions: { prefix: m.actions.prefix, maxBodyBytes: m.actions.maxBodyBytes, ...(m.actions.maxResponseBytes !== undefined ? { maxResponseBytes: m.actions.maxResponseBytes } : {}), ...(m.actions.crossSite ? { crossSite: m.actions.crossSite } : {}) } } : {}),
+    ...(actionsClient(cfg, m) ? { actionsClient: actionsClient(cfg, m) } : {}),
     ...(cfg.cors ? { cors: cfg.cors } : {}),
+    ...(devToken ? { devToken } : {}),
     ...(m.cache ? { l2: { adapter: m.cache.adapter, getTimeoutMs: m.cache.getTimeoutMs, maxBodyBytes: m.cache.maxBodyBytes, namespace: m.cache.namespace, buildId: m.cache.buildId } } : {}),
   }
 }
 
+/** L16: what the page tells the browser `client()` (R16.1/R16.2); absent while it would only repeat the prefix script. */
+function actionsClient(cfg: BrustConfig, m: RunManifest): NonNullable<StartOptions['actionsClient']> | undefined {
+  const credentials = cfg.actionsCredentials !== undefined && cfg.actionsCredentials !== 'same-origin' ? cfg.actionsCredentials : undefined
+  if (cfg.actionsBaseUrl === undefined && credentials === undefined && !m.actions_remote) return undefined
+  const prefix = m.actions?.prefix ?? m.actions_remote?.prefix
+  return { ...(prefix ? { prefix } : {}), ...(cfg.actionsBaseUrl !== undefined ? { baseUrl: cfg.actionsBaseUrl } : {}), ...(credentials ? { credentials } : {}) }
+}
+
 /** Every worker's response buffer, kept reachable until the process exits (see run()). */
 const workerBuffers: SharedArrayBuffer[] = []
 
@@ -63,7 +81,8 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     fail(`bad manifest ${manifest}: ${(e as Error).message}`)
   }
   const entry = resolve(process.env.BRUST_APP_ENTRY || opts.entry || 'routes.tsx')
-  if (!existsSync(entry)) fail(`routes entry ${entry} not found`)
+  // R16.3: an actions-only dist has no pages, so no routes module either.
+  if (!m.actions_only && !existsSync(entry)) fail(`routes entry ${entry} not found`)
 
   let cfg: BrustConfig
   try {
@@ -72,9 +91,11 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     fail((e as Error).message)
   }
 
+  if (m.actions_remote && cfg.actionsBaseUrl === undefined)
+    fail('this build has no local actions app: set [actions] base_url (or BRUST_ACTIONS_BASE_URL) to the deployment that serves them')
   const version: string = (await Bun.file(join(import.meta.dir, '../package.json')).json()).version
   try {
-    startServer(startOptions(cfg, distDir, m, version))
+    startServer(startOptions(cfg, distDir, m, version, process.env.BRUST_DEV_TOKEN || undefined))
   } catch (e) {
     fail((e as Error).message)
   }
@@ -87,6 +108,8 @@ export async function run(opts: RunOptions = {}): Promise<void> {
     ...process.env,
     NODE_ENV: process.env.NODE_ENV,
     BRUST_RENDER_SLOTS: String(cfg.renderSlots),
+    BRUST_SLOT_BYTES: String(cfg.slotBytes),
+    BRUST_MAX_LOADER_RESPONSE_BYTES: String(cfg.maxLoaderResponseBytes),
     BRUST_DIST_DIR: distDir,
     BRUST_APP_ENTRY: entry,
     // One cache-adapter origin per process: its workers' published events are not replayed here.
@@ -115,7 +138,7 @@ export async function run(opts: RunOptions = {}): Promise<void> {
   for (let i = 0; i < cfg.workers; i++) {
     // The response buffer is owned HERE, for the process lifetime: the Rust dispatcher keeps a raw
     // pointer into it, so it must not be freed with the worker (crates/brust-napi dispatch.rs).
-    const sab = new SharedArrayBuffer(SLOT_BYTES * cfg.renderSlots)
+    const sab = new SharedArrayBuffer(cfg.slotBytes * cfg.renderSlots)
     workerBuffers.push(sab)
     const w = new Worker(url, { env: { ...env, BRUST_WORKER_ID: String(i) }, workerData: { sab } } as WorkerOptions)
     // No respawn in M2: a worker that fails to boot or dies later takes the process down loudly
@@ -158,5 +181,14 @@ export async function run(opts: RunOptions = {}): Promise<void> {
   }
   ready = true
   console.log(`[brust] ready (${cfg.workers} worker${cfg.workers === 1 ? '' : 's'})`)
+  if (opts.onReady) {
+    let code = 1
+    try {
+      code = await opts.onReady(localAddr())
+    } catch (e) {
+      console.error(`[brust] ${(e as Error).stack ?? String(e)}`)
+    }
+    if (!draining) drainThenExit(code)
+  }
   await new Promise<never>(() => {})
 }

package/src/worker.ts

@@ -1,14 +1,15 @@
 // The Bun side of contract 7 (`crates/brust-server/src/protocol.rs`): requests arrive as inline
 // JSON, responses go into this worker's SharedArrayBuffer slot (SAB rule, `dispatch.rs`). A
 // handler NEVER rejects across the tsfn: every failure becomes `{error}` / `{id, error}`.
+import { appendFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { workerData } from 'node:worker_threads'
 import { type HeapIo, runFetch, setActionsApp, setActionsLimits } from './actions-bridge'
 import { DEFAULT_MAX_RESPONSE_BYTES } from './actions/prefix'
 import { type CacheBridgeDeps, runCache } from './cache-adapter/bridge'
 import type { CacheManifest } from './cache-adapter/load'
-import { type Handlers, type JobsModule, type ManifestLike, makeHandlers, toJson } from './handlers'
-import { cacheClear, cacheL2Count, cacheReplay, planJobs, putFetchReply, registerWorker, takeFetchBody } from './native'
+import { type Handlers, type JobsModule, type ManifestLike, makeHandlers, type SsgRecord, toJson } from './handlers'
+import { cacheClear, cacheL2Count, cacheReplay, planJobs, planJobsBuf, putFetchReply, registerWorker, takeFetchBody } from './native'
 import { flattenRoutes, type Route } from './routes'
 
 export * from './handlers'
@@ -17,24 +18,58 @@ export * from './handlers'
 
 const enc = new TextEncoder()
 
+/** L10: the default `maxLoaderResponseBytes` (config.ts keeps the range). */
+export const DEFAULT_MAX_LOADER_RESPONSE_BYTES = 8_388_608
+
+/** L10: a reply too large for the slot crosses by heap: `HeapIo.putReply` hands Rust the bytes, and the slot holds
+ * the 5-byte marker `[0x00][u32 LE n]` (JSON never starts with 0x00). `cap` = `maxLoaderResponseBytes`. */
+export const HEAP_MARKER_BYTES = 5
+export interface HeapReply {
+  io: HeapIo
+  /** `planJobsBuf` (napi): plan a loader response handed over directly. */
+  planBuf: (slot: number, buf: Uint8Array) => string
+  /** Default: the worker's `maxLoaderResponseBytes` (env `BRUST_MAX_LOADER_RESPONSE_BYTES`, 8 MiB). */
+  cap?: number
+}
+const nativeHeap: HeapReply = { io: cacheHeapIo(), planBuf: (slot, buf) => planJobsBuf(slot, buf) }
+let loaderCap = DEFAULT_MAX_LOADER_RESPONSE_BYTES
+
 /** Writes `json` as UTF-8 at the start of `slot`'s sub-region `[slot*sub, slot*sub+sub)`,
  * `sub = floor(view.byteLength / slots)`; returns the byte length (> 0, ≤ sub). ONE copy: the
  * encoder writes straight into the slot (M3-P P1); it stops at the last whole code point that
  * fits, so `read < json.length` means "did not fit" and the neighbouring slot is never touched.
- * A response that does not fit is replaced by a small `{"error":"response too large: <n> > <sub>"}`
- * (`n` = its exact UTF-8 length, computed only on this path). */
-export function writeSlot(view: Uint8Array, slot: number, slots: number, json: string): number {
+ * A response that does not fit goes by heap when `io` and `cap` are given (L10): encoded once, handed to
+ * Rust with `io.putReply`, and the slot holds the 5-byte marker. Over `cap` (or declined), or with no `io`, it is
+ * replaced by a small `{"error":"response too large: <n> > <limit>"}` (`n` = its exact UTF-8 length, computed
+ * only on this path). */
+export function writeSlot(view: Uint8Array, slot: number, slots: number, json: string, io?: HeapIo, cap?: number): number {
   const sub = Math.floor(view.byteLength / Math.max(1, slots))
   const dst = view.subarray(slot * sub, slot * sub + sub)
   const r = enc.encodeInto(json, dst)
   if (r.read === json.length) return r.written
-  const err = JSON.stringify({ error: `response too large: ${Buffer.byteLength(json)} > ${sub}` })
+  let why = `response too large: ${Buffer.byteLength(json)} > ${sub}`
+  if (io && cap !== undefined && sub >= HEAP_MARKER_BYTES) {
+    const bytes = enc.encode(json)
+    const n = heapMarker(dst, slot, bytes, io, cap)
+    if (n > 0) return n
+    // Name the real reason: over the cap, or a put Rust declined while under it (idle slot, a second put).
+    why = bytes.length > cap ? `response too large: ${bytes.length} > ${cap} (maxLoaderResponseBytes)` : `heap reply declined: ${bytes.length} bytes did not fit the ${sub}-byte slot and Rust refused the handover`
+  }
+  const err = JSON.stringify({ error: why })
   const e = enc.encodeInto(err, dst)
   if (e.read === err.length) return e.written
   // Not even the message fits: the first `sub` bytes of a fixed one (ASCII, so byte = char).
   return enc.encodeInto('{"error":"too large"}', dst).written
 }
 
+/** Hand `bytes` to Rust and write the marker at `dst`; 0 when over `cap` or Rust declined. */
+function heapMarker(dst: Uint8Array, slot: number, bytes: Uint8Array, io: HeapIo, cap: number): number {
+  if (bytes.length > cap || !io.putReply(slot, bytes)) return 0
+  dst[0] = 0
+  new DataView(dst.buffer, dst.byteOffset + 1, 4).setUint32(0, bytes.length, true)
+  return HEAP_MARKER_BYTES
+}
+
 /** `planJobs` (napi): the misses' JobsRequest JSON, '' (every job hit) or PLAN_DECLINED. */
 export type PlanJobs = (slot: number, len: number) => string
 /** `planJobs` declined: the loader response already in the slot is the answer (Rust plans after the call). */
@@ -44,11 +79,13 @@ const PLANNED = { planned: true } as const
 /** The tsfn callback for `registerWorker`. Never rejects: a parse error, an unknown kind or a
  * throwing handler is written to the slot as `{error}`. A loader request with `plan: true` whose
  * chain answered `ok` is planned in the same call (`plan`, the napi `planJobs` by default — the
- * addon is touched only then). */
-export function makeDispatch(h: Handlers, view: Uint8Array, slots: number, plan: PlanJobs = planJobs) {
+ * addon is touched only then). A loader/jobs/planned reply that does not fit the slot crosses by heap
+ * (`heap`, the napi addon by default; L10). */
+export function makeDispatch(h: Handlers, view: Uint8Array, slots: number, plan: PlanJobs = planJobs, heap: HeapReply = nativeHeap) {
+  const cap = () => heap.cap ?? loaderCap
   return async (kind: string, requestJson: string, slot: number): Promise<number> => {
     if (kind === 'fetch') return runFetch(requestJson, view, slot, slots)
-    if (kind === 'cache') return runCache(requestJson, view, slot, slots, cacheHeapIo, cacheDeps)
+    if (kind === 'cache') return runCache(requestJson, view, slot, slots, cacheHeapIo(), cacheDeps)
     let out: unknown
     try {
       const req = JSON.parse(requestJson)
@@ -58,9 +95,20 @@ export function makeDispatch(h: Handlers, view: Uint8Array, slots: number, plan:
           // One round trip (M3-P P6): the ctx goes to Rust through this slot, synchronously, and only
           // the jobs Rust found missing run here; the final answer replaces it in the same slot.
           const json = toJson(out)
-          const n = writeSlot(view, slot, slots, json)
-          const misses = plan(slot, n)
-          if (misses === PLAN_DECLINED) return n
+          const sub = Math.floor(view.byteLength / Math.max(1, slots))
+          const dst = view.subarray(slot * sub, slot * sub + sub)
+          const w = enc.encodeInto(json, dst)
+          let misses: string
+          if (w.read === json.length) {
+            misses = plan(slot, w.written)
+            if (misses === PLAN_DECLINED) return w.written
+          } else {
+            // L10: too large for the slot — plan from the bytes directly; a declined plan hands them over as the answer.
+            const bytes = enc.encode(json)
+            if (bytes.length > cap()) return writeSlot(view, slot, slots, json, heap.io, cap())
+            misses = heap.planBuf(slot, bytes)
+            if (misses === PLAN_DECLINED) return writeSlot(view, slot, slots, json, heap.io, cap())
+          }
           out = misses === '' ? PLANNED : { planned: true, results: (await h.jobs(JSON.parse(misses))).results }
         }
       } else if (kind === 'jobs') out = await h.jobs(req)
@@ -68,13 +116,15 @@ export function makeDispatch(h: Handlers, view: Uint8Array, slots: number, plan:
     } catch (e) {
       out = { error: String(e) }
     }
-    return writeSlot(view, slot, slots, toJson(out))
+    return writeSlot(view, slot, slots, toJson(out), heap.io, cap())
   }
 }
 
 // ---- cache adapter (the `cache` call kind) ----
 
-const cacheHeapIo: HeapIo = { takeBody: (slot) => takeFetchBody(slot), putReply: (slot, body) => putFetchReply(slot, body) }
+function cacheHeapIo(): HeapIo {
+  return { takeBody: (slot) => takeFetchBody(slot), putReply: (slot, body) => putFetchReply(slot, body) }
+}
 const count = (name: string) => void cacheL2Count(name)
 let cacheDeps: CacheBridgeDeps = { store: undefined, getTimeoutMs: 50, maxBodyBytes: 1_048_576, count }
 
@@ -97,12 +147,20 @@ async function startCacheAdapter(m: CacheManifest, dist: string, appDir: string,
   return { adapter, origin }
 }
 
+// ---- static output (gaps round R9.5) ----
+
+/** Appends each record as one JSON line to `file` (every worker of the render appends to it). */
+function ssgLog(file: string): (r: SsgRecord) => void {
+  return (r) => appendFileSync(file, `${JSON.stringify(r)}\n`)
+}
+
 // ---- worker entry ----
 
+/** The default response slot (`slotBytes`, config.ts: 64 KiB..16 MiB). */
 export const SLOT_BYTES = 256 * 1024
 
 export interface StartWorkerOptions {
-  /** The response buffer to register (`SLOT_BYTES * slots` bytes). `run()` allocates it on the
+  /** The response buffer to register (`slotBytes * slots` bytes). `run()` allocates it on the
    * MAIN thread and keeps it for the process lifetime, passing it as `workerData.sab`: the Rust
    * dispatcher holds a raw pointer into it until the process exits, so its backing store must not
    * die with this worker (`crates/brust-napi/src/dispatch.rs` BufPtr). Absent (tests, a worker
@@ -121,11 +179,18 @@ export async function startWorker(opts: StartWorkerOptions = {}): Promise<number
   const env = process.env
   const slots = Math.max(1, Number.parseInt(env.BRUST_RENDER_SLOTS ?? '1', 10) || 1)
   const dist = resolve(env.BRUST_DIST_DIR ?? 'dist')
-  const entry = env.BRUST_APP_ENTRY
+  // L16 R16.3: an actions-only dist has no routes module (so no BRUST_APP_ENTRY either).
+  const manifestFile = join(dist, 'manifest.json')
+  const hasManifest = await Bun.file(manifestFile).exists()
+  const actionsOnly = hasManifest && !env.BRUST_APP_ENTRY && ((await Bun.file(manifestFile).json()) as { actions_only?: boolean }).actions_only === true
+  const entry = env.BRUST_APP_ENTRY ?? (actionsOnly ? join(dist, 'index.js') : undefined)
   if (!entry) throw new Error('BRUST_APP_ENTRY is not set')
-  const manifest = (await Bun.file(join(dist, 'manifest.json')).json()) as ManifestLike & { cache?: CacheManifest | null }
-  const app = await import(resolve(entry))
-  const routes = (app.routes ?? app.default) as Route[] | undefined
+  const manifest = (await Bun.file(manifestFile).json()) as ManifestLike & { cache?: CacheManifest | null; actions_only?: boolean }
+  let routes: Route[] | undefined = []
+  if (!manifest.actions_only) {
+    const app = await import(resolve(entry))
+    routes = (app.routes ?? app.default) as Route[] | undefined
+  }
   if (!Array.isArray(routes)) throw new Error(`${entry} exports no routes (export const routes or default)`)
   const jobsMod = await import(join(dist, manifest.jobs_module ?? 'jobs.js'))
   const jobs = (jobsMod.default ?? jobsMod) as JobsModule
@@ -135,15 +200,18 @@ export async function startWorker(opts: StartWorkerOptions = {}): Promise<number
     setActionsApp(await loadActionsApp(join(dist, manifest.actions.entry), manifest.actions.prefix))
     setActionsLimits({ maxResponseBytes: manifest.actions.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES })
   }
+  loaderCap = Number.parseInt(env.BRUST_MAX_LOADER_RESPONSE_BYTES ?? '', 10) || DEFAULT_MAX_LOADER_RESPONSE_BYTES
+  const slotBytes = Number.parseInt(env.BRUST_SLOT_BYTES ?? '', 10) || SLOT_BYTES
   const workerId = Number.parseInt(env.BRUST_WORKER_ID ?? '0', 10) || 0
   const l2 = manifest.cache ? await startCacheAdapter(manifest.cache, dist, dirname(resolve(entry)), workerId) : null
-  sab = opts.sab ?? new SharedArrayBuffer(SLOT_BYTES * slots)
+  sab = opts.sab ?? new SharedArrayBuffer(slotBytes * slots)
   view = new Uint8Array(sab)
   const handlers = makeHandlers({
     leaves: flattenRoutes(routes).leaves,
     jobs,
     manifest,
     stores: (jobsMod.stores ?? {}) as Record<string, object>,
+    ...(env.BRUST_SSG === '1' && env.BRUST_SSG_LOG ? { ssg: ssgLog(env.BRUST_SSG_LOG) } : {}),
   })
   const id = registerWorker(view, slots, makeDispatch(handlers, view, slots))
   if (l2 && env.BRUST_WORKER_ID === '0') {