brustjs 0.1.11-alpha → 0.1.12-alpha

package/runtime/routes.ts

@@ -17,7 +17,9 @@ import {
   resolveComponentContext,
 } from './islands/native-render.ts'
 import type { IslandCache } from './islands/native-render.ts'
-import type { ActionDef } from './actions.ts'
+import type { EndpointDef } from './define-actions.ts'
+import { isRespondSentinel, makeRespond } from './define-actions.ts'
+import { validate } from './standard-schema.ts'
 
 // Sub-project J — island ISR cache, backed by the Rust-side store (shared across
 // the worker pool) via NAPI. napi-rs maps snake→camel: island_cache_get →
@@ -441,6 +443,8 @@ export type RouteCall =
       /** Base64-encoded binary body — present for multipart/form-data.
        * JS decodes via Buffer.from(s, 'base64') before parsing. */
       body_b64?: string
+      /** Path params extracted by the Rust router (e.g. {id} → "abc"). */
+      params?: Record<string, string>
       req: BrustRequest
     }
   | {
@@ -475,7 +479,7 @@ export interface MakeRendererOptions {
    * Both the main process and each worker call `brust.scanActions(...)` at
    * module top-level and pass the resulting array here — the wire keys (ids)
    * and the handler functions (fn) must agree across both ends. */
-  actions?: ActionDef[]
+  actions?: EndpointDef[]
   /** MCP server instance — built once per worker at module top-level. */
   mcp?: import('./mcp/server.ts').McpServer
 }
@@ -491,8 +495,10 @@ export function makeRenderer(
   routes.forEach((r, i) => {
     byRouteId.set(i, r)
   })
-  const byActionId = new Map<string, ActionDef>()
-  for (const a of opts.actions ?? []) byActionId.set(a.id, a)
+  const byActionId = new Map<string, EndpointDef>()
+  opts.actions?.forEach((e, i) => {
+    byActionId.set(String(i), e)
+  })
 
   // napi shim for the chunk channel. The sabBytes arg is ignored by the
   // native fn (Rust reads from the pre-registered BufPtr) — the call sites
@@ -726,7 +732,7 @@ export function makeRenderer(
     if (call.kind === 'action') {
       // FAST LANE: pack the framed response into the SAB and return its length.
       // Rust reads it directly after the Promise settles — no chunk channel.
-      const resp = await actionBranchToResponse(call, byActionId)
+      const resp = await dispatchAction(call, byActionId)
       return packSingleChunkResponse(view, encoder, resp)
     }
     if (call.kind === 'mcp') {
@@ -1090,82 +1096,131 @@ interface BranchResponse {
   headers?: Record<string, string>
 }
 
-async function actionBranchToResponse(
+async function decodeActionBody(
   call: Extract<RouteCall, { kind: 'action' }>,
-  byId: Map<string, ActionDef>,
+): Promise<{ ok: true; value: unknown } | { ok: false; status: number; body: string }> {
+  const ct = (call.content_type ?? '').toLowerCase()
+  // urlencoded → flat object of strings
+  if (ct.startsWith('application/x-www-form-urlencoded')) {
+    return { ok: true, value: Object.fromEntries(new URLSearchParams(call.body_text ?? '')) }
+  }
+  // multipart → object of strings + File entries (via Bun's Response.formData)
+  if (ct.startsWith('multipart/form-data')) {
+    try {
+      const bytes = Buffer.from(call.body_b64 ?? '', 'base64')
+      const fd = await new Response(bytes, {
+        headers: { 'content-type': call.content_type },
+      }).formData()
+      return { ok: true, value: Object.fromEntries(fd.entries()) }
+    } catch (err) {
+      return {
+        ok: false,
+        status: 400,
+        body: JSON.stringify({
+          error: { message: `invalid multipart body: ${(err as Error).message}` },
+        }),
+      }
+    }
+  }
+  // default: JSON
+  try {
+    return {
+      ok: true,
+      value:
+        call.body_text != null && call.body_text !== '' ? JSON.parse(call.body_text) : undefined,
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      status: 400,
+      body: JSON.stringify({
+        error: { message: `invalid JSON body: ${(err as Error).message}` },
+      }),
+    }
+  }
+}
+
+export async function dispatchAction(
+  call: Extract<RouteCall, { kind: 'action' }>,
+  byId: Map<string, EndpointDef>,
 ): Promise<BranchResponse> {
   const def = byId.get(call.action_id)
   if (!def) {
-    // Rust already 404s when the id isn't registered, but a race during
-    // hot-reload (or a desynced worker) could land here. Log and 404.
-    // Action clients always expect JSON, so ship a JSON envelope even
-    // when Rust would have 404'd first.
-    console.error(`[brust] unknown action_id=${call.action_id}`)
     return {
       status: 404,
       body: '{"error":{"message":"unknown action"}}',
       contentType: 'application/json; charset=utf-8',
     }
   }
-  // Populate req.signal with the permanently-unaborted sentinel. Action
-  // handlers reading req.signal.aborted always see false; the SSE branch
-  // is where real disconnect lives.
   call.req.signal = NEVER_ABORTS
 
-  // Decode the body into the args array that will be spread into the handler.
-  // Three paths: multipart (body_b64), form-urlencoded (body_text), or JSON (body_text).
-  // Body decode happens BEFORE middleware so a malformed body 400s without running
-  // any user code.
-  let args: unknown[]
-  try {
-    if (call.body_b64 !== undefined) {
-      // Multipart path — base64 → bytes → Web Request.formData()
-      const bytes = Buffer.from(call.body_b64, 'base64')
-      const synthReq = new Request('http://x', {
-        method: 'POST',
-        headers: { 'Content-Type': call.content_type },
-        body: bytes,
-      })
-      const fd = await synthReq.formData()
-      args = [fd]
-    } else if (call.content_type.toLowerCase().startsWith('application/x-www-form-urlencoded')) {
-      // Form-urlencoded path — URLSearchParams → FormData
-      const params = new URLSearchParams(call.body_text ?? '')
-      const fd = new FormData()
-      for (const [k, v] of params) fd.append(k, v)
-      args = [fd]
-    } else {
-      // JSON path (default — empty or application/json content type).
-      const decoded = JSON.parse(call.body_text ?? '') as unknown
-      if (!Array.isArray(decoded)) {
-        return {
-          status: 400,
-          body: '{"error":{"message":"args must be a JSON array"}}',
-          contentType: 'application/json; charset=utf-8',
-        }
+  // Body decode — dispatch by content-type (JSON / urlencoded / multipart).
+  let rawBody: unknown
+  if (def.method !== 'GET' && def.method !== 'HEAD') {
+    const decoded = await decodeActionBody(call)
+    if (!decoded.ok) {
+      return {
+        status: decoded.status,
+        body: decoded.body,
+        contentType: 'application/json; charset=utf-8',
       }
-      args = decoded
     }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err)
+    rawBody = decoded.value
+  }
+
+  const bodyCheck = await validate(def.body, rawBody)
+  if (!bodyCheck.ok) {
     return {
-      status: 400,
-      body: JSON.stringify({ error: { message: `invalid request body: ${msg}` } }),
+      status: 422,
+      body: JSON.stringify({
+        error: { message: 'body validation failed', issues: bodyCheck.issues },
+      }),
       contentType: 'application/json; charset=utf-8',
     }
   }
+  // `req.search` already arrives as a parsed key→value object from the Rust
+  // envelope (BrustRequest.search: Record<string, string>) — use it directly
+  // as the query object rather than re-parsing it as a string.
+  const queryObj = call.req.search ?? {}
+  const queryCheck = await validate(def.query, queryObj)
+  if (!queryCheck.ok) {
+    return {
+      status: 422,
+      body: JSON.stringify({
+        error: { message: 'query validation failed', issues: queryCheck.issues },
+      }),
+      contentType: 'application/json; charset=utf-8',
+    }
+  }
+
+  const ctx = {
+    req: call.req,
+    body: bodyCheck.value,
+    params: call.params ?? {},
+    query: queryCheck.value,
+    headers: call.req.headers ?? {},
+    respond: makeRespond(),
+  }
 
   const terminal = async (): Promise<RouteResponse> => {
     try {
-      const result = await def.fn(call.req, ...args)
+      const result = await def.handler(ctx as never)
+      if (isRespondSentinel(result)) {
+        return {
+          status: result.status,
+          body: result.body === undefined ? '' : JSON.stringify(result.body),
+          contentType: 'application/json; charset=utf-8',
+          headers: result.headers,
+        }
+      }
       return {
         status: 200,
         body: result === undefined ? '' : JSON.stringify(result),
         contentType: 'application/json; charset=utf-8',
       }
     } catch (err) {
-      console.error(`[brust] action ${def.id} threw:`, err)
       const e = err instanceof Error ? err : new Error(String(err))
+      console.error(`[brust] action ${def.method} ${def.path} threw:`, err)
       return {
         status: 500,
         body: JSON.stringify({ error: { message: e.message, name: e.name } }),
@@ -1175,15 +1230,14 @@ async function actionBranchToResponse(
   }
 
   const chain = composeChain(call.req, def.middleware, terminal)
-
   let response: RouteResponse
   try {
     response = await chain()
   } catch (err) {
-    console.error(`[brust] action middleware uncaught:`, err)
+    console.error('[brust] action middleware uncaught:', err)
     response = {
       status: 500,
-      body: JSON.stringify({ error: { message: 'internal error' } }),
+      body: '{"error":{"message":"internal error"}}',
       contentType: 'application/json; charset=utf-8',
     }
   }

package/runtime/standard-schema.ts

@@ -0,0 +1,29 @@
+/** Minimal Standard Schema v1 surface — https://standardschema.dev */
+export interface StandardSchemaV1<Input = unknown, Output = Input> {
+  readonly '~standard': {
+    readonly version: 1
+    readonly vendor: string
+    readonly validate: (value: unknown) => StandardResult<Output> | Promise<StandardResult<Output>>
+  }
+}
+type StandardResult<Output> =
+  | { readonly value: Output; readonly issues?: undefined }
+  | { readonly issues: ReadonlyArray<StandardIssue> }
+export interface StandardIssue {
+  readonly message: string
+  readonly path?: ReadonlyArray<PropertyKey | { key: PropertyKey }>
+}
+export type InferOutput<S> = S extends StandardSchemaV1<unknown, infer O> ? O : never
+export type ValidateOk<T> = { ok: true; value: T }
+export type ValidateErr = { ok: false; issues: ReadonlyArray<StandardIssue> }
+
+export async function validate<S extends StandardSchemaV1 | undefined>(
+  schema: S,
+  input: unknown,
+): Promise<ValidateOk<S extends StandardSchemaV1 ? InferOutput<S> : unknown> | ValidateErr> {
+  if (schema === undefined) return { ok: true, value: input as never }
+  let result = schema['~standard'].validate(input)
+  if (result instanceof Promise) result = await result
+  if (result.issues) return { ok: false, issues: result.issues }
+  return { ok: true, value: result.value as never }
+}

package/runtime/treaty.ts

@@ -0,0 +1,131 @@
+const METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head'])
+
+export interface TreatyResponse<Data = unknown, Err = unknown> {
+  data: Data | null
+  error: { status: number; value: Err } | null
+  status: number
+  headers: Record<string, string>
+  response: Response | null
+}
+export interface ClientOptions {
+  prefix?: string
+  headers?: Record<string, string> | (() => Record<string, string>)
+  fetch?: typeof fetch
+}
+
+function resolvePrefix(opts?: ClientOptions): string {
+  if (opts?.prefix) return opts.prefix
+  const g = (globalThis as { __BRUST_ACTION_PREFIX__?: string }).__BRUST_ACTION_PREFIX__
+  return g ?? '/_brust/action'
+}
+
+/** Build a treaty proxy. Static segments accumulate as a path; a function call
+ * with an object fills the next {param}(s) positionally (in insertion order); a
+ * terminal method key (.get/.post/…) performs the request. URL is composed from
+ * the literal accumulated segments — never from any inferred type. */
+export function client<App = unknown>(opts?: ClientOptions): App {
+  const prefix = resolvePrefix(opts)
+  const doFetch = opts?.fetch ?? fetch
+  function make(segments: string[]): any {
+    return new Proxy(() => {}, {
+      get(_t, key: string) {
+        if (METHODS.has(key)) {
+          return async (arg1?: unknown, arg2?: unknown): Promise<TreatyResponse> => {
+            const isBodyless = key === 'get' || key === 'head'
+            const options = (isBodyless ? arg1 : arg2) as
+              | { query?: Record<string, string>; headers?: Record<string, string> }
+              | undefined
+            const body = isBodyless ? undefined : arg1
+            let url = prefix + '/' + segments.join('/')
+            if (options?.query) {
+              const qs = new URLSearchParams(options.query as Record<string, string>).toString()
+              if (qs) url += '?' + qs
+            }
+            const baseHeaders =
+              typeof opts?.headers === 'function' ? opts.headers() : (opts?.headers ?? {})
+            const init: RequestInit = {
+              method: key.toUpperCase(),
+              headers: { ...baseHeaders, ...(options?.headers ?? {}) },
+            }
+            if (!isBodyless && body !== undefined) {
+              if (hasFilePart(body)) {
+                init.body = toFormData(body)
+                // Let fetch set the multipart boundary; a stale content-type
+                // (e.g. from caller headers) would break it.
+                delete (init.headers as Record<string, string>)['content-type']
+              } else {
+                init.body = JSON.stringify(body)
+                ;(init.headers as Record<string, string>)['content-type'] = 'application/json'
+              }
+            }
+            try {
+              const res = await doFetch(url, init)
+              const text = await res.text()
+              const parsed = text ? safeJson(text) : undefined
+              const headers: Record<string, string> = {}
+              res.headers.forEach((v, k) => {
+                headers[k] = v
+              })
+              if (res.ok)
+                return {
+                  data: parsed ?? null,
+                  error: null,
+                  status: res.status,
+                  headers,
+                  response: res,
+                }
+              return {
+                data: null,
+                error: { status: res.status, value: parsed ?? text },
+                status: res.status,
+                headers,
+                response: res,
+              }
+            } catch (err) {
+              return {
+                data: null,
+                error: { status: 0, value: err },
+                status: 0,
+                headers: {},
+                response: null,
+              }
+            }
+          }
+        }
+        return make([...segments, key])
+      },
+      apply(_t, _this, args: unknown[]) {
+        const arg = args[0] as Record<string, string> | undefined
+        if (!arg) return make(segments)
+        return make([...segments, ...Object.values(arg).map(String)])
+      },
+    })
+  }
+  return make([]) as App
+}
+
+function hasFilePart(b: unknown): boolean {
+  if (b instanceof FormData || b instanceof Blob) return true
+  if (b && typeof b === 'object')
+    return Object.values(b as Record<string, unknown>).some((v) => v instanceof Blob)
+  return false
+}
+
+function toFormData(b: unknown): FormData {
+  if (b instanceof FormData) return b
+  const fd = new FormData()
+  for (const [k, v] of Object.entries(b as Record<string, unknown>)) {
+    if (v instanceof Blob) fd.append(k, v)
+    else if (v !== null && typeof v === 'object') fd.append(k, JSON.stringify(v))
+    else fd.append(k, String(v))
+  }
+  return fd
+}
+
+function safeJson(s: string): unknown {
+  try {
+    return JSON.parse(s)
+  } catch {
+    return s
+  }
+}

package/runtime/cli/actions-prebuilt-plugin.ts

@@ -1,97 +0,0 @@
-import { writeFile } from 'node:fs/promises'
-import { resolve } from 'node:path'
-import type { BunPlugin } from 'bun'
-
-/** Write a TypeScript file that re-exports `scanActions` as a pure function
- * returning a hard-coded ActionDef[]. Bundle this file via `actionsPrebuiltPlugin`
- * below to satisfy `import { scanActions } from './scan-actions.ts'` lookups
- * inside the runtime bundle without walking the filesystem at runtime.
- *
- * `idToSourcePath` maps each discovered action id → absolute path of the
- * `'use server'` file it was exported from. The orchestrator builds this map
- * by calling `collectExports(sourceFile)` for every file in `scan.sourceFiles`.
- *
- * `repoRoot` is the absolute path of the brust repo (where `runtime/` lives).
- * `outPath` is where to write the generated file (e.g. <outDir>/_actions-prebuilt.ts).
- */
-export async function writePrebuiltActionsFileWithMap(
-  outPath: string,
-  idToSourcePath: Map<string, string>,
-  repoRoot: string,
-): Promise<void> {
-  const actionsPath = resolve(repoRoot, 'runtime/actions.ts')
-  const scanPath = resolve(repoRoot, 'runtime/scan-actions.ts')
-
-  // Stable file order = stable import order = deterministic builds.
-  const filePaths = [...new Set(idToSourcePath.values())].sort()
-  const fileToVar = new Map<string, string>()
-  filePaths.forEach((p, i) => {
-    fileToVar.set(p, `__mod${i}`)
-  })
-
-  const imports = filePaths
-    .map((p, i) => `import * as __mod${i} from ${JSON.stringify(p)}`)
-    .join('\n')
-
-  const sortedIds = [...idToSourcePath.keys()].sort((a, b) => a.localeCompare(b))
-  const entries = sortedIds
-    .map((id) => {
-      const v = fileToVar.get(idToSourcePath.get(id)!)!
-      const key = JSON.stringify(id)
-      return `  { id: ${key}, fn: (${v}[${key}] as any), middleware: getActionMiddleware(${v}[${key}]) }`
-    })
-    .join(',\n')
-
-  const src = `// AUTO-GENERATED by brust build — do not edit.
-import { getActionMiddleware } from ${JSON.stringify(actionsPath)}
-import type { ActionDef } from ${JSON.stringify(actionsPath)}
-import type { ScanOptions, ScanActionsResult } from ${JSON.stringify(scanPath)}
-${imports}
-
-// Re-export auxiliaries so any bundle import from scan-actions.ts still resolves.
-export { stripLeadingTrivia, hasUseServerDirective, collectExports } from ${JSON.stringify(scanPath)}
-export type { ScanOptions, ScanActionsResult } from ${JSON.stringify(scanPath)}
-
-const PREBUILT: ActionDef[] = [
-${entries}
-]
-
-export async function scanActions(_opts: ScanOptions = {}): Promise<ScanActionsResult> {
-  return { actions: PREBUILT, sourceFiles: [] }
-}
-`
-  await writeFile(outPath, src, 'utf-8')
-}
-
-/** Bun.build plugin that aliases `runtime/scan-actions.ts` to the generated
- * prebuilt file. Combined with `writePrebuiltActionsFileWithMap` this makes
- * the bundled `scanActions()` return a hard-coded list. */
-export function actionsPrebuiltPlugin(generatedFilePath: string, repoRoot: string): BunPlugin {
-  const targetPath = resolve(repoRoot, 'runtime/scan-actions.ts')
-
-  return {
-    name: 'brust-actions-prebuilt',
-    setup(build) {
-      build.onResolve({ filter: /.*/ }, (args) => {
-        // The generated file re-exports symbols from scan-actions.ts. Without this
-        // guard those re-exports would self-redirect back into the generated file,
-        // creating a circular module graph where the re-exported bindings resolve
-        // to `undefined`.
-        if (args.importer === generatedFilePath) return undefined
-
-        // Match the canonical scan-actions.ts file regardless of how it's
-        // imported (relative './scan-actions.ts' from runtime/index.ts, etc.).
-        // Resolve the import to an absolute path and compare.
-        const resolved = resolve(
-          args.importer ? args.importer.replace(/\/[^/]*$/, '') : repoRoot,
-          args.path,
-        )
-        if (resolved === targetPath || resolved + '.ts' === targetPath) {
-          return { path: generatedFilePath }
-        }
-        // Default resolution for everything else.
-        return undefined
-      })
-    },
-  }
-}

package/runtime/scan-actions.ts

@@ -1,172 +0,0 @@
-import { relative } from 'node:path'
-import type { ActionDef, ActionFn } from './actions.ts'
-import { isValidActionId, getActionMiddleware } from './actions.ts'
-
-const DIRECTIVE_HEAD_BYTES = 512
-
-/** Remove leading whitespace, line comments (`//`), and block comments
- * from `src` and return the rest. Stops at the first non-trivial character.
- * Does NOT understand string literals — fine because we only run this on a
- * directive prologue, which by spec contains comments and the directive only.
- * If a block comment never terminates, returns '' so the caller treats the
- * file as non-server. */
-export function stripLeadingTrivia(src: string): string {
-  let i = 0
-  while (i < src.length) {
-    const ch = src[i]
-    if (ch === ' ' || ch === '\t' || ch === '\r' || ch === '\n') {
-      i++
-      continue
-    }
-    if (ch === '/' && src[i + 1] === '/') {
-      const nl = src.indexOf('\n', i)
-      if (nl === -1) return ''
-      i = nl + 1
-      continue
-    }
-    if (ch === '/' && src[i + 1] === '*') {
-      const end = src.indexOf('*/', i + 2)
-      if (end === -1) return ''
-      i = end + 2
-      continue
-    }
-    break
-  }
-  return src.slice(i)
-}
-
-const USE_SERVER_PATTERN = /^(?:'use server'|"use server")\s*;?\s*(?:\r?\n|$)/
-
-/** Read the first 512 bytes of `filePath` and return true iff a file-level
- * `'use server'` directive sits at the prologue position (before any import
- * or other statement). Comments and whitespace ahead of the directive are
- * skipped. Mirrors the TC39 directive-prologue rule. */
-export async function hasUseServerDirective(filePath: string): Promise<boolean> {
-  const f = Bun.file(filePath)
-  const head = await f.slice(0, DIRECTIVE_HEAD_BYTES).text()
-  const stripped = stripLeadingTrivia(head)
-  return USE_SERVER_PATTERN.test(stripped)
-}
-
-/** Dynamically import `filePath` and collect every named function export as
- * an ActionDef. Skips non-function exports silently. Throws on:
- *   - default export (must be named)
- *   - class export (calling a class without `new` would 500 at dispatch)
- *   - invalid id charset
- *   - zero function exports (likely a bug — file marked 'use server' but
- *     publishes nothing).
- * Middleware metadata installed by withMiddleware is preserved. */
-export async function collectExports(filePath: string): Promise<ActionDef[]> {
-  const mod = (await import(filePath)) as Record<string, unknown>
-  const defs: ActionDef[] = []
-  for (const [name, value] of Object.entries(mod)) {
-    if (typeof value !== 'function') continue
-    // typeof class{} is 'function' in JS; reject explicitly so an accidental
-    // `export class Foo {}` in a 'use server' file fails loudly at scan,
-    // not with a confusing 500 at dispatch.
-    if (Function.prototype.toString.call(value).startsWith('class ')) {
-      throw new Error(
-        `${filePath}: export "${name}" is a class. Actions must be plain async functions, not class constructors.`,
-      )
-    }
-    if (name === 'default') {
-      throw new Error(`${filePath}: default exports are not action-eligible. Use named export.`)
-    }
-    if (!isValidActionId(name)) {
-      throw new Error(
-        `${filePath}: export "${name}" has invalid id (must match [A-Za-z0-9_-]+, 1-128 chars).`,
-      )
-    }
-    defs.push({
-      id: name,
-      fn: value as ActionFn,
-      middleware: getActionMiddleware(value),
-    })
-  }
-  if (defs.length === 0) {
-    throw new Error(`${filePath}: marked 'use server' but exports no functions.`)
-  }
-  return defs
-}
-
-export interface ScanOptions {
-  /** Glob roots to scan from. Default: ['./']. Pass an explicit root (e.g.
-   * `import.meta.dirname`) when the project layout includes sibling subtrees
-   * you don't want scanned — typical for example apps inside a larger repo. */
-  roots?: string[]
-  /** Ignore globs (matched against the path relative to each root). Override
-   * the default array if you need a different policy — there's no merge.
-   * Default covers build outputs and test patterns. */
-  ignore?: string[]
-}
-
-const DEFAULT_IGNORE = Object.freeze([
-  'node_modules/**',
-  '.brust/**',
-  'dist/**',
-  'build/**',
-  'tests/**',
-  '__tests__/**',
-  '*.test.ts',
-  '*.test.tsx',
-  '*.spec.ts',
-  '*.spec.tsx',
-])
-
-const FILE_PATTERN = '**/*.{ts,tsx,js,jsx,mjs,cjs}'
-
-async function findCandidateFiles(opts: ScanOptions): Promise<string[]> {
-  const roots = opts.roots ?? ['./']
-  const ignore = opts.ignore ?? [...DEFAULT_IGNORE]
-  const ignoreGlobs = ignore.map((p) => new Bun.Glob(p))
-  const out: string[] = []
-  for (const root of roots) {
-    const glob = new Bun.Glob(FILE_PATTERN)
-    for await (const f of glob.scan({ cwd: root, dot: false, absolute: true })) {
-      const rel = relative(root, f)
-      if (ignoreGlobs.some((g) => g.match(rel))) continue
-      out.push(f)
-    }
-  }
-  return out
-}
-
-export interface ScanActionsResult {
-  actions: ActionDef[]
-  /** Absolute paths of files that had a `'use server'` directive — needed by
-   * `brust.buildMcpManifest` to feed the TypeScript compiler API extractor. */
-  sourceFiles: string[]
-}
-
-/** Walk the project, find files whose first statement is `'use server'`,
- * import each, and return all named function exports as ActionDef[] plus the
- * list of server source files.
- * Throws on duplicate ids across files. Always returns actions sorted by id
- * for deterministic logging. */
-export async function scanActions(opts: ScanOptions = {}): Promise<ScanActionsResult> {
-  const candidates = await findCandidateFiles(opts)
-  // Run directive checks in parallel — file IO scales well there.
-  const directiveChecks = await Promise.all(
-    candidates.map(async (p) => ({ path: p, isServer: await hasUseServerDirective(p) })),
-  )
-  const serverFiles = directiveChecks.filter((c) => c.isServer).map((c) => c.path)
-
-  // Serial imports — heavy module side effects shouldn't all fire at once.
-  const byId = new Map<string, string>()
-  const all: ActionDef[] = []
-  for (const file of serverFiles) {
-    const defs = await collectExports(file)
-    for (const def of defs) {
-      const prior = byId.get(def.id)
-      if (prior) {
-        throw new Error(
-          `Duplicate action "${def.id}" — defined in both ${prior} and ${file}. Rename one.`,
-        )
-      }
-      byId.set(def.id, file)
-      all.push(def)
-    }
-  }
-  all.sort((a, b) => a.id.localeCompare(b.id))
-  return { actions: all, sourceFiles: serverFiles }
-}