npm - brustjs - Versions diffs - 0.1.24-alpha → 0.1.26-alpha - Mend

brustjs 0.1.24-alpha → 0.1.26-alpha

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/example/pokedex/actions.ts +10 -2
package/example/pokedex/app.css +56 -30
package/example/pokedex/components/AddToTeamButton.tsx +1 -2
package/example/pokedex/components/AppLayout.tsx +15 -27
package/example/pokedex/components/NavLink.tsx +50 -0
package/example/pokedex/components/NavPreloader.tsx +21 -0
package/example/pokedex/components/ThemeToggle.tsx +51 -0
package/example/pokedex/lib/loaders.ts +14 -6
package/example/pokedex/lib/pokeapi.ts +7 -5
package/example/pokedex/lib/types.ts +1 -0
package/package.json +11 -9
package/runtime/client/index.ts +4 -0
package/runtime/cookies.ts +61 -0
package/runtime/define-actions.ts +34 -7
package/runtime/index.js +52 -52
package/runtime/index.ts +9 -0
package/runtime/islands/bootstrap.ts +10 -1
package/runtime/islands/island.tsx +8 -4
package/runtime/islands/native-render.ts +3 -1
package/runtime/loader-cache.ts +42 -0
package/runtime/navigation/active-nav.ts +75 -0
package/runtime/navigation/index.ts +13 -0
package/runtime/navigation/react.ts +24 -0
package/runtime/navigation/store.ts +208 -0
package/runtime/request-context.ts +35 -0
package/runtime/routes.ts +96 -25
package/runtime/treaty.ts +47 -10
package/runtime/treaty.type-test.ts +69 -0
package/runtime/tsconfig.typecheck.json +23 -0

package/runtime/navigation/active-nav.ts ADDED Viewed

@@ -0,0 +1,75 @@
+// runtime/navigation/active-nav.ts
+// The DOM consumer of the navigation store. Installs two effects:
+//  - nav.path  → reconcile is-active/aria-current on links in [data-brust-active-nav]
+//  - nav.phase → mirror to <html data-brust-nav> for CSS-driven indicators
+// Attribute name [data-brust-active-nav] is deliberately distinct from the
+// <html data-brust-nav> phase attr so the reconciler never treats <html> as a
+// container (which would toggle is-active on every <a> in the document).
+import { effect } from '../store/signal.ts'
+import { nav, type NavPhase } from './store.ts'
+// The install guard lives on globalThis (like __BRUST_NAV__), NOT as a module
+// `let`: every Bun.build island chunk inlines its own copy of this module, so a
+// module-local flag would not stop a second chunk from installing a duplicate
+// pair of effects (both resolve the same singleton signals → double reconcile).
+interface ActiveNavState {
+  installed: boolean
+  disposers: Array<() => void>
+}
+const GA = globalThis as { __BRUST_ACTIVE_NAV__?: ActiveNavState }
+function activeNavState(): ActiveNavState {
+  if (!GA.__BRUST_ACTIVE_NAV__) GA.__BRUST_ACTIVE_NAV__ = { installed: false, disposers: [] }
+  return GA.__BRUST_ACTIVE_NAV__
+}
+export function installActiveNav(): void {
+  const a = activeNavState()
+  if (a.installed) return
+  a.installed = true
+  // effect() runs eagerly once and re-runs whenever a signal it read changes;
+  // it returns a disposer we keep so __resetActiveNavForTest can unsubscribe.
+  a.disposers = [
+    effect(() => {
+      const path = nav.path()
+      reconcileActiveLinks(path)
+    }),
+    effect(() => {
+      const phase = nav.phase()
+      setHtmlNav(phase)
+    }),
+  ]
+}
+function setHtmlNav(phase: NavPhase): void {
+  if (typeof document === 'undefined' || !document.documentElement) return
+  // 'success' is a transient logical phase; the DOM attr returns to idle so
+  // loading indicators clear once committed.
+  document.documentElement.setAttribute('data-brust-nav', phase === 'success' ? 'idle' : phase)
+}
+function reconcileActiveLinks(currentPath: string): void {
+  if (typeof document === 'undefined') return
+  const containers = document.querySelectorAll<HTMLElement>('[data-brust-active-nav]')
+  for (const el of Array.from(containers)) {
+    const activeClass = el.dataset.brustActiveClass || 'is-active'
+    const prefix = el.dataset.brustActiveMatch === 'prefix'
+    const links = el.querySelectorAll<HTMLAnchorElement>('a[href]')
+    for (const a of Array.from(links)) {
+      const linkPath = new URL(a.href, location.href).pathname
+      const isActive = prefix
+        ? currentPath === linkPath || currentPath.startsWith(`${linkPath.replace(/\/$/, '')}/`)
+        : currentPath === linkPath
+      a.classList.toggle(activeClass, isActive)
+      if (isActive) a.setAttribute('aria-current', 'page')
+      else a.removeAttribute('aria-current')
+    }
+  }
+}
+// Test-only: dispose the installed effects and clear the guard so a subsequent
+// installActiveNav() rebinds to the fresh singleton (after __resetNavForTest).
+export function __resetActiveNavForTest(): void {
+  const a = activeNavState()
+  for (const d of a.disposers) d()
+  GA.__BRUST_ACTIVE_NAV__ = undefined
+}

package/runtime/navigation/index.ts ADDED Viewed

@@ -0,0 +1,13 @@
+// runtime/navigation/index.ts — brustjs/navigation. React-free, DOM-free entry.
+// (active-nav.ts uses DOM globals but imports no DOM module; it's re-exported for
+// authors who add nav containers dynamically. bootstrap wires it automatically.)
+export type { NavPhase, NavState, NavStore } from './store.ts'
+export {
+  nav,
+  getNavState,
+  subscribe,
+  onBeforeNavigate,
+  onNavigate,
+  onNavigateError,
+} from './store.ts'
+export { installActiveNav } from './active-nav.ts'

package/runtime/navigation/react.ts ADDED Viewed

@@ -0,0 +1,24 @@
+// React view-layer adapter for the navigation store. Lives OUTSIDE navigation/
+// index.ts (which stays React-free + in the typecheck:treaty gate) and is reached
+// only via brustjs/client, the browser/island entry. Uses useSyncExternalStore so
+// a React island re-renders on every navigation transition; getNavState is
+// version-memoized (store.ts) so the snapshot is referentially stable.
+import { useSyncExternalStore } from 'react'
+import { getNavState, subscribe, type NavState } from './store.ts'
+/** Watch the navigation state from a React island.
+ *
+ * ```tsx
+ * import { useNav } from 'brustjs/client'
+ * function Crumb() {
+ *   const { path, phase } = useNav()
+ *   return <span>{phase === 'loading' ? 'Loading…' : path}</span>
+ * }
+ * ```
+ *
+ * The third arg (server snapshot) is the same getter — on the server the store
+ * holds its idle defaults (no `location`), so SSR renders the idle state and the
+ * client hydrates the real one on mount. */
+export function useNav(): NavState {
+  return useSyncExternalStore(subscribe, getNavState, getNavState)
+}

package/runtime/navigation/store.ts ADDED Viewed

@@ -0,0 +1,208 @@
+// runtime/navigation/store.ts
+// Client-side navigation state for brust, driven by the SPA navigator in
+// runtime/islands/bootstrap.ts. Fully React-free AND DOM-free: __navInit takes
+// the initial path/search as arguments (bootstrap reads location), so this module
+// imports nothing web-API and unit-tests without a DOM. The DOM consumer (active
+// links + html[data-brust-nav]) lives in ./active-nav.ts.
+//
+// The `nav` bag of signals is a singleton stashed on globalThis.__BRUST_NAV__:
+// signals share their reactive tracker cross-chunk via Symbol.for (see
+// store/signal.ts), but the bag OBJECT must also be shared or each Bun.build
+// chunk would build its own — the stash gives one object identity for all chunks.
+import { batch, signal, type Signal } from '../store/signal.ts'
+export type NavPhase = 'idle' | 'loading' | 'success' | 'error'
+export interface NavState {
+  path: string
+  search: string
+  phase: NavPhase
+  error: Error | null
+  from: string | null
+  to: string | null
+}
+export interface NavStore {
+  path: Signal<string>
+  search: Signal<string>
+  phase: Signal<NavPhase>
+  error: Signal<Error | null>
+  from: Signal<string | null>
+  to: Signal<string | null>
+}
+type BeforeCb = (e: { from: string; to: string }) => void
+type NavCb = (e: NavState) => void
+type ErrorCb = (e: { to: string; error: Error }) => void
+interface NavInternal extends NavStore {
+  _subs: Set<NavCb>
+  _before: Set<BeforeCb>
+  _success: Set<NavCb>
+  _error: Set<ErrorCb>
+  // version bumps once per committed transition (in emit); `_snap` memoizes the
+  // NavState for that version so getNavState() returns a referentially-stable
+  // object — required by React's useSyncExternalStore (a fresh object each call
+  // would infinite-loop "getSnapshot should be cached"). Mirrors defineStore.
+  _version: number
+  _snap: { value: NavState; version: number } | null
+}
+function createNav(): NavInternal {
+  return {
+    path: signal(''),
+    search: signal(''),
+    phase: signal<NavPhase>('idle'),
+    error: signal<Error | null>(null),
+    from: signal<string | null>(null),
+    to: signal<string | null>(null),
+    _subs: new Set(),
+    _before: new Set(),
+    _success: new Set(),
+    _error: new Set(),
+    _version: 0,
+    _snap: null,
+  }
+}
+const G = globalThis as { __BRUST_NAV__?: NavInternal }
+function store(): NavInternal {
+  if (!G.__BRUST_NAV__) G.__BRUST_NAV__ = createNav()
+  return G.__BRUST_NAV__
+}
+// Public reactive handle. A Proxy resolves the singleton on each property access
+// so (a) every chunk's `nav` points at the one globalThis bag, and (b) tests that
+// reset the singleton see the fresh signals.
+export const nav: NavStore = new Proxy({} as NavStore, {
+  get(_t, prop: string | symbol) {
+    // Symbol keys (Symbol.toPrimitive, Symbol.for('brust.signal') brand probes,
+    // React DevTools, etc.) are never store fields — return undefined without
+    // forcing a lazy singleton init.
+    if (typeof prop !== 'string') return undefined
+    return (store() as unknown as Record<string, unknown>)[prop]
+  },
+})
+export function getNavState(): NavState {
+  const s = store()
+  // Return the memoized snapshot if no transition has happened since it was
+  // built (referential stability for useSyncExternalStore).
+  if (s._snap && s._snap.version === s._version) return s._snap.value
+  const value: NavState = {
+    path: s.path(),
+    search: s.search(),
+    phase: s.phase(),
+    error: s.error(),
+    from: s.from(),
+    to: s.to(),
+  }
+  s._snap = { value, version: s._version }
+  return value
+}
+// Bump the snapshot version immediately after a batch of signal writes so the
+// NEXT getNavState() rebuilds (the lifecycle callbacks + emit must see committed
+// state, not the stale memoized snapshot). Called once per transition, right
+// after the batch and before any callback/getNavState read.
+function bumpVersion(s: NavInternal): void {
+  s._version += 1
+}
+function emit(s: NavInternal): void {
+  const snap = getNavState()
+  for (const cb of [...s._subs]) cb(snap)
+}
+export function subscribe(cb: NavCb): () => void {
+  const s = store()
+  s._subs.add(cb)
+  return () => s._subs.delete(cb)
+}
+export function onBeforeNavigate(cb: BeforeCb): () => void {
+  const s = store()
+  s._before.add(cb)
+  return () => s._before.delete(cb)
+}
+export function onNavigate(cb: NavCb): () => void {
+  const s = store()
+  s._success.add(cb)
+  return () => s._success.delete(cb)
+}
+export function onNavigateError(cb: ErrorCb): () => void {
+  const s = store()
+  s._error.add(cb)
+  return () => s._error.delete(cb)
+}
+// Each lifecycle mutator writes several signals. We wrap the writes in batch()
+// so a consumer effect reading multiple fields (e.g. nav.path() + nav.phase())
+// re-runs ONCE on the settled state instead of firing on each torn intermediate
+// write. The lifecycle callbacks (_before/_success/_error) and emit() run AFTER
+// the batch so they observe fully-committed state.
+export function __navInit(path: string, search: string): void {
+  const s = store()
+  batch(() => {
+    s.path.set(path)
+    s.search.set(search)
+    s.phase.set('idle')
+    s.from.set(null)
+    s.to.set(null)
+    s.error.set(null)
+  })
+  bumpVersion(s)
+  emit(s)
+}
+// `toSearch` is intentionally unused during 'loading': search is part of the
+// COMMITTED state and is written by __navCommit, not while the fetch is pending.
+// Kept in the signature for call-site symmetry with __navCommit.
+export function __navStart(toPath: string, _toSearch: string): void {
+  const s = store()
+  const from = s.path()
+  batch(() => {
+    s.from.set(from)
+    s.to.set(toPath)
+    s.error.set(null)
+    s.phase.set('loading')
+  })
+  bumpVersion(s)
+  for (const cb of [...s._before]) cb({ from, to: toPath })
+  emit(s)
+}
+export function __navCommit(toPath: string, toSearch: string): void {
+  const s = store()
+  batch(() => {
+    s.path.set(toPath)
+    s.search.set(toSearch)
+    s.to.set(null)
+    s.error.set(null)
+    s.phase.set('success')
+  })
+  bumpVersion(s)
+  const snap = getNavState()
+  for (const cb of [...s._success]) cb(snap)
+  emit(s)
+}
+// Accepts `unknown` because the only caller is bootstrap's catch block (err is
+// `unknown` under strict TS); coerce non-Error throws (strings, DOMException)
+// into an Error so consumers always get a stable shape.
+export function __navError(toPath: string, error: unknown): void {
+  const s = store()
+  const err = error instanceof Error ? error : new Error(String(error))
+  batch(() => {
+    s.to.set(null)
+    s.error.set(err)
+    s.phase.set('error')
+  })
+  bumpVersion(s)
+  for (const cb of [...s._error]) cb({ to: toPath, error: err })
+  emit(s)
+}
+// Test-only: drop the singleton so the next access rebuilds fresh signals.
+export function __resetNavForTest(): void {
+  G.__BRUST_NAV__ = undefined
+}

package/runtime/request-context.ts ADDED Viewed

@@ -0,0 +1,35 @@
+// This module imports a Node builtin (node:async_hooks) and therefore must NOT
+// be reachable from browser/island bundles (brustjs/client) or from the
+// isomorphic store entry (brustjs/store). It mirrors store/server-context.ts:
+// the server pulls it in via routes.ts, where each request is wrapped in a
+// per-request scope. cookies.ts reaches the active scope through __scope().
+import { AsyncLocalStorage } from 'node:async_hooks'
+interface RequestScope {
+  ctx: Map<string, unknown>
+  reqCookies: Record<string, string>
+  setCookies: string[]
+}
+const reqCtx = new AsyncLocalStorage<RequestScope>()
+/** Open a per-request scope. `reqCookies` is the parsed incoming Cookie header
+ * (BrustRequest.cookies). Staged Set-Cookie strings accumulate in `setCookies`
+ * and are flushed by routes.ts onto the response headers. */
+export function runInRequestScope<T>(reqCookies: Record<string, string>, fn: () => T): T {
+  return reqCtx.run({ ctx: new Map(), reqCookies, setCookies: [] }, fn)
+}
+/** Per-request scratch Map for apps building request-scoped state on top of the
+ * module-global store. Throws when called outside a request scope. */
+export function getRequestContext(): Map<string, unknown> {
+  const s = reqCtx.getStore()
+  if (!s) throw new Error('getRequestContext() called outside a request scope')
+  return s.ctx
+}
+/** Internal — the active scope (or undefined). Used by cookies.ts and the
+ * routes.ts flush. Not re-exported from the package entry. */
+export function __scope(): RequestScope | undefined {
+  return reqCtx.getStore()
+}

package/runtime/routes.ts CHANGED Viewed

@@ -11,6 +11,8 @@ import { Buffer } from 'node:buffer'
 import * as native from './index.js'
 import { renderBranchStreaming } from './render/stream.ts'
 import { runInStoreContext, collectSnapshot } from './store/server-context.ts'
+import { runInRequestCache } from './loader-cache.ts'
+import { runInRequestScope, __scope } from './request-context.ts'
 import {
   loadIslandManifest,
   resolveIslandContext,
@@ -23,6 +25,16 @@ import type { EndpointDef } from './define-actions.ts'
 import { isRespondSentinel, makeRespond } from './define-actions.ts'
 import { validate } from './standard-schema.ts'
+// S2 + B3 — unified per-request scope. The request scope (B3 cookies/context) is
+// the OUTERMOST layer, then the request-scoped loader cache/dedupe (S2: one Map
+// per request for `cachedFetch`/`dedupe` across loaders AND render), then the
+// store scope (per-request store instance). `reqCookies` is the parsed incoming
+// Cookie header so a loader's `cookies.get` reads it and `cookies.set` stages
+// onto this scope (flushed onto response headers via flushSetCookie).
+function runInRequestContext<T>(reqCookies: Record<string, string>, fn: () => T): T {
+  return runInRequestScope(reqCookies, () => runInRequestCache(() => runInStoreContext(fn)))
+}
 // Sub-project J — island ISR cache, backed by the Rust-side store (shared across
 // the worker pool) via NAPI. napi-rs maps snake→camel: island_cache_get →
 // islandCacheGet, island_cache_set → islandCacheSet. `as any` avoids depending on
@@ -725,7 +737,9 @@ export function makeRenderer(
           // child loaders (one Map per request — NOT one per loader). No
           // snapshot is collected and no <script> is injected on native paths —
           // Spec B owns native store delivery (hard non-goal here).
-          chainResult = await runInStoreContext(() => runNativeChainLoaders(flat.chain, ctx))
+          chainResult = await runInRequestContext(call.req?.cookies ?? {}, () =>
+            runNativeChainLoaders(flat.chain, ctx),
+          )
         } catch (err) {
           console.error(`[brust] loader failed for native route ${flat.fullPath}:`, err)
           // FAST LANE: native routes take dispatch_single_chunk (no chunk
@@ -756,6 +770,13 @@ export function makeRenderer(
           data = chainResult.data
         }
         const json = JSON.stringify(data)
+        // napiRenderJinja has no headers param — any Set-Cookie staged by a
+        // native loader is dropped on this path. Dev-warn so it's not silent.
+        if ((__scope()?.setCookies.length ?? 0) > 0 && process.env.BRUST_DEV === '1') {
+          console.warn(
+            `[brust] cookies.set in a native loader for "${flat.nativeTemplate}" is dropped — native render has no headers; use a React route to write cookies`,
+          )
+        }
         // Sub-project J — islands + components. If this template has an enriched
         // islands manifest or a components manifest, merge per-island context vars
         // (island_<id>_props, plus island_<id>_html for ssr entries) and per-component
@@ -842,7 +863,7 @@ export function makeRenderer(
       // or render resolves the same per-request instance. Snapshot is collected
       // after loaders (buildRenderElement resolved) — that's where Spec A stores
       // are seeded — and threaded into the render for <script> injection.
-      return await runInStoreContext(async () => {
+      return await runInRequestContext(call.req?.cookies ?? {}, async () => {
         let element: ReactNode
         let errorBoundary: ComponentType<{ error: Error }>
         try {
@@ -869,7 +890,7 @@ export function makeRenderer(
           napi,
           errorBoundary,
           status: verdict.status,
-          headers: verdict.headers,
+          headers: flushSetCookie(verdict.headers),
           routePath: flat.fullPath,
           storeSnapshot,
         })
@@ -1047,12 +1068,19 @@ async function navigationBranch(
     // nav payload so the client can apply it to its live stores. Native nav
     // collects no snapshot (Spec B owns native store delivery).
     let store: Record<string, Record<string, unknown>> | null = null
+    // Set-Cookie staged by a React nav loader, flushed onto the nav response
+    // below. The request scope is opened per-path (inside runInRequestContext),
+    // so capture the flushed headers inside that scope — the emit runs after the
+    // scope has closed. Native nav (renderNativeRouteToHtml) opens its own scope
+    // with no headers param, so staged cookies are dropped there (same as the
+    // full-document native render path).
+    let navHeaders: Record<string, string> | undefined
     if (flat.nativeTemplate !== undefined) {
       fullHtml = await renderNativeRouteToHtml(call, flat, view, encoder, workerId)
     } else {
       // Wrap loader run (inside buildRenderElement) + render in one store scope so
       // store reads resolve the per-request instance; collect after render.
-      fullHtml = await runInStoreContext(async () => {
+      fullHtml = await runInRequestContext(call.req?.cookies ?? {}, async () => {
         const element = await buildRenderElement(call as any, flat, getWorkerId)
         if (!element) throw new Error('render setup failed')
         // Use renderToPipeableStream + onAllReady so pages with <Suspense> emit
@@ -1061,6 +1089,7 @@ async function navigationBranch(
         // would otherwise ship "loading…" and never recover.
         const html = await renderToAwaitedString(element)
         store = collectSnapshot()
+        navHeaders = flushSetCookie(undefined)
         return html
       })
     }
@@ -1087,6 +1116,7 @@ async function navigationBranch(
       status: 200,
       contentType: 'application/json; charset=utf-8',
       body,
+      headers: navHeaders,
     })
   } catch (err) {
     console.error('[brust] navigation render failed:', err)
@@ -1122,7 +1152,7 @@ async function renderNativeRouteToHtml(
   // Run the WHOLE route chain's loaders top-down and merge into ONE flat context
   // (child keys win), mirroring the full-render branch. One per-request store
   // scope wraps the entire loop (isolation only — no snapshot / no <script>).
-  const chainResult = await runInStoreContext(() =>
+  const chainResult = await runInRequestContext(call.req?.cookies ?? {}, () =>
     runNativeChainLoaders(flat.chain, {
       params: call.params,
       path: call.path,
@@ -1397,6 +1427,42 @@ function actionErrorResponse(err: ActionError): RouteResponse {
   }
 }
+/** Flush any cookies staged via `cookies.set`/`cookies.delete` in the active
+ * request scope onto the response headers.
+ *
+ * The Rust response-header writer stores worker-response headers in a
+ * CASE-SENSITIVE map (no lowercase dedup), so a mix of 'Set-Cookie' /
+ * 'set-cookie' would emit two lines. We therefore use the SINGLE canonical key
+ * 'set-cookie' (lowercase) for ALL cookie writes.
+ *
+ * RouteResponse.headers is Record<string,string>, so only ONE Set-Cookie per
+ * response is representable. If multiple were staged, only the LAST is sent
+ * (documented limitation; dev-warn). If the handler already set a 'set-cookie'
+ * header explicitly (respond({ headers })), the explicit value WINS and staged
+ * cookies are dropped (dev-warn on conflict). */
+function flushSetCookie(
+  headers: Record<string, string> | undefined,
+): Record<string, string> | undefined {
+  const staged = __scope()?.setCookies ?? []
+  if (staged.length === 0) return headers
+  if (headers && 'set-cookie' in headers) {
+    if (process.env.BRUST_DEV === '1') {
+      console.warn(
+        '[brust] cookies.set conflicts with an explicit set-cookie header — explicit respond() wins',
+      )
+    }
+    return headers
+  }
+  if (staged.length > 1 && process.env.BRUST_DEV === '1') {
+    console.warn(
+      `[brust] ${staged.length} cookies staged but only one Set-Cookie per response is supported — only the last is sent`,
+    )
+  }
+  const out = { ...(headers ?? {}) }
+  out['set-cookie'] = staged[staged.length - 1]
+  return out
+}
 export async function dispatchAction(
   call: Extract<RouteCall, { kind: 'action' }>,
   byId: Map<string, EndpointDef>,
@@ -1487,28 +1553,33 @@ export async function dispatchAction(
     }
   }
-  const chain = composeChain(call.req, def.middleware, terminal)
-  let response: RouteResponse
-  try {
-    response = await chain()
-  } catch (err) {
-    if (isActionError(err)) {
-      response = actionErrorResponse(err)
-    } else {
-      console.error('[brust] action middleware uncaught:', err)
-      response = {
-        status: 500,
-        body: '{"error":{"message":"internal error"}}',
-        contentType: 'application/json; charset=utf-8',
+  // Open a per-request scope (OUTER) so cookies.set during middleware/handler
+  // stage onto this request, then flush the staged Set-Cookie onto the response
+  // headers. The cache + store scopes wrap INNER — request-scope is outermost.
+  return await runInRequestContext(call.req.cookies ?? {}, async () => {
+    const chain = composeChain(call.req, def.middleware, terminal)
+    let response: RouteResponse
+    try {
+      response = await chain()
+    } catch (err) {
+      if (isActionError(err)) {
+        response = actionErrorResponse(err)
+      } else {
+        console.error('[brust] action middleware uncaught:', err)
+        response = {
+          status: 500,
+          body: '{"error":{"message":"internal error"}}',
+          contentType: 'application/json; charset=utf-8',
+        }
       }
     }
-  }
-  return {
-    status: response.status,
-    body: response.body,
-    contentType: response.contentType ?? 'application/json; charset=utf-8',
-    headers: response.headers,
-  }
+    return {
+      status: response.status,
+      body: response.body,
+      contentType: response.contentType ?? 'application/json; charset=utf-8',
+      headers: flushSetCookie(response.headers),
+    }
+  })
 }
 async function mcpBranchToResponse(

package/runtime/treaty.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { ActionsBuilder } from './define-actions.ts'
+import type { ActionsBuilder, EndpointEntry } from './define-actions.ts'
 const METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head'])
@@ -15,12 +15,6 @@ export interface ClientOptions {
   fetch?: typeof fetch
 }
-type FirstSegment<S extends string> = S extends `/${infer Rest}`
-  ? FirstSegment<Rest>
-  : S extends `${infer T}/${infer _U}`
-    ? T
-    : S
 export type PermissiveProxy = {
   (arg?: any): PermissiveProxy
   [key: string]: PermissiveProxy
@@ -33,10 +27,53 @@ export type PermissiveProxy = {
   head: (options?: any) => Promise<TreatyResponse<any, any>>
 }
+// ─── Typed Treaty<App> (B2, descoped) ───────────────────────────────────────
+// Static paths get fully-typed methods (output + discriminated error union);
+// any param path (`{...}`) or unknown segment falls through to PermissiveProxy.
+// Reference shape proven by spike5 (EXIT=0).
+/** Per-method client signatures for one endpoint-entry map (the `{ GET, POST, … }`
+ * object for a single path). Bodyless methods (GET/HEAD) take only options. */
+type Methods<E> = {
+  [M in keyof E & string as Lowercase<M>]: M extends 'GET' | 'HEAD'
+    ? E[M] extends EndpointEntry
+      ? (o?: {
+          query?: Record<string, string>
+          headers?: Record<string, string>
+        }) => Promise<TreatyResponse<E[M]['output'], E[M]['error']>>
+      : never
+    : E[M] extends EndpointEntry
+      ? (
+          b?: E[M]['input'],
+          o?: { headers?: Record<string, string> },
+        ) => Promise<TreatyResponse<E[M]['output'], E[M]['error']>>
+      : never
+}
+/** A path is static iff it contains no `{param}` segment. */
+type IsStatic<K extends string> = K extends `${string}{${string}}${string}` ? false : true
+/** Keep only the static path keys of the accumulator. */
+type StaticAcc<Acc> = {
+  [K in keyof Acc as K extends string ? (IsStatic<K> extends true ? K : never) : never]: Acc[K]
+}
+/** Given a path key `K` and the accumulated prefix `P`, the next segment after `P`. */
+type Tail<K extends string, P extends string> = K extends `${P}/${infer Rest}`
+  ? Rest extends `${infer H}/${string}`
+    ? H
+    : Rest
+  : never
+/** All immediate child segments under prefix `P`. */
+type ChildSegs<SA, P extends string> = { [K in keyof SA]: Tail<K & string, P> }[keyof SA]
+/** The entry map for the exact path `P`, if one exists. */
+// biome-ignore lint/complexity/noBannedTypes: `{}` is the empty-methods identity when no exact endpoint matches the prefix
+type ExactEntry<SA, P extends string> = P extends keyof SA ? SA[P] : {}
+/** A treaty node: methods of the exact path + child segment nodes + permissive fallback. */
+type TNode<SA, P extends string> = Methods<ExactEntry<SA, P>> & {
+  [Seg in ChildSegs<SA, P> & string]: TNode<SA, `${P}/${Seg}`>
+} & PermissiveProxy
 export type Treaty<App> =
-  App extends ActionsBuilder<infer Acc>
-    ? { [K in FirstSegment<keyof Acc & string>]: PermissiveProxy } & PermissiveProxy
-    : PermissiveProxy
+  App extends ActionsBuilder<infer Acc> ? TNode<StaticAcc<Acc>, ''> : PermissiveProxy
 function resolvePrefix(opts?: ClientOptions): string {
   if (opts?.prefix) return opts.prefix