oxidejs 0.1.10 → 0.2.1

package/README.md

@@ -76,15 +76,15 @@ export default {
 };
 ```
 
-`action()` is identity — it only marks the export. Wrap `async function*` in it to stream over tacho SSE. `oxidejs/tsconfig` makes `await ticks()` typecheck. Pass `{ signal }` last on any action to abort the fetch. Types come from the real `*.server.ts`, so declare the last argument there:
+`action()` is runtime identity — it marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over tacho SSE. Inside server code, always read the non-optional signal from `useRequest().signal`:
 
 ```ts
 // src/test.server.ts
-import { action } from "oxidejs";
-import type { ActionOptions } from "oxidejs";
+import { action, useRequest } from "oxidejs";
 
-export const ticks = action(async function* (n: number, _opts?: ActionOptions) {
-  for (let i = 0; i < n; i++) yield i;
+export const ticks = action(async function* (n: number) {
+  const { signal } = useRequest();
+  for (let i = 0; i < n && !signal.aborted; i++) yield i;
 });
 
 // src/client.ts
@@ -113,6 +113,27 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 
 ## Options
 
+### `middleware` and `imports`
+
+\`\`\`ts
+oxide({
+middleware: ["@ilha/router/ssr"], // string or { module, imports }
+imports: ["./side-effects"], // side-effect modules loaded at startup
+})
+\`\`\`
+
+Middleware handlers run in production before the action gate; the same specifiers are loaded through the SSR graph in dev, so dev and prod behave identically. Middleware entries may carry their own \`imports\`.
+
+### Other server options
+
+| Option        | Type   | Default | Description                                                          |
+| ------------- | ------ | ------- | -------------------------------------------------------------------- |
+| \`bodyLimit\` | number | 1048576 | Max request body size (Node preset); larger requests get 413         |
+| \`notFound\`  | string | —       | Custom HTML 404 body when no route or asset matches                  |
+| \`env\`       | object | —       | Passed as \`env\` to \`fetch(request, env, ctx)\` on the Node preset |
+
+## Options
+
 | Option                         | Default                  | Notes                                                                                       |
 | ------------------------------ | ------------------------ | ------------------------------------------------------------------------------------------- |
 | `preset`                       | `"fetch"`                | `"fetch"` or `"celld"`                                                                      |

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-CMEB9B4S.mjs";
+import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-BM4NAnzy.mjs";
 import { UnpluginFactory } from "unplugin";
 //#region src/context.d.ts
 type ExecutionContext = {
@@ -12,28 +12,25 @@ type ActionContext = {
   fetchCtx?: ExecutionContext;
   [key: string]: unknown;
 };
-/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/__oxide/action`. */
+/** Current tacho or host request context. Throws outside request handling. */
 declare function useCtx<C extends ActionContext = ActionContext>(): C;
-/** Current action `Request`. Throws outside `*.server.ts` running over `/__oxide/action`. */
+/** Current server `Request`. Available in actions, SSR, and frame renders. */
 declare function useRequest(): Request;
 /** Worker `env` from `fetch(request, env, ctx)`. `undefined` on the Node fetch preset. */
 declare function useEnv<E = unknown>(): E | undefined;
 /** Worker `ctx` from `fetch(request, env, ctx)` (`waitUntil`). Not tacho `ctx`. `undefined` on Node. */
 declare function useFetchCtx(): ExecutionContext | undefined;
-/** Optional last argument on a `*.server.ts` export so the client can pass `{ signal }`. */
-type ActionOptions = {
-  signal?: AbortSignal;
-};
 /**
- * Marks a `*.server.ts` export as a remote RPC action. Identity: returns `fn` unchanged.
- * Only exports wrapped in `action()` become callable over the wire; other exports stay
- * server-local. Wrap async functions and async generators.
+ * Marks a `*.server.ts` export as a remote RPC action. Runtime identity; the
+ * second call signature adds the transport-only `{ signal }` argument.
  */
-declare function action<T>(fn: T): T;
+declare function action<Args extends unknown[], Result>(fn: (...args: Args) => Result): typeof fn & ((...args: [...Args, options: {
+  signal?: AbortSignal;
+}]) => Result);
 //#endregion
 //#region src/index.d.ts
 declare const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined>;
 declare const oxidejs: import("unplugin").UnpluginInstance<OxidejsOptions | undefined, boolean>;
 declare const vite: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion
-export { type ActionContext, type ActionOptions, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };
+export { type ActionContext, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-CkhMD9M5.mjs";
+import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-CsQ-6GnW.mjs";
 export { action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/rsbuild.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-CMEB9B4S.mjs";
+import { r as OxidejsOptions } from "./types-BM4NAnzy.mjs";
 //#region src/rsbuild.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => any;
 //#endregion

package/dist/rsbuild.mjs

@@ -1,5 +1,6 @@
-import { t as oxidejs } from "./src-CkhMD9M5.mjs";
+import { t as oxidejs } from "./src-CsQ-6GnW.mjs";
 //#region src/rsbuild.ts
+/** @experimental Rsbuild integration is not yet implemented. */
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion
 export { rsbuild_default as default };

package/dist/{src-CkhMD9M5.mjs → src-CsQ-6GnW.mjs}

@@ -3,7 +3,41 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import fs from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/actions.ts
+var actions_exports = /* @__PURE__ */ __exportAll({
+	ACTION_PATH: () => ACTION_PATH,
+	RESOLVED_VIRTUAL_ACTIONS_ID: () => RESOLVED_VIRTUAL_ACTIONS_ID,
+	RESOLVED_VIRTUAL_CLIENT_ID: () => RESOLVED_VIRTUAL_CLIENT_ID,
+	RESOLVED_VIRTUAL_WORKER_ID: () => RESOLVED_VIRTUAL_WORKER_ID,
+	VIRTUAL_ACTIONS_ID: () => VIRTUAL_ACTIONS_ID,
+	VIRTUAL_CLIENT_ID: () => VIRTUAL_CLIENT_ID,
+	VIRTUAL_WORKER_ID: () => VIRTUAL_WORKER_ID,
+	generateActionsModule: () => generateActionsModule,
+	generateClientModule: () => generateClientModule,
+	generateClientStub: () => generateClientStub,
+	generateWorkerWrapper: () => generateWorkerWrapper,
+	isServerFileId: () => isServerFileId,
+	loadClientStub: () => loadClientStub,
+	moduleKey: () => moduleKey,
+	nodeToWebRequest: () => nodeToWebRequest,
+	parseExportedNames: () => parseExportedNames,
+	pluginShouldStub: () => pluginShouldStub,
+	scanServerFiles: () => scanServerFiles,
+	sendWebResponseFrom: () => sendWebResponseFrom,
+	shouldStubServerModule: () => shouldStubServerModule
+});
 const VIRTUAL_ACTIONS_ID = "virtual:oxide/actions";
 const RESOLVED_VIRTUAL_ACTIONS_ID = `\0${VIRTUAL_ACTIONS_ID}`;
 const VIRTUAL_WORKER_ID = "virtual:oxide/worker";
@@ -175,6 +209,8 @@ function generateWorkerWrapper(userWorkerAbs, opts = {}) {
 	const serveAssets = preset === "fetch" && (opts.hasClient === true || opts.hasPublic === true);
 	const hasActions = opts.hasActions !== false;
 	const ws = hasActions && opts.actions === "ws";
+	const bodyLimit = opts.bodyLimit ?? 1048576;
+	const nfBlock = `const __nf = ${`() => new Response(${JSON.stringify(opts.notFound ?? "<h1>404 Not Found</h1>")}, { status: 404, headers: { "content-type": "text/html; charset=utf-8" } })`};\n`;
 	const assetBlock = serveAssets ? `import { readFile } from "node:fs/promises";
 import { extname, join } from "node:path";
 const __assets = join(import.meta.dirname, ${JSON.stringify(clientDir)});
@@ -207,24 +243,31 @@ async function __asset(request, spa) {
     const headers = { "content-type": __types[extname(file)] ?? "application/octet-stream" };
     const cache = __cache(file);
     if (cache) headers["cache-control"] = cache;
+    const etag = '"' + body.length.toString(16) + "-" + file + '"';
+    headers["etag"] = etag;
+    if (request.headers.get("if-none-match") === etag) {
+      return new Response(null, { status: 304, headers });
+    }
     return new Response(body, { headers });
   } catch {
     return;
   }
 }
 ` : "";
+	const envJson = JSON.stringify(opts.env ?? {});
 	const afterAction = serveAssets ? `if (typeof user.fetch === "function") {
-      const hit = await user.fetch(request, env, ctx);
+      const hit = await user.fetch(request, env ?? ${envJson}, ctx);
       if (hit) return hit;
     }
-    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? new Response("Not Found", { status: 404 });` : `return typeof user.fetch === "function"
+    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? __nf();` : `return typeof user.fetch === "function"
       ? user.fetch(request, env, ctx)
-      : new Response("Not Found", { status: 404 });`;
+      : __nf();`;
 	const listen = preset === "fetch" ? `
 import { createServer } from "node:http";
 import { pathToFileURL } from "node:url";
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   const port = Number(process.env.PORT) || 3000;
+  const bodyLimit = ${bodyLimit};
   const server = createServer(async (req, res) => {
     const url = \`http://\${req.headers.host ?? "localhost"}\${req.url ?? "/"}\`;
     const headers = new Headers();
@@ -237,7 +280,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     req.once("aborted", () => ac.abort());
     const method = req.method ?? "GET";
     const chunks = [];
-    if (method !== "GET" && method !== "HEAD") for await (const chunk of req) chunks.push(chunk);
+    let size = 0;
+    if (method !== "GET" && method !== "HEAD") for await (const chunk of req) {
+      size += chunk.length;
+      // Bound request buffering — unbounded bodies are a memory DoS vector.
+      if (size > ${bodyLimit}) { res.statusCode = 413; res.end(); return; }
+      chunks.push(chunk);
+    }
     const init = { method, headers, signal: ac.signal };
     if (chunks.length) init.body = Buffer.concat(chunks);
     const response = await app.fetch(new Request(url, init));
@@ -260,6 +309,12 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   });` : ""}
   server.listen(port, () => console.log(\`oxidejs listening on \${port}\`));
 }
+  for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+      server.close(() => process.exit(0));
+      setTimeout(() => process.exit(0), 5000).unref();
+    });
+  }
 ` : "";
 	const actionImports = hasActions ? ws ? `import { handle as handleWs } from "tacho/transport/ws";
 import actions from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
@@ -270,22 +325,26 @@ const __fetch = Symbol.for("oxidejs.fetch");
 const __rpc = handle(actions, { path: ${JSON.stringify(actionPath)}${sameOrigin ? `, sameOrigin: true` : ``}, createContext: (req) => req[__fetch] ?? {} });
 ` : "";
 	const actionGate = hasActions && !ws ? `if (new URL(request.url).pathname === ${JSON.stringify(actionPath)}) {
-      request[__fetch] = { env, fetchCtx: ctx };
       return __rpc(request);
     }
     ` : "";
-	const middlewareImports = (opts.middleware ?? []).map((spec, i) => `import __mw${i} from ${JSON.stringify(spec)};`).join("\n");
+	const ILHA_SSR_IMPLICIT = ["ilha:pages/server", "ilha:loaders"];
+	const middlewareImports = (opts.middleware ?? []).map((m) => typeof m === "string" ? {
+		module: m,
+		imports: m === "@ilha/router/ssr" ? ILHA_SSR_IMPLICIT : []
+	} : m).map((m, i) => (m.imports ?? []).map((spec) => `import ${JSON.stringify(spec)};`).join("\n") + `\nimport __mw${i} from ${JSON.stringify(m.module)};`).join("\n") + "\n";
 	const middlewareList = (opts.middleware ?? []).map((_, i) => `__mw${i}`).join(", ");
 	const middlewareGate = opts.middleware?.length ? `for (const __mw of [${middlewareList}]) {
       const hit = await __mw(request, { env, ctx });
       if (hit) return hit;
     }
     ` : "";
-	return `export * from ${JSON.stringify(userWorkerAbs)};
+	return `${(opts.imports ?? []).map((spec) => `import ${JSON.stringify(spec)};`).join("\n")}export * from ${JSON.stringify(userWorkerAbs)};
 import user from ${JSON.stringify(userWorkerAbs)};
-${middlewareImports}${actionImports}${assetBlock}const app = {
+${middlewareImports}${actionImports}${assetBlock}${nfBlock}const app = {
   ...user,
   async fetch(request, env, ctx) {
+    request[__fetch] = { env, fetchCtx: ctx };
     ${middlewareGate}${actionGate}${afterAction}
   },
 };
@@ -470,7 +529,11 @@ function resolveOptions(raw, root, config) {
 		actionPath,
 		actionSameOrigin,
 		actionHeaders: raw?.actionHeaders,
-		middleware: raw?.middleware ?? []
+		middleware: raw?.middleware ?? [],
+		imports: raw?.imports ?? [],
+		bodyLimit: raw?.bodyLimit ?? 1048576,
+		notFound: raw?.notFound,
+		env: raw?.env
 	};
 }
 function copyPublicDir(opts) {
@@ -615,20 +678,21 @@ function applyRsbuildEnvironments(config, opts) {
 //#endregion
 //#region src/context.ts
 const ALS_KEY = Symbol.for("oxidejs.requestContext");
+const FETCH_KEY = Symbol.for("oxidejs.fetch");
 function als() {
 	const g = globalThis;
 	return g[ALS_KEY] ??= new AsyncLocalStorage();
 }
 function store() {
 	const current = als().getStore();
-	if (!current) throw new Error("oxidejs: useRequest() called outside an action");
+	if (!current) throw new Error("oxidejs: request context is unavailable");
 	return current;
 }
-/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/__oxide/action`. */
+/** Current tacho or host request context. Throws outside request handling. */
 function useCtx() {
 	return store();
 }
-/** Current action `Request`. Throws outside `*.server.ts` running over `/__oxide/action`. */
+/** Current server `Request`. Available in actions, SSR, and frame renders. */
 function useRequest() {
 	return store().req;
 }
@@ -640,10 +704,20 @@ function useEnv() {
 function useFetchCtx() {
 	return store().fetchCtx;
 }
+function runWithRequest(req, fn, extra) {
+	return als().run({
+		...extra,
+		req
+	}, fn);
+}
+const HOOK_KEY = Symbol.for("oxidejs.runWithRequest");
+globalThis[HOOK_KEY] ??= (req, fn) => {
+	const extra = req[FETCH_KEY];
+	return runWithRequest(req, fn, extra);
+};
 /**
-* Marks a `*.server.ts` export as a remote RPC action. Identity: returns `fn` unchanged.
-* Only exports wrapped in `action()` become callable over the wire; other exports stay
-* server-local. Wrap async functions and async generators.
+* Marks a `*.server.ts` export as a remote RPC action. Runtime identity; the
+* second call signature adds the transport-only `{ signal }` argument.
 */
 function action(fn) {
 	return fn;
@@ -745,7 +819,11 @@ const unpluginFactory = (options) => {
 					actions: resolved.actions,
 					actionPath: resolved.actionPath,
 					actionSameOrigin: resolved.actionSameOrigin,
-					middleware: resolved.middleware
+					middleware: resolved.middleware,
+					imports: resolved.imports,
+					bodyLimit: resolved.bodyLimit,
+					notFound: resolved.notFound,
+					env: resolved.env
 				});
 			}
 			if (isServerFileId(id) && pluginShouldStub(this, extra)) {
@@ -779,6 +857,38 @@ const unpluginFactory = (options) => {
 				const loadRouter = async () => {
 					return (await server.ssrLoadModule(VIRTUAL_ACTIONS_ID)).default;
 				};
+				if ((resolved?.middleware?.length ?? 0) > 0 || (resolved?.imports?.length ?? 0) > 0) (async () => {
+					try {
+						for (const spec of resolved.imports ?? []) await server.ssrLoadModule(spec);
+						const handlers = [];
+						for (const entry of resolved.middleware ?? []) {
+							const spec2 = typeof entry === "string" ? entry : entry.module;
+							const mod = await server.ssrLoadModule(spec2);
+							if (typeof mod.default !== "function") continue;
+							const fn = mod.default;
+							handlers.push((request) => Promise.resolve(fn(request)));
+						}
+						if (handlers.length === 0) return;
+						const { nodeToWebRequest, sendWebResponseFrom } = await Promise.resolve().then(() => actions_exports);
+						server.middlewares.use((creq, cres, next) => {
+							(async () => {
+								try {
+									const request = await nodeToWebRequest(creq);
+									for (const handler of handlers) {
+										const hit = await handler(request);
+										if (hit) return sendWebResponseFrom(creq, cres, hit);
+									}
+									next();
+								} catch (error) {
+									cres.statusCode = 500;
+									cres.end(String(error));
+								}
+							})();
+						});
+					} catch (error) {
+						server.config.logger.error("oxidejs: failed to wire dev middleware: " + String(error));
+					}
+				})();
 				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter, resolved.actionPath, resolved.actionSameOrigin);
 				else server.middlewares.use(actionMiddleware(loadRouter, resolved.actionPath, resolved.actionSameOrigin));
 			},

package/dist/{types-CMEB9B4S.d.mts → types-BM4NAnzy.d.mts}

@@ -40,7 +40,22 @@ interface OxidejsOptions {
   /** Module specifiers whose default export is `(request, ctx) => Response | undefined | Promise<Response | undefined>`.
    * Tried in order at the top of the production fetch handler; a Response short-circuits.
    * Dev servers use connect middleware instead. */
-  middleware?: string[];
+  middleware?: (string | {
+    module: string;
+    imports?: string[];
+  })[];
+  /** Module specifiers imported for side effects at the top of the production
+   * server bundle (e.g. virtual modules that self-register handlers). */
+  imports?: string[];
+  /** Max request body size in bytes (Node preset). Larger requests get 413.
+   * Default: 1048576 (1 MiB). */
+  bodyLimit?: number;
+  /** Custom 404 body (HTML) served when no route, asset, or user fetch
+   * handled the request (fetch preset with client assets). */
+  notFound?: string;
+  /** Extra env passed as the second argument to fetch(request, env, ctx) on
+   * the Node fetch preset — read it with useEnv(). */
+  env?: Record<string, unknown>;
 }
 interface ResolvedOptions {
   root: string;
@@ -63,7 +78,14 @@ interface ResolvedOptions {
   /** Reject cross-origin action requests (CSRF defense). Default: true. */
   actionSameOrigin: boolean;
   actionHeaders: OxidejsActionHeaders | undefined;
-  middleware: string[];
+  middleware: (string | {
+    module: string;
+    imports?: string[];
+  })[];
+  imports: string[];
+  bodyLimit: number;
+  notFound: string | undefined;
+  env: Record<string, unknown> | undefined;
 }
 //#endregion
 export { OxidejsWranglerOptions as a, OxidejsPreset as i, OxidejsActionTransport as n, ResolvedOptions as o, OxidejsOptions as r, OxidejsActionHeaders as t };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-CMEB9B4S.mjs";
+import { r as OxidejsOptions } from "./types-BM4NAnzy.mjs";
 //#region src/vite.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-CkhMD9M5.mjs";
+import { t as oxidejs } from "./src-CsQ-6GnW.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.1.10",
+  "version": "0.2.1",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",
@@ -59,7 +59,7 @@
     "unplugin": "^3.3.0"
   },
   "devDependencies": {
-    "tacho": "^0.4.3"
+    "tacho": "^0.5.0"
   },
   "peerDependencies": {
     "@rsbuild/core": "*",