oxidejs 0.1.4 → 0.1.7

package/README.md

@@ -34,7 +34,7 @@ vite build
 node dist/server.js
 ```
 
-Default preset is `"fetch"`. No `index.html` → only `dist/server.js`. With `index.html` → client to `dist/client/`, then `/_action` (if you have `*.server.ts`) → `src/server.ts` (`undefined` continues) → static file → `index.html` for navigations. `public/` is copied next to the client. Hashed assets get `Cache-Control: immutable`. No `wrangler.jsonc`.
+Default preset is `"fetch"`. No `index.html` → only `dist/server.js`. With `index.html` → client to `dist/client/`, then `/_action` (if you have a `*.server.{ts,tsx,js,jsx}` file) → `src/server.ts` (`undefined` continues) → static file → `index.html` for navigations. `public/` is copied next to the client. Hashed assets get `Cache-Control: immutable`. No `wrangler.jsonc`.
 
 ```ts
 oxide({
@@ -47,7 +47,7 @@ oxide({
 
 ## Server actions
 
-Install `tacho` if you use actions. Files named `*.server.ts` / `*.server.js` are server-only. A client import is replaced with a tacho stub that POSTs `/_action`. The original module never enters the client graph. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is tacho `ctx` (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No `*.server.ts` → the bundle does not import tacho.
+Install `tacho` if you use actions. Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with a tacho stub that POSTs `/_action`. The original module never enters the client graph. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is tacho `ctx` (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import tacho.
 
 ```ts
 // src/test.server.ts
@@ -133,3 +133,34 @@ Same factory as Vite: client stubs, `/_action`, and `dist/server.js`.
 - No `wrangler dev` / workerd emulation
 - No automatic `celld deploy`
 - No Node-builtin polyfills — Vite `ssr.noExternal: true` is a hard-fail for stray Node imports
+
+## Security
+
+### Asset serving (`preset: "fetch"`)
+
+The generated server serves static files from `dist/client/` (or the `public/` directory merged into it). These guards are active:
+
+| Attack vector                      | Guard                                                                                                                                  |
+| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments.                                                                                      |
+| **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`.                                                                  |
+| **Null byte** (`%00`, `\0`)        | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`.                                                   |
+| **Absolute path** (`/etc/passwd`)  | `__rel()` returns `null` for paths not starting with `/`.                                                                              |
+| **SPA fallback**                   | Unknown paths → `index.html`, never a directory listing.                                                                               |
+| **`clientDir` escape**             | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`.                                                        |
+| **Hashed assets**                  | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
+
+The generated `__asset` function uses `path.join` — not `path.resolve` — so a leading `/` in the relative path stays inside the asset root.
+
+### Server actions (`*.server.{ts,tsx,js,jsx}`)
+
+- Server action code is **never bundled into the client**. Client imports are replaced with tacho stubs that POST `/_action`. The original source stays server-only.
+- `/_action` is POST-only. Non-POST requests return `405`.
+- Method dispatch uses `Object.hasOwn`, blocking `__proto__` / `constructor` walks.
+- Unknown or missing content-types → `415`.
+- Body size capped at 1 MB by default (enforced on the actual body, not just `Content-Length`).
+- Batch requests capped at 20 items (both HTTP and WebSocket transports).
+
+### Host header
+
+The generated dev server constructs `request.url` from `req.headers.host`. This is standard HTTP/1.1 behavior (same as Express, Hono, Koa, Node http). If your `src/server.ts` reads `request.url` to construct redirects, validate the host yourself — the framework cannot distinguish a legitimate host header from a malicious one. In production, your reverse proxy handles this.

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as useEnv, i as useCtx, n as unpluginFactory, o as useFetchCtx, r as vite, s as useRequest, t as oxidejs } from "./src-CU7sBRGf.mjs";
+import { a as useEnv, i as useCtx, n as unpluginFactory, o as useFetchCtx, r as vite, s as useRequest, t as oxidejs } from "./src-BWalutn_.mjs";
 export { oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/rsbuild.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-CU7sBRGf.mjs";
+import { t as oxidejs } from "./src-BWalutn_.mjs";
 //#region src/rsbuild.ts
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion

package/dist/{src-CU7sBRGf.mjs → src-BWalutn_.mjs}

@@ -20,10 +20,15 @@ const IGNORE_DIRS = /* @__PURE__ */ new Set([
 const EXPORT_RE = /^\s*export\s+(?:async\s+)?function\s*\*?\s+([A-Za-z_$][\w$]*)|^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=/gm;
 function isServerFileId(id) {
 	const file = id.split("?")[0]?.replace(/\\/g, "/") ?? "";
-	return file.endsWith(".server.ts") || file.endsWith(".server.js");
+	return [
+		".ts",
+		".tsx",
+		".js",
+		".jsx"
+	].some((ext) => file.endsWith(`.server${ext}`));
 }
 function moduleKey(absFile) {
-	return path.basename(absFile).replace(/\.server\.(ts|js)$/i, "");
+	return path.basename(absFile).replace(/\.server\.(?:[jt]sx?)$/i, "");
 }
 function parseExportedNames(source) {
 	const names = /* @__PURE__ */ new Set();

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-CU7sBRGf.mjs";
+import { t as oxidejs } from "./src-BWalutn_.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.1.4",
+  "version": "0.1.7",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",
@@ -59,7 +59,7 @@
     "unplugin": "^3.3.0"
   },
   "devDependencies": {
-    "tacho": "^0.4.1"
+    "tacho": "^0.4.2"
   },
   "peerDependencies": {
     "@rsbuild/core": "*",