oxidejs 0.1.7 → 0.1.9

package/README.md

@@ -34,7 +34,7 @@ vite build
 node dist/server.js
 ```
 
-Default preset is `"fetch"`. No `index.html` → only `dist/server.js`. With `index.html` → client to `dist/client/`, then `/_action` (if you have a `*.server.{ts,tsx,js,jsx}` file) → `src/server.ts` (`undefined` continues) → static file → `index.html` for navigations. `public/` is copied next to the client. Hashed assets get `Cache-Control: immutable`. No `wrangler.jsonc`.
+Default preset is `"fetch"`. No `index.html` → only `dist/server.js`. With `index.html` → client to `dist/client/`, then `/__oxide/action` (if you have a `*.server.{ts,tsx,js,jsx}` file) → `src/server.ts` (`undefined` continues) → static file → `index.html` for navigations. `public/` is copied next to the client. Hashed assets get `Cache-Control: immutable`. No `wrangler.jsonc`.
 
 ```ts
 oxide({
@@ -47,18 +47,21 @@ oxide({
 
 ## Server actions
 
-Install `tacho` if you use actions. Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with a tacho stub that POSTs `/_action`. The original module never enters the client graph. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is tacho `ctx` (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import tacho.
+Install `tacho` if you use actions. Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with a tacho stub that POSTs `/__oxide/action`. The original module never enters the client graph. **Only exports wrapped in `action()` become remote actions** — any other export stays server-local and is not callable over the wire. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is tacho `ctx` (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import tacho.
 
 ```ts
 // src/test.server.ts
-import { useRequest } from "oxidejs";
+import { action, useRequest } from "oxidejs";
 
-export async function who() {
+export const who = action(async () => {
   return useRequest().headers.get("x-user");
-}
+});
+
+export const ping = action(async () => "pong");
 
-export async function ping() {
-  return "pong";
+// a non-action export is never exposed over the wire
+async function internalHelper() {
+  /* server-only */
 }
 
 // src/client.ts
@@ -73,15 +76,16 @@ export default {
 };
 ```
 
-`async function*` exports stream over tacho SSE. `oxidejs/tsconfig` makes `await ticks()` typecheck. Pass `{ signal }` last on any action to abort the fetch. Types come from the real `*.server.ts`, so declare the last argument there:
+`action()` is identity — it only marks the export. Wrap `async function*` in it to stream over tacho SSE. `oxidejs/tsconfig` makes `await ticks()` typecheck. Pass `{ signal }` last on any action to abort the fetch. Types come from the real `*.server.ts`, so declare the last argument there:
 
 ```ts
 // src/test.server.ts
+import { action } from "oxidejs";
 import type { ActionOptions } from "oxidejs";
 
-export async function* ticks(n: number, _opts?: ActionOptions) {
+export const ticks = action(async function* (n: number, _opts?: ActionOptions) {
   for (let i = 0; i < n; i++) yield i;
-}
+});
 
 // src/client.ts
 import { ticks } from "./test.server";
@@ -91,7 +95,7 @@ const stream = await ticks(10, { signal: ac.signal });
 ac.abort();
 ```
 
-`vite dev` and `rsbuild dev` serve `/_action` via middleware. `oxide({ actions: "ws" })` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actionHeaders` are static headers on the shared HTTP client.
+`vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client.
 
 ## Rsbuild
 
@@ -105,26 +109,26 @@ export default defineConfig({
 });
 ```
 
-Same factory as Vite: client stubs, `/_action`, and `dist/server.js`.
+Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 
 ## Options
 
-| Option                         | Default                  | Notes                                  |
-| ------------------------------ | ------------------------ | -------------------------------------- |
-| `preset`                       | `"fetch"`                | `"fetch"` or `"celld"`                 |
-| `workerEntry`                  | `src/server.ts`          | Relative to project root               |
-| `outDir`                       | `dist`                   | Output root                            |
-| `clientDir`                    | `client`                 | Must stay inside `outDir`              |
-| `wrangler.name`                | required if `emitConfig` |                                        |
-| `wrangler.compatibility_date`  | required if `emitConfig` |                                        |
-| `wrangler.compatibility_flags` | —                        | optional                               |
-| `wrangler.durable_objects`     | —                        | optional                               |
-| `wrangler.migrations`          | —                        | optional                               |
-| `wrangler.services`            | —                        | optional                               |
-| `wrangler.vars`                | —                        | optional                               |
-| `emitConfig`                   | `true` on `celld`        | Set `false` to skip `wrangler.jsonc`   |
-| `actions`                      | `"http"`                 | `"ws"` needs `crossws`; not with celld |
-| `actionHeaders`                | —                        | Static headers on the HTTP client      |
+| Option                         | Default                  | Notes                                                                                       |
+| ------------------------------ | ------------------------ | ------------------------------------------------------------------------------------------- |
+| `preset`                       | `"fetch"`                | `"fetch"` or `"celld"`                                                                      |
+| `workerEntry`                  | `src/server.ts`          | Relative to project root                                                                    |
+| `outDir`                       | `dist`                   | Output root                                                                                 |
+| `clientDir`                    | `client`                 | Must stay inside `outDir`                                                                   |
+| `wrangler.name`                | required if `emitConfig` |                                                                                             |
+| `wrangler.compatibility_date`  | required if `emitConfig` |                                                                                             |
+| `wrangler.compatibility_flags` | —                        | optional                                                                                    |
+| `wrangler.durable_objects`     | —                        | optional                                                                                    |
+| `wrangler.migrations`          | —                        | optional                                                                                    |
+| `wrangler.services`            | —                        | optional                                                                                    |
+| `wrangler.vars`                | —                        | optional                                                                                    |
+| `emitConfig`                   | `true` on `celld`        | Set `false` to skip `wrangler.jsonc`                                                        |
+| `actions`                      | `"http"`                 | `"ws"` needs `crossws`; object form: `{ transport, path, sameOrigin }` (`sameOrigin: true`) |
+| `actionHeaders`                | —                        | Static headers on the HTTP client                                                           |
 
 `main` is always `./server.js`. `assets` is added only when `index.html` exists. Unknown wrangler keys fail at build time.
 
@@ -154,8 +158,9 @@ The generated `__asset` function uses `path.join` — not `path.resolve` — so
 
 ### Server actions (`*.server.{ts,tsx,js,jsx}`)
 
-- Server action code is **never bundled into the client**. Client imports are replaced with tacho stubs that POST `/_action`. The original source stays server-only.
-- `/_action` is POST-only. Non-POST requests return `405`.
+- Server action code is **never bundled into the client**. Client imports are replaced with tacho stubs that POST the action endpoint (default `/__oxide/action`). The original source stays server-only.
+- Only `action()`-wrapped exports are exposed as RPC; other exports stay server-local.
+- The endpoint is POST-only. Non-POST requests return `405`.
 - Method dispatch uses `Object.hasOwn`, blocking `__proto__` / `constructor` walks.
 - Unknown or missing content-types → `415`.
 - Body size capped at 1 MB by default (enforced on the actual body, not just `Content-Length`).

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-CFWyYfds.mjs";
+import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-C3ualQ39.mjs";
 import { UnpluginFactory } from "unplugin";
 //#region src/context.d.ts
 type ExecutionContext = {
@@ -12,9 +12,9 @@ type ActionContext = {
   fetchCtx?: ExecutionContext;
   [key: string]: unknown;
 };
-/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/_action`. */
+/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/__oxide/action`. */
 declare function useCtx<C extends ActionContext = ActionContext>(): C;
-/** Current action `Request`. Throws outside `*.server.ts` running over `/_action`. */
+/** Current action `Request`. Throws outside `*.server.ts` running over `/__oxide/action`. */
 declare function useRequest(): Request;
 /** Worker `env` from `fetch(request, env, ctx)`. `undefined` on the Node fetch preset. */
 declare function useEnv<E = unknown>(): E | undefined;
@@ -24,10 +24,16 @@ declare function useFetchCtx(): ExecutionContext | undefined;
 type ActionOptions = {
   signal?: AbortSignal;
 };
+/**
+ * Marks a `*.server.ts` export as a remote RPC action. Identity: returns `fn` unchanged.
+ * Only exports wrapped in `action()` become callable over the wire; other exports stay
+ * server-local. Wrap async functions and async generators.
+ */
+declare function action<T>(fn: T): T;
 //#endregion
 //#region src/index.d.ts
 declare const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined>;
 declare const oxidejs: import("unplugin").UnpluginInstance<OxidejsOptions | undefined, boolean>;
 declare const vite: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion
-export { type ActionContext, type ActionOptions, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };
+export { type ActionContext, type ActionOptions, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as useEnv, i as useCtx, n as unpluginFactory, o as useFetchCtx, r as vite, s as useRequest, t as oxidejs } from "./src-BWalutn_.mjs";
-export { oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };
+import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-GLi2EcPa.mjs";
+export { action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/rsbuild.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-CFWyYfds.mjs";
+import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
 //#region src/rsbuild.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => any;
 //#endregion

package/dist/rsbuild.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-BWalutn_.mjs";
+import { t as oxidejs } from "./src-GLi2EcPa.mjs";
 //#region src/rsbuild.ts
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion

package/dist/{src-BWalutn_.mjs → src-GLi2EcPa.mjs}

@@ -10,14 +10,15 @@ const VIRTUAL_WORKER_ID = "virtual:oxide/worker";
 const RESOLVED_VIRTUAL_WORKER_ID = `\0${VIRTUAL_WORKER_ID}`;
 const VIRTUAL_CLIENT_ID = "virtual:oxide/client";
 const RESOLVED_VIRTUAL_CLIENT_ID = `\0${VIRTUAL_CLIENT_ID}`;
-const ACTION_PATH = "/_action";
+const ACTION_PATH = "/__oxide/action";
 const IGNORE_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	".git",
 	".wrangler"
 ]);
-const EXPORT_RE = /^\s*export\s+(?:async\s+)?function\s*\*?\s+([A-Za-z_$][\w$]*)|^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=/gm;
+/** Only `export const name = action(...)` become remote RPC actions. Everything else stays server-local. */
+const EXPORT_RE = /^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?action\s*\(/gm;
 function isServerFileId(id) {
 	const file = id.split("?")[0]?.replace(/\\/g, "/") ?? "";
 	return [
@@ -33,7 +34,7 @@ function moduleKey(absFile) {
 function parseExportedNames(source) {
 	const names = /* @__PURE__ */ new Set();
 	for (const match of source.matchAll(EXPORT_RE)) {
-		const name = match[1] ?? match[2];
+		const name = match[1];
 		if (name) names.add(name);
 	}
 	return [...names];
@@ -75,20 +76,20 @@ function scanServerFiles(root) {
 	}
 	return modules;
 }
-function generateClientModule(transport = "http", headers) {
+function generateClientModule(transport = "http", headers, path = ACTION_PATH) {
 	if (transport === "ws") return `import { createClient } from "tacho/client/ws";
 const __proto = typeof location === "undefined" ? "ws:" : location.protocol === "https:" ? "wss:" : "ws:";
 const __host = typeof location === "undefined" ? "localhost" : location.host;
-export const client = createClient({ url: __proto + "//" + __host + ${JSON.stringify(ACTION_PATH)} });
+export const client = createClient({ url: __proto + "//" + __host + ${JSON.stringify(path)} });
 `;
-	const opts = { url: ACTION_PATH };
+	const opts = { url: path };
 	if (headers) opts.headers = headers;
 	return `import { createClient } from "tacho/client/http";
 export const client = createClient(${JSON.stringify(opts)});
 `;
 }
 function generateClientStub(mod) {
-	const lines = [`import { client } from ${JSON.stringify(VIRTUAL_CLIENT_ID)};`];
+	const lines = [`// oxidejs:client-stub`, `import { client } from ${JSON.stringify(VIRTUAL_CLIENT_ID)};`];
 	for (const name of mod.exports) lines.push(`export const ${name} = (...args) => {
   const opts = args.at(-1);
   // ponytail: peel last { signal } only. A lone payload { signal: AbortSignal } is treated as CallOptions.
@@ -102,7 +103,8 @@ function generateActionsModule(modules, opts) {
 	const lines = [
 		`import { AsyncLocalStorage } from "node:async_hooks";`,
 		`import { tacho } from "tacho";`,
-		`const __als = globalThis.__oxidejsRequest ??= new AsyncLocalStorage();`
+		`const __alsKey = Symbol.for("oxidejs.requestContext");`,
+		`const __als = globalThis[__alsKey] ??= new AsyncLocalStorage();`
 	];
 	const aliases = modules.map((mod, i) => {
 		const alias = `__m${i}`;
@@ -168,6 +170,8 @@ function pipeResponse(req, res, response) {
 function generateWorkerWrapper(userWorkerAbs, opts = {}) {
 	const preset = opts.preset ?? "fetch";
 	const clientDir = opts.clientDir ?? "client";
+	const actionPath = opts.actionPath ?? "/__oxide/action";
+	const sameOrigin = opts.actionSameOrigin ?? false;
 	const serveAssets = preset === "fetch" && (opts.hasClient === true || opts.hasPublic === true);
 	const hasActions = opts.hasActions !== false;
 	const ws = hasActions && opts.actions === "ws";
@@ -251,7 +255,7 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   import("crossws/adapters/node").then(({ default: crossws }) => {
     const ws = crossws({ hooks: __ws });
     server.on("upgrade", (req, socket, head) => {
-      if (req.url?.split("?")[0] === ${JSON.stringify(ACTION_PATH)}) ws.handleUpgrade(req, socket, head);
+      if (req.url?.split("?")[0] === ${JSON.stringify(actionPath)}) ws.handleUpgrade(req, socket, head);
     });
   });` : ""}
   server.listen(port, () => console.log(\`oxidejs listening on \${port}\`));
@@ -259,13 +263,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
 ` : "";
 	const actionImports = hasActions ? ws ? `import { handle as handleWs } from "tacho/transport/ws";
 import actions from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
-const __ws = handleWs(actions, { path: ${JSON.stringify(ACTION_PATH)} });
+const __ws = handleWs(actions, { path: ${JSON.stringify(actionPath)}${sameOrigin ? `, sameOrigin: true` : ``} });
 ` : `import { handle } from "tacho/transport/fetch";
 import actions from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
 const __fetch = Symbol.for("oxidejs.fetch");
-const __rpc = handle(actions, { path: ${JSON.stringify(ACTION_PATH)}, createContext: (req) => req[__fetch] ?? {} });
+const __rpc = handle(actions, { path: ${JSON.stringify(actionPath)}${sameOrigin ? `, sameOrigin: true` : ``}, createContext: (req) => req[__fetch] ?? {} });
 ` : "";
-	const actionGate = hasActions && !ws ? `if (new URL(request.url).pathname === ${JSON.stringify(ACTION_PATH)}) {
+	const actionGate = hasActions && !ws ? `if (new URL(request.url).pathname === ${JSON.stringify(actionPath)}) {
       request[__fetch] = { env, fetchCtx: ctx };
       return __rpc(request);
     }
@@ -408,11 +412,30 @@ function hasHtmlEntry(root, config) {
 		return file.endsWith(".html") && fs.existsSync(file);
 	});
 }
+function resolveActions(raw) {
+	if (raw === void 0 || typeof raw === "string") {
+		const transport = raw ?? "http";
+		if (transport !== "http" && transport !== "ws") throw new Error(`oxidejs: unknown actions transport "${String(transport)}"`);
+		return {
+			transport,
+			path: ACTION_PATH,
+			sameOrigin: true
+		};
+	}
+	const transport = raw.transport ?? "http";
+	if (transport !== "http" && transport !== "ws") throw new Error(`oxidejs: unknown actions transport "${String(transport)}"`);
+	const path = raw.path ?? "/__oxide/action";
+	if (!path.startsWith("/") || path.includes("?")) throw new Error(`oxidejs: actions.path must start with "/" and contain no query string (got "${path}")`);
+	return {
+		transport,
+		path,
+		sameOrigin: raw.sameOrigin ?? true
+	};
+}
 function resolveOptions(raw, root, config) {
 	const preset = raw?.preset ?? "fetch";
 	if (preset !== "fetch" && preset !== "celld") throw new Error(`oxidejs: unknown preset "${String(preset)}"`);
-	const actions = raw?.actions ?? "http";
-	if (actions !== "http" && actions !== "ws") throw new Error(`oxidejs: unknown actions transport "${String(actions)}"`);
+	const { transport: actions, path: actionPath, sameOrigin: actionSameOrigin } = resolveActions(raw?.actions);
 	if (actions === "ws" && preset === "celld") throw new Error("oxidejs: actions: \"ws\" is not supported with preset: \"celld\"");
 	const workerEntry = raw?.workerEntry ?? "src/server.ts";
 	const outDirInput = raw?.outDir ?? "dist";
@@ -437,6 +460,8 @@ function resolveOptions(raw, root, config) {
 		hasClient,
 		hasPublic,
 		actions,
+		actionPath,
+		actionSameOrigin,
 		actionHeaders: raw?.actionHeaders
 	};
 }
@@ -581,7 +606,7 @@ function applyRsbuildEnvironments(config, opts) {
 }
 //#endregion
 //#region src/context.ts
-const ALS_KEY = "__oxidejsRequest";
+const ALS_KEY = Symbol.for("oxidejs.requestContext");
 function als() {
 	const g = globalThis;
 	return g[ALS_KEY] ??= new AsyncLocalStorage();
@@ -591,11 +616,11 @@ function store() {
 	if (!current) throw new Error("oxidejs: useRequest() called outside an action");
 	return current;
 }
-/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/_action`. */
+/** Current tacho `ctx`. Throws outside `*.server.ts` running over `/__oxide/action`. */
 function useCtx() {
 	return store();
 }
-/** Current action `Request`. Throws outside `*.server.ts` running over `/_action`. */
+/** Current action `Request`. Throws outside `*.server.ts` running over `/__oxide/action`. */
 function useRequest() {
 	return store().req;
 }
@@ -607,11 +632,19 @@ function useEnv() {
 function useFetchCtx() {
 	return store().fetchCtx;
 }
+/**
+* Marks a `*.server.ts` export as a remote RPC action. Identity: returns `fn` unchanged.
+* Only exports wrapped in `action()` become callable over the wire; other exports stay
+* server-local. Wrap async functions and async generators.
+*/
+function action(fn) {
+	return fn;
+}
 //#endregion
 //#region src/index.ts
-function actionMiddleware(loadRouter) {
+function actionMiddleware(loadRouter, path, sameOrigin) {
 	return (req, res, next) => {
-		if ((req.url ?? "").split("?")[0] !== "/_action") {
+		if ((req.url ?? "").split("?")[0] !== path) {
 			next();
 			return;
 		}
@@ -620,11 +653,14 @@ function actionMiddleware(loadRouter) {
 				/* @vite-ignore */
 				"tacho/transport/fetch"
 );
-			await sendWebResponseFrom(req, res, await handle(await loadRouter(), { path: ACTION_PATH })(await nodeToWebRequest(req)));
+			await sendWebResponseFrom(req, res, await handle(await loadRouter(), {
+				path,
+				...sameOrigin ? { sameOrigin: true } : {}
+			})(await nodeToWebRequest(req)));
 		})().catch(next);
 	};
 }
-function attachActionUpgrade(httpServer, loadRouter) {
+function attachActionUpgrade(httpServer, loadRouter, path, sameOrigin) {
 	if (!httpServer) return;
 	Promise.all([import(
 		/* @vite-ignore */
@@ -634,8 +670,11 @@ function attachActionUpgrade(httpServer, loadRouter) {
 		"crossws/adapters/node"
 )]).then(([{ handle }, { default: crossws }]) => {
 		httpServer.on("upgrade", (req, socket, head) => {
-			if ((req.url ?? "").split("?")[0] !== "/_action") return;
-			loadRouter().then((router) => crossws({ hooks: handle(router, { path: ACTION_PATH }) }).handleUpgrade(req, socket, head)).catch(() => {
+			if ((req.url ?? "").split("?")[0] !== path) return;
+			loadRouter().then((router) => crossws({ hooks: handle(router, {
+				path,
+				sameOrigin
+			}) }).handleUpgrade(req, socket, head)).catch(() => {
 				socket.destroy();
 			});
 		});
@@ -675,7 +714,7 @@ const unpluginFactory = (options) => {
 			return null;
 		},
 		load(id, extra) {
-			if (id === RESOLVED_VIRTUAL_CLIENT_ID) return generateClientModule(resolved?.actions ?? options?.actions ?? "http", resolved?.actionHeaders ?? options?.actionHeaders);
+			if (id === RESOLVED_VIRTUAL_CLIENT_ID) return generateClientModule(resolved?.actions ?? (typeof options?.actions === "string" || options?.actions === void 0 ? options?.actions : options.actions.transport) ?? "http", resolved?.actionHeaders ?? options?.actionHeaders, resolved?.actionPath);
 			if (id === RESOLVED_VIRTUAL_ACTIONS_ID || id === RESOLVED_VIRTUAL_WORKER_ID) {
 				if (pluginShouldStub(this, extra)) throw new Error(`oxidejs: ${id === RESOLVED_VIRTUAL_ACTIONS_ID ? VIRTUAL_ACTIONS_ID : VIRTUAL_WORKER_ID} is server-only`);
 			}
@@ -695,7 +734,9 @@ const unpluginFactory = (options) => {
 					hasClient: resolved.hasClient,
 					hasPublic: resolved.hasPublic,
 					hasActions: modules.length > 0,
-					actions: resolved.actions
+					actions: resolved.actions,
+					actionPath: resolved.actionPath,
+					actionSameOrigin: resolved.actionSameOrigin
 				});
 			}
 			if (isServerFileId(id) && pluginShouldStub(this, extra)) {
@@ -705,7 +746,7 @@ const unpluginFactory = (options) => {
 			}
 		},
 		transform(code, id, extra) {
-			if (!isServerFileId(id) || !pluginShouldStub(this, extra)) return;
+			if (!isServerFileId(id) || !pluginShouldStub(this, extra) || code.startsWith("// oxidejs:client-stub\n")) return;
 			return generateClientStub({
 				key: moduleKey(id.split("?")[0] ?? id),
 				exports: parseExportedNames(code)
@@ -729,8 +770,8 @@ const unpluginFactory = (options) => {
 				const loadRouter = async () => {
 					return (await server.ssrLoadModule(VIRTUAL_ACTIONS_ID)).default;
 				};
-				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter);
-				else server.middlewares.use(actionMiddleware(loadRouter));
+				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter, resolved.actionPath, resolved.actionSameOrigin);
+				else server.middlewares.use(actionMiddleware(loadRouter, resolved.actionPath, resolved.actionSameOrigin));
 			},
 			configurePreviewServer(server) {
 				if (resolved?.preset !== "fetch") return;
@@ -746,8 +787,8 @@ const unpluginFactory = (options) => {
 				const loadRouter = async () => {
 					return (await loadActions(resolved?.root ?? process.cwd())).default;
 				};
-				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter);
-				else server.middlewares.use(actionMiddleware(loadRouter));
+				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter, resolved.actionPath, resolved.actionSameOrigin);
+				else server.middlewares.use(actionMiddleware(loadRouter, resolved.actionPath, resolved.actionSameOrigin));
 			});
 			api.onBeforeStartPreviewServer?.(({ server }) => {
 				if (resolved?.preset !== "fetch") return;
@@ -764,4 +805,4 @@ const unpluginFactory = (options) => {
 const oxidejs = /* @__PURE__ */ createUnplugin(unpluginFactory);
 const vite = /* @__PURE__ */ (() => oxidejs.vite)();
 //#endregion
-export { useEnv as a, useCtx as i, unpluginFactory as n, useFetchCtx as o, vite as r, useRequest as s, oxidejs as t };
+export { useCtx as a, useRequest as c, action as i, unpluginFactory as n, useEnv as o, vite as r, useFetchCtx as s, oxidejs as t };

package/dist/{types-CFWyYfds.d.mts → types-C3ualQ39.d.mts}

@@ -10,6 +10,14 @@ interface OxidejsWranglerOptions {
   vars?: Record<string, unknown>;
 }
 type OxidejsActionTransport = "http" | "ws";
+/** `actions` config: transport string, or an object with `transport`, `path`, `sameOrigin`. */
+type OxidejsActions = OxidejsActionTransport | {
+  transport?: OxidejsActionTransport;
+  /** Endpoint path for actions. Default: `/__oxide/action`. */
+  path?: string;
+  /** Reject cross-origin action requests (CSRF defense). Default: true. */
+  sameOrigin?: boolean;
+};
 /** Static headers inlined into the shared action client. Functions cannot ship to the browser. */
 type OxidejsActionHeaders = Record<string, string> | [string, string][];
 interface OxidejsOptions {
@@ -25,8 +33,8 @@ interface OxidejsOptions {
   wrangler?: OxidejsWranglerOptions;
   /** Skip config emission. Defaults to false for celld, true for fetch. */
   emitConfig?: boolean;
-  /** Transport for `*.server.ts` stubs. Default: "http". */
-  actions?: OxidejsActionTransport;
+  /** Transport and path for `*.server.ts` stubs. Default: `"http"` at `/__oxide/action`. */
+  actions?: OxidejsActions;
   /** Extra headers on the shared HTTP action client. Ignored when `actions` is "ws". */
   actionHeaders?: OxidejsActionHeaders;
 }
@@ -46,6 +54,10 @@ interface ResolvedOptions {
   /** True when `<root>/public` exists. Copied next to client assets on fetch. */
   hasPublic: boolean;
   actions: OxidejsActionTransport;
+  /** Endpoint path for actions. Default: `/__oxide/action`. */
+  actionPath: string;
+  /** Reject cross-origin action requests (CSRF defense). Default: true. */
+  actionSameOrigin: boolean;
   actionHeaders: OxidejsActionHeaders | undefined;
 }
 //#endregion

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-CFWyYfds.mjs";
+import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
 //#region src/vite.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-BWalutn_.mjs";
+import { t as oxidejs } from "./src-GLi2EcPa.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",
@@ -59,7 +59,7 @@
     "unplugin": "^3.3.0"
   },
   "devDependencies": {
-    "tacho": "^0.4.2"
+    "tacho": "^0.4.3"
   },
   "peerDependencies": {
     "@rsbuild/core": "*",