oxidejs 0.1.8 → 0.1.10

package/README.md

@@ -95,7 +95,7 @@ const stream = await ticks(10, { signal: ac.signal });
 ac.abort();
 ```
 
-`vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client.
+`vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client and are ignored for WebSocket actions.
 
 ## Rsbuild
 
@@ -129,6 +129,23 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 | `emitConfig`                   | `true` on `celld`        | Set `false` to skip `wrangler.jsonc`                                                        |
 | `actions`                      | `"http"`                 | `"ws"` needs `crossws`; object form: `{ transport, path, sameOrigin }` (`sameOrigin: true`) |
 | `actionHeaders`                | —                        | Static headers on the HTTP client                                                           |
+| `middleware`                   | `[]`                     | Default-exported production fetch middleware, run in order before actions and server entry  |
+
+`middleware` modules receive `(request, { env, ctx })`. They run in array order before actions, the server entry, and assets. Return a `Response` to stop the chain or `undefined` to continue.
+
+```ts
+// src/auth.ts
+export default function auth(request: Request) {
+  if (!request.headers.has("authorization")) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+}
+
+// vite.config.ts
+oxide({ middleware: ["./src/auth.ts"] });
+```
+
+This option applies to production builds; use Connect middleware in Vite or Rsbuild during development.
 
 `main` is always `./server.js`. `assets` is added only when `index.html` exists. Unknown wrangler keys fail at build time.
 

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-C3ualQ39.mjs";
+import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-CMEB9B4S.mjs";
 import { UnpluginFactory } from "unplugin";
 //#region src/context.d.ts
 type ExecutionContext = {

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-Cg_j9ZsH.mjs";
+import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-CkhMD9M5.mjs";
 export { action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/rsbuild.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
+import { r as OxidejsOptions } from "./types-CMEB9B4S.mjs";
 //#region src/rsbuild.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => any;
 //#endregion

package/dist/rsbuild.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-Cg_j9ZsH.mjs";
+import { t as oxidejs } from "./src-CkhMD9M5.mjs";
 //#region src/rsbuild.ts
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion

package/dist/{src-Cg_j9ZsH.mjs → src-CkhMD9M5.mjs}

@@ -89,7 +89,7 @@ export const client = createClient(${JSON.stringify(opts)});
 `;
 }
 function generateClientStub(mod) {
-	const lines = [`import { client } from ${JSON.stringify(VIRTUAL_CLIENT_ID)};`];
+	const lines = [`// oxidejs:client-stub`, `import { client } from ${JSON.stringify(VIRTUAL_CLIENT_ID)};`];
 	for (const name of mod.exports) lines.push(`export const ${name} = (...args) => {
   const opts = args.at(-1);
   // ponytail: peel last { signal } only. A lone payload { signal: AbortSignal } is treated as CallOptions.
@@ -273,13 +273,20 @@ const __rpc = handle(actions, { path: ${JSON.stringify(actionPath)}${sameOrigin
       request[__fetch] = { env, fetchCtx: ctx };
       return __rpc(request);
     }
+    ` : "";
+	const middlewareImports = (opts.middleware ?? []).map((spec, i) => `import __mw${i} from ${JSON.stringify(spec)};`).join("\n");
+	const middlewareList = (opts.middleware ?? []).map((_, i) => `__mw${i}`).join(", ");
+	const middlewareGate = opts.middleware?.length ? `for (const __mw of [${middlewareList}]) {
+      const hit = await __mw(request, { env, ctx });
+      if (hit) return hit;
+    }
     ` : "";
 	return `export * from ${JSON.stringify(userWorkerAbs)};
 import user from ${JSON.stringify(userWorkerAbs)};
-${actionImports}${assetBlock}const app = {
+${middlewareImports}${actionImports}${assetBlock}const app = {
   ...user,
   async fetch(request, env, ctx) {
-    ${actionGate}${afterAction}
+    ${middlewareGate}${actionGate}${afterAction}
   },
 };
 export default app;
@@ -462,7 +469,8 @@ function resolveOptions(raw, root, config) {
 		actions,
 		actionPath,
 		actionSameOrigin,
-		actionHeaders: raw?.actionHeaders
+		actionHeaders: raw?.actionHeaders,
+		middleware: raw?.middleware ?? []
 	};
 }
 function copyPublicDir(opts) {
@@ -736,7 +744,8 @@ const unpluginFactory = (options) => {
 					hasActions: modules.length > 0,
 					actions: resolved.actions,
 					actionPath: resolved.actionPath,
-					actionSameOrigin: resolved.actionSameOrigin
+					actionSameOrigin: resolved.actionSameOrigin,
+					middleware: resolved.middleware
 				});
 			}
 			if (isServerFileId(id) && pluginShouldStub(this, extra)) {
@@ -746,7 +755,7 @@ const unpluginFactory = (options) => {
 			}
 		},
 		transform(code, id, extra) {
-			if (!isServerFileId(id) || !pluginShouldStub(this, extra)) return;
+			if (!isServerFileId(id) || !pluginShouldStub(this, extra) || code.startsWith("// oxidejs:client-stub\n")) return;
 			return generateClientStub({
 				key: moduleKey(id.split("?")[0] ?? id),
 				exports: parseExportedNames(code)

package/dist/{types-C3ualQ39.d.mts → types-CMEB9B4S.d.mts}

@@ -37,6 +37,10 @@ interface OxidejsOptions {
   actions?: OxidejsActions;
   /** Extra headers on the shared HTTP action client. Ignored when `actions` is "ws". */
   actionHeaders?: OxidejsActionHeaders;
+  /** Module specifiers whose default export is `(request, ctx) => Response | undefined | Promise<Response | undefined>`.
+   * Tried in order at the top of the production fetch handler; a Response short-circuits.
+   * Dev servers use connect middleware instead. */
+  middleware?: string[];
 }
 interface ResolvedOptions {
   root: string;
@@ -59,6 +63,7 @@ interface ResolvedOptions {
   /** Reject cross-origin action requests (CSRF defense). Default: true. */
   actionSameOrigin: boolean;
   actionHeaders: OxidejsActionHeaders | undefined;
+  middleware: string[];
 }
 //#endregion
 export { OxidejsWranglerOptions as a, OxidejsPreset as i, OxidejsActionTransport as n, ResolvedOptions as o, OxidejsOptions as r, OxidejsActionHeaders as t };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
+import { r as OxidejsOptions } from "./types-CMEB9B4S.mjs";
 //#region src/vite.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-Cg_j9ZsH.mjs";
+import { t as oxidejs } from "./src-CkhMD9M5.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",