oxidejs 0.1.9 → 0.2.0

package/README.md

@@ -95,7 +95,7 @@ const stream = await ticks(10, { signal: ac.signal });
 ac.abort();
 ```
 
-`vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client.
+`vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client and are ignored for WebSocket actions.
 
 ## Rsbuild
 
@@ -113,6 +113,27 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 
 ## Options
 
+### `middleware` and `imports`
+
+\`\`\`ts
+oxide({
+middleware: ["@ilha/router/ssr"], // string or { module, imports }
+imports: ["./side-effects"], // side-effect modules loaded at startup
+})
+\`\`\`
+
+Middleware handlers run in production before the action gate; the same specifiers are loaded through the SSR graph in dev, so dev and prod behave identically. Middleware entries may carry their own \`imports\`.
+
+### Other server options
+
+| Option        | Type   | Default | Description                                                          |
+| ------------- | ------ | ------- | -------------------------------------------------------------------- |
+| \`bodyLimit\` | number | 1048576 | Max request body size (Node preset); larger requests get 413         |
+| \`notFound\`  | string | —       | Custom HTML 404 body when no route or asset matches                  |
+| \`env\`       | object | —       | Passed as \`env\` to \`fetch(request, env, ctx)\` on the Node preset |
+
+## Options
+
 | Option                         | Default                  | Notes                                                                                       |
 | ------------------------------ | ------------------------ | ------------------------------------------------------------------------------------------- |
 | `preset`                       | `"fetch"`                | `"fetch"` or `"celld"`                                                                      |
@@ -129,6 +150,23 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 | `emitConfig`                   | `true` on `celld`        | Set `false` to skip `wrangler.jsonc`                                                        |
 | `actions`                      | `"http"`                 | `"ws"` needs `crossws`; object form: `{ transport, path, sameOrigin }` (`sameOrigin: true`) |
 | `actionHeaders`                | —                        | Static headers on the HTTP client                                                           |
+| `middleware`                   | `[]`                     | Default-exported production fetch middleware, run in order before actions and server entry  |
+
+`middleware` modules receive `(request, { env, ctx })`. They run in array order before actions, the server entry, and assets. Return a `Response` to stop the chain or `undefined` to continue.
+
+```ts
+// src/auth.ts
+export default function auth(request: Request) {
+  if (!request.headers.has("authorization")) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+}
+
+// vite.config.ts
+oxide({ middleware: ["./src/auth.ts"] });
+```
+
+This option applies to production builds; use Connect middleware in Vite or Rsbuild during development.
 
 `main` is always `./server.js`. `assets` is added only when `index.html` exists. Unknown wrangler keys fail at build time.
 

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-C3ualQ39.mjs";
+import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-BM4NAnzy.mjs";
 import { UnpluginFactory } from "unplugin";
 //#region src/context.d.ts
 type ExecutionContext = {

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-GLi2EcPa.mjs";
+import { a as useCtx, c as useRequest, i as action, n as unpluginFactory, o as useEnv, r as vite, s as useFetchCtx, t as oxidejs } from "./src-zvdCGkyp.mjs";
 export { action, oxidejs as default, oxidejs, unpluginFactory, useCtx, useEnv, useFetchCtx, useRequest, vite };

package/dist/rsbuild.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
+import { r as OxidejsOptions } from "./types-BM4NAnzy.mjs";
 //#region src/rsbuild.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => any;
 //#endregion

package/dist/rsbuild.mjs

@@ -1,5 +1,6 @@
-import { t as oxidejs } from "./src-GLi2EcPa.mjs";
+import { t as oxidejs } from "./src-zvdCGkyp.mjs";
 //#region src/rsbuild.ts
+/** @experimental Rsbuild integration is not yet implemented. */
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion
 export { rsbuild_default as default };

package/dist/{src-GLi2EcPa.mjs → src-zvdCGkyp.mjs}

@@ -3,7 +3,41 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import fs from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/actions.ts
+var actions_exports = /* @__PURE__ */ __exportAll({
+	ACTION_PATH: () => ACTION_PATH,
+	RESOLVED_VIRTUAL_ACTIONS_ID: () => RESOLVED_VIRTUAL_ACTIONS_ID,
+	RESOLVED_VIRTUAL_CLIENT_ID: () => RESOLVED_VIRTUAL_CLIENT_ID,
+	RESOLVED_VIRTUAL_WORKER_ID: () => RESOLVED_VIRTUAL_WORKER_ID,
+	VIRTUAL_ACTIONS_ID: () => VIRTUAL_ACTIONS_ID,
+	VIRTUAL_CLIENT_ID: () => VIRTUAL_CLIENT_ID,
+	VIRTUAL_WORKER_ID: () => VIRTUAL_WORKER_ID,
+	generateActionsModule: () => generateActionsModule,
+	generateClientModule: () => generateClientModule,
+	generateClientStub: () => generateClientStub,
+	generateWorkerWrapper: () => generateWorkerWrapper,
+	isServerFileId: () => isServerFileId,
+	loadClientStub: () => loadClientStub,
+	moduleKey: () => moduleKey,
+	nodeToWebRequest: () => nodeToWebRequest,
+	parseExportedNames: () => parseExportedNames,
+	pluginShouldStub: () => pluginShouldStub,
+	scanServerFiles: () => scanServerFiles,
+	sendWebResponseFrom: () => sendWebResponseFrom,
+	shouldStubServerModule: () => shouldStubServerModule
+});
 const VIRTUAL_ACTIONS_ID = "virtual:oxide/actions";
 const RESOLVED_VIRTUAL_ACTIONS_ID = `\0${VIRTUAL_ACTIONS_ID}`;
 const VIRTUAL_WORKER_ID = "virtual:oxide/worker";
@@ -175,6 +209,8 @@ function generateWorkerWrapper(userWorkerAbs, opts = {}) {
 	const serveAssets = preset === "fetch" && (opts.hasClient === true || opts.hasPublic === true);
 	const hasActions = opts.hasActions !== false;
 	const ws = hasActions && opts.actions === "ws";
+	const bodyLimit = opts.bodyLimit ?? 1048576;
+	const __nf = `() => new Response(${JSON.stringify(opts.notFound ?? "<h1>404 Not Found</h1>")}, { status: 404, headers: { "content-type": "text/html; charset=utf-8" } })`;
 	const assetBlock = serveAssets ? `import { readFile } from "node:fs/promises";
 import { extname, join } from "node:path";
 const __assets = join(import.meta.dirname, ${JSON.stringify(clientDir)});
@@ -207,24 +243,32 @@ async function __asset(request, spa) {
     const headers = { "content-type": __types[extname(file)] ?? "application/octet-stream" };
     const cache = __cache(file);
     if (cache) headers["cache-control"] = cache;
+    const etag = '"' + body.length.toString(16) + "-" + file + '"';
+    headers["etag"] = etag;
+    if (request.headers.get("if-none-match") === etag) {
+      return new Response(null, { status: 304, headers });
+    }
     return new Response(body, { headers });
   } catch {
     return;
   }
 }
+const __nf = ${__nf};
 ` : "";
+	const envJson = JSON.stringify(opts.env ?? {});
 	const afterAction = serveAssets ? `if (typeof user.fetch === "function") {
-      const hit = await user.fetch(request, env, ctx);
+      const hit = await user.fetch(request, env ?? ${envJson}, ctx);
       if (hit) return hit;
     }
-    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? new Response("Not Found", { status: 404 });` : `return typeof user.fetch === "function"
+    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? __nf();` : `return typeof user.fetch === "function"
       ? user.fetch(request, env, ctx)
-      : new Response("Not Found", { status: 404 });`;
+      : __nf();`;
 	const listen = preset === "fetch" ? `
 import { createServer } from "node:http";
 import { pathToFileURL } from "node:url";
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   const port = Number(process.env.PORT) || 3000;
+  const bodyLimit = ${bodyLimit};
   const server = createServer(async (req, res) => {
     const url = \`http://\${req.headers.host ?? "localhost"}\${req.url ?? "/"}\`;
     const headers = new Headers();
@@ -237,7 +281,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     req.once("aborted", () => ac.abort());
     const method = req.method ?? "GET";
     const chunks = [];
-    if (method !== "GET" && method !== "HEAD") for await (const chunk of req) chunks.push(chunk);
+    let size = 0;
+    if (method !== "GET" && method !== "HEAD") for await (const chunk of req) {
+      size += chunk.length;
+      // Bound request buffering — unbounded bodies are a memory DoS vector.
+      if (size > ${bodyLimit}) { res.statusCode = 413; res.end(); return; }
+      chunks.push(chunk);
+    }
     const init = { method, headers, signal: ac.signal };
     if (chunks.length) init.body = Buffer.concat(chunks);
     const response = await app.fetch(new Request(url, init));
@@ -260,6 +310,12 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   });` : ""}
   server.listen(port, () => console.log(\`oxidejs listening on \${port}\`));
 }
+  for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+      server.close(() => process.exit(0));
+      setTimeout(() => process.exit(0), 5000).unref();
+    });
+  }
 ` : "";
 	const actionImports = hasActions ? ws ? `import { handle as handleWs } from "tacho/transport/ws";
 import actions from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
@@ -274,12 +330,23 @@ const __rpc = handle(actions, { path: ${JSON.stringify(actionPath)}${sameOrigin
       return __rpc(request);
     }
     ` : "";
-	return `export * from ${JSON.stringify(userWorkerAbs)};
+	const ILHA_SSR_IMPLICIT = ["ilha:pages/server", "ilha:loaders"];
+	const middlewareImports = (opts.middleware ?? []).map((m) => typeof m === "string" ? {
+		module: m,
+		imports: m === "@ilha/router/ssr" ? ILHA_SSR_IMPLICIT : []
+	} : m).map((m, i) => (m.imports ?? []).map((spec) => `import ${JSON.stringify(spec)};`).join("\n") + `\nimport __mw${i} from ${JSON.stringify(m.module)};`).join("\n") + "\n";
+	const middlewareList = (opts.middleware ?? []).map((_, i) => `__mw${i}`).join(", ");
+	const middlewareGate = opts.middleware?.length ? `for (const __mw of [${middlewareList}]) {
+      const hit = await __mw(request, { env, ctx });
+      if (hit) return hit;
+    }
+    ` : "";
+	return `${(opts.imports ?? []).map((spec) => `import ${JSON.stringify(spec)};`).join("\n")}export * from ${JSON.stringify(userWorkerAbs)};
 import user from ${JSON.stringify(userWorkerAbs)};
-${actionImports}${assetBlock}const app = {
+${middlewareImports}${actionImports}${assetBlock}const app = {
   ...user,
   async fetch(request, env, ctx) {
-    ${actionGate}${afterAction}
+    ${middlewareGate}${actionGate}${afterAction}
   },
 };
 export default app;
@@ -462,7 +529,12 @@ function resolveOptions(raw, root, config) {
 		actions,
 		actionPath,
 		actionSameOrigin,
-		actionHeaders: raw?.actionHeaders
+		actionHeaders: raw?.actionHeaders,
+		middleware: raw?.middleware ?? [],
+		imports: raw?.imports ?? [],
+		bodyLimit: raw?.bodyLimit ?? 1048576,
+		notFound: raw?.notFound,
+		env: raw?.env
 	};
 }
 function copyPublicDir(opts) {
@@ -736,7 +808,12 @@ const unpluginFactory = (options) => {
 					hasActions: modules.length > 0,
 					actions: resolved.actions,
 					actionPath: resolved.actionPath,
-					actionSameOrigin: resolved.actionSameOrigin
+					actionSameOrigin: resolved.actionSameOrigin,
+					middleware: resolved.middleware,
+					imports: resolved.imports,
+					bodyLimit: resolved.bodyLimit,
+					notFound: resolved.notFound,
+					env: resolved.env
 				});
 			}
 			if (isServerFileId(id) && pluginShouldStub(this, extra)) {
@@ -770,6 +847,38 @@ const unpluginFactory = (options) => {
 				const loadRouter = async () => {
 					return (await server.ssrLoadModule(VIRTUAL_ACTIONS_ID)).default;
 				};
+				if ((resolved?.middleware?.length ?? 0) > 0 || (resolved?.imports?.length ?? 0) > 0) (async () => {
+					try {
+						for (const spec of resolved.imports ?? []) await server.ssrLoadModule(spec);
+						const handlers = [];
+						for (const entry of resolved.middleware ?? []) {
+							const spec2 = typeof entry === "string" ? entry : entry.module;
+							const mod = await server.ssrLoadModule(spec2);
+							if (typeof mod.default !== "function") continue;
+							const fn = mod.default;
+							handlers.push((request) => Promise.resolve(fn(request)));
+						}
+						if (handlers.length === 0) return;
+						const { nodeToWebRequest, sendWebResponseFrom } = await Promise.resolve().then(() => actions_exports);
+						server.middlewares.use((creq, cres, next) => {
+							(async () => {
+								try {
+									const request = await nodeToWebRequest(creq);
+									for (const handler of handlers) {
+										const hit = await handler(request);
+										if (hit) return sendWebResponseFrom(creq, cres, hit);
+									}
+									next();
+								} catch (error) {
+									cres.statusCode = 500;
+									cres.end(String(error));
+								}
+							})();
+						});
+					} catch (error) {
+						server.config.logger.error("oxidejs: failed to wire dev middleware: " + String(error));
+					}
+				})();
 				if (resolved?.actions === "ws") attachActionUpgrade(server.httpServer, loadRouter, resolved.actionPath, resolved.actionSameOrigin);
 				else server.middlewares.use(actionMiddleware(loadRouter, resolved.actionPath, resolved.actionSameOrigin));
 			},

package/dist/{types-C3ualQ39.d.mts → types-BM4NAnzy.d.mts}

@@ -37,6 +37,25 @@ interface OxidejsOptions {
   actions?: OxidejsActions;
   /** Extra headers on the shared HTTP action client. Ignored when `actions` is "ws". */
   actionHeaders?: OxidejsActionHeaders;
+  /** Module specifiers whose default export is `(request, ctx) => Response | undefined | Promise<Response | undefined>`.
+   * Tried in order at the top of the production fetch handler; a Response short-circuits.
+   * Dev servers use connect middleware instead. */
+  middleware?: (string | {
+    module: string;
+    imports?: string[];
+  })[];
+  /** Module specifiers imported for side effects at the top of the production
+   * server bundle (e.g. virtual modules that self-register handlers). */
+  imports?: string[];
+  /** Max request body size in bytes (Node preset). Larger requests get 413.
+   * Default: 1048576 (1 MiB). */
+  bodyLimit?: number;
+  /** Custom 404 body (HTML) served when no route, asset, or user fetch
+   * handled the request (fetch preset with client assets). */
+  notFound?: string;
+  /** Extra env passed as the second argument to fetch(request, env, ctx) on
+   * the Node fetch preset — read it with useEnv(). */
+  env?: Record<string, unknown>;
 }
 interface ResolvedOptions {
   root: string;
@@ -59,6 +78,14 @@ interface ResolvedOptions {
   /** Reject cross-origin action requests (CSRF defense). Default: true. */
   actionSameOrigin: boolean;
   actionHeaders: OxidejsActionHeaders | undefined;
+  middleware: (string | {
+    module: string;
+    imports?: string[];
+  })[];
+  imports: string[];
+  bodyLimit: number;
+  notFound: string | undefined;
+  env: Record<string, unknown> | undefined;
 }
 //#endregion
 export { OxidejsWranglerOptions as a, OxidejsPreset as i, OxidejsActionTransport as n, ResolvedOptions as o, OxidejsOptions as r, OxidejsActionHeaders as t };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as OxidejsOptions } from "./types-C3ualQ39.mjs";
+import { r as OxidejsOptions } from "./types-BM4NAnzy.mjs";
 //#region src/vite.d.ts
 declare const _default: (options?: OxidejsOptions | undefined) => import("vite").Plugin<any> | import("vite").Plugin<any>[];
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./src-GLi2EcPa.mjs";
+import { t as oxidejs } from "./src-zvdCGkyp.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",