oxidejs 0.3.0 → 0.3.1

package/README.md

@@ -45,11 +45,11 @@ oxide({
 });
 ```
 
-`"celld"` writes `dist/wrangler.jsonc` for celld, a self-hosted alternative to Cloudflare Workers, and skips asset serving (`ASSETS` does that).
+`"celld"` writes `dist/wrangler.jsonc` for celld, a self-hosted alternative to Cloudflare Workers, and skips asset serving (`ASSETS` does that). The generated worker imports `oxidejs/worker-dom/install` so Ilha SSR has a DOM before your entry evaluates. Oxide merges `nodejs_compat` into `compatibility_flags` when you do not set it.
 
 ## Server actions
 
-Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with an RPC stub that POSTs `/__oxide/action`. The original module never enters the client graph. **Only exports wrapped in `action()` become remote actions** — any other export stays server-local and is not callable over the wire. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is the request context (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import `oxidejs/rpc`.
+Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with an Effect RPC stub that POSTs `/__oxide/action` as newline-delimited JSON-RPC (`application/json-rpc`). The original module never enters the client graph. **Only exports wrapped in `action()` become remote actions** — any other export stays server-local and is not callable over the wire. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is the request context (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import `oxidejs/rpc`. `action()` results are JSON-RPC data — returning a `Response` from an action is an error; return a raw `Response` from `src/server.ts` for raw HTTP responses.
 
 ```ts
 // src/test.server.ts
@@ -78,7 +78,18 @@ export default {
 };
 ```
 
-`action()` is runtime identity — it marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over Effect RPC as newline-delimited JSON-RPC (`application/json-rpc` frames, not SSE). On the client, await the call to get the async generator. Inside server code, always read the non-optional signal from `useRequest().signal`:
+### Call shape
+
+Unary actions return a Promise and expose helpers for UI wiring:
+
+| Call                                        | What it does                                     |
+| ------------------------------------------- | ------------------------------------------------ |
+| `await ping()`                              | Run the action (always invokes RPC on client)    |
+| `ping.set(...args)`                         | Same as calling with args; also writes the atom  |
+| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action  |
+| `ping.result`                               | Read the last `AsyncResult` from the client atom |
+
+`action()` marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over Effect RPC as newline-delimited JSON-RPC (not SSE). On the client the stub returns an async generator — iterate it directly. Inside server code, always read the non-optional signal from `useRequest().signal`:
 
 ```ts
 // src/test.server.ts
@@ -93,12 +104,14 @@ export const ticks = action(async function* (n: number) {
 import { ticks } from "./test.server";
 
 const ac = new AbortController();
-for await (const value of await ticks(10, { signal: ac.signal })) {
+for await (const value of ticks(10, { signal: ac.signal })) {
   console.log(value);
 }
 ac.abort();
 ```
 
+Stream actions do not support `bind` / `with`. Breaking the `for await` loop or calling `return()` on the generator cleans up the server generator.
+
 `vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client and are ignored for WebSocket actions.
 
 ## Rsbuild
@@ -125,7 +138,7 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 | `clientDir`                    | `client`                 | Must stay inside `outDir`                                                                   |
 | `wrangler.name`                | required if `emitConfig` |                                                                                             |
 | `wrangler.compatibility_date`  | required if `emitConfig` |                                                                                             |
-| `wrangler.compatibility_flags` | —                        | optional                                                                                    |
+| `wrangler.compatibility_flags` | —                        | optional; `nodejs_compat` is merged in automatically on `celld`                             |
 | `wrangler.durable_objects`     | —                        | optional                                                                                    |
 | `wrangler.migrations`          | —                        | optional                                                                                    |
 | `wrangler.services`            | —                        | optional                                                                                    |
@@ -178,13 +191,16 @@ The generated `__asset` function uses `path.join` — not `path.resolve` — so
 
 ### Server actions (`*.server.{ts,tsx,js,jsx}`)
 
-- Server action code is **never bundled into the client**. Client imports are replaced with RPC stubs that POST the action endpoint (default `/__oxide/action`). The original source stays server-only.
+- Server action code is **never bundled into the client**. Client imports are replaced with Effect RPC stubs that POST the action endpoint (default `/__oxide/action`). The original source stays server-only.
 - Only `action()`-wrapped exports are exposed as RPC; other exports stay server-local.
+- Stream actions use newline-delimited JSON-RPC (`application/json-rpc`) over that same endpoint — not Server-Sent Events. Frames are scrubbed as they flush on HTTP and WebSocket.
 - The endpoint is POST-only. Non-POST requests return `405`.
 - Method dispatch uses `Object.hasOwn`, blocking `__proto__` / `constructor` walks.
 - Unknown or missing content-types → `415`.
 - Body size capped at 1 MB by default (enforced on the actual body, not just `Content-Length`).
 - Batch requests capped at 20 items (both HTTP and WebSocket transports).
+- Effect `Defect` / `Cause` payloads are scrubbed before they leave the endpoint. Clients see plain JSON-RPC errors (`code` + `message` only). Thrown messages become `Internal error` (`-32603`). Unknown methods → `-32601`; invalid params → `-32602`.
+- `actions.sameOrigin` defaults to `true`. Requests without both `Origin` and `Sec-Fetch-Site` are rejected when that check is on.
 
 ### Host header
 

package/dist/{client-Bc4g9AEw.mjs → client-C-s6XXpS.mjs}

@@ -62,7 +62,8 @@ function clientLayer(options) {
 function loadClient(group, options) {
 	return Effect.gen(function* () {
 		const scope = yield* Scope.make();
-		return yield* Scope.provide(scope)(RpcClient.make(group).pipe(Effect.provide(clientLayer(options))));
+		const context = yield* Scope.provide(scope)(Layer.build(clientLayer(options)));
+		return yield* Scope.provide(scope)(RpcClient.make(group).pipe(Effect.provide(context)));
 	});
 }
 function isStreamResult(value) {
@@ -122,7 +123,9 @@ function createClient(group, options) {
 	const key = cacheKey(group, options);
 	let entry = clientCache.get(key);
 	if (!entry) {
-		entry = { pending: Effect.runPromise(loadClient(group, options)).then((flat) => nestClient(group, flat)).catch((error) => {
+		entry = { pending: Effect.runPromise(loadClient(group, options)).then((flat) => {
+			return nestClient(group, flat);
+		}).catch((error) => {
 			clientCache.delete(key);
 			throw error;
 		}) };

package/dist/{plugin-IQa_lKkT.mjs → plugin-HZKRDuCS.mjs}

@@ -1,5 +1,4 @@
-import { C as scanServerFiles, S as pluginShouldStub, _ as matchesActionPath, a as RequestBodyTooLargeError, b as parseExportedNames, c as VIRTUAL_WORKER_ID, d as generateActionsModule, f as generateClientModule, g as loadClientStub, h as isServerFileId, i as RESOLVED_VIRTUAL_WORKER_ID, m as generateWorkerWrapper, n as RESOLVED_VIRTUAL_ACTIONS_ID, o as VIRTUAL_ACTIONS_ID, p as generateClientStub, r as RESOLVED_VIRTUAL_CLIENT_ID, t as ACTION_PATH, u as generateActionsClientModule, v as moduleKey, w as sendWebResponseFrom, x as parseStreamExports, y as nodeToWebRequest } from "./actions-DE6p5Cyp.mjs";
-import { n as createActionHandler, t as createWsHooks } from "./rpc-DYFEdah8.mjs";
+import { A as pluginShouldStub, C as isServerFileId, D as nodeToWebRequest, E as moduleKey, M as sendWebResponseFrom, O as parseExportedNames, S as generateWorkerWrapper, T as matchesActionPath, b as generateClientModule, d as RESOLVED_VIRTUAL_CLIENT_ID, f as RESOLVED_VIRTUAL_WORKER_ID, g as VIRTUAL_WORKER_ID, j as scanServerFiles, k as parseStreamExports, l as ACTION_PATH, m as VIRTUAL_ACTIONS_ID, n as createActionHandler, p as RequestBodyTooLargeError, t as createWsHooks, u as RESOLVED_VIRTUAL_ACTIONS_ID, v as generateActionsClientModule, w as loadClientStub, x as generateClientStub, y as generateActionsModule } from "./rpc-DzUkWWgQ.mjs";
 import { ensureWorkerDom } from "./worker-dom.mjs";
 import { createUnplugin } from "unplugin";
 import fs from "node:fs";
@@ -182,11 +181,13 @@ function mergeAliases(config, extra) {
 		replacement
 	})), ...extra];
 }
-const EFFECT_DEPS = [
+const OPTIMIZE_DEPS = [
 	"effect",
 	"effect/unstable/rpc",
 	"effect/unstable/http",
-	"effect/unstable/socket"
+	"effect/unstable/socket",
+	"oxidejs",
+	"oxidejs/rpc/client"
 ];
 function applyViteEnvironments(config, opts) {
 	config.builder ??= {};
@@ -198,7 +199,7 @@ function applyViteEnvironments(config, opts) {
 	]);
 	config.resolve.dedupe = [...dedupe];
 	config.optimizeDeps ??= {};
-	const optimizeInclude = /* @__PURE__ */ new Set([...Array.isArray(config.optimizeDeps.include) ? config.optimizeDeps.include : [], ...EFFECT_DEPS]);
+	const optimizeInclude = /* @__PURE__ */ new Set([...Array.isArray(config.optimizeDeps.include) ? config.optimizeDeps.include : [], ...OPTIMIZE_DEPS]);
 	config.optimizeDeps.include = [...optimizeInclude];
 	const celld = opts.preset === "celld";
 	mergeAliases(config, oxideRpcAliases());
@@ -530,7 +531,7 @@ const unpluginFactory = (options) => {
 									next();
 									return;
 								}
-								const { nodeToWebRequest, sendWebResponseFrom } = await import("./actions-DE6p5Cyp.mjs").then((n) => n.l);
+								const { nodeToWebRequest, sendWebResponseFrom } = await import("./rpc-DzUkWWgQ.mjs").then((n) => n._);
 								const request = await nodeToWebRequest(creq, resolved.bodyLimit);
 								const context = {
 									env: resolved.env,

package/dist/plugin.mjs

@@ -1,2 +1,2 @@
-import { n as unpluginFactory, r as vite, t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { n as unpluginFactory, r as vite, t as oxidejs } from "./plugin-HZKRDuCS.mjs";
 export { oxidejs as default, oxidejs, unpluginFactory, vite };

package/dist/rpc/client.mjs

@@ -1,2 +1,2 @@
-import { t as createClient } from "../client-Bc4g9AEw.mjs";
+import { t as createClient } from "../client-C-s6XXpS.mjs";
 export { createClient };

package/dist/{actions-DE6p5Cyp.mjs → rpc-DzUkWWgQ.mjs}

@@ -1,5 +1,9 @@
+import { t as runWithRequest } from "./context-zrTZyYpF.mjs";
 import fs from "node:fs";
 import path from "node:path";
+import { Layer } from "effect";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { HttpRouter } from "effect/unstable/http";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -195,7 +199,13 @@ function generateActionsModule(modules, opts) {
 		`};`,
 		`const __run = (fn) =>`,
 		`  Effect.promise(() => __als.run(__store(), fn)).pipe(`,
-		`    Effect.map((value) => (value === undefined ? null : value)),`,
+		`    Effect.map((value) => {`,
+		`      if (value instanceof Response) {`,
+		`        console.error("oxidejs: action() returned a Response; actions must return serializable data. Return a Response from src/server.ts for raw HTTP responses.");`,
+		`        throw new Error("action() returned a Response; return it from src/server.ts instead");`,
+		`      }`,
+		`      return value === undefined ? null : value;`,
+		`    }),`,
 		`  );`,
 		`const __withStore = (store, fn) => __als.run(store, fn);`
 	];
@@ -501,4 +511,405 @@ async function sendWebResponseFrom(req, res, response) {
 	return pipeResponse(req, res, response);
 }
 //#endregion
-export { scanServerFiles as C, pluginShouldStub as S, matchesActionPath as _, RequestBodyTooLargeError as a, parseExportedNames as b, VIRTUAL_WORKER_ID as c, generateActionsModule as d, generateClientModule as f, loadClientStub as g, isServerFileId as h, RESOLVED_VIRTUAL_WORKER_ID as i, actions_exports as l, generateWorkerWrapper as m, RESOLVED_VIRTUAL_ACTIONS_ID as n, VIRTUAL_ACTIONS_ID as o, generateClientStub as p, RESOLVED_VIRTUAL_CLIENT_ID as r, VIRTUAL_CLIENT_ID as s, ACTION_PATH as t, generateActionsClientModule as u, moduleKey as v, sendWebResponseFrom as w, parseStreamExports as x, nodeToWebRequest as y };
+//#region src/rpc/same-origin.ts
+function isSameOrigin(request) {
+	const site = request.headers.get("sec-fetch-site");
+	const origin = request.headers.get("origin");
+	if (!origin && !site) return false;
+	if (site && site !== "same-origin" && site !== "none") return false;
+	if (!origin) return site === "same-origin" || site === "none";
+	try {
+		return new URL(origin).host === (request.headers.get("host") ?? new URL(request.url).host);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/rpc/scrub.ts
+/** Strip Effect RPC `Defect` / `Cause` payloads down to plain JSON-RPC errors. */
+const INTERNAL = {
+	code: -32603,
+	message: "Internal error"
+};
+const NDJSON_CONTENT = "application/json-rpc";
+function isRecord(value) {
+	return value !== null && typeof value === "object";
+}
+function classifyCause(error) {
+	const blob = `${String(error["message"] ?? "")}${JSON.stringify(error["data"] ?? "")}`;
+	if (/Unknown request tag/i.test(blob)) return {
+		code: -32601,
+		message: "Method not found"
+	};
+	if (/Missing key/i.test(blob) || /Expected/i.test(blob) && /\["args"\]|\[\\"args\\"\]/.test(blob)) return {
+		code: -32602,
+		message: "Invalid params"
+	};
+	return { ...INTERNAL };
+}
+function scrubError(error) {
+	if (!isRecord(error)) return { ...INTERNAL };
+	if (error["_tag"] === "Defect") return { ...INTERNAL };
+	if (error["_tag"] === "Cause") return classifyCause(error);
+	if (typeof error["code"] === "number" && typeof error["message"] === "string") return {
+		code: error["code"],
+		message: error["message"]
+	};
+	return { ...INTERNAL };
+}
+function createIdRepairState(requestIds = []) {
+	return { remaining: new Set(requestIds) };
+}
+/**
+* Scrub one JSON-RPC response object.
+* Effect encodes Defects with `id: -32603`; reclaim the originating request id from `state.remaining`.
+*/
+function scrubRpcMessage(msg, requestIds = [], state = createIdRepairState(requestIds)) {
+	if (!isRecord(msg) || !("error" in msg) || msg["error"] == null) {
+		if (isRecord(msg) && msg["chunk"] !== true && msg["id"] !== -32603 && "id" in msg) state.remaining.delete(msg["id"]);
+		return msg;
+	}
+	const error = scrubError(msg["error"]);
+	let id = msg["id"];
+	if (id === -32603) {
+		const next = state.remaining.values().next();
+		if (!next.done) {
+			id = next.value;
+			state.remaining.delete(next.value);
+		} else id = null;
+	} else if (id !== void 0 && id !== null) state.remaining.delete(id);
+	if (id === void 0) id = null;
+	return {
+		jsonrpc: "2.0",
+		id,
+		error
+	};
+}
+/**
+* Rewrite a JSON / NDJSON body so clients never see Effect `_tag` / `data` trees.
+* Accepts a single object, a JSON array, or newline-delimited frames.
+*/
+function scrubRpcJson(body, requestIds = []) {
+	const trimmed = body.replace(/^\uFEFF/, "");
+	if (!trimmed) return body;
+	const state = createIdRepairState(requestIds);
+	if (trimmed.includes("\n")) {
+		const lines = trimmed.split("\n");
+		const out = [];
+		for (const line of lines) {
+			if (line === "") continue;
+			out.push(scrubRpcLine(line, state));
+		}
+		return trimmed.endsWith("\n") ? `${out.join("\n")}\n` : out.join("\n");
+	}
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (Array.isArray(parsed)) return JSON.stringify(parsed.map((msg) => scrubRpcMessage(msg, requestIds, state)));
+		return JSON.stringify(scrubRpcMessage(parsed, requestIds, state));
+	} catch {
+		return body;
+	}
+}
+function scrubRpcLine(line, state) {
+	try {
+		return JSON.stringify(scrubRpcMessage(JSON.parse(line), [], state));
+	} catch {
+		return line;
+	}
+}
+/** Collect JSON-RPC request ids from a unary object or batch array body. */
+function extractJsonRpcRequestIds(body) {
+	try {
+		let text = typeof body === "string" ? body : new TextDecoder().decode(body instanceof Uint8Array ? body : new Uint8Array(body));
+		text = text.replace(/^\uFEFF/, "").trimEnd();
+		if (text.includes("\n")) {
+			const ids = [];
+			for (const line of text.split("\n")) {
+				if (!line) continue;
+				const parsed = JSON.parse(line);
+				if (isRecord(parsed) && "id" in parsed) ids.push(parsed["id"]);
+			}
+			return ids;
+		}
+		const parsed = JSON.parse(text);
+		if (Array.isArray(parsed)) return parsed.filter(isRecord).filter((item) => "id" in item).map((item) => item["id"]);
+		if (isRecord(parsed) && "id" in parsed) return [parsed["id"]];
+	} catch {}
+	return [];
+}
+/** Ensure a body is a valid NDJSON frame (Effect's ndJsonRpc decode requires a trailing newline). */
+function ensureNdjsonBody(buf) {
+	const bytes = new Uint8Array(buf);
+	if (bytes.length > 0 && bytes[bytes.length - 1] === 10) return bytes;
+	const out = new Uint8Array(bytes.length + 1);
+	out.set(bytes);
+	out[bytes.length] = 10;
+	return out;
+}
+/**
+* TransformStream that scrubs Effect defect payloads one NDJSON line at a time,
+* so long-running stream actions stay incremental.
+*/
+function scrubNdjsonTransform(requestIds = []) {
+	const decoder = new TextDecoder();
+	const encoder = new TextEncoder();
+	const state = createIdRepairState(requestIds);
+	let pending = "";
+	return new TransformStream({
+		transform(chunk, controller) {
+			pending += decoder.decode(chunk, { stream: true });
+			let nl = pending.indexOf("\n");
+			while (nl !== -1) {
+				const line = pending.slice(0, nl);
+				pending = pending.slice(nl + 1);
+				if (line.length > 0) controller.enqueue(encoder.encode(`${scrubRpcLine(line, state)}\n`));
+				nl = pending.indexOf("\n");
+			}
+		},
+		flush(controller) {
+			pending += decoder.decode();
+			if (pending.length > 0) {
+				controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
+				pending = "";
+			}
+		}
+	});
+}
+//#endregion
+//#region src/rpc/server.ts
+const JSON_RPC_FORBIDDEN = {
+	jsonrpc: "2.0",
+	error: {
+		code: -32600,
+		message: "Forbidden"
+	},
+	id: null
+};
+const bundles = /* @__PURE__ */ new Map();
+const groupIds = /* @__PURE__ */ new WeakMap();
+let nextGroupId = 0;
+const serialization = RpcSerialization.layerNdJsonRpc();
+function bundleKey(group, path, transport) {
+	let id = groupIds.get(group);
+	if (id === void 0) {
+		id = nextGroupId++;
+		groupIds.set(group, id);
+	}
+	return `${id}:${path}:${transport}`;
+}
+function forbidden() {
+	return new Response(JSON.stringify(JSON_RPC_FORBIDDEN), {
+		status: 403,
+		headers: { "content-type": "application/json" }
+	});
+}
+function methodNotAllowed() {
+	return new Response("Method Not Allowed", {
+		status: 405,
+		headers: { Allow: "POST" }
+	});
+}
+function buildBundle(group, handlers, path, transport) {
+	const app = RpcServer.layerHttp({
+		group,
+		path,
+		protocol: transport === "ws" ? "websocket" : "http"
+	}).pipe(Layer.provide(handlers), Layer.provide(serialization));
+	return HttpRouter.toWebHandler(app, { disableLogger: true });
+}
+function bundleFor(group, handlers, path, transport) {
+	const key = bundleKey(group, path, transport);
+	const cached = bundles.get(key);
+	if (cached) return cached;
+	const built = buildBundle(group, handlers, path, transport);
+	bundles.set(key, built);
+	return built;
+}
+function scrubJsonResponse(response, requestIds) {
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!contentType.includes("json")) return response;
+	if (response.body && (contentType.includes("application/json-rpc") || contentType.includes("ndjson"))) {
+		const headers = new Headers(response.headers);
+		headers.delete("content-length");
+		return new Response(response.body.pipeThrough(scrubNdjsonTransform(requestIds)), {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	return response;
+}
+async function scrubBufferedJson(response, requestIds) {
+	const text = await response.text();
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	return new Response(scrubRpcJson(text, requestIds), {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function createActionHandler(group, handlers, options = {}) {
+	const path = options.path ?? "/__oxide/action";
+	const transport = options.transport ?? "http";
+	const sameOrigin = options.sameOrigin ?? true;
+	return async (request) => {
+		if (!matchesActionPath(new URL(request.url).pathname, path)) return new Response("Not Found", { status: 404 });
+		if (transport === "http" && request.method !== "POST") return methodNotAllowed();
+		if (sameOrigin && !isSameOrigin(request)) return forbidden();
+		const rawBody = ensureNdjsonBody(await request.arrayBuffer());
+		const requestIds = extractJsonRpcRequestIds(rawBody);
+		const headers = new Headers(request.headers);
+		headers.set("content-type", NDJSON_CONTENT);
+		const forwarded = new Request(request.url, {
+			method: request.method,
+			headers,
+			body: rawBody,
+			signal: request.signal
+		});
+		const extra = await options.createContext?.(forwarded) ?? {};
+		const { handler } = bundleFor(group, handlers, path, transport);
+		const response = await runWithRequest(forwarded, () => handler(forwarded), extra);
+		const contentType = response.headers.get("content-type") ?? "";
+		if (contentType.includes("application/json-rpc") || contentType.includes("ndjson")) return scrubJsonResponse(response, requestIds);
+		if (contentType.includes("json")) return scrubBufferedJson(response, requestIds);
+		return response;
+	};
+}
+function disposeActionHandler(group, path = ACTION_PATH, transport = "http") {
+	const key = bundleKey(group, path, transport);
+	const bundle = bundles.get(key);
+	bundles.delete(key);
+	return bundle?.dispose() ?? Promise.resolve();
+}
+//#endregion
+//#region src/rpc/ws.ts
+function parseMessage(message, maxBytes) {
+	try {
+		const raw = message.text();
+		if (new TextEncoder().encode(raw).byteLength > maxBytes) return {
+			ok: false,
+			tooLarge: true
+		};
+		return {
+			ok: true,
+			value: raw
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* Effect's socket client sends `@effect/rpc/Ping` keepalives (no id) and hangs
+* up unless the server answers `@effect/rpc/Pong`. Handle control messages here
+* so they never reach the action handler.
+*/
+function controlReply(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && parsed.method === "@effect/rpc/Ping") return JSON.stringify({
+			jsonrpc: "2.0",
+			method: "@effect/rpc/Pong"
+		});
+	} catch {}
+}
+/** Forward each complete NDJSON line as its own WS message (keeps streams incremental). */
+async function sendNdjsonFrames(peer, response, signal) {
+	if (signal.aborted) {
+		await response.body?.cancel();
+		return;
+	}
+	if (!response.body) {
+		const text = await response.text();
+		if (text && !signal.aborted) peer.send(text);
+		return;
+	}
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	const onAbort = () => {
+		reader.cancel();
+	};
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		while (!signal.aborted) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			pending += decoder.decode(value, { stream: true });
+			let nl = pending.indexOf("\n");
+			while (nl !== -1) {
+				const line = pending.slice(0, nl);
+				pending = pending.slice(nl + 1);
+				if (line.length > 0 && !signal.aborted) peer.send(`${line}\n`);
+				nl = pending.indexOf("\n");
+			}
+		}
+		if (!signal.aborted) {
+			pending += decoder.decode();
+			if (pending.length > 0) peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
+		}
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+function createWsHooks(group, handlers, options = {}) {
+	const path = options.path ?? "/__oxide/action";
+	const maxBytes = options.maxMessageSize ?? 1048576;
+	const sameOrigin = options.sameOrigin ?? true;
+	const baseOptions = {
+		path,
+		transport: "http",
+		sameOrigin
+	};
+	return {
+		upgrade(req) {
+			let pathname;
+			try {
+				pathname = new URL(req.url).pathname;
+			} catch {
+				return new Response("Bad Request", { status: 400 });
+			}
+			if (!matchesActionPath(pathname, path)) return new Response("Not Found", { status: 404 });
+			if (sameOrigin && !isSameOrigin(req)) return new Response("Forbidden", { status: 403 });
+		},
+		async message(peer, message) {
+			const parsed = parseMessage(message, maxBytes);
+			if (!parsed.ok) {
+				peer.send(JSON.stringify({
+					jsonrpc: "2.0",
+					error: {
+						code: -32600,
+						message: parsed.tooLarge ? "Payload too large" : "Parse error"
+					},
+					id: null
+				}));
+				return;
+			}
+			const pingReply = controlReply(parsed.value);
+			if (pingReply !== void 0) {
+				peer.send(pingReply);
+				return;
+			}
+			const abort = new AbortController();
+			peer.onClose?.(() => abort.abort());
+			const host = peer.request?.headers.get("host") ?? "localhost";
+			const headers = new Headers(peer.request?.headers);
+			headers.set("content-type", NDJSON_CONTENT);
+			const peerCtx = await options.createContext?.(peer) ?? peer.context;
+			await sendNdjsonFrames(peer, await createActionHandler(group, handlers, {
+				...baseOptions,
+				createContext: (req) => ({
+					...peerCtx,
+					req
+				})
+			})(new Request(`http://${host}${path}`, {
+				method: "POST",
+				headers,
+				body: parsed.value,
+				signal: abort.signal
+			})), abort.signal);
+		}
+	};
+}
+//#endregion
+export { pluginShouldStub as A, isServerFileId as C, nodeToWebRequest as D, moduleKey as E, sendWebResponseFrom as M, parseExportedNames as O, generateWorkerWrapper as S, matchesActionPath as T, actions_exports as _, extractJsonRpcRequestIds as a, generateClientModule as b, scrubRpcMessage as c, RESOLVED_VIRTUAL_CLIENT_ID as d, RESOLVED_VIRTUAL_WORKER_ID as f, VIRTUAL_WORKER_ID as g, VIRTUAL_CLIENT_ID as h, ensureNdjsonBody as i, scanServerFiles as j, parseStreamExports as k, ACTION_PATH as l, VIRTUAL_ACTIONS_ID as m, createActionHandler as n, scrubNdjsonTransform as o, RequestBodyTooLargeError as p, disposeActionHandler as r, scrubRpcJson as s, createWsHooks as t, RESOLVED_VIRTUAL_ACTIONS_ID as u, generateActionsClientModule as v, loadClientStub as w, generateClientStub as x, generateActionsModule as y };

package/dist/rpc.mjs

@@ -1,3 +1,3 @@
-import { a as streamToAsyncGen, i as bindAsyncGenContext, n as asyncGenToStream, r as asyncGenToStreamInContext, t as createClient } from "./client-Bc4g9AEw.mjs";
-import { a as extractJsonRpcRequestIds, c as scrubRpcMessage, i as ensureNdjsonBody, n as createActionHandler, o as scrubNdjsonTransform, r as disposeActionHandler, s as scrubRpcJson, t as createWsHooks } from "./rpc-DYFEdah8.mjs";
+import { a as extractJsonRpcRequestIds, c as scrubRpcMessage, i as ensureNdjsonBody, n as createActionHandler, o as scrubNdjsonTransform, r as disposeActionHandler, s as scrubRpcJson, t as createWsHooks } from "./rpc-DzUkWWgQ.mjs";
+import { a as streamToAsyncGen, i as bindAsyncGenContext, n as asyncGenToStream, r as asyncGenToStreamInContext, t as createClient } from "./client-C-s6XXpS.mjs";
 export { asyncGenToStream, asyncGenToStreamInContext, bindAsyncGenContext, createActionHandler, createClient, createWsHooks, disposeActionHandler, ensureNdjsonBody, extractJsonRpcRequestIds, scrubNdjsonTransform, scrubRpcJson, scrubRpcMessage, streamToAsyncGen };

package/dist/rsbuild.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { t as oxidejs } from "./plugin-HZKRDuCS.mjs";
 //#region src/rsbuild.ts
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { t as oxidejs } from "./plugin-HZKRDuCS.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",

package/dist/rpc-DYFEdah8.mjs

@@ -1,382 +0,0 @@
-import { _ as matchesActionPath, t as ACTION_PATH } from "./actions-DE6p5Cyp.mjs";
-import { t as runWithRequest } from "./context-zrTZyYpF.mjs";
-import { Layer } from "effect";
-import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
-import { HttpRouter } from "effect/unstable/http";
-//#region src/rpc/same-origin.ts
-function isSameOrigin(request) {
-	const site = request.headers.get("sec-fetch-site");
-	const origin = request.headers.get("origin");
-	if (!origin && !site) return false;
-	if (site && site !== "same-origin" && site !== "none") return false;
-	if (!origin) return site === "same-origin" || site === "none";
-	try {
-		return new URL(origin).host === (request.headers.get("host") ?? new URL(request.url).host);
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/rpc/scrub.ts
-/** Strip Effect RPC `Defect` / `Cause` payloads down to plain JSON-RPC errors. */
-const INTERNAL = {
-	code: -32603,
-	message: "Internal error"
-};
-const NDJSON_CONTENT = "application/json-rpc";
-function isRecord(value) {
-	return value !== null && typeof value === "object";
-}
-function classifyCause(error) {
-	const blob = `${String(error["message"] ?? "")}${JSON.stringify(error["data"] ?? "")}`;
-	if (/Unknown request tag/i.test(blob)) return {
-		code: -32601,
-		message: "Method not found"
-	};
-	if (/Missing key/i.test(blob) || /Expected/i.test(blob) && /\["args"\]|\[\\"args\\"\]/.test(blob)) return {
-		code: -32602,
-		message: "Invalid params"
-	};
-	return { ...INTERNAL };
-}
-function scrubError(error) {
-	if (!isRecord(error)) return { ...INTERNAL };
-	if (error["_tag"] === "Defect") return { ...INTERNAL };
-	if (error["_tag"] === "Cause") return classifyCause(error);
-	if (typeof error["code"] === "number" && typeof error["message"] === "string") return {
-		code: error["code"],
-		message: error["message"]
-	};
-	return { ...INTERNAL };
-}
-function createIdRepairState(requestIds = []) {
-	return { remaining: new Set(requestIds) };
-}
-/**
-* Scrub one JSON-RPC response object.
-* Effect encodes Defects with `id: -32603`; reclaim the originating request id from `state.remaining`.
-*/
-function scrubRpcMessage(msg, requestIds = [], state = createIdRepairState(requestIds)) {
-	if (!isRecord(msg) || !("error" in msg) || msg["error"] == null) {
-		if (isRecord(msg) && msg["chunk"] !== true && msg["id"] !== -32603 && "id" in msg) state.remaining.delete(msg["id"]);
-		return msg;
-	}
-	const error = scrubError(msg["error"]);
-	let id = msg["id"];
-	if (id === -32603) {
-		const next = state.remaining.values().next();
-		if (!next.done) {
-			id = next.value;
-			state.remaining.delete(next.value);
-		} else id = null;
-	} else if (id !== void 0 && id !== null) state.remaining.delete(id);
-	if (id === void 0) id = null;
-	return {
-		jsonrpc: "2.0",
-		id,
-		error
-	};
-}
-/**
-* Rewrite a JSON / NDJSON body so clients never see Effect `_tag` / `data` trees.
-* Accepts a single object, a JSON array, or newline-delimited frames.
-*/
-function scrubRpcJson(body, requestIds = []) {
-	const trimmed = body.replace(/^\uFEFF/, "");
-	if (!trimmed) return body;
-	const state = createIdRepairState(requestIds);
-	if (trimmed.includes("\n")) {
-		const lines = trimmed.split("\n");
-		const out = [];
-		for (const line of lines) {
-			if (line === "") continue;
-			out.push(scrubRpcLine(line, state));
-		}
-		return trimmed.endsWith("\n") ? `${out.join("\n")}\n` : out.join("\n");
-	}
-	try {
-		const parsed = JSON.parse(trimmed);
-		if (Array.isArray(parsed)) return JSON.stringify(parsed.map((msg) => scrubRpcMessage(msg, requestIds, state)));
-		return JSON.stringify(scrubRpcMessage(parsed, requestIds, state));
-	} catch {
-		return body;
-	}
-}
-function scrubRpcLine(line, state) {
-	try {
-		return JSON.stringify(scrubRpcMessage(JSON.parse(line), [], state));
-	} catch {
-		return line;
-	}
-}
-/** Collect JSON-RPC request ids from a unary object or batch array body. */
-function extractJsonRpcRequestIds(body) {
-	try {
-		let text = typeof body === "string" ? body : new TextDecoder().decode(body instanceof Uint8Array ? body : new Uint8Array(body));
-		text = text.replace(/^\uFEFF/, "").trimEnd();
-		if (text.includes("\n")) {
-			const ids = [];
-			for (const line of text.split("\n")) {
-				if (!line) continue;
-				const parsed = JSON.parse(line);
-				if (isRecord(parsed) && "id" in parsed) ids.push(parsed["id"]);
-			}
-			return ids;
-		}
-		const parsed = JSON.parse(text);
-		if (Array.isArray(parsed)) return parsed.filter(isRecord).filter((item) => "id" in item).map((item) => item["id"]);
-		if (isRecord(parsed) && "id" in parsed) return [parsed["id"]];
-	} catch {}
-	return [];
-}
-/** Ensure a body is a valid NDJSON frame (Effect's ndJsonRpc decode requires a trailing newline). */
-function ensureNdjsonBody(buf) {
-	const bytes = new Uint8Array(buf);
-	if (bytes.length > 0 && bytes[bytes.length - 1] === 10) return bytes;
-	const out = new Uint8Array(bytes.length + 1);
-	out.set(bytes);
-	out[bytes.length] = 10;
-	return out;
-}
-/**
-* TransformStream that scrubs Effect defect payloads one NDJSON line at a time,
-* so long-running stream actions stay incremental.
-*/
-function scrubNdjsonTransform(requestIds = []) {
-	const decoder = new TextDecoder();
-	const encoder = new TextEncoder();
-	const state = createIdRepairState(requestIds);
-	let pending = "";
-	return new TransformStream({
-		transform(chunk, controller) {
-			pending += decoder.decode(chunk, { stream: true });
-			let nl = pending.indexOf("\n");
-			while (nl !== -1) {
-				const line = pending.slice(0, nl);
-				pending = pending.slice(nl + 1);
-				if (line.length > 0) controller.enqueue(encoder.encode(`${scrubRpcLine(line, state)}\n`));
-				nl = pending.indexOf("\n");
-			}
-		},
-		flush(controller) {
-			pending += decoder.decode();
-			if (pending.length > 0) {
-				controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
-				pending = "";
-			}
-		}
-	});
-}
-//#endregion
-//#region src/rpc/server.ts
-const JSON_RPC_FORBIDDEN = {
-	jsonrpc: "2.0",
-	error: {
-		code: -32600,
-		message: "Forbidden"
-	},
-	id: null
-};
-const bundles = /* @__PURE__ */ new Map();
-const groupIds = /* @__PURE__ */ new WeakMap();
-let nextGroupId = 0;
-const serialization = RpcSerialization.layerNdJsonRpc();
-function bundleKey(group, path, transport) {
-	let id = groupIds.get(group);
-	if (id === void 0) {
-		id = nextGroupId++;
-		groupIds.set(group, id);
-	}
-	return `${id}:${path}:${transport}`;
-}
-function forbidden() {
-	return new Response(JSON.stringify(JSON_RPC_FORBIDDEN), {
-		status: 403,
-		headers: { "content-type": "application/json" }
-	});
-}
-function methodNotAllowed() {
-	return new Response("Method Not Allowed", {
-		status: 405,
-		headers: { Allow: "POST" }
-	});
-}
-function buildBundle(group, handlers, path, transport) {
-	const app = RpcServer.layerHttp({
-		group,
-		path,
-		protocol: transport === "ws" ? "websocket" : "http"
-	}).pipe(Layer.provide(handlers), Layer.provide(serialization));
-	return HttpRouter.toWebHandler(app, { disableLogger: true });
-}
-function bundleFor(group, handlers, path, transport) {
-	const key = bundleKey(group, path, transport);
-	const cached = bundles.get(key);
-	if (cached) return cached;
-	const built = buildBundle(group, handlers, path, transport);
-	bundles.set(key, built);
-	return built;
-}
-function scrubJsonResponse(response, requestIds) {
-	const contentType = response.headers.get("content-type") ?? "";
-	if (!contentType.includes("json")) return response;
-	if (response.body && (contentType.includes("application/json-rpc") || contentType.includes("ndjson"))) {
-		const headers = new Headers(response.headers);
-		headers.delete("content-length");
-		return new Response(response.body.pipeThrough(scrubNdjsonTransform(requestIds)), {
-			status: response.status,
-			statusText: response.statusText,
-			headers
-		});
-	}
-	return response;
-}
-async function scrubBufferedJson(response, requestIds) {
-	const text = await response.text();
-	const headers = new Headers(response.headers);
-	headers.delete("content-length");
-	return new Response(scrubRpcJson(text, requestIds), {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-function createActionHandler(group, handlers, options = {}) {
-	const path = options.path ?? "/__oxide/action";
-	const transport = options.transport ?? "http";
-	const sameOrigin = options.sameOrigin ?? true;
-	return async (request) => {
-		if (!matchesActionPath(new URL(request.url).pathname, path)) return new Response("Not Found", { status: 404 });
-		if (transport === "http" && request.method !== "POST") return methodNotAllowed();
-		if (sameOrigin && !isSameOrigin(request)) return forbidden();
-		const rawBody = ensureNdjsonBody(await request.arrayBuffer());
-		const requestIds = extractJsonRpcRequestIds(rawBody);
-		const headers = new Headers(request.headers);
-		headers.set("content-type", NDJSON_CONTENT);
-		const forwarded = new Request(request.url, {
-			method: request.method,
-			headers,
-			body: rawBody,
-			signal: request.signal
-		});
-		const extra = await options.createContext?.(forwarded) ?? {};
-		const { handler } = bundleFor(group, handlers, path, transport);
-		const response = await runWithRequest(forwarded, () => handler(forwarded), extra);
-		const contentType = response.headers.get("content-type") ?? "";
-		if (contentType.includes("application/json-rpc") || contentType.includes("ndjson")) return scrubJsonResponse(response, requestIds);
-		if (contentType.includes("json")) return scrubBufferedJson(response, requestIds);
-		return response;
-	};
-}
-function disposeActionHandler(group, path = ACTION_PATH, transport = "http") {
-	const key = bundleKey(group, path, transport);
-	const bundle = bundles.get(key);
-	bundles.delete(key);
-	return bundle?.dispose() ?? Promise.resolve();
-}
-//#endregion
-//#region src/rpc/ws.ts
-function parseMessage(message, maxBytes) {
-	try {
-		const raw = message.text();
-		if (new TextEncoder().encode(raw).byteLength > maxBytes) return {
-			ok: false,
-			tooLarge: true
-		};
-		return {
-			ok: true,
-			value: raw
-		};
-	} catch {
-		return { ok: false };
-	}
-}
-/** Forward each complete NDJSON line as its own WS message (keeps streams incremental). */
-async function sendNdjsonFrames(peer, response, signal) {
-	if (signal.aborted) {
-		await response.body?.cancel();
-		return;
-	}
-	if (!response.body) {
-		const text = await response.text();
-		if (text && !signal.aborted) peer.send(text);
-		return;
-	}
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let pending = "";
-	const onAbort = () => {
-		reader.cancel();
-	};
-	signal.addEventListener("abort", onAbort, { once: true });
-	try {
-		while (!signal.aborted) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			pending += decoder.decode(value, { stream: true });
-			let nl = pending.indexOf("\n");
-			while (nl !== -1) {
-				const line = pending.slice(0, nl);
-				pending = pending.slice(nl + 1);
-				if (line.length > 0 && !signal.aborted) peer.send(`${line}\n`);
-				nl = pending.indexOf("\n");
-			}
-		}
-		if (!signal.aborted) {
-			pending += decoder.decode();
-			if (pending.length > 0) peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
-		}
-	} finally {
-		signal.removeEventListener("abort", onAbort);
-	}
-}
-function createWsHooks(group, handlers, options = {}) {
-	const path = options.path ?? "/__oxide/action";
-	const maxBytes = options.maxMessageSize ?? 1048576;
-	const sameOrigin = options.sameOrigin ?? true;
-	const baseOptions = {
-		path,
-		transport: "http",
-		sameOrigin
-	};
-	return {
-		upgrade(req) {
-			if (!matchesActionPath(new URL(req.url).pathname, path)) return new Response("Not Found", { status: 404 });
-			if (sameOrigin && !isSameOrigin(req)) return new Response("Forbidden", { status: 403 });
-		},
-		async message(peer, message) {
-			const parsed = parseMessage(message, maxBytes);
-			if (!parsed.ok) {
-				peer.send(JSON.stringify({
-					jsonrpc: "2.0",
-					error: {
-						code: -32600,
-						message: parsed.tooLarge ? "Payload too large" : "Parse error"
-					},
-					id: null
-				}));
-				return;
-			}
-			const abort = new AbortController();
-			peer.onClose?.(() => abort.abort());
-			const host = peer.request?.headers.get("host") ?? "localhost";
-			const headers = new Headers(peer.request?.headers);
-			headers.set("content-type", NDJSON_CONTENT);
-			const peerCtx = await options.createContext?.(peer) ?? peer.context;
-			await sendNdjsonFrames(peer, await createActionHandler(group, handlers, {
-				...baseOptions,
-				createContext: (req) => ({
-					...peerCtx,
-					req
-				})
-			})(new Request(`http://${host}${path}`, {
-				method: "POST",
-				headers,
-				body: parsed.value,
-				signal: abort.signal
-			})), abort.signal);
-		}
-	};
-}
-//#endregion
-export { extractJsonRpcRequestIds as a, scrubRpcMessage as c, ensureNdjsonBody as i, createActionHandler as n, scrubNdjsonTransform as o, disposeActionHandler as r, scrubRpcJson as s, createWsHooks as t };