oxidejs 0.3.0 → 0.3.2

package/README.md

@@ -45,11 +45,11 @@ oxide({
 });
 ```
 
-`"celld"` writes `dist/wrangler.jsonc` for celld, a self-hosted alternative to Cloudflare Workers, and skips asset serving (`ASSETS` does that).
+`"celld"` writes `dist/wrangler.jsonc` for celld, a self-hosted alternative to Cloudflare Workers, and skips asset serving (`ASSETS` does that). The generated worker imports `oxidejs/worker-dom/install` so Ilha SSR has a DOM before your entry evaluates. Oxide merges `nodejs_compat` into `compatibility_flags` when you do not set it.
 
 ## Server actions
 
-Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with an RPC stub that POSTs `/__oxide/action`. The original module never enters the client graph. **Only exports wrapped in `action()` become remote actions** — any other export stays server-local and is not callable over the wire. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is the request context (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import `oxidejs/rpc`.
+Files named `*.server.ts`, `*.server.tsx`, `*.server.js`, or `*.server.jsx` are server-only. A client import is replaced with an Effect RPC stub that POSTs `/__oxide/action` as newline-delimited JSON-RPC (`application/json-rpc`). The original module never enters the client graph. **Only exports wrapped in `action()` become remote actions** — any other export stays server-local and is not callable over the wire. Server and Vite SSR (`import.meta.env.SSR === true`) keep the real functions. Methods are `<file>.<fn>` (`test.ping`). Call `useRequest()` inside an action for the inbound `Request`. `useCtx()` is the request context (`{ req }` plus anything middleware or `createContext` added). On `preset: "celld"`, `useEnv()` and `useFetchCtx()` are the Worker `env` and `ctx` from `fetch(request, env, ctx)` — same values as `useCtx().env` / `useCtx().fetchCtx`. Return `undefined` from `src/server.ts` to fall through to static files. No server action files → the bundle does not import `oxidejs/rpc`. `action()` results are JSON-RPC data — returning a `Response` from an action is an error; return a raw `Response` from `src/server.ts` for raw HTTP responses.
 
 ```ts
 // src/test.server.ts
@@ -78,7 +78,18 @@ export default {
 };
 ```
 
-`action()` is runtime identity — it marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over Effect RPC as newline-delimited JSON-RPC (`application/json-rpc` frames, not SSE). On the client, await the call to get the async generator. Inside server code, always read the non-optional signal from `useRequest().signal`:
+### Call shape
+
+Unary actions return a Promise and expose helpers for UI wiring:
+
+| Call                                        | What it does                                     |
+| ------------------------------------------- | ------------------------------------------------ |
+| `await ping()`                              | Run the action (always invokes RPC on client)    |
+| `ping.set(...args)`                         | Same as calling with args; also writes the atom  |
+| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action  |
+| `ping.result`                               | Read the last `AsyncResult` from the client atom |
+
+`action()` marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over Effect RPC as newline-delimited JSON-RPC (not SSE). On the client the stub returns an async generator — iterate it directly. Inside server code, always read the non-optional signal from `useRequest().signal`:
 
 ```ts
 // src/test.server.ts
@@ -93,12 +104,14 @@ export const ticks = action(async function* (n: number) {
 import { ticks } from "./test.server";
 
 const ac = new AbortController();
-for await (const value of await ticks(10, { signal: ac.signal })) {
+for await (const value of ticks(10, { signal: ac.signal })) {
   console.log(value);
 }
 ac.abort();
 ```
 
+Stream actions do not support `bind` / `with`. Breaking the `for await` loop or calling `return()` on the generator cleans up the server generator.
+
 `vite dev` and `rsbuild dev` serve the endpoint via middleware. `actions: "http"` (default) serves `/__oxide/action`; `actions: "ws"` uses a WebSocket instead (needs `crossws`; not with `preset: "celld"`). `actions.sameOrigin` defaults to `true` for both transports; set it to `false` only when you intentionally accept cross-origin requests. Set `actions.path` to move the endpoint. `actionHeaders` are static headers on the shared HTTP client and are ignored for WebSocket actions.
 
 ## Rsbuild
@@ -125,7 +138,7 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 | `clientDir`                    | `client`                 | Must stay inside `outDir`                                                                   |
 | `wrangler.name`                | required if `emitConfig` |                                                                                             |
 | `wrangler.compatibility_date`  | required if `emitConfig` |                                                                                             |
-| `wrangler.compatibility_flags` | —                        | optional                                                                                    |
+| `wrangler.compatibility_flags` | —                        | optional; `nodejs_compat` is merged in automatically on `celld`                             |
 | `wrangler.durable_objects`     | —                        | optional                                                                                    |
 | `wrangler.migrations`          | —                        | optional                                                                                    |
 | `wrangler.services`            | —                        | optional                                                                                    |
@@ -178,13 +191,17 @@ The generated `__asset` function uses `path.join` — not `path.resolve` — so
 
 ### Server actions (`*.server.{ts,tsx,js,jsx}`)
 
-- Server action code is **never bundled into the client**. Client imports are replaced with RPC stubs that POST the action endpoint (default `/__oxide/action`). The original source stays server-only.
+- Server action code is **never bundled into the client**. Client imports are replaced with Effect RPC stubs that POST the action endpoint (default `/__oxide/action`). The original source stays server-only.
 - Only `action()`-wrapped exports are exposed as RPC; other exports stay server-local.
+- Stream actions use newline-delimited JSON-RPC (`application/json-rpc`) over that same endpoint — not Server-Sent Events. Frames are scrubbed as they flush on HTTP and WebSocket.
 - The endpoint is POST-only. Non-POST requests return `405`.
 - Method dispatch uses `Object.hasOwn`, blocking `__proto__` / `constructor` walks.
 - Unknown or missing content-types → `415`.
 - Body size capped at 1 MB by default (enforced on the actual body, not just `Content-Length`).
 - Batch requests capped at 20 items (both HTTP and WebSocket transports).
+- Effect `Defect` / `Cause` payloads are scrubbed before they leave the endpoint. Clients see plain JSON-RPC errors (`code` + `message` only). Thrown messages become `Internal error` (`-32603`). Unknown methods → `-32601`; invalid params → `-32602`.
+- `actions.sameOrigin` defaults to `true`. Requests without both `Origin` and `Sec-Fetch-Site` are rejected when that check is on.
+- StackBlitz WebContainers do not keep `AsyncLocalStorage` across `async/await`. Oxide detects `process.versions.webcontainer` and falls back to a sync request store, capturing context before Effect schedules work and serializing handler entry so concurrent requests do not stomp that store. Stream pulls re-enter the captured store. This is a demo/dev workaround, not a concurrency model for production.
 
 ### Host header
 

package/dist/{client-Bc4g9AEw.mjs → client-BgBfkZDx.mjs}

@@ -1,3 +1,4 @@
+import { n as inWebcontainer } from "./context-DQDDwFYi.mjs";
 import { Effect, Layer, Scope, Stream } from "effect";
 import { RpcClient, RpcSchema, RpcSerialization } from "effect/unstable/rpc";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
@@ -6,20 +7,37 @@ import { Socket } from "effect/unstable/socket";
 function asyncGenToStream(gen) {
 	return Stream.fromAsyncIterable(gen, (error) => error instanceof Error ? error : new Error(String(error)));
 }
+/** Serialize WebContainer stream pulls so the shared syncStore is not stomped. */
+let pullTail = Promise.resolve();
 /**
-* Re-enter `run` for every generator pull so AsyncLocalStorage request context
-* stays available across yields (Effect may drain the stream after the outer ALS scope ends).
+* Re-enter `run` for every generator pull so request context stays available
+* across yields (Effect may drain the stream after the outer ALS scope ends;
+* WebContainer also loses ALS across awaits, so `run` must reinstall the store).
+* On WebContainer, pulls are serialized through settlement so concurrent streams
+* cannot replace the sync fallback mid-pull. `withRequestEntry` is unchanged.
 */
 function bindAsyncGenContext(gen, run) {
+	const runPull = (fn) => {
+		if (!inWebcontainer()) return run(fn);
+		let release;
+		const gate = new Promise((resolve) => {
+			release = resolve;
+		});
+		const prev = pullTail;
+		pullTail = gate;
+		return prev.then(() => Promise.resolve(run(fn))).finally(() => {
+			release();
+		});
+	};
 	return {
-		next: (value) => run(() => gen.next(value)),
-		return: (value) => run(() => gen.return(value)),
-		throw: (error) => run(() => gen.throw(error)),
+		next: (value) => runPull(() => gen.next(value)),
+		return: (value) => runPull(() => gen.return(value)),
+		throw: (error) => runPull(() => gen.throw(error)),
 		[Symbol.asyncIterator]() {
 			return this;
 		},
 		async [Symbol.asyncDispose]() {
-			await run(() => gen.return(void 0));
+			await runPull(() => gen.return(void 0));
 		}
 	};
 }
@@ -62,7 +80,8 @@ function clientLayer(options) {
 function loadClient(group, options) {
 	return Effect.gen(function* () {
 		const scope = yield* Scope.make();
-		return yield* Scope.provide(scope)(RpcClient.make(group).pipe(Effect.provide(clientLayer(options))));
+		const context = yield* Scope.provide(scope)(Layer.build(clientLayer(options)));
+		return yield* Scope.provide(scope)(RpcClient.make(group).pipe(Effect.provide(context)));
 	});
 }
 function isStreamResult(value) {
@@ -122,7 +141,9 @@ function createClient(group, options) {
 	const key = cacheKey(group, options);
 	let entry = clientCache.get(key);
 	if (!entry) {
-		entry = { pending: Effect.runPromise(loadClient(group, options)).then((flat) => nestClient(group, flat)).catch((error) => {
+		entry = { pending: Effect.runPromise(loadClient(group, options)).then((flat) => {
+			return nestClient(group, flat);
+		}).catch((error) => {
 			clientCache.delete(key);
 			throw error;
 		}) };

package/dist/{context-C1UFQ0Zc.d.mts → context-Ct8u5XUC.d.mts}

@@ -52,6 +52,15 @@ type ActionContext = {
   fetchCtx?: ExecutionContext;
   [key: string]: unknown;
 };
+/** Current request context: ALS first, then the WebContainer sync fallback. */
+declare function getRequestStore(): ActionContext;
+/**
+ * Run `fn` with `store` on ALS and the sync fallback. On WebContainer the sync
+ * slot is restored only after an async `fn` settles (streams capture the store
+ * at invoke time and re-enter via this helper on each pull). Sync returns and
+ * throws restore immediately so a completed request is not left visible.
+ */
+declare function withRequestStore<T>(ctx: ActionContext, fn: () => T): T;
 /** Current RPC or host request context. Throws outside request handling. */
 declare function useCtx<C extends ActionContext = ActionContext>(): C;
 /** Current server `Request`. Available in actions, SSR, and frame renders. */
@@ -61,4 +70,4 @@ declare function useEnv<E = unknown>(): E | undefined;
 /** Worker `ctx` from `fetch(request, env, ctx)` (`waitUntil`). `undefined` on Node. */
 declare function useFetchCtx(): ExecutionContext | undefined;
 //#endregion
-export { useFetchCtx as a, ServerActionHandle as c, brandServerAction as d, wrapClientRpc as f, useEnv as i, StreamActionHandle as l, ExecutionContext as n, useRequest as o, wrapClientStreamRpc as p, useCtx as r, ACTION_CALL as s, ActionContext as t, action as u };
+export { useEnv as a, withRequestStore as c, StreamActionHandle as d, action as f, wrapClientStreamRpc as h, useCtx as i, ACTION_CALL as l, wrapClientRpc as m, ExecutionContext as n, useFetchCtx as o, brandServerAction as p, getRequestStore as r, useRequest as s, ActionContext as t, ServerActionHandle as u };

package/dist/context-DQDDwFYi.mjs

@@ -0,0 +1,100 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import process from "node:process";
+//#region src/context.ts
+const ALS_KEY = Symbol.for("oxidejs.requestContext");
+const FETCH_KEY = Symbol.for("oxidejs.fetch");
+/** StackBlitz WebContainers lose AsyncLocalStorage across `async/await`. */
+const inWebcontainer = () => {
+	if (typeof process === "undefined") return false;
+	const versions = process.versions;
+	return Boolean(versions.webcontainer);
+};
+/** Module fallback when ALS does not survive awaits (WebContainer). */
+let syncStore = null;
+/** Serialize handler *entry* on WebContainer so syncStore is not stomped. */
+let entryTail = Promise.resolve();
+function als() {
+	const g = globalThis;
+	return g[ALS_KEY] ??= new AsyncLocalStorage();
+}
+const isPromiseLike = (value) => value !== null && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
+/** Current request context: ALS first, then the WebContainer sync fallback. */
+function getRequestStore() {
+	const current = als().getStore() ?? syncStore;
+	if (!current) throw new Error("oxidejs: request context is unavailable");
+	return current;
+}
+function store() {
+	return getRequestStore();
+}
+/**
+* Run `fn` with `store` on ALS and the sync fallback. On WebContainer the sync
+* slot is restored only after an async `fn` settles (streams capture the store
+* at invoke time and re-enter via this helper on each pull). Sync returns and
+* throws restore immediately so a completed request is not left visible.
+*/
+function withRequestStore(ctx, fn) {
+	const previous = syncStore;
+	syncStore = ctx;
+	let deferRestore = false;
+	try {
+		const result = als().run(ctx, fn);
+		if (inWebcontainer() && isPromiseLike(result)) {
+			deferRestore = true;
+			return Promise.resolve(result).finally(() => {
+				if (syncStore === ctx) syncStore = previous;
+			});
+		}
+		return result;
+	} finally {
+		if (!deferRestore) syncStore = previous;
+	}
+}
+/**
+* Serialize async work that installs request context on WebContainer.
+* Release as soon as `fn` settles — do not wait for streamed response bodies.
+*/
+async function withRequestEntry(fn) {
+	if (!inWebcontainer()) return fn();
+	let release;
+	const gate = new Promise((resolve) => {
+		release = resolve;
+	});
+	const previous = entryTail;
+	entryTail = gate;
+	await previous;
+	try {
+		return await fn();
+	} finally {
+		release();
+	}
+}
+/** Current RPC or host request context. Throws outside request handling. */
+function useCtx() {
+	return store();
+}
+/** Current server `Request`. Available in actions, SSR, and frame renders. */
+function useRequest() {
+	return store().req;
+}
+/** Worker `env` from `fetch(request, env, ctx)`. `undefined` on the Node fetch preset. */
+function useEnv() {
+	return store().env;
+}
+/** Worker `ctx` from `fetch(request, env, ctx)` (`waitUntil`). `undefined` on Node. */
+function useFetchCtx() {
+	return store().fetchCtx;
+}
+function runWithRequest(req, fn, extra) {
+	return withRequestStore({
+		...extra,
+		req
+	}, fn);
+}
+const HOOK_KEY = Symbol.for("oxidejs.runWithRequest");
+globalThis[HOOK_KEY] ??= (req, fn) => {
+	const extra = req[FETCH_KEY];
+	return runWithRequest(req, fn, extra);
+};
+//#endregion
+export { useEnv as a, withRequestEntry as c, useCtx as i, withRequestStore as l, inWebcontainer as n, useFetchCtx as o, runWithRequest as r, useRequest as s, getRequestStore as t };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-import { a as useFetchCtx, c as ServerActionHandle, d as brandServerAction, f as wrapClientRpc, i as useEnv, l as StreamActionHandle, n as ExecutionContext, o as useRequest, p as wrapClientStreamRpc, r as useCtx, s as ACTION_CALL, t as ActionContext, u as action } from "./context-C1UFQ0Zc.mjs";
+import { a as useEnv, c as withRequestStore, d as StreamActionHandle, f as action, h as wrapClientStreamRpc, i as useCtx, l as ACTION_CALL, m as wrapClientRpc, n as ExecutionContext, o as useFetchCtx, p as brandServerAction, r as getRequestStore, s as useRequest, t as ActionContext, u as ServerActionHandle } from "./context-Ct8u5XUC.mjs";
 import { a as OxidejsWranglerOptions, i as OxidejsPreset, n as OxidejsActionTransport, o as ResolvedOptions, r as OxidejsOptions, t as OxidejsActionHeaders } from "./types-BM4NAnzy.mjs";
-export { ACTION_CALL, type ActionContext, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, type ServerActionHandle, type StreamActionHandle, action, brandServerAction, useCtx, useEnv, useFetchCtx, useRequest, wrapClientRpc, wrapClientStreamRpc };
+export { ACTION_CALL, type ActionContext, type ExecutionContext, type OxidejsActionHeaders, type OxidejsActionTransport, type OxidejsOptions, type OxidejsPreset, type OxidejsWranglerOptions, type ResolvedOptions, type ServerActionHandle, type StreamActionHandle, action, brandServerAction, getRequestStore, useCtx, useEnv, useFetchCtx, useRequest, withRequestStore, wrapClientRpc, wrapClientStreamRpc };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as useRequest, i as useFetchCtx, n as useCtx, r as useEnv } from "./context-zrTZyYpF.mjs";
+import { a as useEnv, i as useCtx, l as withRequestStore, o as useFetchCtx, s as useRequest, t as getRequestStore } from "./context-DQDDwFYi.mjs";
 import * as Effect from "effect/Effect";
 import * as Atom from "effect/unstable/reactivity/Atom";
 import * as Registry from "effect/unstable/reactivity/AtomRegistry";
@@ -105,4 +105,4 @@ function action(fn) {
 	}))), invoke);
 }
 //#endregion
-export { ACTION_CALL, action, brandServerAction, useCtx, useEnv, useFetchCtx, useRequest, wrapClientRpc, wrapClientStreamRpc };
+export { ACTION_CALL, action, brandServerAction, getRequestStore, useCtx, useEnv, useFetchCtx, useRequest, withRequestStore, wrapClientRpc, wrapClientStreamRpc };

package/dist/{plugin-IQa_lKkT.mjs → plugin-CurpVnGn.mjs}

@@ -1,5 +1,4 @@
-import { C as scanServerFiles, S as pluginShouldStub, _ as matchesActionPath, a as RequestBodyTooLargeError, b as parseExportedNames, c as VIRTUAL_WORKER_ID, d as generateActionsModule, f as generateClientModule, g as loadClientStub, h as isServerFileId, i as RESOLVED_VIRTUAL_WORKER_ID, m as generateWorkerWrapper, n as RESOLVED_VIRTUAL_ACTIONS_ID, o as VIRTUAL_ACTIONS_ID, p as generateClientStub, r as RESOLVED_VIRTUAL_CLIENT_ID, t as ACTION_PATH, u as generateActionsClientModule, v as moduleKey, w as sendWebResponseFrom, x as parseStreamExports, y as nodeToWebRequest } from "./actions-DE6p5Cyp.mjs";
-import { n as createActionHandler, t as createWsHooks } from "./rpc-DYFEdah8.mjs";
+import { A as pluginShouldStub, C as isServerFileId, D as nodeToWebRequest, E as moduleKey, M as sendWebResponseFrom, O as parseExportedNames, S as generateWorkerWrapper, T as matchesActionPath, b as generateClientModule, d as RESOLVED_VIRTUAL_CLIENT_ID, f as RESOLVED_VIRTUAL_WORKER_ID, g as VIRTUAL_WORKER_ID, j as scanServerFiles, k as parseStreamExports, l as ACTION_PATH, m as VIRTUAL_ACTIONS_ID, n as createActionHandler, p as RequestBodyTooLargeError, t as createWsHooks, u as RESOLVED_VIRTUAL_ACTIONS_ID, v as generateActionsClientModule, w as loadClientStub, x as generateClientStub, y as generateActionsModule } from "./rpc-tYqxQToi.mjs";
 import { ensureWorkerDom } from "./worker-dom.mjs";
 import { createUnplugin } from "unplugin";
 import fs from "node:fs";
@@ -182,11 +181,13 @@ function mergeAliases(config, extra) {
 		replacement
 	})), ...extra];
 }
-const EFFECT_DEPS = [
+const OPTIMIZE_DEPS = [
 	"effect",
 	"effect/unstable/rpc",
 	"effect/unstable/http",
-	"effect/unstable/socket"
+	"effect/unstable/socket",
+	"oxidejs",
+	"oxidejs/rpc/client"
 ];
 function applyViteEnvironments(config, opts) {
 	config.builder ??= {};
@@ -198,7 +199,7 @@ function applyViteEnvironments(config, opts) {
 	]);
 	config.resolve.dedupe = [...dedupe];
 	config.optimizeDeps ??= {};
-	const optimizeInclude = /* @__PURE__ */ new Set([...Array.isArray(config.optimizeDeps.include) ? config.optimizeDeps.include : [], ...EFFECT_DEPS]);
+	const optimizeInclude = /* @__PURE__ */ new Set([...Array.isArray(config.optimizeDeps.include) ? config.optimizeDeps.include : [], ...OPTIMIZE_DEPS]);
 	config.optimizeDeps.include = [...optimizeInclude];
 	const celld = opts.preset === "celld";
 	mergeAliases(config, oxideRpcAliases());
@@ -530,7 +531,7 @@ const unpluginFactory = (options) => {
 									next();
 									return;
 								}
-								const { nodeToWebRequest, sendWebResponseFrom } = await import("./actions-DE6p5Cyp.mjs").then((n) => n.l);
+								const { nodeToWebRequest, sendWebResponseFrom } = await import("./rpc-tYqxQToi.mjs").then((n) => n._);
 								const request = await nodeToWebRequest(creq, resolved.bodyLimit);
 								const context = {
 									env: resolved.env,

package/dist/plugin.mjs

@@ -1,2 +1,2 @@
-import { n as unpluginFactory, r as vite, t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { n as unpluginFactory, r as vite, t as oxidejs } from "./plugin-CurpVnGn.mjs";
 export { oxidejs as default, oxidejs, unpluginFactory, vite };

package/dist/rpc/client.mjs

@@ -1,2 +1,2 @@
-import { t as createClient } from "../client-Bc4g9AEw.mjs";
+import { t as createClient } from "../client-BgBfkZDx.mjs";
 export { createClient };

package/dist/{actions-DE6p5Cyp.mjs → rpc-tYqxQToi.mjs}

@@ -1,5 +1,9 @@
+import { c as withRequestEntry, r as runWithRequest } from "./context-DQDDwFYi.mjs";
 import fs from "node:fs";
 import path from "node:path";
+import { Layer } from "effect";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { HttpRouter } from "effect/unstable/http";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -184,20 +188,21 @@ function generateActionsModule(modules, opts) {
 		`import { Effect } from "effect";`,
 		`import { Schema } from "effect";`,
 		`import { Rpc, RpcGroup } from "effect/unstable/rpc";`,
-		`import { AsyncLocalStorage } from "node:async_hooks";`,
+		`import { getRequestStore, withRequestStore } from "oxidejs";`,
 		`import { asyncGenToStreamInContext } from "oxidejs/rpc";`,
-		`const __alsKey = Symbol.for("oxidejs.requestContext");`,
-		`const __als = globalThis[__alsKey] ??= new AsyncLocalStorage();`,
-		`const __store = () => {`,
-		`  const ctx = __als.getStore();`,
-		`  if (!ctx) throw new Error("oxidejs: request context is unavailable");`,
-		`  return ctx;`,
-		`};`,
-		`const __run = (fn) =>`,
-		`  Effect.promise(() => __als.run(__store(), fn)).pipe(`,
-		`    Effect.map((value) => (value === undefined ? null : value)),`,
+		`const __run = (fn) => {`,
+		`  const __s = getRequestStore();`,
+		`  return Effect.promise(() => withRequestStore(__s, fn)).pipe(`,
+		`    Effect.map((value) => {`,
+		`      if (value instanceof Response) {`,
+		`        console.error("oxidejs: action() returned a Response; actions must return serializable data. Return a Response from src/server.ts for raw HTTP responses.");`,
+		`        throw new Error("action() returned a Response; return it from src/server.ts instead");`,
+		`      }`,
+		`      return value === undefined ? null : value;`,
+		`    }),`,
 		`  );`,
-		`const __withStore = (store, fn) => __als.run(store, fn);`
+		`};`,
+		`const __withStore = (store, fn) => withRequestStore(store, fn);`
 	];
 	const rpcNames = [];
 	const aliases = modules.map((mod, i) => {
@@ -221,7 +226,7 @@ function generateActionsModule(modules, opts) {
 	for (const { alias, mod } of aliases) for (const name of mod.exports) {
 		const tag = `${mod.key}.${name}`;
 		const stream = mod.streams?.includes(name) ?? false;
-		lines.push(stream ? `  ${JSON.stringify(tag)}: ({ args }) => { const __s = __store(); return asyncGenToStreamInContext(() => ${alias}[${JSON.stringify(name)}].apply(null, args), (fn) => __withStore(__s, fn)); },` : `  ${JSON.stringify(tag)}: ({ args }) => __run(() => ${alias}[${JSON.stringify(name)}].apply(null, args)),`);
+		lines.push(stream ? `  ${JSON.stringify(tag)}: ({ args }) => { const __s = getRequestStore(); return asyncGenToStreamInContext(() => ${alias}[${JSON.stringify(name)}].apply(null, args), (fn) => __withStore(__s, fn)); },` : `  ${JSON.stringify(tag)}: ({ args }) => __run(() => ${alias}[${JSON.stringify(name)}].apply(null, args)),`);
 	}
 	lines.push(`});`);
 	lines.push(`export default actionsGroup;`);
@@ -501,4 +506,407 @@ async function sendWebResponseFrom(req, res, response) {
 	return pipeResponse(req, res, response);
 }
 //#endregion
-export { scanServerFiles as C, pluginShouldStub as S, matchesActionPath as _, RequestBodyTooLargeError as a, parseExportedNames as b, VIRTUAL_WORKER_ID as c, generateActionsModule as d, generateClientModule as f, loadClientStub as g, isServerFileId as h, RESOLVED_VIRTUAL_WORKER_ID as i, actions_exports as l, generateWorkerWrapper as m, RESOLVED_VIRTUAL_ACTIONS_ID as n, VIRTUAL_ACTIONS_ID as o, generateClientStub as p, RESOLVED_VIRTUAL_CLIENT_ID as r, VIRTUAL_CLIENT_ID as s, ACTION_PATH as t, generateActionsClientModule as u, moduleKey as v, sendWebResponseFrom as w, parseStreamExports as x, nodeToWebRequest as y };
+//#region src/rpc/same-origin.ts
+function isSameOrigin(request) {
+	const site = request.headers.get("sec-fetch-site");
+	const origin = request.headers.get("origin");
+	if (!origin && !site) return false;
+	if (site && site !== "same-origin" && site !== "none") return false;
+	if (!origin) return site === "same-origin" || site === "none";
+	try {
+		return new URL(origin).host === (request.headers.get("host") ?? new URL(request.url).host);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/rpc/scrub.ts
+/** Strip Effect RPC `Defect` / `Cause` payloads down to plain JSON-RPC errors. */
+const INTERNAL = {
+	code: -32603,
+	message: "Internal error"
+};
+const NDJSON_CONTENT = "application/json-rpc";
+function isRecord(value) {
+	return value !== null && typeof value === "object";
+}
+function classifyCause(error) {
+	const blob = `${String(error["message"] ?? "")}${JSON.stringify(error["data"] ?? "")}`;
+	if (/Unknown request tag/i.test(blob)) return {
+		code: -32601,
+		message: "Method not found"
+	};
+	if (/Missing key/i.test(blob) || /Expected/i.test(blob) && /\["args"\]|\[\\"args\\"\]/.test(blob)) return {
+		code: -32602,
+		message: "Invalid params"
+	};
+	return { ...INTERNAL };
+}
+function scrubError(error) {
+	if (!isRecord(error)) return { ...INTERNAL };
+	if (error["_tag"] === "Defect") return { ...INTERNAL };
+	if (error["_tag"] === "Cause") return classifyCause(error);
+	if (typeof error["code"] === "number" && typeof error["message"] === "string") return {
+		code: error["code"],
+		message: error["message"]
+	};
+	return { ...INTERNAL };
+}
+function createIdRepairState(requestIds = []) {
+	return { remaining: new Set(requestIds) };
+}
+/**
+* Scrub one JSON-RPC response object.
+* Effect encodes Defects with `id: -32603`; reclaim the originating request id from `state.remaining`.
+*/
+function scrubRpcMessage(msg, requestIds = [], state = createIdRepairState(requestIds)) {
+	if (!isRecord(msg) || !("error" in msg) || msg["error"] == null) {
+		if (isRecord(msg) && msg["chunk"] !== true && msg["id"] !== -32603 && "id" in msg) state.remaining.delete(msg["id"]);
+		return msg;
+	}
+	const error = scrubError(msg["error"]);
+	let id = msg["id"];
+	if (id === -32603) {
+		const next = state.remaining.values().next();
+		if (!next.done) {
+			id = next.value;
+			state.remaining.delete(next.value);
+		} else id = null;
+	} else if (id !== void 0 && id !== null) state.remaining.delete(id);
+	if (id === void 0) id = null;
+	return {
+		jsonrpc: "2.0",
+		id,
+		error
+	};
+}
+/**
+* Rewrite a JSON / NDJSON body so clients never see Effect `_tag` / `data` trees.
+* Accepts a single object, a JSON array, or newline-delimited frames.
+*/
+function scrubRpcJson(body, requestIds = []) {
+	const trimmed = body.replace(/^\uFEFF/, "");
+	if (!trimmed) return body;
+	const state = createIdRepairState(requestIds);
+	if (trimmed.includes("\n")) {
+		const lines = trimmed.split("\n");
+		const out = [];
+		for (const line of lines) {
+			if (line === "") continue;
+			out.push(scrubRpcLine(line, state));
+		}
+		return trimmed.endsWith("\n") ? `${out.join("\n")}\n` : out.join("\n");
+	}
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (Array.isArray(parsed)) return JSON.stringify(parsed.map((msg) => scrubRpcMessage(msg, requestIds, state)));
+		return JSON.stringify(scrubRpcMessage(parsed, requestIds, state));
+	} catch {
+		return body;
+	}
+}
+function scrubRpcLine(line, state) {
+	try {
+		return JSON.stringify(scrubRpcMessage(JSON.parse(line), [], state));
+	} catch {
+		return line;
+	}
+}
+/** Collect JSON-RPC request ids from a unary object or batch array body. */
+function extractJsonRpcRequestIds(body) {
+	try {
+		let text = typeof body === "string" ? body : new TextDecoder().decode(body instanceof Uint8Array ? body : new Uint8Array(body));
+		text = text.replace(/^\uFEFF/, "").trimEnd();
+		if (text.includes("\n")) {
+			const ids = [];
+			for (const line of text.split("\n")) {
+				if (!line) continue;
+				const parsed = JSON.parse(line);
+				if (isRecord(parsed) && "id" in parsed) ids.push(parsed["id"]);
+			}
+			return ids;
+		}
+		const parsed = JSON.parse(text);
+		if (Array.isArray(parsed)) return parsed.filter(isRecord).filter((item) => "id" in item).map((item) => item["id"]);
+		if (isRecord(parsed) && "id" in parsed) return [parsed["id"]];
+	} catch {}
+	return [];
+}
+/** Ensure a body is a valid NDJSON frame (Effect's ndJsonRpc decode requires a trailing newline). */
+function ensureNdjsonBody(buf) {
+	const bytes = new Uint8Array(buf);
+	if (bytes.length > 0 && bytes[bytes.length - 1] === 10) return bytes;
+	const out = new Uint8Array(bytes.length + 1);
+	out.set(bytes);
+	out[bytes.length] = 10;
+	return out;
+}
+/**
+* TransformStream that scrubs Effect defect payloads one NDJSON line at a time,
+* so long-running stream actions stay incremental.
+*/
+function scrubNdjsonTransform(requestIds = []) {
+	const decoder = new TextDecoder();
+	const encoder = new TextEncoder();
+	const state = createIdRepairState(requestIds);
+	let pending = "";
+	return new TransformStream({
+		transform(chunk, controller) {
+			pending += decoder.decode(chunk, { stream: true });
+			let nl = pending.indexOf("\n");
+			while (nl !== -1) {
+				const line = pending.slice(0, nl);
+				pending = pending.slice(nl + 1);
+				if (line.length > 0) controller.enqueue(encoder.encode(`${scrubRpcLine(line, state)}\n`));
+				nl = pending.indexOf("\n");
+			}
+		},
+		flush(controller) {
+			pending += decoder.decode();
+			if (pending.length > 0) {
+				controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
+				pending = "";
+			}
+		}
+	});
+}
+//#endregion
+//#region src/rpc/server.ts
+const JSON_RPC_FORBIDDEN = {
+	jsonrpc: "2.0",
+	error: {
+		code: -32600,
+		message: "Forbidden"
+	},
+	id: null
+};
+const bundles = /* @__PURE__ */ new Map();
+const groupIds = /* @__PURE__ */ new WeakMap();
+let nextGroupId = 0;
+const serialization = RpcSerialization.layerNdJsonRpc();
+function bundleKey(group, path, transport) {
+	let id = groupIds.get(group);
+	if (id === void 0) {
+		id = nextGroupId++;
+		groupIds.set(group, id);
+	}
+	return `${id}:${path}:${transport}`;
+}
+function forbidden() {
+	return new Response(JSON.stringify(JSON_RPC_FORBIDDEN), {
+		status: 403,
+		headers: { "content-type": "application/json" }
+	});
+}
+function methodNotAllowed() {
+	return new Response("Method Not Allowed", {
+		status: 405,
+		headers: { Allow: "POST" }
+	});
+}
+function buildBundle(group, handlers, path, transport) {
+	const app = RpcServer.layerHttp({
+		group,
+		path,
+		protocol: transport === "ws" ? "websocket" : "http"
+	}).pipe(Layer.provide(handlers), Layer.provide(serialization));
+	return HttpRouter.toWebHandler(app, { disableLogger: true });
+}
+function bundleFor(group, handlers, path, transport) {
+	const key = bundleKey(group, path, transport);
+	const cached = bundles.get(key);
+	if (cached) return cached;
+	const built = buildBundle(group, handlers, path, transport);
+	bundles.set(key, built);
+	return built;
+}
+function scrubJsonResponse(response, requestIds) {
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!contentType.includes("json")) return response;
+	if (response.body && (contentType.includes("application/json-rpc") || contentType.includes("ndjson"))) {
+		const headers = new Headers(response.headers);
+		headers.delete("content-length");
+		return new Response(response.body.pipeThrough(scrubNdjsonTransform(requestIds)), {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	return response;
+}
+async function scrubBufferedJson(response, requestIds) {
+	const text = await response.text();
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	return new Response(scrubRpcJson(text, requestIds), {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function createActionHandler(group, handlers, options = {}) {
+	const path = options.path ?? "/__oxide/action";
+	const transport = options.transport ?? "http";
+	const sameOrigin = options.sameOrigin ?? true;
+	return async (request) => {
+		if (!matchesActionPath(new URL(request.url).pathname, path)) return new Response("Not Found", { status: 404 });
+		if (transport === "http" && request.method !== "POST") return methodNotAllowed();
+		if (sameOrigin && !isSameOrigin(request)) return forbidden();
+		return withRequestEntry(async () => {
+			const rawBody = ensureNdjsonBody(await request.arrayBuffer());
+			const requestIds = extractJsonRpcRequestIds(rawBody);
+			const headers = new Headers(request.headers);
+			headers.set("content-type", NDJSON_CONTENT);
+			const forwarded = new Request(request.url, {
+				method: request.method,
+				headers,
+				body: rawBody,
+				signal: request.signal
+			});
+			const extra = await options.createContext?.(forwarded) ?? {};
+			const { handler } = bundleFor(group, handlers, path, transport);
+			const response = await runWithRequest(forwarded, () => handler(forwarded), extra);
+			const contentType = response.headers.get("content-type") ?? "";
+			if (contentType.includes("application/json-rpc") || contentType.includes("ndjson")) return scrubJsonResponse(response, requestIds);
+			if (contentType.includes("json")) return scrubBufferedJson(response, requestIds);
+			return response;
+		});
+	};
+}
+function disposeActionHandler(group, path = ACTION_PATH, transport = "http") {
+	const key = bundleKey(group, path, transport);
+	const bundle = bundles.get(key);
+	bundles.delete(key);
+	return bundle?.dispose() ?? Promise.resolve();
+}
+//#endregion
+//#region src/rpc/ws.ts
+function parseMessage(message, maxBytes) {
+	try {
+		const raw = message.text();
+		if (new TextEncoder().encode(raw).byteLength > maxBytes) return {
+			ok: false,
+			tooLarge: true
+		};
+		return {
+			ok: true,
+			value: raw
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* Effect's socket client sends `@effect/rpc/Ping` keepalives (no id) and hangs
+* up unless the server answers `@effect/rpc/Pong`. Handle control messages here
+* so they never reach the action handler.
+*/
+function controlReply(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && parsed.method === "@effect/rpc/Ping") return JSON.stringify({
+			jsonrpc: "2.0",
+			method: "@effect/rpc/Pong"
+		});
+	} catch {}
+}
+/** Forward each complete NDJSON line as its own WS message (keeps streams incremental). */
+async function sendNdjsonFrames(peer, response, signal) {
+	if (signal.aborted) {
+		await response.body?.cancel();
+		return;
+	}
+	if (!response.body) {
+		const text = await response.text();
+		if (text && !signal.aborted) peer.send(text);
+		return;
+	}
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	const onAbort = () => {
+		reader.cancel();
+	};
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		while (!signal.aborted) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			pending += decoder.decode(value, { stream: true });
+			let nl = pending.indexOf("\n");
+			while (nl !== -1) {
+				const line = pending.slice(0, nl);
+				pending = pending.slice(nl + 1);
+				if (line.length > 0 && !signal.aborted) peer.send(`${line}\n`);
+				nl = pending.indexOf("\n");
+			}
+		}
+		if (!signal.aborted) {
+			pending += decoder.decode();
+			if (pending.length > 0) peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
+		}
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+function createWsHooks(group, handlers, options = {}) {
+	const path = options.path ?? "/__oxide/action";
+	const maxBytes = options.maxMessageSize ?? 1048576;
+	const sameOrigin = options.sameOrigin ?? true;
+	const baseOptions = {
+		path,
+		transport: "http",
+		sameOrigin
+	};
+	return {
+		upgrade(req) {
+			let pathname;
+			try {
+				pathname = new URL(req.url).pathname;
+			} catch {
+				return new Response("Bad Request", { status: 400 });
+			}
+			if (!matchesActionPath(pathname, path)) return new Response("Not Found", { status: 404 });
+			if (sameOrigin && !isSameOrigin(req)) return new Response("Forbidden", { status: 403 });
+		},
+		async message(peer, message) {
+			const parsed = parseMessage(message, maxBytes);
+			if (!parsed.ok) {
+				peer.send(JSON.stringify({
+					jsonrpc: "2.0",
+					error: {
+						code: -32600,
+						message: parsed.tooLarge ? "Payload too large" : "Parse error"
+					},
+					id: null
+				}));
+				return;
+			}
+			const pingReply = controlReply(parsed.value);
+			if (pingReply !== void 0) {
+				peer.send(pingReply);
+				return;
+			}
+			const abort = new AbortController();
+			peer.onClose?.(() => abort.abort());
+			const host = peer.request?.headers.get("host") ?? "localhost";
+			const headers = new Headers(peer.request?.headers);
+			headers.set("content-type", NDJSON_CONTENT);
+			const peerCtx = await options.createContext?.(peer) ?? peer.context;
+			await sendNdjsonFrames(peer, await createActionHandler(group, handlers, {
+				...baseOptions,
+				createContext: (req) => ({
+					...peerCtx,
+					req
+				})
+			})(new Request(`http://${host}${path}`, {
+				method: "POST",
+				headers,
+				body: parsed.value,
+				signal: abort.signal
+			})), abort.signal);
+		}
+	};
+}
+//#endregion
+export { pluginShouldStub as A, isServerFileId as C, nodeToWebRequest as D, moduleKey as E, sendWebResponseFrom as M, parseExportedNames as O, generateWorkerWrapper as S, matchesActionPath as T, actions_exports as _, extractJsonRpcRequestIds as a, generateClientModule as b, scrubRpcMessage as c, RESOLVED_VIRTUAL_CLIENT_ID as d, RESOLVED_VIRTUAL_WORKER_ID as f, VIRTUAL_WORKER_ID as g, VIRTUAL_CLIENT_ID as h, ensureNdjsonBody as i, scanServerFiles as j, parseStreamExports as k, ACTION_PATH as l, VIRTUAL_ACTIONS_ID as m, createActionHandler as n, scrubNdjsonTransform as o, RequestBodyTooLargeError as p, disposeActionHandler as r, scrubRpcJson as s, createWsHooks as t, RESOLVED_VIRTUAL_ACTIONS_ID as u, generateActionsClientModule as v, loadClientStub as w, generateClientStub as x, generateActionsModule as y };

package/dist/rpc.d.mts

@@ -1,4 +1,4 @@
-import { t as ActionContext } from "./context-C1UFQ0Zc.mjs";
+import { t as ActionContext } from "./context-Ct8u5XUC.mjs";
 import { RpcClientOptions, createClient } from "./rpc/client.mjs";
 import { Layer, Stream } from "effect";
 import { Rpc, RpcGroup } from "effect/unstable/rpc";
@@ -38,8 +38,11 @@ declare function createWsHooks(group: RpcGroup.RpcGroup<Rpc.Any>, handlers: Laye
 //#region src/rpc/stream.d.ts
 declare function asyncGenToStream<T>(gen: AsyncGenerator<T, unknown, unknown>): Stream.Stream<T, Error, never>;
 /**
- * Re-enter `run` for every generator pull so AsyncLocalStorage request context
- * stays available across yields (Effect may drain the stream after the outer ALS scope ends).
+ * Re-enter `run` for every generator pull so request context stays available
+ * across yields (Effect may drain the stream after the outer ALS scope ends;
+ * WebContainer also loses ALS across awaits, so `run` must reinstall the store).
+ * On WebContainer, pulls are serialized through settlement so concurrent streams
+ * cannot replace the sync fallback mid-pull. `withRequestEntry` is unchanged.
  */
 declare function bindAsyncGenContext<T>(gen: AsyncGenerator<T, unknown, unknown>, run: <R>(fn: () => R) => R): AsyncGenerator<T, unknown, unknown>;
 /** Create a generator inside `run`, then keep every subsequent pull inside `run`. */

package/dist/rpc.mjs

@@ -1,3 +1,3 @@
-import { a as streamToAsyncGen, i as bindAsyncGenContext, n as asyncGenToStream, r as asyncGenToStreamInContext, t as createClient } from "./client-Bc4g9AEw.mjs";
-import { a as extractJsonRpcRequestIds, c as scrubRpcMessage, i as ensureNdjsonBody, n as createActionHandler, o as scrubNdjsonTransform, r as disposeActionHandler, s as scrubRpcJson, t as createWsHooks } from "./rpc-DYFEdah8.mjs";
+import { a as extractJsonRpcRequestIds, c as scrubRpcMessage, i as ensureNdjsonBody, n as createActionHandler, o as scrubNdjsonTransform, r as disposeActionHandler, s as scrubRpcJson, t as createWsHooks } from "./rpc-tYqxQToi.mjs";
+import { a as streamToAsyncGen, i as bindAsyncGenContext, n as asyncGenToStream, r as asyncGenToStreamInContext, t as createClient } from "./client-BgBfkZDx.mjs";
 export { asyncGenToStream, asyncGenToStreamInContext, bindAsyncGenContext, createActionHandler, createClient, createWsHooks, disposeActionHandler, ensureNdjsonBody, extractJsonRpcRequestIds, scrubNdjsonTransform, scrubRpcJson, scrubRpcMessage, streamToAsyncGen };

package/dist/rsbuild.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { t as oxidejs } from "./plugin-CurpVnGn.mjs";
 //#region src/rsbuild.ts
 var rsbuild_default = oxidejs.rsbuild;
 //#endregion

package/dist/vite.mjs

@@ -1,4 +1,4 @@
-import { t as oxidejs } from "./plugin-IQa_lKkT.mjs";
+import { t as oxidejs } from "./plugin-CurpVnGn.mjs";
 //#region src/vite.ts
 var vite_default = oxidejs.vite;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",

package/dist/context-zrTZyYpF.mjs

@@ -1,42 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/context.ts
-const ALS_KEY = Symbol.for("oxidejs.requestContext");
-const FETCH_KEY = Symbol.for("oxidejs.fetch");
-function als() {
-	const g = globalThis;
-	return g[ALS_KEY] ??= new AsyncLocalStorage();
-}
-function store() {
-	const current = als().getStore();
-	if (!current) throw new Error("oxidejs: request context is unavailable");
-	return current;
-}
-/** Current RPC or host request context. Throws outside request handling. */
-function useCtx() {
-	return store();
-}
-/** Current server `Request`. Available in actions, SSR, and frame renders. */
-function useRequest() {
-	return store().req;
-}
-/** Worker `env` from `fetch(request, env, ctx)`. `undefined` on the Node fetch preset. */
-function useEnv() {
-	return store().env;
-}
-/** Worker `ctx` from `fetch(request, env, ctx)` (`waitUntil`). `undefined` on Node. */
-function useFetchCtx() {
-	return store().fetchCtx;
-}
-function runWithRequest(req, fn, extra) {
-	return als().run({
-		...extra,
-		req
-	}, fn);
-}
-const HOOK_KEY = Symbol.for("oxidejs.runWithRequest");
-globalThis[HOOK_KEY] ??= (req, fn) => {
-	const extra = req[FETCH_KEY];
-	return runWithRequest(req, fn, extra);
-};
-//#endregion
-export { useRequest as a, useFetchCtx as i, useCtx as n, useEnv as r, runWithRequest as t };

package/dist/rpc-DYFEdah8.mjs

@@ -1,382 +0,0 @@
-import { _ as matchesActionPath, t as ACTION_PATH } from "./actions-DE6p5Cyp.mjs";
-import { t as runWithRequest } from "./context-zrTZyYpF.mjs";
-import { Layer } from "effect";
-import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
-import { HttpRouter } from "effect/unstable/http";
-//#region src/rpc/same-origin.ts
-function isSameOrigin(request) {
-	const site = request.headers.get("sec-fetch-site");
-	const origin = request.headers.get("origin");
-	if (!origin && !site) return false;
-	if (site && site !== "same-origin" && site !== "none") return false;
-	if (!origin) return site === "same-origin" || site === "none";
-	try {
-		return new URL(origin).host === (request.headers.get("host") ?? new URL(request.url).host);
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/rpc/scrub.ts
-/** Strip Effect RPC `Defect` / `Cause` payloads down to plain JSON-RPC errors. */
-const INTERNAL = {
-	code: -32603,
-	message: "Internal error"
-};
-const NDJSON_CONTENT = "application/json-rpc";
-function isRecord(value) {
-	return value !== null && typeof value === "object";
-}
-function classifyCause(error) {
-	const blob = `${String(error["message"] ?? "")}${JSON.stringify(error["data"] ?? "")}`;
-	if (/Unknown request tag/i.test(blob)) return {
-		code: -32601,
-		message: "Method not found"
-	};
-	if (/Missing key/i.test(blob) || /Expected/i.test(blob) && /\["args"\]|\[\\"args\\"\]/.test(blob)) return {
-		code: -32602,
-		message: "Invalid params"
-	};
-	return { ...INTERNAL };
-}
-function scrubError(error) {
-	if (!isRecord(error)) return { ...INTERNAL };
-	if (error["_tag"] === "Defect") return { ...INTERNAL };
-	if (error["_tag"] === "Cause") return classifyCause(error);
-	if (typeof error["code"] === "number" && typeof error["message"] === "string") return {
-		code: error["code"],
-		message: error["message"]
-	};
-	return { ...INTERNAL };
-}
-function createIdRepairState(requestIds = []) {
-	return { remaining: new Set(requestIds) };
-}
-/**
-* Scrub one JSON-RPC response object.
-* Effect encodes Defects with `id: -32603`; reclaim the originating request id from `state.remaining`.
-*/
-function scrubRpcMessage(msg, requestIds = [], state = createIdRepairState(requestIds)) {
-	if (!isRecord(msg) || !("error" in msg) || msg["error"] == null) {
-		if (isRecord(msg) && msg["chunk"] !== true && msg["id"] !== -32603 && "id" in msg) state.remaining.delete(msg["id"]);
-		return msg;
-	}
-	const error = scrubError(msg["error"]);
-	let id = msg["id"];
-	if (id === -32603) {
-		const next = state.remaining.values().next();
-		if (!next.done) {
-			id = next.value;
-			state.remaining.delete(next.value);
-		} else id = null;
-	} else if (id !== void 0 && id !== null) state.remaining.delete(id);
-	if (id === void 0) id = null;
-	return {
-		jsonrpc: "2.0",
-		id,
-		error
-	};
-}
-/**
-* Rewrite a JSON / NDJSON body so clients never see Effect `_tag` / `data` trees.
-* Accepts a single object, a JSON array, or newline-delimited frames.
-*/
-function scrubRpcJson(body, requestIds = []) {
-	const trimmed = body.replace(/^\uFEFF/, "");
-	if (!trimmed) return body;
-	const state = createIdRepairState(requestIds);
-	if (trimmed.includes("\n")) {
-		const lines = trimmed.split("\n");
-		const out = [];
-		for (const line of lines) {
-			if (line === "") continue;
-			out.push(scrubRpcLine(line, state));
-		}
-		return trimmed.endsWith("\n") ? `${out.join("\n")}\n` : out.join("\n");
-	}
-	try {
-		const parsed = JSON.parse(trimmed);
-		if (Array.isArray(parsed)) return JSON.stringify(parsed.map((msg) => scrubRpcMessage(msg, requestIds, state)));
-		return JSON.stringify(scrubRpcMessage(parsed, requestIds, state));
-	} catch {
-		return body;
-	}
-}
-function scrubRpcLine(line, state) {
-	try {
-		return JSON.stringify(scrubRpcMessage(JSON.parse(line), [], state));
-	} catch {
-		return line;
-	}
-}
-/** Collect JSON-RPC request ids from a unary object or batch array body. */
-function extractJsonRpcRequestIds(body) {
-	try {
-		let text = typeof body === "string" ? body : new TextDecoder().decode(body instanceof Uint8Array ? body : new Uint8Array(body));
-		text = text.replace(/^\uFEFF/, "").trimEnd();
-		if (text.includes("\n")) {
-			const ids = [];
-			for (const line of text.split("\n")) {
-				if (!line) continue;
-				const parsed = JSON.parse(line);
-				if (isRecord(parsed) && "id" in parsed) ids.push(parsed["id"]);
-			}
-			return ids;
-		}
-		const parsed = JSON.parse(text);
-		if (Array.isArray(parsed)) return parsed.filter(isRecord).filter((item) => "id" in item).map((item) => item["id"]);
-		if (isRecord(parsed) && "id" in parsed) return [parsed["id"]];
-	} catch {}
-	return [];
-}
-/** Ensure a body is a valid NDJSON frame (Effect's ndJsonRpc decode requires a trailing newline). */
-function ensureNdjsonBody(buf) {
-	const bytes = new Uint8Array(buf);
-	if (bytes.length > 0 && bytes[bytes.length - 1] === 10) return bytes;
-	const out = new Uint8Array(bytes.length + 1);
-	out.set(bytes);
-	out[bytes.length] = 10;
-	return out;
-}
-/**
-* TransformStream that scrubs Effect defect payloads one NDJSON line at a time,
-* so long-running stream actions stay incremental.
-*/
-function scrubNdjsonTransform(requestIds = []) {
-	const decoder = new TextDecoder();
-	const encoder = new TextEncoder();
-	const state = createIdRepairState(requestIds);
-	let pending = "";
-	return new TransformStream({
-		transform(chunk, controller) {
-			pending += decoder.decode(chunk, { stream: true });
-			let nl = pending.indexOf("\n");
-			while (nl !== -1) {
-				const line = pending.slice(0, nl);
-				pending = pending.slice(nl + 1);
-				if (line.length > 0) controller.enqueue(encoder.encode(`${scrubRpcLine(line, state)}\n`));
-				nl = pending.indexOf("\n");
-			}
-		},
-		flush(controller) {
-			pending += decoder.decode();
-			if (pending.length > 0) {
-				controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
-				pending = "";
-			}
-		}
-	});
-}
-//#endregion
-//#region src/rpc/server.ts
-const JSON_RPC_FORBIDDEN = {
-	jsonrpc: "2.0",
-	error: {
-		code: -32600,
-		message: "Forbidden"
-	},
-	id: null
-};
-const bundles = /* @__PURE__ */ new Map();
-const groupIds = /* @__PURE__ */ new WeakMap();
-let nextGroupId = 0;
-const serialization = RpcSerialization.layerNdJsonRpc();
-function bundleKey(group, path, transport) {
-	let id = groupIds.get(group);
-	if (id === void 0) {
-		id = nextGroupId++;
-		groupIds.set(group, id);
-	}
-	return `${id}:${path}:${transport}`;
-}
-function forbidden() {
-	return new Response(JSON.stringify(JSON_RPC_FORBIDDEN), {
-		status: 403,
-		headers: { "content-type": "application/json" }
-	});
-}
-function methodNotAllowed() {
-	return new Response("Method Not Allowed", {
-		status: 405,
-		headers: { Allow: "POST" }
-	});
-}
-function buildBundle(group, handlers, path, transport) {
-	const app = RpcServer.layerHttp({
-		group,
-		path,
-		protocol: transport === "ws" ? "websocket" : "http"
-	}).pipe(Layer.provide(handlers), Layer.provide(serialization));
-	return HttpRouter.toWebHandler(app, { disableLogger: true });
-}
-function bundleFor(group, handlers, path, transport) {
-	const key = bundleKey(group, path, transport);
-	const cached = bundles.get(key);
-	if (cached) return cached;
-	const built = buildBundle(group, handlers, path, transport);
-	bundles.set(key, built);
-	return built;
-}
-function scrubJsonResponse(response, requestIds) {
-	const contentType = response.headers.get("content-type") ?? "";
-	if (!contentType.includes("json")) return response;
-	if (response.body && (contentType.includes("application/json-rpc") || contentType.includes("ndjson"))) {
-		const headers = new Headers(response.headers);
-		headers.delete("content-length");
-		return new Response(response.body.pipeThrough(scrubNdjsonTransform(requestIds)), {
-			status: response.status,
-			statusText: response.statusText,
-			headers
-		});
-	}
-	return response;
-}
-async function scrubBufferedJson(response, requestIds) {
-	const text = await response.text();
-	const headers = new Headers(response.headers);
-	headers.delete("content-length");
-	return new Response(scrubRpcJson(text, requestIds), {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-function createActionHandler(group, handlers, options = {}) {
-	const path = options.path ?? "/__oxide/action";
-	const transport = options.transport ?? "http";
-	const sameOrigin = options.sameOrigin ?? true;
-	return async (request) => {
-		if (!matchesActionPath(new URL(request.url).pathname, path)) return new Response("Not Found", { status: 404 });
-		if (transport === "http" && request.method !== "POST") return methodNotAllowed();
-		if (sameOrigin && !isSameOrigin(request)) return forbidden();
-		const rawBody = ensureNdjsonBody(await request.arrayBuffer());
-		const requestIds = extractJsonRpcRequestIds(rawBody);
-		const headers = new Headers(request.headers);
-		headers.set("content-type", NDJSON_CONTENT);
-		const forwarded = new Request(request.url, {
-			method: request.method,
-			headers,
-			body: rawBody,
-			signal: request.signal
-		});
-		const extra = await options.createContext?.(forwarded) ?? {};
-		const { handler } = bundleFor(group, handlers, path, transport);
-		const response = await runWithRequest(forwarded, () => handler(forwarded), extra);
-		const contentType = response.headers.get("content-type") ?? "";
-		if (contentType.includes("application/json-rpc") || contentType.includes("ndjson")) return scrubJsonResponse(response, requestIds);
-		if (contentType.includes("json")) return scrubBufferedJson(response, requestIds);
-		return response;
-	};
-}
-function disposeActionHandler(group, path = ACTION_PATH, transport = "http") {
-	const key = bundleKey(group, path, transport);
-	const bundle = bundles.get(key);
-	bundles.delete(key);
-	return bundle?.dispose() ?? Promise.resolve();
-}
-//#endregion
-//#region src/rpc/ws.ts
-function parseMessage(message, maxBytes) {
-	try {
-		const raw = message.text();
-		if (new TextEncoder().encode(raw).byteLength > maxBytes) return {
-			ok: false,
-			tooLarge: true
-		};
-		return {
-			ok: true,
-			value: raw
-		};
-	} catch {
-		return { ok: false };
-	}
-}
-/** Forward each complete NDJSON line as its own WS message (keeps streams incremental). */
-async function sendNdjsonFrames(peer, response, signal) {
-	if (signal.aborted) {
-		await response.body?.cancel();
-		return;
-	}
-	if (!response.body) {
-		const text = await response.text();
-		if (text && !signal.aborted) peer.send(text);
-		return;
-	}
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let pending = "";
-	const onAbort = () => {
-		reader.cancel();
-	};
-	signal.addEventListener("abort", onAbort, { once: true });
-	try {
-		while (!signal.aborted) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			pending += decoder.decode(value, { stream: true });
-			let nl = pending.indexOf("\n");
-			while (nl !== -1) {
-				const line = pending.slice(0, nl);
-				pending = pending.slice(nl + 1);
-				if (line.length > 0 && !signal.aborted) peer.send(`${line}\n`);
-				nl = pending.indexOf("\n");
-			}
-		}
-		if (!signal.aborted) {
-			pending += decoder.decode();
-			if (pending.length > 0) peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
-		}
-	} finally {
-		signal.removeEventListener("abort", onAbort);
-	}
-}
-function createWsHooks(group, handlers, options = {}) {
-	const path = options.path ?? "/__oxide/action";
-	const maxBytes = options.maxMessageSize ?? 1048576;
-	const sameOrigin = options.sameOrigin ?? true;
-	const baseOptions = {
-		path,
-		transport: "http",
-		sameOrigin
-	};
-	return {
-		upgrade(req) {
-			if (!matchesActionPath(new URL(req.url).pathname, path)) return new Response("Not Found", { status: 404 });
-			if (sameOrigin && !isSameOrigin(req)) return new Response("Forbidden", { status: 403 });
-		},
-		async message(peer, message) {
-			const parsed = parseMessage(message, maxBytes);
-			if (!parsed.ok) {
-				peer.send(JSON.stringify({
-					jsonrpc: "2.0",
-					error: {
-						code: -32600,
-						message: parsed.tooLarge ? "Payload too large" : "Parse error"
-					},
-					id: null
-				}));
-				return;
-			}
-			const abort = new AbortController();
-			peer.onClose?.(() => abort.abort());
-			const host = peer.request?.headers.get("host") ?? "localhost";
-			const headers = new Headers(peer.request?.headers);
-			headers.set("content-type", NDJSON_CONTENT);
-			const peerCtx = await options.createContext?.(peer) ?? peer.context;
-			await sendNdjsonFrames(peer, await createActionHandler(group, handlers, {
-				...baseOptions,
-				createContext: (req) => ({
-					...peerCtx,
-					req
-				})
-			})(new Request(`http://${host}${path}`, {
-				method: "POST",
-				headers,
-				body: parsed.value,
-				signal: abort.signal
-			})), abort.signal);
-		}
-	};
-}
-//#endregion
-export { extractJsonRpcRequestIds as a, scrubRpcMessage as c, ensureNdjsonBody as i, createActionHandler as n, scrubNdjsonTransform as o, disposeActionHandler as r, scrubRpcJson as s, createWsHooks as t };