From 987917240623a2f758abf63a1f4fc1b77dec1bdf Mon Sep 17 00:00:00 2001
From: Ryuz <ryuzer@proton.me>
Date: Sat, 5 Sep 2026 11:00:18 +0200
Subject: [PATCH 1/2] chore(oxide): refactor with ultracite

---
 .claude/CLAUDE.md                             | 126 +++
 .husky/pre-commit                             |  27 +
 .oxfmtrc.json                                 |  10 -
 AGENTS.md                                     | 127 +++
 README.md                                     |   4 +-
 apps/website/blume.config.ts                  |  45 +-
 .../blume/{Header.astro => header.astro}      |   0
 apps/website/docs/(introduction)/meta.ts      |   2 +-
 apps/website/docs/oxide/configuration.mdx     |  44 +-
 apps/website/docs/oxide/meta.ts               |  13 +-
 apps/website/docs/oxide/quickstart.mdx        |  15 +-
 apps/website/docs/oxide/security.mdx          |  18 +-
 apps/website/docs/oxide/server-actions.mdx    |  22 +-
 apps/website/docs/oxide/server-entry.mdx      |  70 +-
 apps/website/pages/_home/highlight.ts         |  11 +-
 apps/website/pages/index.astro                |  21 +-
 apps/website/tsconfig.json                    |   3 +-
 bun.lock                                      | 206 +++-
 oxfmt.config.ts                               |  14 +
 oxlint.config.ts                              |   8 +
 package.json                                  |  13 +-
 packages/oxidejs/README.md                    |  83 +-
 packages/oxidejs/client.d.ts                  |  24 +-
 packages/oxidejs/package.json                 |   2 +-
 packages/oxidejs/src/action.test.ts           |  56 +-
 packages/oxidejs/src/action.ts                | 309 ++++--
 packages/oxidejs/src/actions.test.ts          | 952 ++++++++++++------
 packages/oxidejs/src/actions.ts               | 712 ++++++++-----
 packages/oxidejs/src/context.ts               | 214 +++-
 packages/oxidejs/src/core.test.ts             | 145 ++-
 packages/oxidejs/src/core.ts                  | 357 ++++---
 packages/oxidejs/src/index.test.ts            | 447 +++++---
 packages/oxidejs/src/index.ts                 |   3 +
 packages/oxidejs/src/plugin.ts                | 806 ++++++++++-----
 packages/oxidejs/src/rpc/client.ts            | 338 +++++--
 packages/oxidejs/src/rpc/same-origin.ts       |  21 +-
 packages/oxidejs/src/rpc/scrub.test.ts        | 241 +++--
 packages/oxidejs/src/rpc/scrub.ts             | 275 +++--
 packages/oxidejs/src/rpc/server.ts            | 140 ++-
 packages/oxidejs/src/rpc/stream.ts            |  82 +-
 packages/oxidejs/src/rpc/test-harness.ts      |  31 +
 packages/oxidejs/src/rpc/ws-crossws.test.ts   | 158 +--
 packages/oxidejs/src/rpc/ws.test.ts           |  80 +-
 packages/oxidejs/src/rpc/ws.ts                | 178 ++--
 packages/oxidejs/src/types.ts                 |  25 +-
 packages/oxidejs/src/worker-build.ts          | 159 +--
 packages/oxidejs/src/worker-dom.test.ts       |  48 +-
 packages/oxidejs/src/worker-dom.ts            |  38 +-
 packages/oxidejs/src/wrapper.test.ts          |  35 +-
 packages/oxidejs/tsconfig.json                |   3 +-
 packages/oxidejs/tsdown.config.ts             |  12 +-
 packages/oxidejs/virtual.d.ts                 |   8 +-
 scripts/release.ts                            |  96 +-
 templates/simple/package.json                 |   2 +-
 templates/simple/src/lib/greet.server.tsx     |  16 +-
 templates/simple/src/pages/index.tsx          |  11 +-
 templates/simple/src/server.ts                |   2 +-
 templates/simple/tsconfig.json                |   3 +-
 templates/simple/vite.config.ts               |   6 +-
 templates/tasks/package.json                  |   2 +-
 templates/tasks/src/lib/tasks.server.tsx      | 126 ++-
 templates/tasks/src/pages/index.tsx           |  27 +-
 templates/tasks/src/server.ts                 |   8 +-
 templates/tasks/tsconfig.json                 |   3 +-
 templates/tasks/vite.config.ts                |   2 +-
 tsconfig.json                                 |   3 +-
 66 files changed, 4803 insertions(+), 2285 deletions(-)
 create mode 100644 .claude/CLAUDE.md
 create mode 100644 .husky/pre-commit
 delete mode 100644 .oxfmtrc.json
 rename apps/website/components/blume/{Header.astro => header.astro} (100%)
 create mode 100644 oxfmt.config.ts
 create mode 100644 oxlint.config.ts
 create mode 100644 packages/oxidejs/src/rpc/test-harness.ts

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
new file mode 100644
index 0000000..f8a5623
--- /dev/null
+++ b/.claude/CLAUDE.md
@@ -0,0 +1,126 @@
+# Ultracite Code Standards
+
+This project uses **Ultracite**, a zero-config preset that enforces strict code quality standards through automated formatting and linting.
+
+## Quick Reference
+
+- **Format code**: `bun x ultracite fix`
+- **Check for issues**: `bun x ultracite check`
+- **Diagnose setup**: `bun x ultracite doctor`
+
+Oxlint + Oxfmt (the underlying engine) provides robust linting and formatting. Most issues are automatically fixable.
+
+---
+
+## Core Principles
+
+Write code that is **accessible, performant, type-safe, and maintainable**. Focus on clarity and explicit intent over brevity.
+
+### Type Safety & Explicitness
+
+- Use explicit types for function parameters and return values when they enhance clarity
+- Prefer `unknown` over `any` when the type is genuinely unknown
+- Use const assertions (`as const`) for immutable values and literal types
+- Leverage TypeScript's type narrowing instead of type assertions
+- Use meaningful variable names instead of magic numbers - extract constants with descriptive names
+
+### Modern JavaScript/TypeScript
+
+- Use arrow functions for callbacks and short functions
+- Prefer `for...of` loops over `.forEach()` and indexed `for` loops
+- Use optional chaining (`?.`) and nullish coalescing (`??`) for safer property access
+- Prefer template literals over string concatenation
+- Use destructuring for object and array assignments
+- Use `const` by default, `let` only when reassignment is needed, never `var`
+
+### Async & Promises
+
+- Always `await` promises in async functions - don't forget to use the return value
+- Use `async/await` syntax instead of promise chains for better readability
+- Handle errors appropriately in async code with try-catch blocks
+- Don't use async functions as Promise executors
+
+### React & JSX
+
+- Use function components over class components
+- Call hooks at the top level only, never conditionally
+- Specify all dependencies in hook dependency arrays correctly
+- Use the `key` prop for elements in iterables (prefer unique IDs over array indices)
+- Nest children between opening and closing tags instead of passing as props
+- Don't define components inside other components
+- Use semantic HTML and ARIA attributes for accessibility:
+  - Provide meaningful alt text for images
+  - Use proper heading hierarchy
+  - Add labels for form inputs
+  - Include keyboard event handlers alongside mouse events
+  - Use semantic elements (`<button>`, `<nav>`, etc.) instead of divs with roles
+
+### Error Handling & Debugging
+
+- Remove `console.log`, `debugger`, and `alert` statements from production code
+- Throw `Error` objects with descriptive messages, not strings or other values
+- Use `try-catch` blocks meaningfully - don't catch errors just to rethrow them
+- Prefer early returns over nested conditionals for error cases
+
+### Code Organization
+
+- Keep functions focused and under reasonable cognitive complexity limits
+- Extract complex conditions into well-named boolean variables
+- Use early returns to reduce nesting
+- Prefer simple conditionals over nested ternary operators
+- Group related code together and separate concerns
+
+### Security
+
+- Add `rel="noopener"` when using `target="_blank"` on links
+- Avoid `dangerouslySetInnerHTML` unless absolutely necessary
+- Don't use `eval()` or assign directly to `document.cookie`
+- Validate and sanitize user input
+
+### Performance
+
+- Avoid spread syntax in accumulators within loops
+- Use top-level regex literals instead of creating them in loops
+- Prefer specific imports over namespace imports
+- Avoid barrel files (index files that re-export everything)
+- Use proper image components (e.g., Next.js `<Image>`) over `<img>` tags
+
+### Framework-Specific Guidance
+
+**Next.js:**
+
+- Use Next.js `<Image>` component for images
+- Use `next/head` or App Router metadata API for head elements
+- Use Server Components for async data fetching instead of async Client Components
+
+**React 19+:**
+
+- Use ref as a prop instead of `React.forwardRef`
+
+**Solid/Svelte/Vue/Qwik:**
+
+- Use `class` and `for` attributes (not `className` or `htmlFor`)
+
+---
+
+## Testing
+
+- Write assertions inside `it()` or `test()` blocks
+- Avoid done callbacks in async tests - use async/await instead
+- Don't use `.only` or `.skip` in committed code
+- Keep test suites reasonably flat - avoid excessive `describe` nesting
+
+## When Oxlint + Oxfmt Can't Help
+
+Oxlint + Oxfmt's linter will catch most issues automatically. Focus your attention on:
+
+1. **Business logic correctness** - Oxlint + Oxfmt can't validate your algorithms
+2. **Meaningful naming** - Use descriptive names for functions, variables, and types
+3. **Architecture decisions** - Component structure, data flow, and API design
+4. **Edge cases** - Handle boundary conditions and error states
+5. **User experience** - Accessibility, performance, and usability considerations
+6. **Documentation** - Add comments for complex logic, but prefer self-documenting code
+
+---
+
+Most formatting and common issues are automatically fixed by Oxlint + Oxfmt. Run `bun x ultracite fix` before committing to ensure compliance.
diff --git a/.husky/pre-commit b/.husky/pre-commit
new file mode 100644
index 0000000..a0f5a4f
--- /dev/null
+++ b/.husky/pre-commit
@@ -0,0 +1,27 @@
+# ultracite
+#!/bin/sh
+# Check if there are any staged files
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACMR)
+if [ -z "$STAGED_FILES" ]; then
+  echo "No staged files to format"
+  exit 0
+fi
+
+# Run formatter, capturing the exit code so we can still re-stage and report
+FORMAT_EXIT_CODE=0
+bun x ultracite fix || FORMAT_EXIT_CODE=$?
+
+# Re-stage files that were already staged
+echo "$STAGED_FILES" | while IFS= read -r file; do
+  if [ -f "$file" ]; then
+    git add -- "$file"
+  fi
+done
+
+if [ $FORMAT_EXIT_CODE -ne 0 ]; then
+  echo "Ultracite found issues that could not be auto-fixed."
+  exit $FORMAT_EXIT_CODE
+fi
+
+echo "✨ Files formatted by Ultracite"
+# ultracite end
diff --git a/.oxfmtrc.json b/.oxfmtrc.json
deleted file mode 100644
index 6508fdf..0000000
--- a/.oxfmtrc.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "overrides": [
-    {
-      "files": ["**/*.mdx"],
-      "options": {
-        "printWidth": 72
-      }
-    }
-  ]
-}
diff --git a/AGENTS.md b/AGENTS.md
index a4c44e3..2fbad02 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -100,3 +100,130 @@ Package READMEs (`packages/oxidejs/README.md`, `packages/tacho/README.md`) ship
 - Prefer TypeScript inference over explicit annotations. Do not annotate function, async function, or generator return types when TypeScript can infer them correctly.
 - Keep public exports stable. New entrypoints need a reason and a README update.
 - If a request contradicts this file (add a Result library, emulate `wrangler dev`, drop Bun, merge tacho into oxidejs), stop and ask.
+
+# Ultracite Code Standards
+
+This project uses **Ultracite**, a zero-config preset that enforces strict code quality standards through automated formatting and linting.
+
+## Quick Reference
+
+- **Format code**: `bun x ultracite fix`
+- **Check for issues**: `bun x ultracite check`
+- **Diagnose setup**: `bun x ultracite doctor`
+
+Oxlint + Oxfmt (the underlying engine) provides robust linting and formatting. Most issues are automatically fixable.
+
+---
+
+## Core Principles
+
+Write code that is **accessible, performant, type-safe, and maintainable**. Focus on clarity and explicit intent over brevity.
+
+### Type Safety & Explicitness
+
+- Use explicit types for function parameters and return values when they enhance clarity
+- Prefer `unknown` over `any` when the type is genuinely unknown
+- Use const assertions (`as const`) for immutable values and literal types
+- Leverage TypeScript's type narrowing instead of type assertions
+- Use meaningful variable names instead of magic numbers - extract constants with descriptive names
+
+### Modern JavaScript/TypeScript
+
+- Use arrow functions for callbacks and short functions
+- Prefer `for...of` loops over `.forEach()` and indexed `for` loops
+- Use optional chaining (`?.`) and nullish coalescing (`??`) for safer property access
+- Prefer template literals over string concatenation
+- Use destructuring for object and array assignments
+- Use `const` by default, `let` only when reassignment is needed, never `var`
+
+### Async & Promises
+
+- Always `await` promises in async functions - don't forget to use the return value
+- Use `async/await` syntax instead of promise chains for better readability
+- Handle errors appropriately in async code with try-catch blocks
+- Don't use async functions as Promise executors
+
+### React & JSX
+
+- Use function components over class components
+- Call hooks at the top level only, never conditionally
+- Specify all dependencies in hook dependency arrays correctly
+- Use the `key` prop for elements in iterables (prefer unique IDs over array indices)
+- Nest children between opening and closing tags instead of passing as props
+- Don't define components inside other components
+- Use semantic HTML and ARIA attributes for accessibility:
+  - Provide meaningful alt text for images
+  - Use proper heading hierarchy
+  - Add labels for form inputs
+  - Include keyboard event handlers alongside mouse events
+  - Use semantic elements (`<button>`, `<nav>`, etc.) instead of divs with roles
+
+### Error Handling & Debugging
+
+- Remove `console.log`, `debugger`, and `alert` statements from production code
+- Throw `Error` objects with descriptive messages, not strings or other values
+- Use `try-catch` blocks meaningfully - don't catch errors just to rethrow them
+- Prefer early returns over nested conditionals for error cases
+
+### Code Organization
+
+- Keep functions focused and under reasonable cognitive complexity limits
+- Extract complex conditions into well-named boolean variables
+- Use early returns to reduce nesting
+- Prefer simple conditionals over nested ternary operators
+- Group related code together and separate concerns
+
+### Security
+
+- Add `rel="noopener"` when using `target="_blank"` on links
+- Avoid `dangerouslySetInnerHTML` unless absolutely necessary
+- Don't use `eval()` or assign directly to `document.cookie`
+- Validate and sanitize user input
+
+### Performance
+
+- Avoid spread syntax in accumulators within loops
+- Use top-level regex literals instead of creating them in loops
+- Prefer specific imports over namespace imports
+- Avoid barrel files (index files that re-export everything)
+- Use proper image components (e.g., Next.js `<Image>`) over `<img>` tags
+
+### Framework-Specific Guidance
+
+**Next.js:**
+
+- Use Next.js `<Image>` component for images
+- Use `next/head` or App Router metadata API for head elements
+- Use Server Components for async data fetching instead of async Client Components
+
+**React 19+:**
+
+- Use ref as a prop instead of `React.forwardRef`
+
+**Solid/Svelte/Vue/Qwik:**
+
+- Use `class` and `for` attributes (not `className` or `htmlFor`)
+
+---
+
+## Testing
+
+- Write assertions inside `it()` or `test()` blocks
+- Avoid done callbacks in async tests - use async/await instead
+- Don't use `.only` or `.skip` in committed code
+- Keep test suites reasonably flat - avoid excessive `describe` nesting
+
+## When Oxlint + Oxfmt Can't Help
+
+Oxlint + Oxfmt's linter will catch most issues automatically. Focus your attention on:
+
+1. **Business logic correctness** - Oxlint + Oxfmt can't validate your algorithms
+2. **Meaningful naming** - Use descriptive names for functions, variables, and types
+3. **Architecture decisions** - Component structure, data flow, and API design
+4. **Edge cases** - Handle boundary conditions and error states
+5. **User experience** - Accessibility, performance, and usability considerations
+6. **Documentation** - Add comments for complex logic, but prefer self-documenting code
+
+---
+
+Most formatting and common issues are automatically fixed by Oxlint + Oxfmt. Run `bun x ultracite fix` before committing to ensure compliance.
diff --git a/README.md b/README.md
index 13b5031..48e9eb6 100644
--- a/README.md
+++ b/README.md
@@ -44,8 +44,8 @@ It guides you. It doesn't frame you.
 
 ## Packages
 
-| Package                     | Purpose                                                                 |
-| --------------------------- | ----------------------------------------------------------------------- |
+| Package | Purpose |
+| --- | --- |
 | [oxidejs](packages/oxidejs) | Turns Vite or Rsbuild into a backend. One plugin, one folder to deploy. |
 
 Server actions ride [Effect](https://effect.website) RPC (`application/json-rpc`). The `templates/simple` and `templates/tasks` apps show fetch and celld deployments.
diff --git a/apps/website/blume.config.ts b/apps/website/blume.config.ts
index f405425..f553c85 100644
--- a/apps/website/blume.config.ts
+++ b/apps/website/blume.config.ts
@@ -1,49 +1,52 @@
 import { fileURLToPath } from "node:url";
+
 import ilha from "@ilha/astro";
 import { defineConfig } from "blume";
 
 export default defineConfig({
-  title: "Oxide",
+  analytics: {
+    scripts: [
+      {
+        attributes: {
+          "data-website-id": "a6f30bfd-7ef3-49f5-901c-b9ce066cd824",
+        },
+        src: "https://umami.guarana.studio/script.js",
+        strategy: "defer",
+      },
+    ],
+  },
+  deployment: {
+    site: "https://oxide.build",
+  },
   description: "The backend unframework.",
-  logo: "/logo.svg",
-  github: { owner: "ryuzcorp", repo: "oxide", dir: "apps/website" },
+  github: { dir: "apps/website", owner: "ryuzcorp", repo: "oxide" },
   integrations: [
     ilha(),
     {
       // PageLayout imports Header directly and has no layout slot, so alias
       // both RootLayout and PageLayout onto our copy.
-      name: "header-override",
       hooks: {
         "astro:config:setup": ({ updateConfig }) => {
           const headerPath = fileURLToPath(
-            new URL("./components/blume/Header.astro", import.meta.url),
+            new URL("components/blume/header.astro", import.meta.url)
           );
           updateConfig({
             vite: {
               resolve: {
-                alias: [{ find: /^\.\/Header\.astro$/u, replacement: headerPath }],
+                alias: [
+                  { find: /^\.\/Header\.astro$/u, replacement: headerPath },
+                ],
               },
             },
           });
         },
       },
+      name: "header-override",
     },
   ],
+  logo: "/logo.svg",
   navigation: {
-    tabs: [{ label: "Docs", path: "/", href: "/getting-started" }],
-  },
-  deployment: {
-    site: "https://oxide.build",
-  },
-  analytics: {
-    scripts: [
-      {
-        src: "https://umami.guarana.studio/script.js",
-        strategy: "defer",
-        attributes: {
-          "data-website-id": "a6f30bfd-7ef3-49f5-901c-b9ce066cd824",
-        },
-      },
-    ],
+    tabs: [{ href: "/getting-started", label: "Docs", path: "/" }],
   },
+  title: "Oxide",
 });
diff --git a/apps/website/components/blume/Header.astro b/apps/website/components/blume/header.astro
similarity index 100%
rename from apps/website/components/blume/Header.astro
rename to apps/website/components/blume/header.astro
diff --git a/apps/website/docs/(introduction)/meta.ts b/apps/website/docs/(introduction)/meta.ts
index b163f92..1b2b5ad 100644
--- a/apps/website/docs/(introduction)/meta.ts
+++ b/apps/website/docs/(introduction)/meta.ts
@@ -1,6 +1,6 @@
 import { defineMeta } from "blume";
 
 export default defineMeta({
-  title: "Introduction",
   pages: ["getting-started"],
+  title: "Introduction",
 });
diff --git a/apps/website/docs/oxide/configuration.mdx b/apps/website/docs/oxide/configuration.mdx
index a247ef1..2598a9a 100644
--- a/apps/website/docs/oxide/configuration.mdx
+++ b/apps/website/docs/oxide/configuration.mdx
@@ -7,27 +7,27 @@ description: Choose the build target, output folders, and server-action transpor
 
 Pass options to `oxide()` in your Vite or Rsbuild config. You can start with `oxide()` and add options only when your app needs them.
 
-| Option                                      | Default                  | What it controls                                            |
-| ------------------------------------------- | ------------------------ | ----------------------------------------------------------- |
-| [`preset`](#preset)                         | `"fetch"`                | Node-style fetch server or celld worker output              |
-| [`workerEntry`](#workerentry)               | `src/server.ts`          | Server entry file                                           |
-| [`outDir`](#outdir)                         | `dist`                   | Build output folder                                         |
-| [`clientDir`](#clientdir)                   | `client`                 | Client folder inside `outDir`                               |
-| [`wrangler.name`](#wrangler)                | required if `emitConfig` | Worker name                                                 |
-| [`wrangler.compatibility_date`](#wrangler)  | required if `emitConfig` | Worker compatibility date                                   |
-| [`wrangler.compatibility_flags`](#wrangler) | -                        | Optional worker flags                                       |
-| [`wrangler.durable_objects`](#wrangler)     | -                        | Optional Durable Object config                              |
-| [`wrangler.migrations`](#wrangler)          | -                        | Optional migrations                                         |
-| [`wrangler.services`](#wrangler)            | -                        | Optional service bindings                                   |
-| [`wrangler.vars`](#wrangler)                | -                        | Optional variables                                          |
-| [`emitConfig`](#emitconfig)                 | `true` on `celld`        | Whether to write `wrangler.jsonc`                           |
-| [`actions`](#actions)                       | `"http"`                 | Action transport, endpoint path, and same-origin protection |
-| [`actionHeaders`](#actionheaders)           | -                        | Public static headers added by the browser action client    |
-| [`middleware`](#middleware)                 | `[]`                     | Production request middleware, in order                     |
-| [`imports`](#imports)                       | `[]`                     | Side-effect modules loaded at server startup                |
-| [`bodyLimit`](#bodylimit)                   | `1048576`                | Max Node request body size (413 when exceeded)              |
-| [`notFound`](#notfound)                     | -                        | Custom HTML 404 body on the fetch preset                    |
-| [`env`](#env)                               | -                        | Node preset value passed to `fetch(request, env, ctx)`      |
+| Option | Default | What it controls |
+| --- | --- | --- |
+| [`preset`](#preset) | `"fetch"` | Node-style fetch server or celld worker output |
+| [`workerEntry`](#workerentry) | `src/server.ts` | Server entry file |
+| [`outDir`](#outdir) | `dist` | Build output folder |
+| [`clientDir`](#clientdir) | `client` | Client folder inside `outDir` |
+| [`wrangler.name`](#wrangler) | required if `emitConfig` | Worker name |
+| [`wrangler.compatibility_date`](#wrangler) | required if `emitConfig` | Worker compatibility date |
+| [`wrangler.compatibility_flags`](#wrangler) | - | Optional worker flags |
+| [`wrangler.durable_objects`](#wrangler) | - | Optional Durable Object config |
+| [`wrangler.migrations`](#wrangler) | - | Optional migrations |
+| [`wrangler.services`](#wrangler) | - | Optional service bindings |
+| [`wrangler.vars`](#wrangler) | - | Optional variables |
+| [`emitConfig`](#emitconfig) | `true` on `celld` | Whether to write `wrangler.jsonc` |
+| [`actions`](#actions) | `"http"` | Action transport, endpoint path, and same-origin protection |
+| [`actionHeaders`](#actionheaders) | - | Public static headers added by the browser action client |
+| [`middleware`](#middleware) | `[]` | Production request middleware, in order |
+| [`imports`](#imports) | `[]` | Side-effect modules loaded at server startup |
+| [`bodyLimit`](#bodylimit) | `1048576` | Max Node request body size (413 when exceeded) |
+| [`notFound`](#notfound) | - | Custom HTML 404 body on the fetch preset |
+| [`env`](#env) | - | Node preset value passed to `fetch(request, env, ctx)` |
 
 `main` is always `./server.js`. Oxide adds `assets` only when the project has an `index.html`. Unknown Wrangler keys fail the build instead of being silently ignored.
 
@@ -124,7 +124,7 @@ List modules that run before server actions, your server entry, and static files
 // src/auth.ts
 export default function auth(
   request: Request,
-  context: { env: unknown; ctx: unknown },
+  context: { env: unknown; ctx: unknown }
 ) {
   if (!request.headers.has("authorization")) {
     return new Response("Unauthorized", { status: 401 });
diff --git a/apps/website/docs/oxide/meta.ts b/apps/website/docs/oxide/meta.ts
index cde19d0..24846fe 100644
--- a/apps/website/docs/oxide/meta.ts
+++ b/apps/website/docs/oxide/meta.ts
@@ -1,8 +1,15 @@
 import { defineMeta } from "blume";
 
 export default defineMeta({
-  title: "Oxide",
-  display: "group",
   collapsed: false,
-  pages: ["overview", "quickstart", "server-entry", "server-actions", "configuration", "security"],
+  display: "group",
+  pages: [
+    "overview",
+    "quickstart",
+    "server-entry",
+    "server-actions",
+    "configuration",
+    "security",
+  ],
+  title: "Oxide",
 });
diff --git a/apps/website/docs/oxide/quickstart.mdx b/apps/website/docs/oxide/quickstart.mdx
index b3421b1..5836056 100644
--- a/apps/website/docs/oxide/quickstart.mdx
+++ b/apps/website/docs/oxide/quickstart.mdx
@@ -76,13 +76,14 @@ Add scripts to `package.json`:
 ## Write a server entry
 
 ```ts twoslash src/server.ts
-export default {
-  fetch(request: Request) {
-    if (new URL(request.url).pathname === "/api/ok") {
-      return new Response("ok");
-    }
-  },
-};
+import type { FetchHandler } from "oxidejs";
+
+export const fetch = ((request) => {
+  if (new URL(request.url).pathname === "/api/ok") {
+    return new Response("ok");
+  }
+  return;
+}) satisfies FetchHandler;
 ```
 
 Return `undefined` to fall through to static files. Missing files fall back to `index.html` only for navigations.
diff --git a/apps/website/docs/oxide/security.mdx b/apps/website/docs/oxide/security.mdx
index b1009b4..5b4454e 100644
--- a/apps/website/docs/oxide/security.mdx
+++ b/apps/website/docs/oxide/security.mdx
@@ -11,15 +11,15 @@ oxidejs guards the build output, action transport, and dev server by default. Au
 
 The generated server serves static files from `dist/client/` (or the `public/` directory merged into it). These guards are active:
 
-| Attack vector                      | Guard                                                                                                                                  |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments.                                                                                      |
-| **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`.                                                                  |
-| **Null byte** (`%00`, `\0`)        | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`.                                                   |
-| **Absolute path** (`/etc/passwd`)  | `__rel()` returns `null` for paths not starting with `/`.                                                                              |
-| **SPA fallback**                   | Unknown paths → `index.html`, never a directory listing.                                                                               |
-| **`clientDir` escape**             | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`.                                                        |
-| **Hashed assets**                  | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
+| Attack vector | Guard |
+| --- | --- |
+| **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments. |
+| **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`. |
+| **Null byte** (`%00`, `\0`) | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`. |
+| **Absolute path** (`/etc/passwd`) | `__rel()` returns `null` for paths not starting with `/`. |
+| **SPA fallback** | Unknown paths → `index.html`, never a directory listing. |
+| **`clientDir` escape** | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`. |
+| **Hashed assets** | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
 
 The generated `__asset` function uses `path.join` — not `path.resolve` — so a leading `/` in the relative path stays inside the asset root.
 
diff --git a/apps/website/docs/oxide/server-actions.mdx b/apps/website/docs/oxide/server-actions.mdx
index a94a201..096009e 100644
--- a/apps/website/docs/oxide/server-actions.mdx
+++ b/apps/website/docs/oxide/server-actions.mdx
@@ -56,12 +56,12 @@ This explicit marker prevents an exported helper from accidentally becoming a pu
 
 Unary actions are Promise-returning handles with helpers for UI wiring:
 
-| Call                                        | What it does                                     |
-| ------------------------------------------- | ------------------------------------------------ |
-| `await ping()`                              | Run the action (always invokes RPC on client)    |
-| `ping.set(...args)`                         | Same as calling with args; also writes the atom  |
-| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action  |
-| `ping.result`                               | Read the last `AsyncResult` from the client atom |
+| Call | What it does |
+| --- | --- |
+| `await ping()` | Run the action (always invokes RPC on client) |
+| `ping.set(...args)` | Same as calling with args; also writes the atom |
+| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action |
+| `ping.result` | Read the last `AsyncResult` from the client atom |
 
 ```ts twoslash src/bind.ts
 // @filename: tasks.server.ts
@@ -102,7 +102,7 @@ class UnauthorizedError extends Error {
 }
 
 function withUser<Args extends unknown[], Result>(
-  handler: (user: User, ...args: Args) => Result,
+  handler: (user: User, ...args: Args) => Result
 ) {
   return async (...args: Args) => {
     const authorization = useRequest().headers.get("authorization");
@@ -120,7 +120,7 @@ function withUser<Args extends unknown[], Result>(
 }
 
 export const profile = action(
-  withUser((user) => db.profiles.find(user.id)),
+  withUser((user) => db.profiles.find(user.id))
 );
 ```
 
@@ -129,8 +129,8 @@ The client calls `profile()` without supplying `user`. The wrapper reads the req
 ```ts
 export const update = action(
   withUser((user, name: string) =>
-    db.profiles.update(user.id, { name }),
-  ),
+    db.profiles.update(user.id, { name })
+  )
 );
 ```
 
@@ -227,7 +227,7 @@ import { action, useEnv, useFetchCtx } from "oxidejs";
 type Env = { API_URL: string };
 
 export const hasApi = action(async () => {
-  useFetchCtx()?.waitUntil?.(Promise.resolve());
+  useFetchCtx()?.waitUntil?.(Promise.resolve(null));
   return Boolean(useEnv<Env>()?.API_URL);
 });
 ```
diff --git a/apps/website/docs/oxide/server-entry.mdx b/apps/website/docs/oxide/server-entry.mdx
index d7262f5..c4fbb38 100644
--- a/apps/website/docs/oxide/server-entry.mdx
+++ b/apps/website/docs/oxide/server-entry.mdx
@@ -5,27 +5,69 @@ sidebar:
 description: Handle a request in your server entry, or skip it and let static files take over.
 ---
 
-Every request hits this file first. The default path is [`src/server.ts`](/oxide/configuration#workerentry). Export a `fetch` that takes the request and returns a response. On [`preset: "celld"`](/oxide/configuration#preset) the runtime also passes Worker `env` and `ctx` — the same pair actions read with [`useEnv()` / `useFetchCtx()`](/oxide/server-actions#useenv-and-usefetchctx).
+Every request hits this file first. The default path is [`src/server.ts`](/oxide/configuration#workerentry). Export a `fetch` that takes the request and returns a response — either as a named export or on the default export. On [`preset: "celld"`](/oxide/configuration#preset) the runtime also passes Worker `env` and `ctx` — the same pair actions read with [`useEnv()` / `useFetchCtx()`](/oxide/server-actions#useenv-and-usefetchctx).
+
+Type `fetch` with [`FetchHandler`](#fetchhandler):
 
 ```ts twoslash src/server.ts
-export default {
-  fetch(
-    request: Request,
-    env?: { SECRET?: string },
-    ctx?: { waitUntil?(p: Promise<unknown>): void },
-  ) {
-    if (new URL(request.url).pathname === "/api/ok") {
-      ctx?.waitUntil?.(Promise.resolve());
-      return new Response(env?.SECRET ?? "ok");
-    }
-  },
-};
+import type { FetchHandler } from "oxidejs";
+
+type Env = { SECRET?: string };
+
+export const fetch = ((request, env, ctx) => {
+  if (new URL(request.url).pathname === "/api/ok") {
+    ctx.waitUntil?.(Promise.resolve(null));
+    return new Response(env.SECRET ?? "ok");
+  }
+  return;
+}) satisfies FetchHandler<Env>;
 ```
 
+`export default { fetch }` works the same way when you prefer an object entry (or need to put `scheduled` / `queue` on the default for celld). If both a default `fetch` and a named `fetch` exist, the default wins.
+
 If `fetch` returns nothing, `oxidejs` keeps going. With a page in the project, that means a matching static file. Missing files fall back to `index.html` only for navigations (`Sec-Fetch-Dest: document` or `Accept: text/html`). A fetch for `/missing.js` is still `404`.
 
 `public/` is copied next to the client on [`preset: "fetch"`](/oxide/configuration#preset). Hashed assets get `Cache-Control: immutable` plus an `ETag`, and answer `304 Not Modified` on a matching `If-None-Match`. `index.html` is `no-cache`. Without a page, the build is only the server bundle - there is nothing to fall through to.
 
-Named exports such as `scheduled` and `queue` stay on the celld wrapper. Spread them yourself if you replace `fetch`.
+Named exports such as `scheduled` and `queue` are re-exported from the wrapper (`export *`). Put them on `export default { … }` as well when the host only reads the default export.
 
 On the Node preset the generated server also handles `SIGTERM`/`SIGINT`: it stops accepting connections and exits once in-flight requests drain (forced after 5 seconds).
+
+## `FetchHandler`
+
+```ts
+type FetchHandler<Env = { [key: string]: OxidejsJson }> = (
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext
+) => FetchResult | Promise<FetchResult>;
+```
+
+`Env` defaults to a JSON-compatible binding bag. Pass your Worker / [`env`](/oxide/configuration#env) shape as the type argument. The wrapper always supplies `env` and `ctx`.
+
+Prefer `satisfies FetchHandler<Env>` on the function so `request`, `env`, and `ctx` pick up types without annotations. `const fetch: FetchHandler<Env> = …` works the same way. Under `noImplicitReturns`, use a bare `return` when you want to fall through.
+
+## `ServerEntry`
+
+```ts
+interface ServerEntry<Env = { [key: string]: OxidejsJson }> {
+  fetch: FetchHandler<Env>;
+}
+```
+
+When you use the object form:
+
+```ts twoslash
+import type { FetchHandler, ServerEntry } from "oxidejs";
+
+type Env = { SECRET?: string };
+
+const fetch = ((request, env) => {
+  if (new URL(request.url).pathname === "/api/ok") {
+    return new Response(env.SECRET ?? "ok");
+  }
+  return;
+}) satisfies FetchHandler<Env>;
+
+export default { fetch } satisfies ServerEntry<Env>;
+```
diff --git a/apps/website/pages/_home/highlight.ts b/apps/website/pages/_home/highlight.ts
index c3c3237..c780dd8 100644
--- a/apps/website/pages/_home/highlight.ts
+++ b/apps/website/pages/_home/highlight.ts
@@ -1,5 +1,14 @@
 import { codeToHtml } from "rangi/core";
-import { bash, html, js, js_template_literals, jsdoc, regex, todo, ts } from "rangi/languages";
+import {
+  bash,
+  html,
+  js,
+  js_template_literals,
+  jsdoc,
+  regex,
+  todo,
+  ts,
+} from "rangi/languages";
 import { cssVariables } from "rangi/themes";
 
 const languages = {
diff --git a/apps/website/pages/index.astro b/apps/website/pages/index.astro
index 7b370a2..16605a1 100644
--- a/apps/website/pages/index.astro
+++ b/apps/website/pages/index.astro
@@ -7,7 +7,6 @@ const { config } = data;
 const repoUrl = "https://github.com/ryuzcorp/oxide";
 const files = [
   {
-    name: "client.ts",
     html: highlight(
       `// Looks local. Runs on the server.
 // Your server code never reaches the browser.
@@ -20,9 +19,9 @@ console.log(note); // { id: "…", title: "Ship Oxide" }
 for await (const n of await watch()) console.log(n);`,
       "ts",
     ),
+    name: "client.ts",
   },
   {
-    name: "notes.server.ts",
     html: highlight(
       `// Only action()-wrapped exports are callable over the wire.
 import { action, useRequest } from "oxidejs";
@@ -37,9 +36,9 @@ export const watch = action(async function* () {
 });`,
       "ts",
     ),
+    name: "notes.server.ts",
   },
   {
-    name: "server.ts",
     html: highlight(
       `// Every request hits this first. Return nothing to let
 // static files take over — no extra setup needed.
@@ -51,9 +50,9 @@ export default {
 };`,
       "ts",
     ),
+    name: "server.ts",
   },
   {
-    name: "index.html",
     html: highlight(
       `<!doctype html>
 <html lang="en">
@@ -64,9 +63,9 @@ export default {
 </html>`,
       "html",
     ),
+    name: "index.html",
   },
   {
-    name: "vite.config.ts",
     html: highlight(
       `import { defineConfig } from "vite";
 import oxide from "oxidejs/vite";
@@ -76,6 +75,7 @@ export default defineConfig({
 });`,
       "ts",
     ),
+    name: "vite.config.ts",
   },
 ];
 
@@ -95,7 +95,6 @@ const btn =
 
 const bundlers = [
   {
-    name: "Vite",
     html: highlight(
       `import { defineConfig } from "vite";
 import oxide from "oxidejs/vite";
@@ -105,9 +104,9 @@ export default defineConfig({
 });`,
       "ts",
     ),
+    name: "Vite",
   },
   {
-    name: "Rsbuild",
     html: highlight(
       `import { defineConfig } from "@rsbuild/core";
 import oxide from "oxidejs/rsbuild";
@@ -117,6 +116,7 @@ export default defineConfig({
 });`,
       "ts",
     ),
+    name: "Rsbuild",
   },
 ] as const;
 ---
@@ -434,8 +434,11 @@ dist/
     readyCta?.removeAttribute("tabindex");
   };
 
-  if (matchMedia("(prefers-reduced-motion: reduce)").matches) showPrimary();
-  else lastRow?.addEventListener("animationend", showPrimary, { once: true });
+  if (matchMedia("(prefers-reduced-motion: reduce)").matches) {
+    showPrimary();
+  } else {
+    lastRow?.addEventListener("animationend", showPrimary, { once: true });
+  }
 </script>
 
 <style>
diff --git a/apps/website/tsconfig.json b/apps/website/tsconfig.json
index 1df5ea6..c096320 100644
--- a/apps/website/tsconfig.json
+++ b/apps/website/tsconfig.json
@@ -3,7 +3,8 @@
   "compilerOptions": {
     "module": "ESNext",
     "moduleResolution": "Bundler",
-    "noEmit": true
+    "noEmit": true,
+    "strictNullChecks": true
   },
   "include": ["pages/**/*.ts", "blume.config.ts"]
 }
diff --git a/bun.lock b/bun.lock
index 129e300..4723bdb 100644
--- a/bun.lock
+++ b/bun.lock
@@ -7,10 +7,12 @@
       "devDependencies": {
         "@tsconfig/strictest": "^2.0.8",
         "@types/bun": "latest",
-        "oxfmt": "^0.63.0",
-        "oxlint": "^1.78.0",
+        "husky": "^9.1.7",
+        "oxfmt": "^0.66.0",
+        "oxlint": "^1.81.0",
         "tsdown": "^0.22.14",
         "typescript": "^6",
+        "ultracite": "7.10.8",
       },
     },
     "apps/website": {
@@ -28,7 +30,7 @@
     },
     "packages/oxidejs": {
       "name": "oxidejs",
-      "version": "0.3.2",
+      "version": "0.3.3",
       "dependencies": {
         "effect": "~4.0.0-rc.112",
         "linkedom": "^0.18.13",
@@ -55,7 +57,7 @@
       "devDependencies": {
         "@tailwindcss/vite": "^4.3.3",
         "daisyui": "^5.7.22",
-        "oxidejs": "^0.3.2",
+        "oxidejs": "^0.3.3",
         "tailwindcss": "^4.3.3",
         "typescript": "^6",
         "vite": "^8.2.1",
@@ -73,7 +75,7 @@
         "@cloudflare/workers-types": "^5.20260818.1",
         "@tailwindcss/vite": "^4.3.3",
         "daisyui": "^5.7.22",
-        "oxidejs": "^0.3.2",
+        "oxidejs": "^0.3.3",
         "tailwindcss": "^4.3.3",
         "typescript": "^6",
         "vite": "^8.2.1",
@@ -81,7 +83,7 @@
     },
   },
   "packages": {
-    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.74", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-6hpLUtAD162KLyyj9LN2OuEyze7lzq4wwj7PyQPYdMmA8PBYwyMbmvmu1C7OzfexLSPltZK29pX8R6hrJsqBqA=="],
+    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.75", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-HOnhw3oXtBnboBF7kAKipjToCN6+5w6EuukiUKiULcxBitS+vbHRRv9IUBcq+Z1wkXcJjfywKrt5r++I6OYyXg=="],
 
     "@ai-sdk/provider": ["@ai-sdk/provider@4.0.10", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-fX2ENAc7iDpZ+Wp4+Rk06Usn/Ys7dI9uAkGv0jlF6XVrW13NkRWx5Ou+U6lIM2E1fTLkCs16GGrUAaVvroag7A=="],
 
@@ -209,7 +211,7 @@
 
     "@clack/prompts": ["@clack/prompts@1.7.0", "", { "dependencies": { "@clack/core": "1.4.3", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A=="],
 
-    "@cloudflare/workers-types": ["@cloudflare/workers-types@5.20260904.1", "", {}, "sha512-SbulPvrdb4j5iISDr81Iw+YpNCG4Bb6xRqV3arkgn/Ib6STMaoG63lhPnuWqmZdakOn0qS1OUudBMdxtBFx0Jg=="],
+    "@cloudflare/workers-types": ["@cloudflare/workers-types@5.20260905.1", "", {}, "sha512-ebDpVTgrnee245IRBTazyfjfmZas+HJehZyVQkKmUozsBN8RzvXXMI0XjjcT2rQjw+0USewfEGGLYiHO+TL0Sg=="],
 
     "@emmetio/abbreviation": ["@emmetio/abbreviation@2.3.3", "", { "dependencies": { "@emmetio/scanner": "^1.0.4" } }, "sha512-mgv58UrU3rh4YgbE/TzgLQwJ3pFsHHhCLqY20aJq+9comytTXUDNGG/SMtSeMJdkpxgXSXunBGLD8Boka3JyVA=="],
 
@@ -293,7 +295,7 @@
 
     "@ilha/astro": ["@ilha/astro@0.3.4", "", { "peerDependencies": { "astro": "^7.2.9", "ilha": "^0.14.4" } }, "sha512-SWCVPZeTjJqBGGGtPFDmIR6I7ltgFYYaC9kAd3Sp0+6woeMaNr9Lpm/DW9fEZrlxZ5deLoaAgPSB8GqfWySA0g=="],
 
-    "@ilha/router": ["@ilha/router@0.11.5", "", { "dependencies": { "effect": "4.0.0-rc.112", "unplugin": "3.3.0" }, "peerDependencies": { "ilha": ">=0.14.4", "oxidejs": ">=0.3.1" }, "optionalPeers": ["oxidejs"] }, "sha512-mSBuh5bfjrX8qBvH7qWagavsLOq91MtrkATleSpO8hnnOL16ZPak9ZqKYETdQgLQXVzc5TP5xc70tLRqgqbHYQ=="],
+    "@ilha/router": ["@ilha/router@0.11.6", "", { "dependencies": { "effect": "4.0.0-rc.112", "unplugin": "3.3.0" }, "peerDependencies": { "ilha": ">=0.14.4", "oxidejs": ">=0.3.2" }, "optionalPeers": ["oxidejs"] }, "sha512-1N4HAt/mCh4Ta3XNDB40RcnMUmAJv4EHsXJticOFxqQPQu4GlaVfqdJKCS4JyRuAr+CqKnGyu7gEagmIamr7Vw=="],
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
@@ -391,6 +393,12 @@
 
     "@nodable/entities": ["@nodable/entities@3.0.0", "", {}, "sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw=="],
 
+    "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
+
+    "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
+
+    "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
+
     "@openapi-contrib/openapi-schema-to-json-schema": ["@openapi-contrib/openapi-schema-to-json-schema@3.2.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3" } }, "sha512-Gj6C0JwCr8arj0sYuslWXUBSP/KnUlEGnPW4qxlXvAl543oaNQgMgIgkQUA6vs5BCCvwTEiL8m/wdWzfl4UvSw=="],
 
     "@orama/orama": ["@orama/orama@3.1.18", "", {}, "sha512-a61ljmRVVyG5MC/698C8/FfFDw5a8LOIvyOLW5fztgUXqUpc1jOfQzOitSCbge657OgXXThmY3Tk8fpiDb4UcA=="],
@@ -399,43 +407,43 @@
 
     "@oxc-project/types": ["@oxc-project/types@0.148.0", "", {}, "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A=="],
 
-    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.63.0", "", { "os": "android", "cpu": "arm" }, "sha512-YmRth4ZPGgEXcgmkhvANbC9uD67dxmSobW7DQuyt5tOBOKvPnIpk5SVHBj88E+7wMNRI2FhqaDbOhQFBix+b8A=="],
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.66.0", "", { "os": "android", "cpu": "arm" }, "sha512-2Me9eoptv6ERdEuI2P8AOlYdHHraXebJaM6SC0kc2Dfb+mLrep2db+fedBPKaYn673h/vBgvP4tkOdAbaudX6w=="],
 
-    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.63.0", "", { "os": "android", "cpu": "arm64" }, "sha512-icbahX8X2X3sRamOMecvdYeZXWjPDazRDIfvWfy7Ca1nc/ZDT2Y9k5Nt7s46EqFd7NQPdgk+CM3/SgIT5LPCaQ=="],
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.66.0", "", { "os": "android", "cpu": "arm64" }, "sha512-u7O+bSSF0HGsDKkQQxBqvLGVepu93RA+JKu+ONqvfh4sCnCEbj31wZj4iG5gk3XfRwrmYj0/8catkO2LcblQKQ=="],
 
-    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.63.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-WV+Ze5v5gI2qoj8jpAovt8KBTW8pjEz/AiMXXjeTQS+Bmf/MmZXTS40S8xNPDszX+W8WDv2Bbk6qKrMTtUGu1A=="],
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.66.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-/ikyMIVjX/sdo7KtjxoEsSUosfPzveVhT9RWMx9yGqFDKFJ89JAEKuEeLBmurDjrkb4w8tOnAdSO3SBaplY3bw=="],
 
-    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.63.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-CJGSBdDxXOWIpoFXHpverimCvz084KA7L483rqJ44c3jDtzv6d4qOSoR/V9ywSHfV+Ks1lwIj2P49BFhunLNAA=="],
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.66.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-q5xUsKeFqawa9NXa6ZGXWimFV19m8MogKPdTaSVDAAk2EQKBmBZRDeluwcl1p8ty/OFc9s9888OKEh3xfPVH0g=="],
 
-    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.63.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BDfKY+KhL2078cgswBBFQPAYuxCy93bS/iC5frdSeSbTLcGrR6VC2hsuPTanoJmg84+wSyWl0wWC1eR+uTnkRg=="],
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.66.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-CR+x4VzMY0pRXLK/xFQ/RzsSFkP5t2Z2mef0QY6OP/rTRcMUoMLCOM62/3Fp/t0K+UDoBKxvMyeb6D0zPMjleA=="],
 
-    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.63.0", "", { "os": "linux", "cpu": "arm" }, "sha512-Ov1cQEXT4mj7cojAokWSS1eoxkoyvbDfAbxNsGIKY2o36kvdAaFzPxRN6NxFRk9fD72B8oCoTTX/NuYTUWlpsg=="],
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.66.0", "", { "os": "linux", "cpu": "arm" }, "sha512-ZEYmO/LbH9tTQCADILHGZE4GeOXOAj2VzedHkASNwjmwlwtutJCLpCJbIs37wRGTFgWRoEcD72jpMX+IBJUGjQ=="],
 
-    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.63.0", "", { "os": "linux", "cpu": "arm" }, "sha512-0LE7ro3+6L79jcMANycAZfRaC7zxr9YZ2+vEL5uMD9QlEep+rS/r1kSJsnuLl991NXJZD60euh0PC1GHrR20vw=="],
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.66.0", "", { "os": "linux", "cpu": "arm" }, "sha512-hNtR9/oU0CeTkq7JnRkmBQwqe17v2ZaAMLC4VcN7IIOWeRyWDk0knSPWS9iiLmtbZ2RRBBtsG01jQgkZmKCJeQ=="],
 
-    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.63.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-izPk+2Z4gjuZK32Fqh5qXoMpT/2NXzLh++ob57HiEiVSQZ1iYXu8EKMzb+K5AvWyIEXhdDIt7ADjGGtFhkT9Bw=="],
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.66.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-uwOVQ8i6I1LT/+eDzfsgrrcZp8Fn6NPVUPn8fF5gdFGekFf0PddF+LEuwsD0/pbNUcKZhDj2rQ5UpITh9gF4iQ=="],
 
-    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.63.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-alPmbOuWXFXiSo+lOtv6X71C7SYMEDW2WVvywOvf9BwKgEhSNGhMTLeFVSjKUMCamcjbbgVdsWF8GN1uy8xshg=="],
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.66.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-tTkF2Dmx4nGAjmBlZb+UtTGqR/EK4ZrW9qBfzte07a9XWqzoGGKzpFFlyNDhQe+Uwql94+ReCTeNbhOXscw1Dg=="],
 
-    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.63.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-BdzCPvolJc4AWZ+YMzgUDJcDzbQWrFjYuqBHoNHNqP1aCaluQRJNs4k3vNU5IG7vTpjf9zeD73D7MFM1TecZpg=="],
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.66.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-F3cKHUav4yXOHn6GFnwpBhSYsJOYKKf9eqO/9jlEuqPxNw9zb98E9ZFct79gcg8pibUGkbveEu9WDlmXJpDzKw=="],
 
-    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.63.0", "", { "os": "linux", "cpu": "none" }, "sha512-7sIgfLzqtNKSkMGsGVyRpHwpjNezRg2XONvUOheFZs95TSZpM0JAuPpA8KrQFsWc4wPU95roX2O69JgH8igOgw=="],
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-K5fDaNZfDyQMYA/3qL21bqyN0X9T15LLwwbFPt2aHc94+ZG7bh0vZEsy2y7NlRnjjHFSwN+Hzg6ldJtbOriH4Q=="],
 
-    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.63.0", "", { "os": "linux", "cpu": "none" }, "sha512-9Tcg0y0WcVa6Mm9AgcgFMseDS+VkFJZpKZ8We9SpDY4gg5jewSwln+0sO04QLcTS1BtfDl9MwR+NfID8L7PUTg=="],
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-44Yc+I+qOmTElRcEhm5hUKIUJEQIOugymz4ua4tB0Wox7tGAfIbjzmXz/HDAtw1Ij6gmBwZlzh4hc9679RhWeA=="],
 
-    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.63.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-qWKC1pEOpx1qYhXaugPhHUeXwSfqEOk2wJH2LqVXGPV5iQYfdAZdt+d2XDiX4DTSWA2QDMUcFB+wEORh3Xn/sA=="],
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.66.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-1e29Eg9hEj2kRBB19M0seIehPbbXHCk35GvImjDvb79rjjYjXCRmtbUNHJcgoktZAMIzXrTbxDBKmTc1V4bg3A=="],
 
-    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.63.0", "", { "os": "linux", "cpu": "x64" }, "sha512-S9wXYOiGSqYGS4Fx/TFsY+xDd/7dE5s+rUgbA4TsHiVF9e8J3ZcKmP7dsP/7iqLI9Wz7Ic7TzEr3mdthRCTdrA=="],
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.66.0", "", { "os": "linux", "cpu": "x64" }, "sha512-vODY1UQo10gngn0+D4xHKU84F1Twm1LqrzV4SqPXvmQKSd87paehvZ6jqA5wKs6XQrlWul9clYMDVHcoW9CPMA=="],
 
-    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.63.0", "", { "os": "linux", "cpu": "x64" }, "sha512-5eGyTJuMZNwBSHCivXt8Yuta6GeTYksOPXRk2MIhajiyFGQx7bjaHIwY+ZusAoFHhT157A9x6sktLjYo9D5oMQ=="],
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.66.0", "", { "os": "linux", "cpu": "x64" }, "sha512-YDzXx2JsT4+HL4MdkVrYjO55NS5lUKNm8rLC4ZPou8+seu0v0jhecSh+ufoO6+xEa8gccEezMlI2WHJi4ApUgw=="],
 
-    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.63.0", "", { "os": "none", "cpu": "arm64" }, "sha512-Rz7hx+Dv3DoW/S6pwVAyjfFXp7/trdQ1zg+vNmsdsdDNlUccugp4XNqambSuEAeP0DaG9k72AtNyfDXCEg0AGw=="],
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.66.0", "", { "os": "none", "cpu": "arm64" }, "sha512-mJjUYd8lj0+j4JkYyEM+5qKBf1Rnrpgjn/SVYKJhicVDqLz566ooa7Fs8zflPqt+dnZDV7X054rVIQX6ZcQNlQ=="],
 
-    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.63.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-T/IuizKN9mr4Xw6YYnptkXRNdLkyIlUZ7c8zfTOBpoytZyJ1BAsMUvsMDEx0X4YvSMpaivm+DR8112rQfzC25g=="],
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.66.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-soV+0vESv7e5ntCHWC61x4gg8OSak6IHHnWsZmHrJFlvMj2AK+kmldErCNkVkrvc1Ts2/++rJXn+IuAb2WMXhw=="],
 
-    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.63.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-XjrO5FJ5Wl9vsAxtCP1G/eaeT6y1K2s9CICUHGE42cEjou32/J6S+B1KnrOAboj6E7uhJnwPbRSvznWcxNdA0g=="],
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.66.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-YCPi23uRIEYuIKTZohAkKbPFpujQ5QBuUM5iDv+UqbCmTPAkaFsxjsSuB8xlBpRT0G7eP/4HMF+cPDSqHtOD9A=="],
 
-    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.63.0", "", { "os": "win32", "cpu": "x64" }, "sha512-sgsHCQy432OTQH4Ikk3tZptp3GqwnhwUDuY0loBH41zyHWfMZY9v8Dy78wsnSofHejvFozZGgJgBB1A0LQRwMQ=="],
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.66.0", "", { "os": "win32", "cpu": "x64" }, "sha512-bwTQcv/JVRPkOqQtMF0X7vpvpncDQiBcXHxZ9S2hR12Hlo8bvBdUR5x5XnxzDZ3kM0qoZw1rv7KaD66Ly+pFWA=="],
 
     "@oxidejs/template-simple": ["@oxidejs/template-simple@workspace:templates/simple"],
 
@@ -493,7 +501,7 @@
 
     "@pagefind/windows-x64": ["@pagefind/windows-x64@1.5.2", "", { "os": "win32", "cpu": "x64" }, "sha512-Fa2Iyw7kaDRzGMfNYNUXNW2zbL5FQVDgSOcbDHdzBrDEdpqOqg8TcZ68F22ol6NJ9IGzvUdmeyZypLW5dyhqsg=="],
 
-    "@pierre/diffs": ["@pierre/diffs@1.4.0", "", { "dependencies": { "@pierre/theme": "2.0.0", "@pierre/theming": "1.0.1", "@shikijs/transformers": "^3.0.0 || ^4.0.0", "diff": "9.0.0", "hast-util-to-html": "9.0.5", "lru_map": "0.4.1", "shiki": "^3.0.0 || ^4.0.0" }, "peerDependencies": { "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-eSYnNDjRdgx01O16t8yxVW5M96ppgUMKbMyRE7/cyeJa+dMQrS/s0ed3n0KK9a2Or7SXon6cYbBLhAiAggD6ZQ=="],
+    "@pierre/diffs": ["@pierre/diffs@1.4.1", "", { "dependencies": { "@pierre/theme": "2.0.0", "@pierre/theming": "1.0.1", "@shikijs/transformers": "^3.0.0 || ^4.0.0", "diff": "9.0.0", "hast-util-to-html": "9.0.5", "lru_map": "0.4.1", "shiki": "^3.0.0 || ^4.0.0" }, "peerDependencies": { "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-rzvY9FeeYdGtVcErjNsW6tnrjpMb0DvGtgCFNuMoYT8wufE+gO1ZXAzKAc2VPRBS3Rl5HELEQ38WDlis4qZHkQ=="],
 
     "@pierre/theme": ["@pierre/theme@2.0.0", "", {}, "sha512-yNDd9GYLQl1mEUJR8AneJ5e4ohLIHQd/wZLWr4fagt78vS2RwwZNW530vVgHqXFAyFVcFlRmGUD5ramXH46OXw=="],
 
@@ -561,6 +569,8 @@
 
     "@scarf/scarf": ["@scarf/scarf@1.4.0", "", {}, "sha512-xxeapPiUXdZAE3che6f3xogoJPeZgig6omHEy1rIY5WVsB3H2BHNnZH+gHG6x91SCWyQCzWGsuL2Hh3ClO5/qQ=="],
 
+    "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
+
     "@shikijs/core": ["@shikijs/core@4.4.3", "", { "dependencies": { "@shikijs/primitive": "4.4.3", "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5", "hast-util-to-html": "^9.0.5" } }, "sha512-QCR4q2ZO/ILJEuwiBMel4wdcTDb1JGwfjKTxPDF6x8ixOaluPrVqIn06C99AcRPhmYlBR56d/Fb+GN58GzExpg=="],
 
     "@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-FbOjFJp9VLdo1Wevs10BBtVxiTWwNLqZh5Gkhjgda/ioL15YOgeSl9n+6XMa3qRlPQzfhFNe641SrynFHYG0nQ=="],
@@ -583,6 +593,8 @@
 
     "@sindresorhus/is": ["@sindresorhus/is@4.6.0", "", {}, "sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw=="],
 
+    "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
+
     "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@stoplight/better-ajv-errors": ["@stoplight/better-ajv-errors@1.0.3", "", { "dependencies": { "jsonpointer": "^5.0.0", "leven": "^3.1.0" }, "peerDependencies": { "ajv": ">=8" } }, "sha512-0p9uXkuB22qGdNfy3VeEhxkU5uwvp/KrBTAbrLBURv6ilxIVwanKwjMc41lQfIVgPGcOkmLbTolfFrSsueu7zA=="],
@@ -681,7 +693,7 @@
 
     "@types/babel__traverse": ["@types/babel__traverse@7.28.0", "", { "dependencies": { "@babel/types": "^7.28.2" } }, "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q=="],
 
-    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
+    "@types/bun": ["@types/bun@1.4.1", "", { "dependencies": { "bun-types": "1.4.1" } }, "sha512-0AVGiTXGajf1rgKom3N+c5L7CBxuoyyv1i44M0nX4UDK0G/fnRAMiri93nHuVPIb429KKtAgj7HatVmmOjeQLA=="],
 
     "@types/d3": ["@types/d3@7.4.3", "", { "dependencies": { "@types/d3-array": "*", "@types/d3-axis": "*", "@types/d3-brush": "*", "@types/d3-chord": "*", "@types/d3-color": "*", "@types/d3-contour": "*", "@types/d3-delaunay": "*", "@types/d3-dispatch": "*", "@types/d3-drag": "*", "@types/d3-dsv": "*", "@types/d3-ease": "*", "@types/d3-fetch": "*", "@types/d3-force": "*", "@types/d3-format": "*", "@types/d3-geo": "*", "@types/d3-hierarchy": "*", "@types/d3-interpolate": "*", "@types/d3-path": "*", "@types/d3-polygon": "*", "@types/d3-quadtree": "*", "@types/d3-random": "*", "@types/d3-scale": "*", "@types/d3-scale-chromatic": "*", "@types/d3-selection": "*", "@types/d3-shape": "*", "@types/d3-time": "*", "@types/d3-time-format": "*", "@types/d3-timer": "*", "@types/d3-transition": "*", "@types/d3-zoom": "*" } }, "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww=="],
 
@@ -883,7 +895,7 @@
 
     "agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="],
 
-    "ai": ["ai@7.0.92", "", { "dependencies": { "@ai-sdk/gateway": "4.0.74", "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-9xb8Xo6aw7YMxuROznR02q4Hpne1DJ7JbKurpcOsabSSY3sd3xGoTANSqEs4gYLRpIz27MmT3IMfH8X3+oK1CQ=="],
+    "ai": ["ai@7.0.93", "", { "dependencies": { "@ai-sdk/gateway": "4.0.75", "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-CJss6zb9mlltk/mCr8qom20NBnqEQxVawkqwtT62tCwsxilZpXfHNRMRwcS3XRpzdP1kEluVuDBUayYWEEd95g=="],
 
     "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -897,6 +909,8 @@
 
     "am-i-vibing": ["am-i-vibing@0.4.0", "", { "dependencies": { "process-ancestry": "^0.1.0" }, "bin": { "am-i-vibing": "dist/cli.mjs" } }, "sha512-MxT4XZL7pzLHpuvhDKdMaQHMGGkJDLluKBLsbstn+8wv9sWcFT6h+0ve9qkml95amVTZtZV83gQe2hY+ojgHLg=="],
 
+    "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="],
+
     "ansi-regex": ["ansi-regex@6.3.0", "", {}, "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ=="],
 
     "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
@@ -953,9 +967,11 @@
 
     "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
 
-    "browserslist": ["browserslist@4.28.8", "", { "dependencies": { "baseline-browser-mapping": "^2.11.12", "caniuse-lite": "^1.0.30001809", "electron-to-chromium": "^1.5.402", "node-releases": "^2.0.53", "update-browserslist-db": "^1.3.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA=="],
+    "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
-    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
+    "browserslist": ["browserslist@4.28.9", "", { "dependencies": { "baseline-browser-mapping": "^2.11.20", "caniuse-lite": "^1.0.30001810", "electron-to-chromium": "^1.5.420", "node-releases": "^2.0.54", "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" } }, "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg=="],
+
+    "bun-types": ["bun-types@1.4.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-loKuVrAFZKfEv+JvWkHRS9GW5IqLuLRjVXN9p+vZvBN86O5hf/pBZQ5hSoyipsrMmWObZBDvWnlmKvjKTM0PdA=="],
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
@@ -989,6 +1005,10 @@
 
     "citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
 
+    "cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
+
+    "cli-truncate": ["cli-truncate@6.1.1", "", { "dependencies": { "slice-ansi": "^9.0.0", "string-width": "^8.2.0" } }, "sha512-06p9vyLahLa4zkGcgsGxU6iEkSOiuI4fhCH6Emhe2lPAcoUv73n72DnODsnHA+5wwXGnV0n9M9/qOQJSjYhFhw=="],
+
     "cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
@@ -1003,6 +1023,8 @@
 
     "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
 
+    "confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+
     "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
 
     "content-disposition": ["content-disposition@1.1.0", "", {}, "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g=="],
@@ -1127,6 +1149,8 @@
 
     "decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="],
 
+    "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="],
+
     "define-data-property": ["define-data-property@1.1.4", "", { "dependencies": { "es-define-property": "^1.0.0", "es-errors": "^1.3.0", "gopd": "^1.0.1" } }, "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A=="],
 
     "define-properties": ["define-properties@1.2.1", "", { "dependencies": { "define-data-property": "^1.0.1", "has-property-descriptors": "^1.0.0", "object-keys": "^1.1.1" } }, "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg=="],
@@ -1193,6 +1217,8 @@
 
     "entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
+    "environment": ["environment@1.1.0", "", {}, "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q=="],
+
     "epub-gen-memory": ["epub-gen-memory@1.1.2", "", { "dependencies": { "abort-controller": "^3.0.0", "css-select": "^4.1.3", "diacritics": "^1.3.0", "dom-serializer": "^1.3.2", "domhandler": "^4.2.2", "domutils": "^2.8.0", "ejs": "^3.1.6", "htmlparser2": "^7.1.2", "jszip": "^3.7.1", "mime": "^2.5.2", "node-fetch": "^2.0.0", "ow": "^0.28.1", "slugify": "^1.6.5" } }, "sha512-vwGM6MVNqKIskFzPZqhi4ZOs0ZTUXco9oDuHFX1vB2Il9pTAkaHWFBFgHrrl832dYmBPb/raGVUZXFvZYueRyw=="],
 
     "es-abstract": ["es-abstract@1.24.2", "", { "dependencies": { "array-buffer-byte-length": "^1.0.2", "arraybuffer.prototype.slice": "^1.0.4", "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.8", "call-bound": "^1.0.4", "data-view-buffer": "^1.0.2", "data-view-byte-length": "^1.0.2", "data-view-byte-offset": "^1.0.1", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "es-set-tostringtag": "^2.1.0", "es-to-primitive": "^1.3.0", "function.prototype.name": "^1.1.8", "get-intrinsic": "^1.3.0", "get-proto": "^1.0.1", "get-symbol-description": "^1.1.0", "globalthis": "^1.0.4", "gopd": "^1.2.0", "has-property-descriptors": "^1.0.2", "has-proto": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "internal-slot": "^1.1.0", "is-array-buffer": "^3.0.5", "is-callable": "^1.2.7", "is-data-view": "^1.0.2", "is-negative-zero": "^2.0.3", "is-regex": "^1.2.1", "is-set": "^2.0.3", "is-shared-array-buffer": "^1.0.4", "is-string": "^1.1.1", "is-typed-array": "^1.1.15", "is-weakref": "^1.1.1", "math-intrinsics": "^1.1.0", "object-inspect": "^1.13.4", "object-keys": "^1.1.1", "object.assign": "^4.1.7", "own-keys": "^1.0.1", "regexp.prototype.flags": "^1.5.4", "safe-array-concat": "^1.1.3", "safe-push-apply": "^1.0.0", "safe-regex-test": "^1.1.0", "set-proto": "^1.0.0", "stop-iteration-iterator": "^1.1.0", "string.prototype.trim": "^1.2.10", "string.prototype.trimend": "^1.0.9", "string.prototype.trimstart": "^1.0.8", "typed-array-buffer": "^1.0.3", "typed-array-byte-length": "^1.0.3", "typed-array-byte-offset": "^1.0.4", "typed-array-length": "^1.0.7", "unbox-primitive": "^1.1.0", "which-typed-array": "^1.1.19" } }, "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg=="],
@@ -1253,7 +1279,7 @@
 
     "eventsource-parser": ["eventsource-parser@3.1.1", "", {}, "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ=="],
 
-    "execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
+    "execa": ["execa@10.0.1", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "figures": "^6.1.0", "get-stream": "^9.0.1", "human-signals": "^8.0.1", "is-plain-obj": "^4.1.0", "is-stream": "^4.0.1", "npm-run-path": "^6.0.0", "pretty-ms": "^9.3.0", "signal-exit": "^4.1.0", "strip-final-newline": "^4.0.0", "which-command": "^0.1.0", "yoctocolors": "^2.1.2" } }, "sha512-ge98qjkRK4IB7tL7Ju/6qmm5LHoH1eEMt5FNZrz3f4UIYhF28lggX20z3FaX1sgc67msLEn0N0BscOs29iuwyw=="],
 
     "expr-eval-fork": ["expr-eval-fork@3.0.3", "", {}, "sha512-BhC+hbc5lIVjygr840n5DEkW3MQq7H9o+mc1/N7Z5uIiCFVyESLL5DIE7LNq4CYUNxy+XjA+3jRrL/h0Kt2xcg=="],
 
@@ -1269,6 +1295,8 @@
 
     "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
 
+    "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
+
     "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="],
 
     "fast-memoize": ["fast-memoize@2.5.2", "", {}, "sha512-Ue0LwpDYErFbmNnZSF0UH6eImUwDmogUO1jyE+JbN2gsQz/jICm1Ve7t9QT0rNSsfJt+Hs4/S3GnsDVjL4HVrw=="],
@@ -1287,16 +1315,24 @@
 
     "fastdom": ["fastdom@1.0.12", "", { "dependencies": { "strictdom": "^1.0.1" } }, "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg=="],
 
+    "fastq": ["fastq@1.20.3", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw=="],
+
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
+    "figures": ["figures@6.1.0", "", { "dependencies": { "is-unicode-supported": "^2.0.0" } }, "sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg=="],
+
     "file-uri-to-path": ["file-uri-to-path@1.0.0", "", {}, "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="],
 
     "filelist": ["filelist@1.0.6", "", { "dependencies": { "minimatch": "^5.0.1" } }, "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA=="],
 
+    "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
+
     "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
 
     "find-proc": ["find-proc@0.1.0", "", {}, "sha512-OaOpEYv2PiQ7SQ5LIrl+deA1XaWcxEjnpM6VuWXTUvn+teIXxeFTLDmu18/zDQpFmHN4o3oDBX+BT0AGwEhemg=="],
 
+    "find-workspaces": ["find-workspaces@0.3.1", "", { "dependencies": { "fast-glob": "^3.3.2", "pkg-types": "^1.0.3", "yaml": "^2.3.4" } }, "sha512-UDkGILGJSA1LN5Aa7McxCid4sqW3/e+UYsVwyxki3dDT0F8+ym0rAfnCkEfkL0rO7M+8/mvkim4t/s3IPHmg+w=="],
+
     "flattie": ["flattie@1.1.1", "", {}, "sha512-9UbaD6XdAL97+k/n+N7JwX46K/M6Zc6KcFYskrYL8wbBV/Uyk0CTAMY0VT+qiK5PM7AIc9aTWYtq65U7T+aCNQ=="],
 
     "fontace": ["fontace@0.4.1", "", { "dependencies": { "fontkitten": "^1.0.2" } }, "sha512-lDMvbAzSnHmbYMTEld5qdtvNH2/pWpICOqpean9IgC7vUbUJc3k+k5Dokp85CegamqQpFbXf0rAVkbzpyTA8aw=="],
@@ -1331,7 +1367,7 @@
 
     "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
 
-    "get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
+    "get-stream": ["get-stream@9.0.1", "", { "dependencies": { "@sec-ant/readable-stream": "^0.4.1", "is-stream": "^4.0.1" } }, "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA=="],
 
     "get-symbol-description": ["get-symbol-description@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6" } }, "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg=="],
 
@@ -1341,6 +1377,8 @@
 
     "glob": ["glob@13.0.6", "", { "dependencies": { "minimatch": "^10.2.2", "minipass": "^7.1.3", "path-scurry": "^2.0.2" } }, "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw=="],
 
+    "glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
+
     "globalthis": ["globalthis@1.0.4", "", { "dependencies": { "define-properties": "^1.2.1", "gopd": "^1.0.1" } }, "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ=="],
 
     "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
@@ -1391,7 +1429,7 @@
 
     "hastscript": ["hastscript@9.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-parse-selector": "^4.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0" } }, "sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w=="],
 
-    "hono": ["hono@4.13.5", "", {}, "sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw=="],
+    "hono": ["hono@4.13.7", "", {}, "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ=="],
 
     "hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
 
@@ -1407,7 +1445,9 @@
 
     "https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
 
-    "human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
+    "human-signals": ["human-signals@8.0.1", "", {}, "sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ=="],
+
+    "husky": ["husky@9.1.7", "", { "bin": { "husky": "bin.js" } }, "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA=="],
 
     "iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
 
@@ -1463,10 +1503,16 @@
 
     "is-extendable": ["is-extendable@0.1.1", "", {}, "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw=="],
 
+    "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
+
     "is-finalizationregistry": ["is-finalizationregistry@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg=="],
 
+    "is-fullwidth-code-point": ["is-fullwidth-code-point@5.1.0", "", { "dependencies": { "get-east-asian-width": "^1.3.1" } }, "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ=="],
+
     "is-generator-function": ["is-generator-function@1.1.2", "", { "dependencies": { "call-bound": "^1.0.4", "generator-function": "^2.0.0", "get-proto": "^1.0.1", "has-tostringtag": "^1.0.2", "safe-regex-test": "^1.1.0" } }, "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA=="],
 
+    "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
+
     "is-hexadecimal": ["is-hexadecimal@2.0.1", "", {}, "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg=="],
 
     "is-map": ["is-map@2.0.3", "", {}, "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw=="],
@@ -1475,6 +1521,8 @@
 
     "is-network-error": ["is-network-error@1.3.2", "", {}, "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA=="],
 
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
+
     "is-number-object": ["is-number-object@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw=="],
 
     "is-obj": ["is-obj@2.0.0", "", {}, "sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w=="],
@@ -1489,7 +1537,7 @@
 
     "is-shared-array-buffer": ["is-shared-array-buffer@1.0.4", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A=="],
 
-    "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
 
     "is-string": ["is-string@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA=="],
 
@@ -1497,6 +1545,8 @@
 
     "is-typed-array": ["is-typed-array@1.1.15", "", { "dependencies": { "which-typed-array": "^1.1.16" } }, "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ=="],
 
+    "is-unicode-supported": ["is-unicode-supported@2.1.0", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
+
     "is-unsafe": ["is-unsafe@2.0.2", "", {}, "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ=="],
 
     "is-weakmap": ["is-weakmap@2.0.2", "", {}, "sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w=="],
@@ -1591,6 +1641,8 @@
 
     "lodash.topath": ["lodash.topath@4.5.2", "", {}, "sha512-1/W4dM+35DwvE/iEd1M9ekewOSTlpFekhw9mhAtrwjVqUr83/ilQiyAvmg4tVX7Unkcfl1KC+i9WdaT4B6aQcg=="],
 
+    "log-update": ["log-update@8.0.0", "", { "dependencies": { "ansi-escapes": "^7.3.0", "cli-cursor": "^5.0.0", "slice-ansi": "^9.0.0", "string-width": "^8.2.0", "strip-ansi": "^7.2.0", "wrap-ansi": "^10.0.0" } }, "sha512-lddSgOt3bPASrylL54ZSpy8nBHns+vBVSoILlVOx+dei300pnLRN958rj/EdlVLKuWlSESU3qdnDZdAI7FXYGg=="],
+
     "longest-streak": ["longest-streak@3.1.0", "", {}, "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g=="],
 
     "lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
@@ -1653,6 +1705,8 @@
 
     "merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="],
 
+    "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
+
     "mermaid": ["mermaid@11.17.2", "", { "dependencies": { "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", "@mermaid-js/parser": "^1.2.1", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", "cytoscape": "^3.34.0", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", "dayjs": "^1.11.21", "dompurify": "^3.3.3", "es-toolkit": "^1.45.1", "fastdom": "1.0.12", "katex": "^0.16.47", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", "stylis": "^4.3.6", "ts-dedent": "^2.2.0", "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0" } }, "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg=="],
 
     "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="],
@@ -1725,6 +1779,8 @@
 
     "micromark-util-types": ["micromark-util-types@2.0.2", "", {}, "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA=="],
 
+    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
+
     "mime": ["mime@2.6.0", "", { "bin": { "mime": "cli.js" } }, "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg=="],
 
     "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],
@@ -1733,12 +1789,16 @@
 
     "mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
 
+    "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
+
     "minimatch": ["minimatch@10.2.6", "", { "dependencies": { "brace-expansion": "^5.0.8" } }, "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A=="],
 
     "minipass": ["minipass@7.1.3", "", {}, "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A=="],
 
     "minizlib": ["minizlib@3.1.0", "", { "dependencies": { "minipass": "^7.1.2" } }, "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw=="],
 
+    "mlly": ["mlly@1.8.2", "", { "dependencies": { "acorn": "^8.16.0", "pathe": "^2.0.3", "pkg-types": "^1.3.1", "ufo": "^1.6.3" } }, "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA=="],
+
     "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
@@ -1781,10 +1841,12 @@
 
     "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
 
-    "npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
+    "npm-run-path": ["npm-run-path@6.0.0", "", { "dependencies": { "path-key": "^4.0.0", "unicorn-magic": "^0.3.0" } }, "sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA=="],
 
     "nth-check": ["nth-check@3.0.1", "", { "dependencies": { "boolbase": "^2.0.0" } }, "sha512-GX0gsdbGVCgnRgbeGaubfjpBXyYRWOOCVeYh08bSQvDZqxz5ndXs1OTfAt/h36G1xvI94YIspsI0sVFqAV9+RQ=="],
 
+    "nypm": ["nypm@0.6.9", "", { "dependencies": { "citty": "^0.2.2", "pathe": "^2.0.3", "tinyexec": "^1.2.4" }, "bin": { "nypm": "./dist/cli.mjs" } }, "sha512-zxlE2yvSWZWmHcNdT3+5zV2lrCogeE9YOklHrR3dFjqutq5wO7GFDYLFDRXLsYnJzwvy/im9fYoxePvS0VTW0w=="],
+
     "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
 
     "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
@@ -1803,7 +1865,7 @@
 
     "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
 
-    "onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
+    "onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
     "oniguruma-parser": ["oniguruma-parser@0.12.2", "", {}, "sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw=="],
 
@@ -1817,7 +1879,7 @@
 
     "own-keys": ["own-keys@1.0.2", "", { "dependencies": { "call-bound": "^1.0.4", "get-intrinsic": "^1.3.0", "object-keys": "^1.1.1", "safe-push-apply": "^1.0.0" } }, "sha512-19YVAg7T+WTrxggPukVq7DjTv6+PJ867TmhCvBsYwmbFCsZd344rq2Ld1p0wo8f8Qrrhgp82c6FJRqdXWtSEhg=="],
 
-    "oxfmt": ["oxfmt@0.63.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.63.0", "@oxfmt/binding-android-arm64": "0.63.0", "@oxfmt/binding-darwin-arm64": "0.63.0", "@oxfmt/binding-darwin-x64": "0.63.0", "@oxfmt/binding-freebsd-x64": "0.63.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.63.0", "@oxfmt/binding-linux-arm-musleabihf": "0.63.0", "@oxfmt/binding-linux-arm64-gnu": "0.63.0", "@oxfmt/binding-linux-arm64-musl": "0.63.0", "@oxfmt/binding-linux-ppc64-gnu": "0.63.0", "@oxfmt/binding-linux-riscv64-gnu": "0.63.0", "@oxfmt/binding-linux-riscv64-musl": "0.63.0", "@oxfmt/binding-linux-s390x-gnu": "0.63.0", "@oxfmt/binding-linux-x64-gnu": "0.63.0", "@oxfmt/binding-linux-x64-musl": "0.63.0", "@oxfmt/binding-openharmony-arm64": "0.63.0", "@oxfmt/binding-win32-arm64-msvc": "0.63.0", "@oxfmt/binding-win32-ia32-msvc": "0.63.0", "@oxfmt/binding-win32-x64-msvc": "0.63.0" }, "peerDependencies": { "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-kgdDwv35wvVf6554U2Ab8Jnd0zTM+TsEQWwaB70RAjK3gICFAFGO+2Hd3Be27GMoXj3XRL9IKSNRVl7KBQL6iw=="],
+    "oxfmt": ["oxfmt@0.66.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.66.0", "@oxfmt/binding-android-arm64": "0.66.0", "@oxfmt/binding-darwin-arm64": "0.66.0", "@oxfmt/binding-darwin-x64": "0.66.0", "@oxfmt/binding-freebsd-x64": "0.66.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.66.0", "@oxfmt/binding-linux-arm-musleabihf": "0.66.0", "@oxfmt/binding-linux-arm64-gnu": "0.66.0", "@oxfmt/binding-linux-arm64-musl": "0.66.0", "@oxfmt/binding-linux-ppc64-gnu": "0.66.0", "@oxfmt/binding-linux-riscv64-gnu": "0.66.0", "@oxfmt/binding-linux-riscv64-musl": "0.66.0", "@oxfmt/binding-linux-s390x-gnu": "0.66.0", "@oxfmt/binding-linux-x64-gnu": "0.66.0", "@oxfmt/binding-linux-x64-musl": "0.66.0", "@oxfmt/binding-openharmony-arm64": "0.66.0", "@oxfmt/binding-win32-arm64-msvc": "0.66.0", "@oxfmt/binding-win32-ia32-msvc": "0.66.0", "@oxfmt/binding-win32-x64-msvc": "0.66.0" }, "peerDependencies": { "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-FfvqR8RFtV6JJpRrpkfqyVCQ7HDvZ/VriWFx7veftCgL1B5ZO9qNr+1rvPieycMQnNfVG0PWyJQiy7p0hq1I5w=="],
 
     "oxidejs": ["oxidejs@workspace:packages/oxidejs"],
 
@@ -1843,6 +1905,8 @@
 
     "parse-latin": ["parse-latin@7.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "@types/unist": "^3.0.0", "nlcst-to-string": "^4.0.0", "unist-util-modify-children": "^4.0.0", "unist-util-visit-children": "^3.0.0", "vfile": "^6.0.0" } }, "sha512-mhHgobPPua5kZ98EF4HWiH167JWBfl4pvAIXXdbaVohtK7a6YBOy56kvhCqduqyo/f3yrHFWmqmiMg/BkBkYYQ=="],
 
+    "parse-ms": ["parse-ms@4.0.0", "", {}, "sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw=="],
+
     "parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
 
     "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
@@ -1877,6 +1941,8 @@
 
     "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
 
+    "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="],
+
     "points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
 
     "points-on-path": ["points-on-path@0.2.1", "", { "dependencies": { "path-data-parser": "0.1.0", "points-on-curve": "0.2.0" } }, "sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g=="],
@@ -1891,6 +1957,8 @@
 
     "prettier": ["prettier@3.9.6", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g=="],
 
+    "pretty-ms": ["pretty-ms@9.3.1", "", { "dependencies": { "parse-ms": "^4.0.0" } }, "sha512-HzMy3Geq23nVALD/M2LliU+F+M+gVNsvkQWWqeBZ8HDiCgzo6YPJ/Omrmtq24EFrIsk0a3EkQGEd7bDOo+IhGA=="],
+
     "prismjs": ["prismjs@1.30.0", "", {}, "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw=="],
 
     "process": ["process@0.11.10", "", {}, "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A=="],
@@ -1911,6 +1979,8 @@
 
     "quansync": ["quansync@1.0.0", "", {}, "sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA=="],
 
+    "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
+
     "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],
 
     "range-parser": ["range-parser@1.3.0", "", {}, "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw=="],
@@ -1973,6 +2043,10 @@
 
     "resolve-pkg-maps": ["resolve-pkg-maps@1.0.0", "", {}, "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw=="],
 
+    "resolve.exports": ["resolve.exports@2.0.3", "", {}, "sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A=="],
+
+    "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
+
     "retext": ["retext@9.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "retext-latin": "^4.0.0", "retext-stringify": "^4.0.0", "unified": "^11.0.0" } }, "sha512-sbMDcpHCNjvlheSgMfEcVrZko3cDzdbe1x/e7G66dFp0Ff7Mldvi2uv6JkJQzdRcvLYE8CA8Oe8siQx8ZOgTcA=="],
 
     "retext-latin": ["retext-latin@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "parse-latin": "^7.0.0", "unified": "^11.0.0" } }, "sha512-hv9woG7Fy0M9IlRQloq/N6atV82NxLGveq+3H2WOi79dtIYWN8OaxogDm77f8YnVXJL2VD3bbqowu5E3EMhBYA=="],
@@ -1981,6 +2055,8 @@
 
     "retext-stringify": ["retext-stringify@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "nlcst-to-string": "^4.0.0", "unified": "^11.0.0" } }, "sha512-rtfN/0o8kL1e+78+uxPTqu1Klt0yPzKuQ2BfWwwfgIUSayyzxpM1PJzkKt4V8803uB9qSy32MvI7Xep9khTpiA=="],
 
+    "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
+
     "robots-parser": ["robots-parser@3.0.1", "", {}, "sha512-s+pyvQeIKIZ0dx5iJiQk1tPLJAWln39+MI5jtM8wnyws+G5azk+dMnMX0qfbqNetKKNgcWWOdi0sfm+FbQbgdQ=="],
 
     "robust-predicates": ["robust-predicates@3.0.3", "", {}, "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA=="],
@@ -1993,6 +2069,8 @@
 
     "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="],
 
+    "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
+
     "rw": ["rw@1.3.3", "", {}, "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ=="],
 
     "safe-array-concat": ["safe-array-concat@1.1.4", "", { "dependencies": { "call-bind": "^1.0.9", "call-bound": "^1.0.4", "get-intrinsic": "^1.3.0", "has-symbols": "^1.1.0", "isarray": "^2.0.5" } }, "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg=="],
@@ -2055,6 +2133,8 @@
 
     "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
+    "slice-ansi": ["slice-ansi@9.0.0", "", { "dependencies": { "ansi-styles": "^6.2.3", "is-fullwidth-code-point": "^5.1.0" } }, "sha512-SO/3iYL5S3W57LLEniscOGPZgOqZUPCx6d3dB+52B80yJ0XstzsC/eV8gnA4tM3MHDrKz+OCFSLNjswdSC+/bA=="],
+
     "slugify": ["slugify@1.6.9", "", {}, "sha512-vZ7rfeehZui7wQs438JXBckYLkIIdfHOXsaVEUMyS5fHo1483l1bMdo0EDSWYclY0yZKFOipDy4KHuKs6ssvdg=="],
 
     "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
@@ -2089,7 +2169,7 @@
 
     "strip-bom-string": ["strip-bom-string@1.0.0", "", {}, "sha512-uCC2VHvQRYu+lMh4My/sFNmF2klFymLX1wHJeXnbEJERpV/ZsVuonzerjfrGpIGF7LBVa1O7i9kjiWvJiFck8g=="],
 
-    "strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
+    "strip-final-newline": ["strip-final-newline@4.0.0", "", {}, "sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw=="],
 
     "strnum": ["strnum@2.4.2", "", { "dependencies": { "anynum": "^1.0.1" } }, "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw=="],
 
@@ -2127,6 +2207,8 @@
 
     "tinypool": ["tinypool@2.1.0", "", {}, "sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw=="],
 
+    "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
+
     "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
 
     "tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],
@@ -2171,6 +2253,8 @@
 
     "uhyphen": ["uhyphen@0.2.0", "", {}, "sha512-qz3o9CHXmJJPGBdqzab7qAYuW8kQGKNEuoHFYrBwV6hWIMcpAmxDLXojcHfFr9US1Pe6zUswEIJIbLI610fuqA=="],
 
+    "ultracite": ["ultracite@7.10.8", "", { "dependencies": { "@clack/prompts": "^1.5.1", "cli-truncate": "^6.1.1", "commander": "^15.0.0", "deepmerge": "^4.3.1", "empathic": "^2.0.1", "execa": "^10.0.1", "fast-glob": "^3.3.3", "find-workspaces": "^0.3.1", "jsonc-parser": "^3.3.1", "log-update": "^8.0.0", "magicast": "^0.5.4", "nypm": "^0.6.9", "resolve.exports": "^2.0.3", "string-width": "^8.2.2", "yaml": "^2.9.0", "zod": "^4.4.3" }, "peerDependencies": { "oxfmt": ">=0.1.0", "oxlint": "^1.79.0" }, "optionalPeers": ["oxfmt", "oxlint"], "bin": { "ultracite": "dist/index.js" } }, "sha512-oSPLhcMMX7BtfPtDvs5KrPMQxOr2kitBK4jsCbGAj/F863GJO000bLaKrT5ElpAKyuL+LgnvdsGzCh/dlWMC7Q=="],
+
     "ultrahtml": ["ultrahtml@1.7.0", "", {}, "sha512-2xRd0VHoAQE4M+vF/DvFFB7pUV0ZxTW1TLi7lHQWnF/Sb5TPeEUV/l+hxcNnGO00ZXGnR0voCMmYRKQf+rvJ2g=="],
 
     "unbox-primitive": ["unbox-primitive@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "has-bigints": "^1.0.2", "has-symbols": "^1.1.0", "which-boxed-primitive": "^1.1.1" } }, "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw=="],
@@ -2179,10 +2263,12 @@
 
     "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
 
-    "undici": ["undici@8.10.1", "", {}, "sha512-YQ3WlbqjYMmNpdvDH64jAgLjxuAR9+649calDWhbshYaeQGO2bR4nI94ORJmwI3J9YhoKQnpyGOK+0zlWS5N5Q=="],
+    "undici": ["undici@8.10.2", "", {}, "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ=="],
 
     "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
 
+    "unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="],
+
     "unified": ["unified@11.0.5", "", { "dependencies": { "@types/unist": "^3.0.0", "bail": "^2.0.0", "devlop": "^1.0.0", "extend": "^3.0.0", "is-plain-obj": "^4.0.0", "trough": "^2.0.0", "vfile": "^6.0.0" } }, "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA=="],
 
     "unifont": ["unifont@0.7.5", "", { "dependencies": { "css-tree": "^3.1.0", "ohash": "^2.0.11", "undici": "^8.0.0" } }, "sha512-ULe/Cs+ZIsq+dcFofNkhqielCrUJnb5mr+Yc4EBM2VlL+6OZR6+cjtI2mT1bJvRBrVncqHAbLURxmPLcCXzWMg=="],
@@ -2295,9 +2381,11 @@
 
     "which-collection": ["which-collection@1.0.2", "", { "dependencies": { "is-map": "^2.0.3", "is-set": "^2.0.3", "is-weakmap": "^2.0.2", "is-weakset": "^2.0.3" } }, "sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw=="],
 
+    "which-command": ["which-command@0.1.0", "", { "bin": { "which-command": "cli.js" } }, "sha512-XZyoF5/5hZtXitIwzrU4NKK+Wtbb9aB9CezUEw2Q0wlYK8NUYQxC1rRXgNueYLtBAJwXIb+/tFVk4dozciNJMA=="],
+
     "which-typed-array": ["which-typed-array@1.1.22", "", { "dependencies": { "available-typed-arrays": "^1.0.7", "call-bind": "^1.0.9", "call-bound": "^1.0.4", "for-each": "^0.3.5", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-tostringtag": "^1.0.2" } }, "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw=="],
 
-    "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
+    "wrap-ansi": ["wrap-ansi@10.0.1", "", { "dependencies": { "ansi-styles": "^6.2.3", "string-width": "^8.2.0" } }, "sha512-M0N4xzyzosiIok3svYlEo1sdLZts/8FPgYH/GPC3wvlmPoRvnoManGMrE54waYj3tISA8w6lsdesfVv67qSr8Q=="],
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
@@ -2325,6 +2413,8 @@
 
     "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="],
 
+    "yoctocolors": ["yoctocolors@2.2.0", "", {}, "sha512-xYqdZFUK/VYazNl/oCDYN+3WloWQwMfZxBoiNt6qNyk+xfOdi598muWE42rNZFp1kNOiqW936q5RhUdnpqElSg=="],
+
     "yuku-ast": ["yuku-ast@0.8.7", "", { "dependencies": { "@yuku-toolchain/types": "^0.8.7" } }, "sha512-h6+4bDfyootiMB9vckk5uKo5r5j0GHrkr17FQTDNfEsFT3DWlN9uu1HJwQwc64pgmLCI945fWM3lbTIqxjT3GQ=="],
 
     "yuku-codegen": ["yuku-codegen@0.8.7", "", { "dependencies": { "@yuku-toolchain/types": "^0.8.7" }, "optionalDependencies": { "@yuku-codegen/binding-android-arm64": "0.8.7", "@yuku-codegen/binding-darwin-arm64": "0.8.7", "@yuku-codegen/binding-darwin-x64": "0.8.7", "@yuku-codegen/binding-freebsd-x64": "0.8.7", "@yuku-codegen/binding-linux-arm-gnu": "0.8.7", "@yuku-codegen/binding-linux-arm-musl": "0.8.7", "@yuku-codegen/binding-linux-arm64-gnu": "0.8.7", "@yuku-codegen/binding-linux-arm64-musl": "0.8.7", "@yuku-codegen/binding-linux-x64-gnu": "0.8.7", "@yuku-codegen/binding-linux-x64-musl": "0.8.7", "@yuku-codegen/binding-win32-arm64": "0.8.7", "@yuku-codegen/binding-win32-x64": "0.8.7" } }, "sha512-adwDZSh8oVDzhE6Du9PwVWxcOxeV0e2EVhUuMKWfhSY4wkrDq9eqixlxFF3l/XGUV1E7UFzhpz9393MUumkyNw=="],
@@ -2339,7 +2429,7 @@
 
     "@ai-sdk/gateway/@vercel/oidc": ["@vercel/oidc@3.2.0", "", {}, "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug=="],
 
-    "@ai-sdk/provider-utils/undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "@ai-sdk/provider-utils/undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "@astrojs/check/chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
 
@@ -2425,6 +2515,8 @@
 
     "@vercel/cli-config/zod": ["zod@4.1.11", "", {}, "sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg=="],
 
+    "@vercel/cli-exec/execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
+
     "@vercel/nft/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
     "@vercel/oidc/jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],
@@ -2451,6 +2543,8 @@
 
     "cliui/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
 
+    "cliui/wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
+
     "csso/css-tree": ["css-tree@2.2.1", "", { "dependencies": { "mdn-data": "2.0.28", "source-map-js": "^1.0.1" } }, "sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA=="],
 
     "cytoscape-fcose/cose-base": ["cose-base@2.2.0", "", { "dependencies": { "layout-base": "^2.0.0" } }, "sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g=="],
@@ -2481,8 +2575,6 @@
 
     "epub-gen-memory/htmlparser2": ["htmlparser2@7.2.0", "", { "dependencies": { "domelementtype": "^2.0.1", "domhandler": "^4.2.2", "domutils": "^2.8.0", "entities": "^3.0.1" } }, "sha512-H7MImA4MS6cw7nbyURtLPO1Tms7C5H602LRETv95z1MxO/7CP7rDVROehUYeYBUYEON94NXXDEPmZuq+hX4sog=="],
 
-    "execa/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
     "express/cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="],
 
     "filelist/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
@@ -2497,12 +2589,18 @@
 
     "mermaid/marked": ["marked@16.4.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA=="],
 
+    "micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
     "negotiator/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
 
     "node-html-parser/css-select": ["css-select@5.2.2", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^6.1.0", "domhandler": "^5.0.2", "domutils": "^3.0.1", "nth-check": "^2.0.1" } }, "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw=="],
 
     "node-html-parser/entities": ["entities@8.0.0", "", {}, "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA=="],
 
+    "npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
+
+    "nypm/citty": ["citty@0.2.2", "", {}, "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w=="],
+
     "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
 
     "parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
@@ -2531,8 +2629,6 @@
 
     "which-builtin-type/isarray": ["isarray@2.0.5", "", {}, "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw=="],
 
-    "wrap-ansi/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
-
     "yaml-language-server/request-light": ["request-light@0.5.8", "", {}, "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg=="],
 
     "yaml-language-server/yaml": ["yaml@2.8.3", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg=="],
@@ -2575,6 +2671,20 @@
 
     "@tailwindcss/node/lightningcss/lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
 
+    "@vercel/cli-exec/execa/get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
+
+    "@vercel/cli-exec/execa/human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
+
+    "@vercel/cli-exec/execa/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+
+    "@vercel/cli-exec/execa/npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
+
+    "@vercel/cli-exec/execa/onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
+
+    "@vercel/cli-exec/execa/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
+
+    "@vercel/cli-exec/execa/strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
+
     "@vercel/routing-utils/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
 
     "csso/css-tree/mdn-data": ["mdn-data@2.0.28", "", {}, "sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g=="],
diff --git a/oxfmt.config.ts b/oxfmt.config.ts
new file mode 100644
index 0000000..678c9b8
--- /dev/null
+++ b/oxfmt.config.ts
@@ -0,0 +1,14 @@
+import { defineConfig } from "oxfmt";
+import ultracite from "ultracite/oxfmt";
+
+export default defineConfig({
+  ...ultracite,
+  overrides: [
+    {
+      files: ["**/*.mdx"],
+      options: {
+        printWidth: 72,
+      },
+    },
+  ],
+});
diff --git a/oxlint.config.ts b/oxlint.config.ts
new file mode 100644
index 0000000..33e2946
--- /dev/null
+++ b/oxlint.config.ts
@@ -0,0 +1,8 @@
+import { defineConfig } from "oxlint";
+import antiSlop from "ultracite/oxlint/anti-slop";
+import core from "ultracite/oxlint/core";
+
+export default defineConfig({
+  extends: [core, antiSlop],
+  ignorePatterns: core.ignorePatterns,
+});
diff --git a/package.json b/package.json
index 713b357..d7f8e91 100644
--- a/package.json
+++ b/package.json
@@ -15,14 +15,19 @@
     "lint": "oxlint",
     "fmt": "oxfmt --write .",
     "docs:dev": "bun run --filter website dev",
-    "docs:build": "bun run --filter website build"
+    "docs:build": "bun run --filter website build",
+    "check": "ultracite check",
+    "fix": "ultracite fix",
+    "prepare": "husky"
   },
   "devDependencies": {
     "@tsconfig/strictest": "^2.0.8",
     "@types/bun": "latest",
-    "oxfmt": "^0.63.0",
-    "oxlint": "^1.78.0",
+    "husky": "^9.1.7",
+    "oxfmt": "^0.66.0",
+    "oxlint": "^1.81.0",
     "tsdown": "^0.22.14",
-    "typescript": "^6"
+    "typescript": "^6",
+    "ultracite": "7.10.8"
   }
 }
diff --git a/packages/oxidejs/README.md b/packages/oxidejs/README.md
index 68a8558..e94a0d2 100644
--- a/packages/oxidejs/README.md
+++ b/packages/oxidejs/README.md
@@ -71,23 +71,24 @@ import { ping } from "./test.server";
 console.log(await ping()); // "pong"
 
 // src/server.ts
-export default {
-  fetch(request: Request) {
-    if (new URL(request.url).pathname === "/api/ok") return new Response("ok");
-  },
-};
+import type { FetchHandler } from "oxidejs";
+
+export const fetch = ((request) => {
+  if (new URL(request.url).pathname === "/api/ok") return new Response("ok");
+  return;
+}) satisfies FetchHandler;
 ```
 
 ### Call shape
 
 Unary actions return a Promise and expose helpers for UI wiring:
 
-| Call                                        | What it does                                     |
-| ------------------------------------------- | ------------------------------------------------ |
-| `await ping()`                              | Run the action (always invokes RPC on client)    |
-| `ping.set(...args)`                         | Same as calling with args; also writes the atom  |
-| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action  |
-| `ping.result`                               | Read the last `AsyncResult` from the client atom |
+| Call | What it does |
+| --- | --- |
+| `await ping()` | Run the action (always invokes RPC on client) |
+| `ping.set(...args)` | Same as calling with args; also writes the atom |
+| `ping.bind(...args)` / `ping.with(...args)` | Return an event handler that invokes the action |
+| `ping.result` | Read the last `AsyncResult` from the client atom |
 
 `action()` marks the export and adds a typed transport-only `{ signal }` argument. Wrap `async function*` in it to stream over Effect RPC as newline-delimited JSON-RPC (not SSE). On the client the stub returns an async generator — iterate it directly. Inside server code, always read the non-optional signal from `useRequest().signal`:
 
@@ -130,27 +131,27 @@ Same factory as Vite: client stubs, `/__oxide/action`, and `dist/server.js`.
 
 ## Options
 
-| Option                         | Default                  | Notes                                                                                       |
-| ------------------------------ | ------------------------ | ------------------------------------------------------------------------------------------- |
-| `preset`                       | `"fetch"`                | `"fetch"` or `"celld"`                                                                      |
-| `workerEntry`                  | `src/server.ts`          | Relative to project root                                                                    |
-| `outDir`                       | `dist`                   | Output root                                                                                 |
-| `clientDir`                    | `client`                 | Must stay inside `outDir`                                                                   |
-| `wrangler.name`                | required if `emitConfig` |                                                                                             |
-| `wrangler.compatibility_date`  | required if `emitConfig` |                                                                                             |
-| `wrangler.compatibility_flags` | —                        | optional; `nodejs_compat` is merged in automatically on `celld`                             |
-| `wrangler.durable_objects`     | —                        | optional                                                                                    |
-| `wrangler.migrations`          | —                        | optional                                                                                    |
-| `wrangler.services`            | —                        | optional                                                                                    |
-| `wrangler.vars`                | —                        | optional                                                                                    |
-| `emitConfig`                   | `true` on `celld`        | Set `false` to skip `wrangler.jsonc`                                                        |
-| `actions`                      | `"http"`                 | `"ws"` needs `crossws`; object form: `{ transport, path, sameOrigin }` (`sameOrigin: true`) |
-| `actionHeaders`                | —                        | Static headers on the HTTP client                                                           |
-| `middleware`                   | `[]`                     | Fetch middleware, run in order before actions and the server entry                          |
-| `imports`                      | `[]`                     | Modules imported for side effects at server startup                                         |
-| `bodyLimit`                    | `1048576`                | Max Node request body size; larger requests get 413                                         |
-| `notFound`                     | —                        | Custom HTML 404 body when no route or asset matches                                         |
-| `env`                          | —                        | Node preset value passed to `fetch(request, env, ctx)`                                      |
+| Option | Default | Notes |
+| --- | --- | --- |
+| `preset` | `"fetch"` | `"fetch"` or `"celld"` |
+| `workerEntry` | `src/server.ts` | Relative to project root |
+| `outDir` | `dist` | Output root |
+| `clientDir` | `client` | Must stay inside `outDir` |
+| `wrangler.name` | required if `emitConfig` |  |
+| `wrangler.compatibility_date` | required if `emitConfig` |  |
+| `wrangler.compatibility_flags` | — | optional; `nodejs_compat` is merged in automatically on `celld` |
+| `wrangler.durable_objects` | — | optional |
+| `wrangler.migrations` | — | optional |
+| `wrangler.services` | — | optional |
+| `wrangler.vars` | — | optional |
+| `emitConfig` | `true` on `celld` | Set `false` to skip `wrangler.jsonc` |
+| `actions` | `"http"` | `"ws"` needs `crossws`; object form: `{ transport, path, sameOrigin }` (`sameOrigin: true`) |
+| `actionHeaders` | — | Static headers on the HTTP client |
+| `middleware` | `[]` | Fetch middleware, run in order before actions and the server entry |
+| `imports` | `[]` | Modules imported for side effects at server startup |
+| `bodyLimit` | `1048576` | Max Node request body size; larger requests get 413 |
+| `notFound` | — | Custom HTML 404 body when no route or asset matches |
+| `env` | — | Node preset value passed to `fetch(request, env, ctx)` |
 
 ### `middleware` and `imports`
 
@@ -177,15 +178,15 @@ Middleware modules receive `(request, { env, ctx })`. They run before actions, t
 
 The generated server serves static files from `dist/client/` (or the `public/` directory merged into it). These guards are active:
 
-| Attack vector                      | Guard                                                                                                                                  |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments.                                                                                      |
-| **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`.                                                                  |
-| **Null byte** (`%00`, `\0`)        | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`.                                                   |
-| **Absolute path** (`/etc/passwd`)  | `__rel()` returns `null` for paths not starting with `/`.                                                                              |
-| **SPA fallback**                   | Unknown paths → `index.html`, never a directory listing.                                                                               |
-| **`clientDir` escape**             | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`.                                                        |
-| **Hashed assets**                  | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
+| Attack vector | Guard |
+| --- | --- |
+| **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments. |
+| **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`. |
+| **Null byte** (`%00`, `\0`) | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`. |
+| **Absolute path** (`/etc/passwd`) | `__rel()` returns `null` for paths not starting with `/`. |
+| **SPA fallback** | Unknown paths → `index.html`, never a directory listing. |
+| **`clientDir` escape** | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`. |
+| **Hashed assets** | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
 
 The generated `__asset` function uses `path.join` — not `path.resolve` — so a leading `/` in the relative path stays inside the asset root.
 
diff --git a/packages/oxidejs/client.d.ts b/packages/oxidejs/client.d.ts
index b98cb39..51fbb95 100644
--- a/packages/oxidejs/client.d.ts
+++ b/packages/oxidejs/client.d.ts
@@ -1,10 +1,16 @@
-interface AsyncGenerator<T = unknown, TReturn = any, TNext = any> extends AsyncIteratorObject<
-  T,
-  TReturn,
-  TNext
-> {
-  then<TResult1 = AsyncIterable<T>, TResult2 = never>(
-    onfulfilled?: ((value: AsyncIterable<T>) => TResult1 | PromiseLike<TResult1>) | null,
-    onrejected?: ((reason: any) => TResult2 | PromiseLike<TResult2>) | null,
-  ): Promise<TResult1 | TResult2>;
+interface AsyncGenerator<
+  T = unknown,
+  TReturn = unknown,
+  TNext = unknown,
+> extends AsyncIteratorObject<T, TReturn, TNext> {
+  then: <TResult1 = AsyncIterable<T>, TResult2 = never>(
+    onfulfilled?:
+      | ((value: AsyncIterable<T>) => TResult1 | PromiseLike<TResult1>)
+      | null,
+    onrejected?:
+      | ((
+          reason: Error | string | number | boolean | null | undefined
+        ) => TResult2 | PromiseLike<TResult2>)
+      | null
+  ) => Promise<TResult1 | TResult2>;
 }
diff --git a/packages/oxidejs/package.json b/packages/oxidejs/package.json
index e1de5f1..38ef136 100644
--- a/packages/oxidejs/package.json
+++ b/packages/oxidejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "oxidejs",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Vite/Rsbuild plugin. One build → dist/server.js + optional client. Server actions via *.server.ts.",
   "keywords": [
     "cloudflare",
diff --git a/packages/oxidejs/src/action.test.ts b/packages/oxidejs/src/action.test.ts
index e6ca380..8381243 100644
--- a/packages/oxidejs/src/action.test.ts
+++ b/packages/oxidejs/src/action.test.ts
@@ -1,28 +1,47 @@
 import { expect, test } from "bun:test";
 
-import { action, ACTION_CALL, brandServerAction, wrapClientRpc } from "./action";
+import {
+  action,
+  ACTION_CALL,
+  brandServerAction,
+  wrapClientRpc,
+} from "./action";
+
+interface ActionCallPayload {
+  a: unknown[];
+  k: string;
+}
+
+interface ActionCallCarrier {
+  [ACTION_CALL]?: ActionCallPayload;
+}
+
+const actionCall = function actionCall(handler: ActionCallCarrier) {
+  return handler[ACTION_CALL];
+};
 
 test("action wraps Atom.fn with set, bind, and invoke", async () => {
-  const ping = action(async () => "pong");
+  const ping = action(() => "pong");
   expect(ping.$$atom).toBe(1);
   expect(await ping.set()).toBe("pong");
   expect(await ping()).toBe("pong");
 
   const branded = brandServerAction(
     "x:echo",
-    action(async (value: string) => value),
+    action((value: string) => value)
   ).bind("hi");
-  expect((branded as unknown as Record<symbol, { k: string; a: unknown[] }>)[ACTION_CALL]).toEqual({
-    k: "x:echo",
+  // SAFETY: bind attaches ACTION_CALL for ilha server-island capture.
+  expect(actionCall(branded as ActionCallCarrier)).toEqual({
     a: ["hi"],
+    k: "x:echo",
   });
 });
 
 test("wrapClientRpc zero-arg call invokes RPC (does not read the atom)", async () => {
   const calls: unknown[][] = [];
-  const ping = wrapClientRpc(async (...args: []) => {
+  const ping = wrapClientRpc((...args: []) => {
     calls.push(args);
-    return "pong";
+    return Promise.resolve("pong");
   });
   expect(await ping()).toBe("pong");
   expect(calls).toEqual([[]]);
@@ -31,9 +50,9 @@ test("wrapClientRpc zero-arg call invokes RPC (does not read the atom)", async (
 
 test("wrapClientRpc rest stubs preserve argument lists on call and set", async () => {
   const calls: unknown[][] = [];
-  const echo = wrapClientRpc(async (...args: unknown[]) => {
+  const echo = wrapClientRpc((...args: unknown[]) => {
     calls.push(args);
-    return args;
+    return Promise.resolve(args);
   });
   expect(await echo("a")).toEqual(["a"]);
   expect(await echo("a", "b")).toEqual(["a", "b"]);
@@ -42,20 +61,23 @@ test("wrapClientRpc rest stubs preserve argument lists on call and set", async (
 });
 
 test("with is an alias for bind", () => {
-  const echo = action(async (value: string) => value);
-  const BRAND = ACTION_CALL;
-  const viaWith = echo.with("hi") as unknown as Record<symbol, { k: string; a: unknown[] }>;
-  const viaBind = echo.bind("hi") as unknown as Record<symbol, { k: string; a: unknown[] }>;
-  expect(viaWith[BRAND]?.a).toEqual(viaBind[BRAND]?.a);
+  const echo = action((value: string) => value);
+  // SAFETY: with attaches ACTION_CALL payload for ilha capture.
+  const viaWith = actionCall(echo.with("hi") as ActionCallCarrier);
+  // SAFETY: bind attaches ACTION_CALL payload for ilha capture.
+  const viaBind = actionCall(echo.bind("hi") as ActionCallCarrier);
+  expect(viaWith?.a).toEqual(viaBind?.a);
 });
 
 test("stream actions return async generators", async () => {
-  const ticks = action(async function* () {
+  const ticks = action(async function* ticks() {
     yield 0;
     yield 1;
   });
   const gen = ticks();
-  expect((await gen.next()).value).toBe(0);
-  expect((await gen.next()).value).toBe(1);
+  const first = await gen.next();
+  expect(first.value).toBe(0);
+  const second = await gen.next();
+  expect(second.value).toBe(1);
   expect(() => ticks.bind()).toThrow("stream actions cannot be bound");
 });
diff --git a/packages/oxidejs/src/action.ts b/packages/oxidejs/src/action.ts
index f0da336..59a34b6 100644
--- a/packages/oxidejs/src/action.ts
+++ b/packages/oxidejs/src/action.ts
@@ -6,178 +6,299 @@ import * as Registry from "effect/unstable/reactivity/AtomRegistry";
 export const ACTION_CALL = Symbol.for("ilha.actionCall");
 const ACTION_KEY = Symbol.for("oxidejs.actionKey");
 
-const AsyncGeneratorFunction = Object.getPrototypeOf(async function* () {}).constructor as new (
+const asyncGeneratorProbe = async function* asyncGeneratorProbe() {
+  yield;
+};
+// SAFETY: getPrototypeOf(async generator).constructor is the AsyncGeneratorFunction constructor.
+const AsyncGeneratorFunction = Object.getPrototypeOf(asyncGeneratorProbe)
+  .constructor as new (
   ...args: string[]
-) => (...args: unknown[]) => AsyncGenerator;
+) => (...args: never[]) => AsyncGenerator;
 
-type CallOptions = { signal?: AbortSignal };
+interface CallOptions {
+  signal?: AbortSignal;
+}
+
+interface SplitCallResult<Args extends unknown[]> {
+  args: Args;
+  options?: CallOptions;
+}
+
+interface ActionKeyCarrier {
+  [ACTION_KEY]?: string;
+}
+
+interface ActionCallPayload {
+  a: unknown[];
+  k: string;
+}
+
+interface ActionCallHandler {
+  (...ev: unknown[]): void;
+  [ACTION_CALL]?: ActionCallPayload;
+}
+
+interface DefineServerActionOpts {
+  captureKey?: string;
+  stripCallOptions?: boolean;
+}
 
 /** Atom write payload is always the argument list (never collapsed), so rest stubs / single-array args stay intact. */
 type PackArgs<Args extends unknown[]> = Args;
 
+type ActionExport = (
+  ...args: never[]
+) =>
+  | AsyncGenerator
+  | PromiseLike<object | string | number | boolean | null | undefined>
+  | object
+  | string
+  | number
+  | boolean
+  | null
+  | undefined;
+
 let defaultRegistry: Registry.AtomRegistry | undefined;
 
-function registry(): Registry.AtomRegistry {
+const registry = function registry(): Registry.AtomRegistry {
   return (defaultRegistry ??= Registry.make());
-}
+};
 
-function isAsyncGeneratorFunction(fn: unknown): fn is (...args: unknown[]) => AsyncGenerator {
-  return typeof fn === "function" && fn instanceof AsyncGeneratorFunction;
-}
+const isAsyncGeneratorFunction = function isAsyncGeneratorFunction<
+  T extends ActionExport,
+>(fn: T): fn is T & ((...args: never[]) => AsyncGenerator) {
+  return fn instanceof AsyncGeneratorFunction;
+};
 
-function splitCallOptions<Args extends unknown[]>(
-  args: Args | [...Args, CallOptions],
-): { args: Args; options?: CallOptions } {
-  if (args.length === 0) return { args: [] as unknown as Args };
-  const last = args[args.length - 1];
+const emptyArgs = function emptyArgs<Args extends unknown[]>(): Args {
+  // SAFETY: an empty argument list is valid for any Args extends unknown[].
+  return [] as never;
+};
+
+const asArgs = function asArgs<Args extends unknown[]>(
+  value: readonly unknown[]
+): Args {
+  // SAFETY: caller peeled CallOptions; remaining tuple matches Args.
+  return value as Args;
+};
+
+const readActionKey = function readActionKey(
+  target: ActionKeyCarrier
+): string | undefined {
+  return target[ACTION_KEY];
+};
+
+const writeActionKey = function writeActionKey(
+  target: ActionKeyCarrier,
+  key: string
+) {
+  target[ACTION_KEY] = key;
+};
+
+const denyStreamBind = function denyStreamBind(): never {
+  throw new Error("oxidejs: stream actions cannot be bound to DOM events");
+};
+
+const splitCallOptions = function splitCallOptions<Args extends unknown[]>(
+  args: Args | [...Args, CallOptions]
+): SplitCallResult<Args> {
+  if (args.length === 0) {
+    return { args: emptyArgs<Args>() };
+  }
+  const last = args.at(-1);
   if (
-    last &&
-    typeof last === "object" &&
+    last instanceof Object &&
+    !Array.isArray(last) &&
     "signal" in last &&
-    (last as CallOptions).signal instanceof AbortSignal &&
+    last.signal instanceof AbortSignal &&
     Object.keys(last).length === 1
   ) {
-    return { args: args.slice(0, -1) as Args, options: last as CallOptions };
+    return {
+      args: asArgs<Args>(args.slice(0, -1)),
+      options: { signal: last.signal },
+    };
   }
+  // SAFETY: no trailing CallOptions; the full list is Args.
   return { args: args as Args };
-}
+};
 
-export type ServerActionHandle<Args extends unknown[], A> = {
+export interface ServerActionHandle<Args extends unknown[], A> {
   (...args: Args | [...Args, CallOptions]): Promise<A>;
-  set(...args: Args): Promise<A>;
-  bind(...args: Args): (...ev: unknown[]) => void;
-  with(...args: Args): (...ev: unknown[]) => void;
+  set: (...args: Args) => Promise<A>;
+  bind: (...args: Args) => (...ev: unknown[]) => void;
+  with: (...args: Args) => (...ev: unknown[]) => void;
   /** Last `AsyncResult` for this action's client atom (does not invoke RPC). */
   readonly result: AsyncResult.AsyncResult<A, unknown>;
   readonly atom: Atom.Atom<unknown>;
   readonly $$atom: 1;
-};
+}
 
-export type StreamActionHandle<Args extends unknown[], Y, R = void> = {
+export interface StreamActionHandle<Args extends unknown[], Y, R = void> {
   (...args: Args | [...Args, CallOptions]): AsyncGenerator<Y, R, undefined>;
-  set(...args: Args): AsyncGenerator<Y, R, undefined>;
-  bind(...args: Args): (...ev: unknown[]) => void;
-  with(...args: Args): (...ev: unknown[]) => void;
+  set: (...args: Args) => AsyncGenerator<Y, R, undefined>;
+  bind: (...args: Args) => (...ev: unknown[]) => void;
+  with: (...args: Args) => (...ev: unknown[]) => void;
   readonly atom: undefined;
   readonly $$atom: 1;
-};
+}
 
-function bindHandler<Args extends unknown[]>(
+const bindHandler = function bindHandler<Args extends unknown[]>(
   key: string | undefined,
   invoke: (...args: Args) => void,
-  args: Args,
+  args: Args
 ): (...ev: unknown[]) => void {
-  const handler = ((..._ev: unknown[]) => invoke(...args)) as ((...ev: unknown[]) => void) &
-    Record<typeof ACTION_CALL, { k: string; a: unknown[] }>;
-  if (key) handler[ACTION_CALL] = { k: key, a: args };
+  // SAFETY: ACTION_CALL is attached below when a capture key is present.
+  const handler = ((..._ev: unknown[]) => {
+    invoke(...args);
+  }) as ActionCallHandler;
+  if (key) {
+    handler[ACTION_CALL] = { a: args, k: key };
+  }
   return handler;
-}
+};
 
-function defineServerAction<Args extends unknown[], A>(
+const defineServerAction = function defineServerAction<
+  Args extends unknown[],
+  A,
+>(
   atom: Atom.Atom<unknown>,
   invoke: (...args: Args | [...Args, CallOptions]) => A | Promise<A>,
-  opts?: { captureKey?: string; stripCallOptions?: boolean },
+  opts?: DefineServerActionOpts
 ): ServerActionHandle<Args, A> {
   const captureKey = opts?.captureKey;
   const stripCallOptions = opts?.stripCallOptions ?? true;
 
+  // SAFETY: Object.assign below installs set/bind/with/atom/$$atom on this callable.
   const run = ((...allArgs: Args | [...Args, CallOptions]) => {
     if (!stripCallOptions) {
-      return Promise.resolve(invoke(...(allArgs as Args | [...Args, CallOptions])));
+      return Promise.resolve(invoke(...allArgs));
     }
-    const { args } = splitCallOptions(allArgs as Args | [...Args, CallOptions]);
-    return Promise.resolve(invoke(...(args as Args)));
+    const { args } = splitCallOptions<Args>(allArgs);
+    return Promise.resolve(invoke(...args));
   }) as ServerActionHandle<Args, A>;
 
   const set = (...args: Args) => {
-    registry().set(atom as Atom.Writable<unknown, PackArgs<Args>>, args as PackArgs<Args>);
+    // SAFETY: Atom.fn write side accepts the packed Args tuple for this action.
+    registry().set(
+      atom as Atom.Writable<unknown, PackArgs<Args>>,
+      args as PackArgs<Args>
+    );
     return Promise.resolve(invoke(...args));
   };
 
   const bind = (...args: Args) => {
-    const key = captureKey ?? (run as { [ACTION_KEY]?: string })[ACTION_KEY];
-    return bindHandler(key, (...a) => void set(...a), args);
+    // SAFETY: run may carry ACTION_KEY from brandServerAction / captureKey.
+    const key = captureKey ?? readActionKey(run as ActionKeyCarrier);
+    return bindHandler(
+      key,
+      (...a) => {
+        set(...a);
+      },
+      args
+    );
   };
 
   Object.assign(run, {
-    set,
+    $$atom: 1 as const,
+    atom,
     bind,
+    set,
     with: bind,
-    atom,
-    $$atom: 1 as const,
   });
   Object.defineProperty(run, "result", {
     enumerable: true,
+    // SAFETY: registry stores AsyncResult for this action atom.
     get: () => registry().get(atom) as AsyncResult.AsyncResult<A, unknown>,
   });
 
-  if (captureKey) (run as { [ACTION_KEY]?: string })[ACTION_KEY] = captureKey;
+  if (captureKey) {
+    // SAFETY: run is the callable handle we brand with ACTION_KEY.
+    writeActionKey(run as ActionKeyCarrier, captureKey);
+  }
 
   return run;
-}
+};
 
-function defineStreamAction<Args extends unknown[], Y, R>(
-  fn: (...args: Args) => AsyncGenerator<Y, R, unknown>,
+const defineStreamAction = function defineStreamAction<
+  Args extends unknown[],
+  Y,
+  R,
+>(
+  fn: (...args: Args) => AsyncGenerator<Y, R, unknown>
 ): StreamActionHandle<Args, Y, R> {
+  // SAFETY: Object.assign below installs set/bind/with/atom/$$atom on this callable.
   const call = ((...allArgs: Args | [...Args, CallOptions]) => {
-    const { args } = splitCallOptions(allArgs as Args | [...Args, CallOptions]);
-    return fn(...(args as Args));
+    const { args } = splitCallOptions<Args>(allArgs);
+    return fn(...args);
   }) as StreamActionHandle<Args, Y, R>;
 
-  const deny = () => {
-    throw new Error("oxidejs: stream actions cannot be bound to DOM events");
-  };
-
   Object.assign(call, {
-    set: call,
-    bind: deny,
-    with: deny,
-    atom: undefined,
     $$atom: 1 as const,
+    atom: undefined,
+    bind: denyStreamBind,
+    set: call,
+    with: denyStreamBind,
   });
 
   return call;
-}
+};
 
 /** Attach an ilha server-island capture key to an action handle. */
-export function brandServerAction<Args extends unknown[], A>(
+export const brandServerAction = function brandServerAction<
+  Args extends unknown[],
+  A,
+>(
   key: string,
-  handle: ServerActionHandle<Args, A>,
+  handle: ServerActionHandle<Args, A>
 ): ServerActionHandle<Args, A> {
-  (handle as { [ACTION_KEY]?: string })[ACTION_KEY] = key;
+  // SAFETY: handle is the callable we brand with ACTION_KEY for ilha capture.
+  writeActionKey(handle as ActionKeyCarrier, key);
   return handle;
-}
+};
 
 /** Wrap an RPC caller as an `Atom.fn`-shaped client action handle. */
-export function wrapClientRpc<Args extends unknown[], A>(
-  rpc: (...args: Args | [...Args, CallOptions]) => Promise<A>,
+export const wrapClientRpc = function wrapClientRpc<Args extends unknown[], A>(
+  rpc: (...args: Args | [...Args, CallOptions]) => Promise<A>
 ): ServerActionHandle<Args, A> {
-  const invoke = (...args: Args | [...Args, CallOptions]) => Promise.resolve(rpc(...args));
+  const invoke = (...args: Args | [...Args, CallOptions]) =>
+    Promise.resolve(rpc(...args));
 
   const atom = Atom.make(
     Atom.fn((packed: PackArgs<Args>) =>
       Effect.tryPromise({
+        catch: (error) =>
+          error instanceof Error ? error : new Error(String(error)),
+        // SAFETY: Atom.fn packs the full Args tuple as the write payload.
         try: () => invoke(...(packed as Args)),
-        catch: (error) => (error instanceof Error ? error : new Error(String(error))),
-      }),
-    ),
+      })
+    )
   );
 
-  return defineServerAction(atom, (...args: Args | [...Args, CallOptions]) => invoke(...args), {
-    // Client stubs forward optional `{ signal }` into Effect RPC — do not peel it here.
-    stripCallOptions: false,
-  });
-}
+  return defineServerAction(
+    atom,
+    (...args: Args | [...Args, CallOptions]) => invoke(...args),
+    {
+      // Client stubs forward optional `{ signal }` into Effect RPC — do not peel it here.
+      stripCallOptions: false,
+    }
+  );
+};
 
 /**
  * Wrap a streaming RPC caller so the client handle returns an async generator
  * (awaiting the underlying client lazily), not `Promise<AsyncGenerator>`.
  */
-export function wrapClientStreamRpc<Args extends unknown[], Y, R = void>(
-  rpc: (...args: Args | [...Args, CallOptions]) => AsyncGenerator<Y, R, undefined>,
+export const wrapClientStreamRpc = function wrapClientStreamRpc<
+  Args extends unknown[],
+  Y,
+  R = void,
+>(
+  rpc: (
+    ...args: Args | [...Args, CallOptions]
+  ) => AsyncGenerator<Y, R, undefined>
 ): StreamActionHandle<Args, Y, R> {
   return defineStreamAction((...args: Args) => rpc(...args));
-}
+};
 
 /**
  * Marks a `*.server.ts` export as a remote RPC action. On the server the
@@ -185,34 +306,44 @@ export function wrapClientStreamRpc<Args extends unknown[], Y, R = void>(
  * with an `Atom.fn`-shaped RPC handle (`set`, `bind`, `result`).
  */
 export function action<Args extends unknown[], Y, R = void>(
-  fn: (...args: Args) => AsyncGenerator<Y, R, unknown>,
+  fn: (...args: Args) => AsyncGenerator<Y, R, unknown>
 ): StreamActionHandle<Args, Y, R>;
 export function action<Args extends unknown[], Result>(
-  fn: (...args: Args) => Result,
+  fn: (...args: Args) => Result
 ): ServerActionHandle<Args, Awaited<Result>>;
 export function action<Args extends unknown[], Result>(
-  fn: (...args: Args) => Result,
-): ServerActionHandle<Args, Awaited<Result>> | StreamActionHandle<Args, unknown> {
-  if (isAsyncGeneratorFunction(fn)) {
-    return defineStreamAction(fn as (...args: Args) => AsyncGenerator<unknown, void, unknown>);
+  fn: (...args: Args) => Result
+):
+  | ServerActionHandle<Args, Awaited<Result>>
+  | StreamActionHandle<Args, unknown> {
+  // SAFETY: ActionExport uses never[] params; Args is the real call signature.
+  if (isAsyncGeneratorFunction(fn as never)) {
+    // SAFETY: instanceof AsyncGeneratorFunction narrows to an async generator export.
+    return defineStreamAction(
+      fn as (...args: Args) => AsyncGenerator<unknown, void, unknown>
+    );
   }
 
+  // SAFETY: non-generator branch; fn returns Result / Promise<Result>.
   const invoke = (...args: Args) =>
-    Promise.resolve((fn as (...args: Args) => Result)(...args)) as Promise<Awaited<Result>>;
+    Promise.resolve(fn(...args)) as Promise<Awaited<Result>>;
 
   const atom = Atom.make(
     Atom.fn((packed: PackArgs<Args>) =>
       Effect.tryPromise({
+        catch: (error) =>
+          error instanceof Error ? error : new Error(String(error)),
+        // SAFETY: Atom.fn packs the full Args tuple as the write payload.
         try: () => invoke(...(packed as Args)),
-        catch: (error) => (error instanceof Error ? error : new Error(String(error))),
-      }),
-    ),
+      })
+    )
   );
 
   return defineServerAction(
     atom,
+    // SAFETY: invoke already awaits Result; CallOptions are peeled inside defineServerAction.
     invoke as (
       ...args: Args | [...Args, CallOptions]
-    ) => Awaited<Result> | Promise<Awaited<Result>>,
+    ) => Awaited<Result> | Promise<Awaited<Result>>
   );
 }
diff --git a/packages/oxidejs/src/actions.test.ts b/packages/oxidejs/src/actions.test.ts
index 6757ac5..cdfedd0 100644
--- a/packages/oxidejs/src/actions.test.ts
+++ b/packages/oxidejs/src/actions.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+
 import {
   assetRelPath,
   generateActionsClientModule,
@@ -34,71 +35,147 @@ import { createActionHandler } from "./rpc/server";
 const RPC_MODULE = path.join(import.meta.dir, "rpc/index.ts");
 const OXIDE_RUNTIME = path.join(import.meta.dir, "context.ts");
 
-function writeActionsModule(root: string, code: string) {
+type JsonPrimitive = string | number | boolean | null;
+type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };
+
+interface RpcRequestBody {
+  id: number;
+  jsonrpc: "2.0";
+  method: string;
+  params: { args: JsonValue[] };
+}
+
+interface RpcCallInit {
+  headers?: HeadersInit;
+  signal?: AbortSignal;
+}
+
+interface ClientStubOpts {
+  extra?: boolean;
+  signal?: AbortSignal;
+}
+
+interface ClientStubCall {
+  opts?: ClientStubOpts;
+  params?: JsonValue | ClientStubOpts;
+}
+
+const expectDefined = function expectDefined<T>(
+  value: T | null | undefined
+): T {
+  if (value === null || value === undefined) {
+    throw new Error("expected value to be defined");
+  }
+  return value;
+};
+
+const writeActionsModule = function writeActionsModule(
+  root: string,
+  code: string
+) {
   const out = path.join(root, "actions.mjs");
   fs.writeFileSync(
     out,
     code
       .replaceAll("oxidejs/rpc", RPC_MODULE)
-      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`),
+      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`)
   );
   return out;
-}
+};
 
-async function loadGeneratedRouter(root: string) {
-  const out = writeActionsModule(root, generateActionsModule(scanServerFiles(root)));
+const loadGeneratedRouter = async function loadGeneratedRouter(root: string) {
+  const out = writeActionsModule(
+    root,
+    generateActionsModule(scanServerFiles(root))
+  );
   const mod = await import(out);
   return createActionHandler(mod.default, mod.actionsHandlers, {
     path: "/__oxide/action",
     sameOrigin: false,
   });
-}
+};
+
+const parseRpcLine = function parseRpcLine(line: string): JsonValue {
+  // SAFETY: each NDJSON line is a JSON-RPC frame from the action handler.
+  return JSON.parse(line) as JsonValue;
+};
 
 /** Parse NDJSON (`application/json-rpc`) or a legacy JSON array/object body. */
-async function readRpcFrames(res: Response): Promise<unknown[]> {
+const readRpcFrames = async function readRpcFrames(
+  res: Response
+): Promise<JsonValue[]> {
   const text = await res.text();
   const trimmed = text.trim();
-  if (!trimmed) return [];
+  if (!trimmed) {
+    return [];
+  }
   if (trimmed.startsWith("[")) {
-    const parsed: unknown = JSON.parse(trimmed);
+    // SAFETY: RPC test response body is JSON from the action handler.
+    const parsed = JSON.parse(trimmed) as JsonValue;
     return Array.isArray(parsed) ? parsed : [parsed];
   }
   if (!trimmed.includes("\n") && trimmed.startsWith("{")) {
-    return [JSON.parse(trimmed)];
+    // SAFETY: single JSON-RPC object body from the action handler.
+    return [JSON.parse(trimmed) as JsonValue];
   }
   return trimmed
     .split("\n")
     .filter((line) => line.length > 0)
-    .map((line) => JSON.parse(line));
-}
+    .map(parseRpcLine);
+};
 
-async function readRpcFrame(res: Response): Promise<unknown> {
+const readRpcFrame = async function readRpcFrame(
+  res: Response
+): Promise<JsonValue> {
   const frames = await readRpcFrames(res);
   expect(frames.length).toBeGreaterThan(0);
-  return frames[0];
-}
+  return expectDefined(frames[0]);
+};
 
-async function rpcCall(
+const rpcCall = async function rpcCall(
   fetch: (request: Request) => Promise<Response>,
   method: string,
-  args?: unknown[],
-  init: { headers?: HeadersInit; signal?: AbortSignal } = {},
+  args?: JsonValue[],
+  init: RpcCallInit = {}
 ) {
-  const body: Record<string, unknown> = {
-    jsonrpc: "2.0",
+  const body = {
     id: 1,
+    jsonrpc: "2.0" as const,
     method,
     params: { args: args ?? [] },
-  };
+  } satisfies RpcRequestBody;
   const requestInit: RequestInit = {
-    method: "POST",
-    headers: { "content-type": "application/json", ...init.headers },
     body: JSON.stringify(body),
+    headers: { "content-type": "application/json", ...init.headers },
+    method: "POST",
   };
-  if (init.signal) requestInit.signal = init.signal;
-  const res = await fetch(new Request("http://localhost/__oxide/action", requestInit));
+  if (init.signal) {
+    requestInit.signal = init.signal;
+  }
+  const res = await fetch(
+    new Request("http://localhost/__oxide/action", requestInit)
+  );
   return res;
-}
+};
+
+const readStreamUntilNewline = async function readStreamUntilNewline(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  decoder: TextDecoder,
+  buf = ""
+): Promise<{ buf: string; done: boolean }> {
+  if (buf.includes("\n")) {
+    return { buf, done: false };
+  }
+  const { done, value } = await reader.read();
+  if (done) {
+    return { buf, done: true };
+  }
+  return readStreamUntilNewline(
+    reader,
+    decoder,
+    buf + decoder.decode(value, { stream: true })
+  );
+};
 
 describe("parseExportedNames", () => {
   test("finds only action-marked exports (functions, generators, consts)", () => {
@@ -110,7 +187,7 @@ describe("parseExportedNames", () => {
         export const add = action(async (a: number, b: number) => a + b)
         export async function hidden() { return "server-only" }
         export const helper = async () => "server-only"
-      `),
+      `)
     ).toEqual(["ping", "echo", "ticks", "add"]);
   });
 
@@ -125,7 +202,7 @@ describe("parseExportedNames", () => {
         export * from "./all"
         const hidden = 1
         export { hidden }
-      `),
+      `)
     ).toEqual([]);
   });
 });
@@ -136,13 +213,18 @@ describe("scanServerFiles", () => {
     for (const ext of ["ts", "tsx", "js", "jsx"]) {
       fs.writeFileSync(
         path.join(root, `${ext}.server.${ext}`),
-        "export async function ping() {}\n",
+        "export async function ping() {}\n"
       );
     }
     try {
-      expect(scanServerFiles(root).map((mod) => mod.key)).toEqual(["js", "jsx", "ts", "tsx"]);
+      expect(scanServerFiles(root).map((mod) => mod.key)).toEqual([
+        "js",
+        "jsx",
+        "ts",
+        "tsx",
+      ]);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -151,7 +233,7 @@ describe("scanServerFiles", () => {
     fs.mkdirSync(path.join(root, "src"), { recursive: true });
     fs.writeFileSync(
       path.join(root, "src", "test.server.ts"),
-      "export const ping = action(async () => {})\n",
+      "export const ping = action(async () => {})\n"
     );
     const mods = scanServerFiles(root);
     expect(mods).toHaveLength(1);
@@ -161,10 +243,12 @@ describe("scanServerFiles", () => {
     fs.mkdirSync(path.join(root, "lib"), { recursive: true });
     fs.writeFileSync(
       path.join(root, "lib", "test.server.ts"),
-      "export const ping = action(async () => {})\n",
+      "export const ping = action(async () => {})\n"
+    );
+    expect(() => scanServerFiles(root)).toThrow(
+      'duplicate server module key "test"'
     );
-    expect(() => scanServerFiles(root)).toThrow('duplicate server module key "test"');
-    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(root, { force: true, recursive: true });
   });
 
   test("skips ignored dirs and hidden files", () => {
@@ -173,19 +257,25 @@ describe("scanServerFiles", () => {
     fs.mkdirSync(path.join(root, "dist"), { recursive: true });
     fs.writeFileSync(
       path.join(root, "node_modules", "dep.server.ts"),
-      "export async function leak() {}\n",
+      "export async function leak() {}\n"
     );
     fs.writeFileSync(
       path.join(root, "dist", "built.server.ts"),
-      "export async function leak() {}\n",
+      "export async function leak() {}\n"
+    );
+    fs.writeFileSync(
+      path.join(root, ".secret.server.ts"),
+      "export async function leak() {}\n"
+    );
+    fs.writeFileSync(
+      path.join(root, "ok.server.ts"),
+      "export async function ping() {}\n"
     );
-    fs.writeFileSync(path.join(root, ".secret.server.ts"), "export async function leak() {}\n");
-    fs.writeFileSync(path.join(root, "ok.server.ts"), "export async function ping() {}\n");
     try {
       const mods = scanServerFiles(root);
       expect(mods.map((m) => m.key)).toEqual(["ok"]);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 });
@@ -193,9 +283,11 @@ describe("scanServerFiles", () => {
 describe("codegen", () => {
   test("custom action path threads into client and server codegen", () => {
     expect(generateClientModule("http", undefined, "/custom/action")).toContain(
-      '"url":"/custom/action"',
+      '"url":"/custom/action"'
+    );
+    expect(generateClientModule("ws", undefined, "/custom/action")).toContain(
+      "/custom/action"
     );
-    expect(generateClientModule("ws", undefined, "/custom/action")).toContain("/custom/action");
     const code = generateWorkerWrapper("/app/src/server.ts", {
       actionPath: "/custom/action",
       actionSameOrigin: true,
@@ -205,60 +297,115 @@ describe("codegen", () => {
   });
 
   test("client stub posts through the shared RPC client", () => {
-    const stub = generateClientStub({ key: "test", exports: ["ping"], streams: [] });
+    const stub = generateClientStub({
+      exports: ["ping"],
+      key: "test",
+      streams: [],
+    });
     expect(stub).toContain('from "virtual:oxide/client"');
-    expect(stub).toContain('import { wrapClientRpc, wrapClientStreamRpc } from "oxidejs"');
-    expect(stub).toContain('client["test"]["ping"](...args.slice(0, -1), opts)');
+    expect(stub).toContain(
+      'import { wrapClientRpc, wrapClientStreamRpc } from "oxidejs"'
+    );
+    expect(stub).toContain(
+      'client["test"]["ping"](...args.slice(0, -1), opts)'
+    );
     expect(stub).toContain('client["test"]["ping"](...args)');
     expect(stub).toContain("opts.signal instanceof AbortSignal");
     expect(generateClientModule()).toContain(
-      'createClient(actionsGroup, {"url":"/__oxide/action"})',
-    );
-    expect(generateClientModule("http", { authorization: "Bearer x" })).toContain(
-      '"authorization":"Bearer x"',
+      'createClient(actionsGroup, {"url":"/__oxide/action"})'
     );
+    expect(
+      generateClientModule("http", { authorization: "Bearer x" })
+    ).toContain('"authorization":"Bearer x"');
     expect(generateClientModule("ws")).toContain('"transport":"ws"');
   });
 
   test("client stub peels { signal } and keeps other last args", async () => {
-    const seen: { params?: unknown; opts?: unknown }[] = [];
+    const seen: ClientStubCall[] = [];
     const client = {
       test: {
-        ticks: (params: unknown, opts?: unknown) => {
-          seen.push({ params, opts });
+        ticks: (params: JsonValue | ClientStubOpts, opts?: ClientStubOpts) => {
+          if (opts === undefined) {
+            seen.push({ params });
+          } else {
+            seen.push({ opts, params });
+          }
           return params;
         },
       },
     };
     const { wrapClientRpc, wrapClientStreamRpc } = await import("./action");
-    const fn = new Function(
-      "client",
-      "wrapClientRpc",
-      "wrapClientStreamRpc",
-      `${generateClientStub({ key: "test", exports: ["ticks"], streams: [] })
-        .replace('import { wrapClientRpc, wrapClientStreamRpc } from "oxidejs";\n', "")
-        .replace('import { client } from "virtual:oxide/client";\n', "")
-        .replace("export const ticks", "const ticks")}\nreturn ticks;`,
-    )(client, wrapClientRpc, wrapClientStreamRpc) as (...args: unknown[]) => unknown;
-    const ac = new AbortController();
-    expect(await fn(10, { signal: ac.signal })).toBe(10);
-    expect(await fn({ signal: ac.signal })).toEqual({ signal: ac.signal });
-    expect(await fn({ n: 1 })).toEqual({ n: 1 });
-    expect(await fn({ signal: "nope" })).toEqual({ signal: "nope" });
-    expect(await fn(10, { signal: ac.signal, extra: true })).toBe(10);
-    expect(seen).toEqual([
-      { params: 10, opts: { signal: ac.signal } },
-      { params: { signal: ac.signal } },
-      { params: { n: 1 } },
-      { params: { signal: "nope" } },
-      { params: 10, opts: { signal: ac.signal, extra: true } },
-    ]);
+    const stubSource = `${generateClientStub({
+      exports: ["ticks"],
+      key: "test",
+      streams: [],
+    })
+      .replace(
+        'import { wrapClientRpc, wrapClientStreamRpc } from "oxidejs";\n',
+        ""
+      )
+      .replace('import { client } from "virtual:oxide/client";\n', "")
+      .replace("export const ticks", "const ticks")}\nexport default ticks;\n`;
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "oxide-stub-"));
+    const stubFile = path.join(dir, "stub.mjs");
+    // Inject client/wrappers as globals the stub closes over via import rewrite.
+    fs.writeFileSync(
+      stubFile,
+      `const client = globalThis.__oxideStubClient;
+const wrapClientRpc = globalThis.__oxideWrapClientRpc;
+const wrapClientStreamRpc = globalThis.__oxideWrapClientStreamRpc;
+${stubSource}`
+    );
+    // SAFETY: test harness globals for the generated stub module.
+    const g = globalThis as typeof globalThis & {
+      __oxideStubClient?: typeof client;
+      __oxideWrapClientRpc?: typeof wrapClientRpc;
+      __oxideWrapClientStreamRpc?: typeof wrapClientStreamRpc;
+    };
+    g.__oxideStubClient = client;
+    g.__oxideWrapClientRpc = wrapClientRpc;
+    g.__oxideWrapClientStreamRpc = wrapClientStreamRpc;
+    try {
+      const mod = await import(stubFile);
+      // SAFETY: generated stub default export is the ticks client handle.
+      const fn = mod.default as (
+        ...args: (JsonValue | ClientStubOpts)[]
+      ) => Promise<JsonValue | ClientStubOpts>;
+      const ac = new AbortController();
+      expect(await fn(10, { signal: ac.signal })).toBe(10);
+      expect(await fn({ signal: ac.signal })).toEqual({ signal: ac.signal });
+      expect(await fn({ n: 1 })).toEqual({ n: 1 });
+      expect(await fn({ signal: "nope" })).toEqual({ signal: "nope" });
+      expect(await fn(10, { extra: true, signal: ac.signal })).toBe(10);
+      expect(seen).toEqual([
+        { opts: { signal: ac.signal }, params: 10 },
+        { params: { signal: ac.signal } },
+        { params: { n: 1 } },
+        { params: { signal: "nope" } },
+        { opts: { extra: true, signal: ac.signal }, params: 10 },
+      ]);
+    } finally {
+      delete g.__oxideStubClient;
+      delete g.__oxideWrapClientRpc;
+      delete g.__oxideWrapClientStreamRpc;
+      fs.rmSync(dir, { force: true, recursive: true });
+    }
   });
 
   test("client actions module exposes RpcGroup only", () => {
     const code = generateActionsClientModule([
-      { abs: "/app/src/test.server.ts", key: "test", exports: ["ping"], streams: [] },
-      { abs: "/app/src/tasks.server.ts", key: "tasks", exports: ["list"], streams: ["list"] },
+      {
+        abs: "/app/src/test.server.ts",
+        exports: ["ping"],
+        key: "test",
+        streams: [],
+      },
+      {
+        abs: "/app/src/tasks.server.ts",
+        exports: ["list"],
+        key: "tasks",
+        streams: ["list"],
+      },
     ]);
     expect(code).toContain('Rpc.make("test.ping"');
     expect(code).toContain('Rpc.make("tasks.list", { payload:');
@@ -270,11 +417,18 @@ describe("codegen", () => {
 
   test("virtual module keys exports by file", () => {
     const code = generateActionsModule([
-      { abs: "/app/src/test.server.ts", key: "test", exports: ["ping"], streams: [] },
+      {
+        abs: "/app/src/test.server.ts",
+        exports: ["ping"],
+        key: "test",
+        streams: [],
+      },
     ]);
     expect(code).toContain('import * as __m0 from "/app/src/test.server.ts"');
     expect(code).toContain('Rpc.make("test.ping"');
-    expect(code).toContain('import { getRequestStore, withRequestStore } from "oxidejs"');
+    expect(code).toContain(
+      'import { getRequestStore, withRequestStore } from "oxidejs"'
+    );
     expect(code).toContain('"test.ping": ({ args }) => __run');
     expect(code).toContain("const __s = getRequestStore()");
     expect(code).toContain(".apply(null, args))");
@@ -284,13 +438,22 @@ describe("codegen", () => {
   });
 
   test("fetch wrapper tries server.ts then assets", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "fetch", hasClient: true });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasClient: true,
+      preset: "fetch",
+    });
     expect(code).toContain('export * from "/app/src/server.ts"');
-    expect(code).toContain('import user from "/app/src/server.ts"');
-    expect(code).toContain('import { actionsGroup, actionsHandlers } from "virtual:oxide/actions"');
-    expect(code).toContain('p === "/__oxide/action" || p === "/__oxide/action/"');
+    expect(code).toContain(
+      'import user, { fetch as __namedFetch } from "/app/src/server.ts"'
+    );
+    expect(code).toContain(
+      'import { actionsGroup, actionsHandlers } from "virtual:oxide/actions"'
+    );
+    expect(code).toContain(
+      'p === "/__oxide/action" || p === "/__oxide/action/"'
+    );
     expect(code).toContain("request[__fetch]");
-    expect(code).toContain("await user.fetch(request, env ?? {}, ctx)");
+    expect(code).toContain("await __userFetch(request, env ?? {}, ctx)");
     expect(code).toContain("if (hit) return hit");
     expect(code).toContain('from "node:fs/promises"');
     expect(code).toContain("await __asset(request)");
@@ -305,18 +468,24 @@ describe("codegen", () => {
   });
 
   test("fetch wrapper without client skips assets", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "fetch" });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      preset: "fetch",
+    });
     expect(code).not.toContain("node:fs/promises");
     expect(code).toContain("createServer");
-    expect(code).toContain("user.fetch(request, env, ctx)");
+    expect(code).toContain("__userFetch(request, env, ctx)");
     expect(code).not.toContain("__asset");
   });
 
   test("celld wrapper does not serve assets or listen", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "celld" });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      preset: "celld",
+    });
     expect(code).not.toContain("node:fs/promises");
     expect(code).not.toContain("createServer");
-    expect(code).toContain('__nf = () => new Response("<h1>404 Not Found</h1>", { status: 404');
+    expect(code).toContain(
+      '__nf = () => new Response("<h1>404 Not Found</h1>", { status: 404'
+    );
     expect(code).toContain("env?.ASSETS");
     expect(code).toContain("assets.fetch(request)");
     expect(code).toContain('oxidejs/worker-dom/install"');
@@ -327,17 +496,21 @@ describe("codegen", () => {
   });
 
   test("fetch wrapper with public/ still serves assets", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { hasPublic: true });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasPublic: true,
+    });
     expect(code).toContain("node:fs/promises");
     expect(code).toContain("__nav(request)");
   });
 
   test("wrapper without actions skips RPC", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { hasActions: false });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasActions: false,
+    });
     expect(code).not.toContain("oxidejs/rpc");
     expect(code).not.toContain("virtual:oxide/actions");
     expect(code).not.toContain("/__oxide/action");
-    expect(code).toContain("user.fetch(request, env, ctx)");
+    expect(code).toContain("__userFetch(request, env, ctx)");
   });
 
   test("ws wrapper upgrades /__oxide/action", () => {
@@ -356,7 +529,10 @@ describe("codegen", () => {
     expect(assetRelPath("/foo/../../etc/passwd")).toBeNull();
     expect(assetRelPath("/app.js%00.txt")).toBeNull();
     expect(assetRelPath("app.js")).toBeNull();
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "fetch", hasClient: true });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasClient: true,
+      preset: "fetch",
+    });
     expect(code).toContain("rel.startsWith");
     expect(code).toContain('file.split("/").includes("..")');
   });
@@ -414,43 +590,60 @@ describe("codegen", () => {
     expect(assetRelPath("/.vite/manifest.json")).toBe(".vite/manifest.json");
   });
 
-  test("generated __rel matches assetRelPath for all attack vectors", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "fetch", hasClient: true });
+  test("generated __rel matches assetRelPath for all attack vectors", async () => {
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasClient: true,
+      preset: "fetch",
+    });
     // Extract the __rel function from generated code and evaluate it
-    const match = code.match(/function __rel\(pathname, spa\) \{[\s\S]*?\n\}/)?.[0];
+    const match = code.match(
+      /function __rel\(pathname, spa\) \{[\s\S]*?\n\}/u
+    )?.[0];
     expect(match).toBeTruthy();
-    const __rel = new Function(`${match}; return __rel;`)() as (
-      pathname: string,
-      spa?: boolean,
-    ) => string | undefined;
-
-    const vectors: [string, boolean | undefined][] = [
-      ["/app.js", undefined],
-      ["/", undefined],
-      ["/missing", true],
-      ["/../secret", undefined],
-      ["/%2e%2e/secret", undefined],
-      ["/foo/../../etc/passwd", undefined],
-      ["/app.js%00.txt", undefined],
-      ["app.js", undefined],
-      ["//etc/passwd", undefined],
-      ["///etc/passwd", undefined],
-      ["/foo\0bar", undefined],
-      ["/foo%00bar", undefined],
-      ["../secret", undefined],
-      ["", undefined],
-      ["/assets/js/app.js", undefined],
-      ["/.vite/manifest.json", undefined],
-    ];
-    for (const [pathname, spa] of vectors) {
-      const expected = assetRelPath(pathname, spa);
-      const actual = __rel(pathname, spa) ?? null;
-      expect(actual).toBe(expected);
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "oxide-rel-"));
+    const file = path.join(dir, "rel.mjs");
+    fs.writeFileSync(file, `${expectDefined(match)};\nexport default __rel;\n`);
+    try {
+      const mod = await import(file);
+      // SAFETY: temp module default-exports the extracted __rel helper.
+      const __rel = mod.default as (
+        pathname: string,
+        spa?: boolean
+      ) => string | undefined;
+
+      const vectors: [string, boolean | undefined][] = [
+        ["/app.js", undefined],
+        ["/", undefined],
+        ["/missing", true],
+        ["/../secret", undefined],
+        ["/%2e%2e/secret", undefined],
+        ["/foo/../../etc/passwd", undefined],
+        ["/app.js%00.txt", undefined],
+        ["app.js", undefined],
+        ["//etc/passwd", undefined],
+        ["///etc/passwd", undefined],
+        ["/foo\0bar", undefined],
+        ["/foo%00bar", undefined],
+        ["../secret", undefined],
+        ["", undefined],
+        ["/assets/js/app.js", undefined],
+        ["/.vite/manifest.json", undefined],
+      ];
+      for (const [pathname, spa] of vectors) {
+        const expected = assetRelPath(pathname, spa);
+        const actual = __rel(pathname, spa) ?? null;
+        expect(actual).toBe(expected);
+      }
+    } finally {
+      fs.rmSync(dir, { force: true, recursive: true });
     }
   });
 
   test("generated server uses req.url safely with URL constructor", () => {
-    const code = generateWorkerWrapper("/app/src/server.ts", { preset: "fetch", hasClient: true });
+    const code = generateWorkerWrapper("/app/src/server.ts", {
+      hasClient: true,
+      preset: "fetch",
+    });
     // The generated code uses new URL(request.url).pathname to extract the path,
     // not raw string manipulation. This ensures URL parsing normalization.
     expect(code).toContain("__actionMatch");
@@ -471,8 +664,8 @@ describe("codegen", () => {
 
     try {
       const code = generateWorkerWrapper("/app/src/server.ts", {
-        preset: "fetch",
         hasPublic: true,
+        preset: "fetch",
       });
       // The asset block sits between the __assets const and the app object.
       const start = code.indexOf("const __assets");
@@ -482,71 +675,114 @@ describe("codegen", () => {
       const assetBlock = code.slice(start, end);
       // Strip the import lines and the __assets const; we inject those via scope.
       const body = assetBlock
-        .replace(/^import .*\n/gm, "")
-        .replace(/^const __assets = .*;\n?/m, "");
-      const factory = new Function(
-        "readFile",
-        "extname",
-        "join",
-        "__assets",
-        `${body}\nreturn { __rel, __asset };`,
-      ) as (
-        readFile: (p: string) => Promise<Buffer>,
-        extname: typeof path.extname,
-        join: typeof path.join,
-        assets: string,
-      ) => {
-        __rel: (pathname: string, spa?: boolean) => string | undefined;
-        __asset: (request: Request, spa?: boolean) => Promise<Response | undefined>;
-      };
-      const { __asset } = factory(
-        (p: string) => import("node:fs/promises").then((m) => m.readFile(p)),
-        path.extname,
-        path.join,
-        client,
+        .replaceAll(/^import .*\n/gmu, "")
+        .replace(/^const __assets = .*;\n?/mu, "");
+      const evalDir = fs.mkdtempSync(
+        path.join(os.tmpdir(), "oxide-asset-eval-")
       );
-
-      // Valid asset served with correct content-type
-      const index = await __asset(new Request("http://x/index.html"));
-      expect(index?.status).toBe(200);
-      expect(await index!.text()).toBe("<html>home</html>");
-      expect(index!.headers.get("content-type")).toBe("text/html; charset=utf-8");
-      expect(index!.headers.get("cache-control")).toBe("no-cache");
-
-      // Binary asset keeps its bytes and gets the right type
-      const png = await __asset(new Request("http://x/logo.png"));
-      expect(png?.headers.get("content-type")).toBe("image/png");
-      expect(Buffer.from(await png!.arrayBuffer())).toEqual(Buffer.from([1, 2, 3, 4]));
-
-      // Nested path
-      const deep = await __asset(new Request("http://x/nested/deep.txt"));
-      expect(await deep!.text()).toBe("deep-content");
-      expect(deep!.headers.get("content-type")).toBe("application/octet-stream");
-
-      // Missing file → undefined (caller returns 404)
-      expect(await __asset(new Request("http://x/missing.png"))).toBeUndefined();
-
-      // SPA fallback resolves unknown paths to index.html
-      const spa = await __asset(new Request("http://x/some/route"), true);
-      expect(await spa!.text()).toBe("<html>home</html>");
-
-      // Traversal and double-slash are blocked at the __rel gate
-      expect(await __asset(new Request("http://x/../secret.txt"))).toBeUndefined();
-      expect(await __asset(new Request("http://x/..%2fsecret.txt"))).toBeUndefined();
-      expect(await __asset(new Request("http://x//etc/passwd"))).toBeUndefined();
-      expect(await __asset(new Request("http://x/%2e%2e/secret.txt"))).toBeUndefined();
-      // SPA fallback maps traversal paths to index.html — never outside assets
-      const spaTraversal = await __asset(new Request("http://x/../secret.txt"), true);
-      expect(await spaTraversal!.text()).toBe("<html>home</html>");
+      const evalFile = path.join(evalDir, "assets.mjs");
+      fs.writeFileSync(
+        evalFile,
+        `export default function create(readFile, extname, join, __assets) {
+${body}
+return { __rel, __asset };
+}
+`
+      );
+      try {
+        const mod = await import(evalFile);
+        // SAFETY: temp module default-exports the generated __rel/__asset factory.
+        const factory = mod.default as (
+          readFile: (p: string) => Promise<Buffer>,
+          extname: typeof path.extname,
+          join: typeof path.join,
+          assets: string
+        ) => {
+          __rel: (pathname: string, spa?: boolean) => string | undefined;
+          __asset: (
+            request: Request,
+            spa?: boolean
+          ) => Promise<Response | undefined>;
+        };
+        const { __asset } = factory(
+          (p: string) => import("node:fs/promises").then((m) => m.readFile(p)),
+          path.extname,
+          path.join,
+          client
+        );
+
+        // Valid asset served with correct content-type
+        const index = expectDefined(
+          await __asset(new Request("http://x/index.html"))
+        );
+        expect(index.status).toBe(200);
+        expect(await index.text()).toBe("<html>home</html>");
+        expect(index.headers.get("content-type")).toBe(
+          "text/html; charset=utf-8"
+        );
+        expect(index.headers.get("cache-control")).toBe("no-cache");
+
+        // Binary asset keeps its bytes and gets the right type
+        const png = expectDefined(
+          await __asset(new Request("http://x/logo.png"))
+        );
+        expect(png.headers.get("content-type")).toBe("image/png");
+        expect(Buffer.from(await png.arrayBuffer())).toEqual(
+          Buffer.from([1, 2, 3, 4])
+        );
+
+        // Nested path
+        const deep = expectDefined(
+          await __asset(new Request("http://x/nested/deep.txt"))
+        );
+        expect(await deep.text()).toBe("deep-content");
+        expect(deep.headers.get("content-type")).toBe(
+          "application/octet-stream"
+        );
+
+        // Missing file → undefined (caller returns 404)
+        expect(
+          await __asset(new Request("http://x/missing.png"))
+        ).toBeUndefined();
+
+        // SPA fallback resolves unknown paths to index.html
+        const spa = expectDefined(
+          await __asset(new Request("http://x/some/route"), true)
+        );
+        expect(await spa.text()).toBe("<html>home</html>");
+
+        // Traversal and double-slash are blocked at the __rel gate
+        expect(
+          await __asset(new Request("http://x/../secret.txt"))
+        ).toBeUndefined();
+        expect(
+          await __asset(new Request("http://x/..%2fsecret.txt"))
+        ).toBeUndefined();
+        expect(
+          await __asset(new Request("http://x//etc/passwd"))
+        ).toBeUndefined();
+        expect(
+          await __asset(new Request("http://x/%2e%2e/secret.txt"))
+        ).toBeUndefined();
+        // SPA fallback maps traversal paths to index.html — never outside assets
+        const spaTraversal = expectDefined(
+          await __asset(new Request("http://x/../secret.txt"), true)
+        );
+        expect(await spaTraversal.text()).toBe("<html>home</html>");
+      } finally {
+        fs.rmSync(evalDir, { force: true, recursive: true });
+      }
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("stubs client, not worker", () => {
     expect(shouldStubServerModule({ consumer: "client" })).toBe(true);
     expect(shouldStubServerModule({ consumer: "server" })).toBe(false);
-    expect(shouldStubServerModule({ config: { consumer: "server" } })).toBe(false);
+    expect(shouldStubServerModule({ config: { consumer: "server" } })).toBe(
+      false
+    );
     expect(shouldStubServerModule({ name: "worker" })).toBe(false);
     expect(shouldStubServerModule({ name: "ssr" })).toBe(false);
     expect(shouldStubServerModule({ name: "web" })).toBe(true);
@@ -558,18 +794,24 @@ describe("codegen", () => {
   });
 
   test("plugin this follows Vite consumer and webpack target", () => {
-    expect(pluginShouldStub({ environment: { config: { consumer: "server" } } })).toBe(false);
-    expect(pluginShouldStub({ environment: { config: { consumer: "client" } } })).toBe(true);
+    expect(
+      pluginShouldStub({ environment: { config: { consumer: "server" } } })
+    ).toBe(false);
+    expect(
+      pluginShouldStub({ environment: { config: { consumer: "client" } } })
+    ).toBe(true);
     expect(pluginShouldStub({}, { ssr: true })).toBe(false);
     expect(
       pluginShouldStub({
-        getNativeBuildContext: () => ({ compiler: { options: { target: "node" } } }),
-      }),
+        getNativeBuildContext: () => ({
+          compiler: { options: { target: "node" } },
+        }),
+      })
     ).toBe(false);
     expect(
       pluginShouldStub({
         getNativeBuildContext: () => ({ compiler: { name: "web" } }),
-      }),
+      })
     ).toBe(true);
   });
 
@@ -578,16 +820,18 @@ describe("codegen", () => {
     const file = path.join(root, "secret.server.ts");
     fs.writeFileSync(
       file,
-      `const SECRET = "leak-me";\nexport const ping = action(async () => SECRET)\n`,
+      `const SECRET = "leak-me";\nexport const ping = action(async () => SECRET)\n`
     );
     try {
       const stub = loadClientStub(file);
       expect(stub).toContain('from "virtual:oxide/client"');
-      expect(stub).toContain('client["secret"]["ping"](...args.slice(0, -1), opts)');
+      expect(stub).toContain(
+        'client["secret"]["ping"](...args.slice(0, -1), opts)'
+      );
       expect(stub).not.toContain("leak-me");
       expect(stub).not.toContain("const SECRET");
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 });
@@ -602,22 +846,24 @@ describe("generated router", () => {
       `import { action } from ${ctx};
 export const ping = action(async () => "pong")
 export const echo = action(async (value: string) => value)
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       expect(await readRpcFrame(await rpcCall(fetch, "test.ping"))).toEqual({
-        jsonrpc: "2.0",
         id: 1,
+        jsonrpc: "2.0",
         result: "pong",
       });
-      expect(await readRpcFrame(await rpcCall(fetch, "test.echo", ["hello"]))).toEqual({
-        jsonrpc: "2.0",
+      expect(
+        await readRpcFrame(await rpcCall(fetch, "test.echo", ["hello"]))
+      ).toEqual({
         id: 1,
+        jsonrpc: "2.0",
         result: "hello",
       });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -627,17 +873,19 @@ export const echo = action(async (value: string) => value)
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       file,
-      `import { action } from ${ctx};\nexport const raw = action(() => new Response("RAW"))\n`,
+      `import { action } from ${ctx};\nexport const raw = action(() => new Response("RAW"))\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
-      expect(await readRpcFrame(await rpcCall(fetch, "test.raw"))).toMatchObject({
-        jsonrpc: "2.0",
+      expect(
+        await readRpcFrame(await rpcCall(fetch, "test.raw"))
+      ).toMatchObject({
+        error: { code: -32_603, message: "Internal error" },
         id: 1,
-        error: { code: -32603, message: "Internal error" },
+        jsonrpc: "2.0",
       });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -647,26 +895,30 @@ export const echo = action(async (value: string) => value)
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       file,
-      `import { action } from ${ctx};\nexport const ping = action(async () => "pong")\n`,
+      `import { action } from ${ctx};\nexport const ping = action(async () => "pong")\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const res = await fetch(
         new Request("http://localhost/__oxide/action/", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
           body: JSON.stringify({
-            jsonrpc: "2.0",
             id: 1,
+            jsonrpc: "2.0",
             method: "test.ping",
             params: { args: [] },
           }),
-        }),
+          headers: { "content-type": "application/json" },
+          method: "POST",
+        })
       );
       expect(res.status).toBe(200);
-      expect(await readRpcFrame(res)).toEqual({ jsonrpc: "2.0", id: 1, result: "pong" });
+      expect(await readRpcFrame(res)).toEqual({
+        id: 1,
+        jsonrpc: "2.0",
+        result: "pong",
+      });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -676,26 +928,30 @@ export const echo = action(async (value: string) => value)
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       file,
-      `import { action } from ${ctx};\nexport const echo = action(async (value: string[]) => value)\n`,
+      `import { action } from ${ctx};\nexport const echo = action(async (value: string[]) => value)\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const res = await fetch(
         new Request("http://localhost/__oxide/action/", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
           body: JSON.stringify({
-            jsonrpc: "2.0",
             id: 1,
+            jsonrpc: "2.0",
             method: "test.echo",
             params: { args: [["hello"]] },
           }),
-        }),
+          headers: { "content-type": "application/json" },
+          method: "POST",
+        })
       );
       expect(res.status).toBe(200);
-      expect(await readRpcFrame(res)).toEqual({ jsonrpc: "2.0", id: 1, result: ["hello"] });
+      expect(await readRpcFrame(res)).toEqual({
+        id: 1,
+        jsonrpc: "2.0",
+        result: ["hello"],
+      });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -706,17 +962,17 @@ export const echo = action(async (value: string) => value)
       path.join(root, "noop.server.ts"),
       `import { action } from ${ctx};
 export const noop = action(async () => {})
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       expect(await readRpcFrame(await rpcCall(fetch, "noop.noop"))).toEqual({
-        jsonrpc: "2.0",
         id: 1,
+        jsonrpc: "2.0",
         result: null,
       });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -727,7 +983,7 @@ export const noop = action(async () => {})
       path.join(root, "ticks.server.ts"),
       `import { action } from ${ctx};
 export const ticks = action(async function* () { yield 0; yield 1; return 2 })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
@@ -735,17 +991,19 @@ export const ticks = action(async function* () { yield 0; yield 1; return 2 })
       expect(res.headers.get("content-type")).toContain("application/json-rpc");
       const body = await readRpcFrames(res);
       expect(body).toEqual([
-        { jsonrpc: "2.0", chunk: true, id: 1, result: [0] },
-        { jsonrpc: "2.0", chunk: true, id: 1, result: [1] },
-        { jsonrpc: "2.0", id: 1, result: null },
+        { chunk: true, id: 1, jsonrpc: "2.0", result: [0] },
+        { chunk: true, id: 1, jsonrpc: "2.0", result: [1] },
+        { id: 1, jsonrpc: "2.0", result: null },
       ]);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("stream frames flush before the generator finishes", async () => {
-    const root = fs.mkdtempSync(path.join(import.meta.dir, "oxide-stream-live-"));
+    const root = fs.mkdtempSync(
+      path.join(import.meta.dir, "oxide-stream-live-")
+    );
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     const gateFile = path.join(root, "gate");
     fs.writeFileSync(
@@ -759,54 +1017,51 @@ export const ticks = action(async function* () {
   }
   yield 1;
 })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const res = await rpcCall(fetch, "ticks.ticks");
       expect(res.body).toBeTruthy();
-      const reader = res.body!.getReader();
+      const reader = expectDefined(res.body).getReader();
       const decoder = new TextDecoder();
-      let buf = "";
-      while (!buf.includes("\n")) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buf += decoder.decode(value, { stream: true });
-      }
-      expect(JSON.parse(buf.split("\n")[0]!)).toEqual({
-        jsonrpc: "2.0",
+      const first = await readStreamUntilNewline(reader, decoder);
+      const firstLine = expectDefined(first.buf.split("\n")[0]);
+      expect(JSON.parse(firstLine)).toEqual({
         chunk: true,
         id: 1,
+        jsonrpc: "2.0",
         result: [0],
       });
 
       // Second frame must not arrive until the gate opens.
       const second = reader.read();
       const premature = await Promise.race([
-        second.then((chunk) => ({ kind: "frame" as const, chunk })),
-        new Promise<{ kind: "timeout" }>((resolve) =>
-          setTimeout(() => resolve({ kind: "timeout" }), 40),
-        ),
+        second.then((chunk) => ({ chunk, kind: "frame" as const })),
+        Bun.sleep(40).then(() => ({ kind: "timeout" as const })),
       ]);
       expect(premature.kind).toBe("timeout");
 
       fs.writeFileSync(gateFile, "go");
       const rest = premature.kind === "frame" ? premature.chunk : await second;
-      let restText = rest.value ? decoder.decode(rest.value, { stream: true }) : "";
-      while (!restText.includes("\n") && !rest.done) {
-        const next = await reader.read();
-        if (next.done) break;
-        restText += decoder.decode(next.value, { stream: true });
-      }
-      expect(JSON.parse(restText.split("\n").find((l) => l.length > 0)!)).toEqual({
-        jsonrpc: "2.0",
+      const restStart = rest.value
+        ? decoder.decode(rest.value, { stream: true })
+        : "";
+      const restRead = rest.done
+        ? { buf: restStart, done: true }
+        : await readStreamUntilNewline(reader, decoder, restStart);
+      const restLine = expectDefined(
+        restRead.buf.split("\n").find((line) => line.length > 0)
+      );
+      expect(JSON.parse(restLine)).toEqual({
         chunk: true,
         id: 1,
+        jsonrpc: "2.0",
         result: [1],
       });
       await reader.cancel();
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -816,20 +1071,26 @@ export const ticks = action(async function* () {
       path.join(root, "who.server.ts"),
       `import { action, useRequest } from ${JSON.stringify(path.join(import.meta.dir, "context.ts"))};
 export const who = action(async function* () { yield useRequest().headers.get("x-user") })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
-      const res = await rpcCall(fetch, "who.who", undefined, { headers: { "x-user": "ada" } });
+      const res = await rpcCall(fetch, "who.who", undefined, {
+        headers: { "x-user": "ada" },
+      });
       const body = await readRpcFrames(res);
-      expect((body[0] as { result?: unknown })?.result).toEqual(["ada"]);
+      // SAFETY: first NDJSON frame is a JSON-RPC success/error object.
+      const first = body[0] as { result?: JsonValue } | undefined;
+      expect(first?.result).toEqual(["ada"]);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("useRequest() stays available after a yield in an async generator", async () => {
-    const root = fs.mkdtempSync(path.join(import.meta.dir, "oxide-gen-req-after-"));
+    const root = fs.mkdtempSync(
+      path.join(import.meta.dir, "oxide-gen-req-after-")
+    );
     fs.writeFileSync(
       path.join(root, "who.server.ts"),
       `import { action, useRequest } from ${JSON.stringify(path.join(import.meta.dir, "context.ts"))};
@@ -837,19 +1098,21 @@ export const who = action(async function* () {
   yield "start";
   yield useRequest().headers.get("x-user");
 })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
-      const res = await rpcCall(fetch, "who.who", undefined, { headers: { "x-user": "ada" } });
+      const res = await rpcCall(fetch, "who.who", undefined, {
+        headers: { "x-user": "ada" },
+      });
       const body = await readRpcFrames(res);
       expect(body).toEqual([
-        { jsonrpc: "2.0", chunk: true, id: 1, result: ["start"] },
-        { jsonrpc: "2.0", chunk: true, id: 1, result: ["ada"] },
-        { jsonrpc: "2.0", id: 1, result: null },
+        { chunk: true, id: 1, jsonrpc: "2.0", result: ["start"] },
+        { chunk: true, id: 1, jsonrpc: "2.0", result: ["ada"] },
+        { id: 1, jsonrpc: "2.0", result: null },
       ]);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -859,30 +1122,35 @@ export const who = action(async function* () {
       path.join(root, "who.server.ts"),
       `import { action, useRequest } from ${JSON.stringify(path.join(import.meta.dir, "context.ts"))};
 export const who = action(async () => useRequest().headers.get("x-user"))
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
-      const res = await rpcCall(fetch, "who.who", undefined, { headers: { "x-user": "ada" } });
-      expect(await readRpcFrame(res)).toEqual({ jsonrpc: "2.0", id: 1, result: "ada" });
+      const res = await rpcCall(fetch, "who.who", undefined, {
+        headers: { "x-user": "ada" },
+      });
+      expect(await readRpcFrame(res)).toEqual({
+        id: 1,
+        jsonrpc: "2.0",
+        result: "ada",
+      });
       expect(() => useRequest()).toThrow("request context is unavailable");
       expect(() => useCtx()).toThrow("request context is unavailable");
       expect(() => useEnv()).toThrow("request context is unavailable");
       expect(() => useFetchCtx()).toThrow("request context is unavailable");
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("action adds typed cancellation and Atom.fn-shaped handles", async () => {
-    const pingFn = async () => "pong" as const;
-    const ping = action(pingFn);
-    const echo = action(async (value: string) => value);
-    const signal = new AbortController().signal;
+    const ping = action(() => "pong" as const);
+    const echo = action((value: string) => value);
+    const { signal } = new AbortController();
 
     expect(ping.$$atom).toBe(1);
-    expect(typeof ping.set).toBe("function");
-    expect(typeof ping.bind).toBe("function");
+    expect(ping.set).toBeInstanceOf(Function);
+    expect(ping.bind).toBeInstanceOf(Function);
     expect(await ping({ signal })).toBe("pong");
     expect(await echo("ok", { signal })).toBe("ok");
     expect(await ping.set()).toBe("pong");
@@ -890,7 +1158,9 @@ export const who = action(async () => useRequest().headers.get("x-user"))
 
   test("runWithRequest always provides the current Request", () => {
     const controller = new AbortController();
-    const request = new Request("http://localhost/frame", { signal: controller.signal });
+    const request = new Request("http://localhost/frame", {
+      signal: controller.signal,
+    });
 
     runWithRequest(
       request,
@@ -899,7 +1169,7 @@ export const who = action(async () => useRequest().headers.get("x-user"))
         expect(useRequest().signal).toBe(controller.signal);
         expect(useEnv<{ TASKS: boolean }>()).toEqual({ TASKS: true });
       },
-      { req: new Request("http://wrong/"), env: { TASKS: true } },
+      { env: { TASKS: true }, req: new Request("http://wrong/") }
     );
   });
 
@@ -940,7 +1210,7 @@ export const who = action(async () => useRequest().headers.get("x-user"))
       expect(() =>
         withRequestStore({ req: request }, () => {
           throw new Error("boom");
-        }),
+        })
       ).toThrow("boom");
       expect(() => getRequestStore()).toThrow("request context is unavailable");
     } finally {
@@ -957,9 +1227,9 @@ export const who = action(async () => useRequest().headers.get("x-user"))
         await Bun.sleep(20);
         order.push("a-end");
       });
-      const b = withRequestEntry(async () => {
-        order.push("b-start");
-        order.push("b-end");
+      const b = withRequestEntry(() => {
+        order.push("b-start", "b-end");
+        return Promise.resolve();
       });
       await Promise.all([a, b]);
       expect(order).toEqual(["a-start", "a-end", "b-start", "b-end"]);
@@ -978,19 +1248,19 @@ export const who = action(async () => {
   await Promise.resolve();
   return useRequest().url;
 })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const res = await rpcCall(fetch, "who.who");
       expect(await readRpcFrame(res)).toEqual({
-        jsonrpc: "2.0",
         id: 1,
+        jsonrpc: "2.0",
         result: "http://localhost/__oxide/action",
       });
     } finally {
       __setInWebcontainerForTests(null);
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -1001,34 +1271,41 @@ export const who = action(async () => {
       `import { action, useCtx, useEnv, useFetchCtx } from ${JSON.stringify(path.join(import.meta.dir, "context.ts"))};
 export const who = action(async () => {
   const env = useEnv();
-  useFetchCtx()?.waitUntil?.(Promise.resolve());
+  useFetchCtx()?.waitUntil?.(Promise.resolve(null));
   return { secret: env.SECRET, user: useCtx().user };
 })
-`,
+`
+    );
+    const out = writeActionsModule(
+      root,
+      generateActionsModule(scanServerFiles(root))
     );
-    const out = writeActionsModule(root, generateActionsModule(scanServerFiles(root)));
     try {
       const mod = await import(out);
       const waited: Promise<unknown>[] = [];
       const fetch = createActionHandler(mod.default, mod.actionsHandlers, {
-        path: "/__oxide/action",
-        sameOrigin: false,
         createContext: () => ({
-          req: new Request("http://localhost/__oxide/action"),
           env: { SECRET: "from-env" },
-          fetchCtx: { waitUntil: (p: Promise<unknown>) => waited.push(p) },
+          fetchCtx: {
+            waitUntil: (p) => {
+              waited.push(Promise.resolve(p));
+            },
+          },
+          req: new Request("http://localhost/__oxide/action"),
           user: "ada",
         }),
+        path: "/__oxide/action",
+        sameOrigin: false,
       });
       const res = await rpcCall(fetch, "who.who");
       expect(await readRpcFrame(res)).toEqual({
-        jsonrpc: "2.0",
         id: 1,
+        jsonrpc: "2.0",
         result: { secret: "from-env", user: "ada" },
       });
       expect(waited).toHaveLength(1);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -1043,33 +1320,37 @@ export const wait = action(async () => {
   await new Promise((resolve) => req.signal.addEventListener("abort", resolve, { once: true }));
   return "aborted";
 })
-`,
+`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const ac = new AbortController();
-      const pending = rpcCall(fetch, "wait.wait", undefined, { signal: ac.signal });
+      const pending = rpcCall(fetch, "wait.wait", undefined, {
+        signal: ac.signal,
+      });
       await Promise.resolve();
       ac.abort();
       expect(await readRpcFrame(await pending)).toEqual({
-        jsonrpc: "2.0",
         id: 1,
+        jsonrpc: "2.0",
         result: "aborted",
       });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("nodeToWebRequest abort follows IncomingMessage aborted", async () => {
     const { EventEmitter } = await import("node:events");
+    // oxlint-disable-next-line unicorn/prefer-event-target -- IncomingMessage uses EventEmitter once/emit
     const req = Object.assign(new EventEmitter(), {
-      method: "GET",
-      url: "/",
-      headers: { host: "localhost" },
       aborted: false,
       destroyed: true,
+      headers: { host: "localhost" },
+      method: "GET",
+      url: "/",
     });
+    // SAFETY: minimal IncomingMessage stand-in for abort wiring.
     const request = await nodeToWebRequest(req as never);
     expect(request.signal.aborted).toBe(false);
     req.emit("close");
@@ -1080,31 +1361,35 @@ export const wait = action(async () => {
 
   test("nodeToWebRequest enforces the body limit", async () => {
     const { EventEmitter } = await import("node:events");
+    // oxlint-disable-next-line unicorn/prefer-event-target -- IncomingMessage uses EventEmitter once/emit
     const req = Object.assign(new EventEmitter(), {
-      method: "POST",
-      url: "/__oxide/action",
-      headers: { host: "localhost" },
       async *[Symbol.asyncIterator]() {
         yield Buffer.from("too large");
       },
+      headers: { host: "localhost" },
+      method: "POST",
+      url: "/__oxide/action",
     });
+    // SAFETY: minimal IncomingMessage stand-in for body-limit checks.
     await expect(nodeToWebRequest(req as never, 3)).rejects.toBeInstanceOf(
-      RequestBodyTooLargeError,
+      RequestBodyTooLargeError
     );
   });
 
   test("nodeToWebRequest stays open after draining a POST body", async () => {
     const { EventEmitter } = await import("node:events");
     const chunks = [Buffer.from('{"jsonrpc":"2.0"}')];
+    // oxlint-disable-next-line unicorn/prefer-event-target -- IncomingMessage uses EventEmitter once/emit
     const req = Object.assign(new EventEmitter(), {
-      method: "POST",
-      url: "/__oxide/action",
-      headers: { host: "localhost" },
-      destroyed: true,
       async *[Symbol.asyncIterator]() {
         yield* chunks;
       },
+      destroyed: true,
+      headers: { host: "localhost" },
+      method: "POST",
+      url: "/__oxide/action",
     });
+    // SAFETY: minimal IncomingMessage stand-in for POST body drain.
     const request = await nodeToWebRequest(req as never);
     expect(request.signal.aborted).toBe(false);
     expect(await request.text()).toBe('{"jsonrpc":"2.0"}');
@@ -1115,7 +1400,7 @@ export const wait = action(async () => {
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       path.join(root, "test.server.ts"),
-      `import { action } from ${ctx};\nexport const ping = action(async () => "pong")\n`,
+      `import { action } from ${ctx};\nexport const ping = action(async () => "pong")\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
@@ -1124,38 +1409,46 @@ export const wait = action(async () => {
       expect(get.headers.get("allow")).toBe("POST");
       const miss = await fetch(
         new Request("http://localhost/__oxide/action", {
-          method: "POST",
+          body: JSON.stringify({
+            id: 1,
+            jsonrpc: "2.0",
+            method: "test.secret",
+          }),
           headers: { "content-type": "application/json" },
-          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "test.secret" }),
-        }),
+          method: "POST",
+        })
       );
       expect(await readRpcFrame(miss)).toEqual({
-        jsonrpc: "2.0",
+        error: { code: -32_601, message: "Method not found" },
         id: 1,
-        error: { code: -32601, message: "Method not found" },
+        jsonrpc: "2.0",
       });
       const proto = await fetch(
         new Request("http://localhost/__oxide/action", {
-          method: "POST",
+          body: JSON.stringify({
+            id: 1,
+            jsonrpc: "2.0",
+            method: "__proto__.ping",
+          }),
           headers: { "content-type": "application/json" },
-          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "__proto__.ping" }),
-        }),
+          method: "POST",
+        })
       );
       expect(await readRpcFrame(proto)).toEqual({
-        jsonrpc: "2.0",
+        error: { code: -32_601, message: "Method not found" },
         id: 1,
-        error: { code: -32601, message: "Method not found" },
+        jsonrpc: "2.0",
       });
       const other = await fetch(
         new Request("http://localhost/api", {
-          method: "POST",
+          body: JSON.stringify({ id: 1, jsonrpc: "2.0", method: "test.ping" }),
           headers: { "content-type": "application/json" },
-          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "test.ping" }),
-        }),
+          method: "POST",
+        })
       );
       expect(other.status).toBe(404);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -1164,26 +1457,35 @@ export const wait = action(async () => {
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       path.join(root, "test.server.ts"),
-      `import { action } from ${ctx};\nexport const echo = action(async (value) => value ?? "empty")\n`,
+      `import { action } from ${ctx};\nexport const echo = action(async (value) => value ?? "empty")\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
-      const call = (params: unknown) =>
+      const call = (params: JsonValue) =>
         fetch(
           new Request("http://localhost/__oxide/action", {
-            method: "POST",
+            body: JSON.stringify({
+              id: 1,
+              jsonrpc: "2.0",
+              method: "test.echo",
+              params,
+            }),
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "test.echo", params }),
-          }),
+            method: "POST",
+          })
         ).then((res) => readRpcFrame(res));
       expect(await call({ 0: "sneak" })).toEqual({
+        error: { code: -32_602, message: "Invalid params" },
+        id: 1,
         jsonrpc: "2.0",
+      });
+      expect(await call({ args: ["ok"] })).toEqual({
         id: 1,
-        error: { code: -32602, message: "Invalid params" },
+        jsonrpc: "2.0",
+        result: "ok",
       });
-      expect(await call({ args: ["ok"] })).toEqual({ jsonrpc: "2.0", id: 1, result: "ok" });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -1192,22 +1494,22 @@ export const wait = action(async () => {
     const ctx = JSON.stringify(path.join(import.meta.dir, "context.ts"));
     fs.writeFileSync(
       path.join(root, "test.server.ts"),
-      `import { action } from ${ctx};\nexport const boom = action(async () => { throw new Error("secret-leak-check"); })\n`,
+      `import { action } from ${ctx};\nexport const boom = action(async () => { throw new Error("secret-leak-check"); })\n`
     );
     try {
       const fetch = await loadGeneratedRouter(root);
       const res = await rpcCall(fetch, "test.boom");
       const body = await readRpcFrame(res);
       expect(body).toEqual({
-        jsonrpc: "2.0",
+        error: { code: -32_603, message: "Internal error" },
         id: 1,
-        error: { code: -32603, message: "Internal error" },
+        jsonrpc: "2.0",
       });
       expect(JSON.stringify(body)).not.toContain("secret-leak-check");
       expect(JSON.stringify(body)).not.toContain("Defect");
       expect(JSON.stringify(body)).not.toContain("_tag");
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 });
diff --git a/packages/oxidejs/src/actions.ts b/packages/oxidejs/src/actions.ts
index bb970c1..a03fe8f 100644
--- a/packages/oxidejs/src/actions.ts
+++ b/packages/oxidejs/src/actions.ts
@@ -1,7 +1,13 @@
 import fs from "node:fs";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import path from "node:path";
-import type { OxidejsActionHeaders, OxidejsActionTransport, OxidejsPreset } from "./types";
+
+import type {
+  OxidejsActionHeaders,
+  OxidejsActionTransport,
+  OxidejsJson,
+  OxidejsPreset,
+} from "./types";
 
 export const VIRTUAL_ACTIONS_ID = "virtual:oxide/actions";
 export const RESOLVED_VIRTUAL_ACTIONS_ID = `\0${VIRTUAL_ACTIONS_ID}`;
@@ -12,51 +18,67 @@ export const RESOLVED_VIRTUAL_CLIENT_ID = `\0${VIRTUAL_CLIENT_ID}`;
 export const ACTION_PATH = "/__oxide/action";
 
 /** Match the action endpoint with or without a trailing slash (Effect RPC posts to `path/`). */
-export function matchesActionPath(pathname: string, path: string = ACTION_PATH): boolean {
-  return pathname === path || pathname === `${path}/`;
-}
+export const matchesActionPath = function matchesActionPath(
+  pathname: string,
+  actionPath: string = ACTION_PATH
+): boolean {
+  return pathname === actionPath || pathname === `${actionPath}/`;
+};
 
 const IGNORE_DIRS = new Set(["node_modules", "dist", ".git", ".wrangler"]);
 /** Only `export const name = action(...)` become remote RPC actions. Everything else stays server-local. */
-const EXPORT_RE = /^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?action\s*\(/gm;
+const EXPORT_RE =
+  /^\s*export\s+const\s+(?<exportName>[A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?action\s*\(/gmu;
 const STREAM_EXPORT_RE =
-  /^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*action\s*\(\s*async\s+function\s*\*/gm;
+  /^\s*export\s+const\s+(?<exportName>[A-Za-z_$][\w$]*)\s*=\s*action\s*\(\s*async\s+function\s*\*/gmu;
 
 export interface ServerModule {
   abs: string;
-  key: string;
   exports: string[];
+  key: string;
   streams: string[];
 }
 
-export function isServerFileId(id: string): boolean {
-  const file = id.split("?")[0]?.replace(/\\/g, "/") ?? "";
-  return [".ts", ".tsx", ".js", ".jsx"].some((ext) => file.endsWith(`.server${ext}`));
-}
+export const isServerFileId = function isServerFileId(id: string): boolean {
+  const file = id.split("?")[0]?.replaceAll("\\", "/") ?? "";
+  return [".ts", ".tsx", ".js", ".jsx"].some((ext) =>
+    file.endsWith(`.server${ext}`)
+  );
+};
 
-export function moduleKey(absFile: string): string {
-  return path.basename(absFile).replace(/\.server\.(?:[jt]sx?)$/i, "");
-}
+export const moduleKey = function moduleKey(absFile: string): string {
+  return path.basename(absFile).replace(/\.server\.(?:[jt]sx?)$/iu, "");
+};
 
-export function parseExportedNames(source: string): string[] {
+export const parseExportedNames = function parseExportedNames(
+  source: string
+): string[] {
   const names = new Set<string>();
   for (const match of source.matchAll(EXPORT_RE)) {
-    const name = match[1];
-    if (name) names.add(name);
+    const [, name] = match;
+    if (name) {
+      names.add(name);
+    }
   }
   return [...names];
-}
+};
 
-export function parseStreamExports(source: string): string[] {
+export const parseStreamExports = function parseStreamExports(
+  source: string
+): string[] {
   const names = new Set<string>();
   for (const match of source.matchAll(STREAM_EXPORT_RE)) {
-    const name = match[1];
-    if (name) names.add(name);
+    const [, name] = match;
+    if (name) {
+      names.add(name);
+    }
   }
   return [...names];
-}
+};
 
-export function scanServerFiles(root: string): ServerModule[] {
+export const scanServerFiles = function scanServerFiles(
+  root: string
+): ServerModule[] {
   const files: string[] = [];
   const walk = (dir: string) => {
     let entries: fs.Dirent[];
@@ -66,82 +88,119 @@ export function scanServerFiles(root: string): ServerModule[] {
       return;
     }
     for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
+      if (entry.name.startsWith(".")) {
+        continue;
+      }
       const abs = path.join(dir, entry.name);
       if (entry.isDirectory()) {
-        if (IGNORE_DIRS.has(entry.name)) continue;
+        if (IGNORE_DIRS.has(entry.name)) {
+          continue;
+        }
         walk(abs);
         continue;
       }
-      if (entry.isFile() && isServerFileId(entry.name)) files.push(abs);
+      if (entry.isFile() && isServerFileId(entry.name)) {
+        files.push(abs);
+      }
     }
   };
   walk(root);
 
   const byKey = new Map<string, string>();
   const modules: ServerModule[] = [];
-  for (const abs of files.sort()) {
+  // SAFETY: Bun provides Array.prototype.toSorted; package tsconfig targets ES2022 without its typings.
+  const sortedFiles = (
+    files as string[] & { toSorted: () => string[] }
+  ).toSorted();
+  for (const abs of sortedFiles) {
     const key = moduleKey(abs);
     if (!key) {
       throw new Error(`oxidejs: invalid server module name: ${abs}`);
     }
     const existing = byKey.get(key);
     if (existing) {
-      throw new Error(`oxidejs: duplicate server module key "${key}": ${existing} and ${abs}`);
+      throw new Error(
+        `oxidejs: duplicate server module key "${key}": ${existing} and ${abs}`
+      );
     }
     byKey.set(key, abs);
-    const source = fs.readFileSync(abs, "utf8");
+    const source = fs.readFileSync(abs, "utf-8");
     modules.push({
       abs,
-      key,
       exports: parseExportedNames(source),
+      key,
       streams: parseStreamExports(source),
     });
   }
   return modules;
-}
+};
 
 /** Path under the asset root, or null if the URL must not be served. */
-export function assetRelPath(pathname: string, spa = false): string | null {
-  if (pathname.includes("\0")) return null;
+export const assetRelPath = function assetRelPath(
+  pathname: string,
+  spa = false
+): string | null {
+  if (pathname.includes("\0")) {
+    return null;
+  }
   let file: string;
   try {
     file = decodeURIComponent(pathname);
   } catch {
     return null;
   }
-  if (file.includes("\0")) return null;
-  if (file === "/" || spa) file = "/index.html";
-  if (!file.startsWith("/") || file.split("/").includes("..")) return null;
+  if (file.includes("\0")) {
+    return null;
+  }
+  if (file === "/" || spa) {
+    file = "/index.html";
+  }
+  if (!file.startsWith("/") || file.split("/").includes("..")) {
+    return null;
+  }
   const rel = file.slice(1);
-  if (rel.startsWith("/")) return null;
+  if (rel.startsWith("/")) {
+    return null;
+  }
   return rel;
+};
+
+interface ClientModuleOpts {
+  headers?: OxidejsActionHeaders;
+  transport?: "ws";
+  url: string;
 }
 
-export function generateClientModule(
+export const generateClientModule = function generateClientModule(
   transport: OxidejsActionTransport = "http",
   headers?: OxidejsActionHeaders,
-  path: string = ACTION_PATH,
+  actionPath: string = ACTION_PATH
 ): string {
-  const opts: { url: string; transport?: "ws"; headers?: OxidejsActionHeaders } = { url: path };
-  if (transport === "ws") opts.transport = "ws";
-  if (headers) opts.headers = headers;
+  const opts: ClientModuleOpts = { url: actionPath };
+  if (transport === "ws") {
+    opts.transport = "ws";
+  }
+  if (headers) {
+    opts.headers = headers;
+  }
   if (transport === "ws") {
     return `import { createClient } from "oxidejs/rpc/client";
 import { actionsGroup } from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
 const __proto = typeof location === "undefined" ? "ws:" : location.protocol === "https:" ? "wss:" : "ws:";
 const __host = typeof location === "undefined" ? "localhost" : location.host;
-export const client = createClient(actionsGroup, { ...${JSON.stringify(opts)}, url: __proto + "//" + __host + ${JSON.stringify(path)} });
+export const client = createClient(actionsGroup, { ...${JSON.stringify(opts)}, url: __proto + "//" + __host + ${JSON.stringify(actionPath)} });
 `;
   }
   return `import { createClient } from "oxidejs/rpc/client";
 import { actionsGroup } from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
 export const client = createClient(actionsGroup, ${JSON.stringify(opts)});
 `;
-}
+};
 
-export function generateClientStub(mod: Pick<ServerModule, "key" | "exports" | "streams">): string {
-  const streams = new Set(mod.streams ?? []);
+export const generateClientStub = function generateClientStub(
+  mod: Pick<ServerModule, "key" | "exports" | "streams">
+): string {
+  const streams = new Set(mod.streams);
   const lines = [
     `// oxidejs:client-stub`,
     `import { wrapClientRpc, wrapClientStreamRpc } from "oxidejs";`,
@@ -163,32 +222,39 @@ export function generateClientStub(mod: Pick<ServerModule, "key" | "exports" | "
     }
   }
   return `${lines.join("\n")}\n`;
-}
+};
 
-export function generateActionsClientModule(modules: ServerModule[]): string {
+export const generateActionsClientModule = function generateActionsClientModule(
+  modules: ServerModule[]
+): string {
   const lines = [
     `import { Schema } from "effect";`,
     `import { Rpc, RpcGroup } from "effect/unstable/rpc";`,
   ];
   const rpcNames: string[] = [];
-  modules.forEach((mod, i) => {
+  for (const [i, mod] of modules.entries()) {
     for (const name of mod.exports) {
       const rpc = `__rpc_${i}_${name}`;
       rpcNames.push(rpc);
       const tag = `${mod.key}.${name}`;
       const stream = mod.streams?.includes(name) ?? false;
       lines.push(
-        `const ${rpc} = Rpc.make(${JSON.stringify(tag)}, { payload: Schema.Struct({ args: Schema.Array(Schema.Unknown) }), success: Schema.Unknown${stream ? ", stream: true" : ""} });`,
+        `const ${rpc} = Rpc.make(${JSON.stringify(tag)}, { payload: Schema.Struct({ args: Schema.Array(Schema.Unknown) }), success: Schema.Unknown${stream ? ", stream: true" : ""} });`
       );
     }
-  });
-  lines.push(`export const actionsGroup = RpcGroup.make(${rpcNames.join(", ")});`);
-  lines.push(`export default actionsGroup;`);
-  lines.push(`export { actionsGroup as actions };`);
+  }
+  lines.push(
+    `export const actionsGroup = RpcGroup.make(${rpcNames.join(", ")});`,
+    `export default actionsGroup;`,
+    `export { actionsGroup as actions };`
+  );
   return `${lines.join("\n")}\n`;
-}
+};
 
-export function generateActionsModule(modules: ServerModule[], opts?: { bust?: boolean }): string {
+export const generateActionsModule = function generateActionsModule(
+  modules: ServerModule[],
+  opts?: { bust?: boolean }
+): string {
   const lines = [
     `import { Effect } from "effect";`,
     `import { Schema } from "effect";`,
@@ -213,7 +279,10 @@ export function generateActionsModule(modules: ServerModule[], opts?: { bust?: b
   const rpcNames: string[] = [];
   const aliases = modules.map((mod, i) => {
     const alias = `__m${i}`;
-    const spec = opts?.bust === true ? `${mod.abs}?t=${fs.statSync(mod.abs).mtimeMs}` : mod.abs;
+    const spec =
+      opts?.bust === true
+        ? `${mod.abs}?t=${fs.statSync(mod.abs).mtimeMs}`
+        : mod.abs;
     lines.push(`import * as ${alias} from ${JSON.stringify(spec)};`);
     for (const name of mod.exports) {
       const rpc = `__rpc_${i}_${name}`;
@@ -221,13 +290,15 @@ export function generateActionsModule(modules: ServerModule[], opts?: { bust?: b
       const tag = `${mod.key}.${name}`;
       const stream = mod.streams?.includes(name) ?? false;
       lines.push(
-        `const ${rpc} = Rpc.make(${JSON.stringify(tag)}, { payload: Schema.Struct({ args: Schema.Array(Schema.Unknown) }), success: Schema.Unknown${stream ? ", stream: true" : ""} });`,
+        `const ${rpc} = Rpc.make(${JSON.stringify(tag)}, { payload: Schema.Struct({ args: Schema.Array(Schema.Unknown) }), success: Schema.Unknown${stream ? ", stream: true" : ""} });`
       );
     }
     return { alias, mod };
   });
-  lines.push(`export const actionsGroup = RpcGroup.make(${rpcNames.join(", ")});`);
-  lines.push(`export const actionsHandlers = actionsGroup.toLayer({`);
+  lines.push(
+    `export const actionsGroup = RpcGroup.make(${rpcNames.join(", ")});`,
+    `export const actionsHandlers = actionsGroup.toLayer({`
+  );
   for (const { alias, mod } of aliases) {
     for (const name of mod.exports) {
       const tag = `${mod.key}.${name}`;
@@ -235,84 +306,88 @@ export function generateActionsModule(modules: ServerModule[], opts?: { bust?: b
       lines.push(
         stream
           ? `  ${JSON.stringify(tag)}: ({ args }) => { const __s = getRequestStore(); return asyncGenToStreamInContext(() => ${alias}[${JSON.stringify(name)}].apply(null, args), (fn) => __withStore(__s, fn)); },`
-          : `  ${JSON.stringify(tag)}: ({ args }) => __run(() => ${alias}[${JSON.stringify(name)}].apply(null, args)),`,
+          : `  ${JSON.stringify(tag)}: ({ args }) => __run(() => ${alias}[${JSON.stringify(name)}].apply(null, args)),`
       );
     }
   }
-  lines.push(`});`);
-  lines.push(`export default actionsGroup;`);
-  lines.push(`export { actionsGroup as actions };`);
+  lines.push(
+    `});`,
+    `export default actionsGroup;`,
+    `export { actionsGroup as actions };`
+  );
   return `${lines.join("\n")}\n`;
-}
+};
 
-function pipeResponse(
+const pipeResponse = async function pipeResponse(
   req: IncomingMessage,
   res: ServerResponse,
-  response: Response,
+  response: Response
 ): Promise<void> {
-  return new Promise((resolve, reject) => {
-    res.statusCode = response.status;
-    response.headers.forEach((value, key) => {
-      res.setHeader(key, value);
-    });
-    if (!response.body) {
+  res.statusCode = response.status;
+  for (const [key, value] of response.headers) {
+    res.setHeader(key, value);
+  }
+  if (!response.body) {
+    res.end();
+    return;
+  }
+  const reader = response.body.getReader();
+  const abort = () => {
+    void reader.cancel();
+  };
+  req.once("aborted", abort);
+  const pull = async function pull(): Promise<void> {
+    const { done, value } = await reader.read();
+    if (done) {
+      req.off("aborted", abort);
       res.end();
-      resolve();
       return;
     }
-    const reader = response.body.getReader();
-    const abort = () => {
-      void reader.cancel();
-    };
-    req.once("aborted", abort);
-    const pull = (): void => {
-      reader.read().then(({ done, value }) => {
-        if (done) {
-          req.off("aborted", abort);
-          res.end();
-          resolve();
-          return;
-        }
-        if (value) res.write(value);
-        pull();
-      }, reject);
-    };
-    pull();
-  });
+    if (value) {
+      res.write(value);
+    }
+    await pull();
+  };
+  await pull();
+};
+
+interface WorkerWrapperOpts {
+  actionPath?: string;
+  actionSameOrigin?: boolean;
+  actions?: OxidejsActionTransport;
+  bodyLimit?: number;
+  clientDir?: string;
+  env?: { [key: string]: OxidejsJson } | undefined;
+  hasActions?: boolean;
+  hasClient?: boolean;
+  hasPublic?: boolean;
+  imports?: string[];
+  middleware?: (string | MiddlewareModuleConfig)[];
+  notFound?: string | undefined;
+  preset?: OxidejsPreset;
 }
 
-export function generateWorkerWrapper(
-  userWorkerAbs: string,
-  opts: {
-    preset?: OxidejsPreset;
-    clientDir?: string;
-    hasClient?: boolean;
-    hasPublic?: boolean;
-    hasActions?: boolean;
-    actions?: OxidejsActionTransport;
-    actionPath?: string;
-    actionSameOrigin?: boolean;
-    middleware?: (string | { module: string; imports?: string[] })[];
-    imports?: string[];
-    bodyLimit?: number;
-    notFound?: string | undefined;
-    env?: Record<string, unknown> | undefined;
-  } = {},
+interface MiddlewareModuleConfig {
+  imports?: string[];
+  module: string;
+}
+
+const isMiddlewareSpecifier = function isMiddlewareSpecifier(
+  entry: string | MiddlewareModuleConfig
+): entry is string {
+  return typeof entry === "string";
+};
+
+const EMPTY_MIDDLEWARE_IMPORTS: string[] = [];
+
+const buildAssetBlock = function buildAssetBlock(
+  serveAssets: boolean,
+  clientDir: string
 ): string {
-  const preset = opts.preset ?? "fetch";
-  const clientDir = opts.clientDir ?? "client";
-  const actionPath = opts.actionPath ?? ACTION_PATH;
-  const sameOrigin = opts.actionSameOrigin ?? false;
-  const serveAssets = preset === "fetch" && (opts.hasClient === true || opts.hasPublic === true);
-  const hasActions = opts.hasActions !== false;
-  const ws = hasActions && opts.actions === "ws";
-  const bodyLimit = opts.bodyLimit ?? 1048576;
-  const nfBody = JSON.stringify(opts.notFound ?? "<h1>404 Not Found</h1>");
-  const __nf = `() => new Response(${nfBody}, { status: 404, headers: { "content-type": "text/html; charset=utf-8" } })`;
-  void __nf; // referenced by name inside the generated wrapper source
-  const nfBlock = `const __nf = ${__nf};\n`;
-  const assetBlock = serveAssets
-    ? `import { readFile } from "node:fs/promises";
+  if (!serveAssets) {
+    return "";
+  }
+  return `import { readFile } from "node:fs/promises";
 import { extname, join } from "node:path";
 const __assets = join(import.meta.dirname, ${JSON.stringify(clientDir)});
 const __types = { ".html": "text/html; charset=utf-8", ".js": "text/javascript", ".css": "text/css", ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png", ".ico": "image/x-icon", ".woff2": "font/woff2", ".webp": "image/webp" };
@@ -354,30 +429,54 @@ async function __asset(request, spa) {
     return;
   }
 }
-`
-    : "";
-  const envJson = JSON.stringify(opts.env ?? {});
+`;
+};
+
+const buildAfterAction = function buildAfterAction(
+  serveAssets: boolean,
+  preset: OxidejsPreset,
+  envJson: string
+): string {
   const celldAfterAction = `{
-    const hit = typeof user.fetch === "function" ? await user.fetch(request, env ?? ${envJson}, ctx) : undefined;
+    const hit = __userFetch ? await __userFetch(request, env ?? ${envJson}, ctx) : undefined;
     if (hit) return hit;
     const assets = env?.ASSETS;
     if (assets && typeof assets.fetch === "function") return assets.fetch(request);
     return __nf();
   }`;
-  const afterAction = serveAssets
-    ? `if (typeof user.fetch === "function") {
-      const hit = await user.fetch(request, env ?? ${envJson}, ctx);
+  if (serveAssets) {
+    return `if (__userFetch) {
+      const hit = await __userFetch(request, env ?? ${envJson}, ctx);
       if (hit) return hit;
     }
-    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? __nf();`
-    : preset === "celld"
-      ? celldAfterAction
-      : `return typeof user.fetch === "function"
-      ? user.fetch(request, env, ctx)
+    return (await __asset(request)) ?? (__nav(request) ? await __asset(request, true) : undefined) ?? __nf();`;
+  }
+  if (preset === "celld") {
+    return celldAfterAction;
+  }
+  return `return __userFetch
+      ? __userFetch(request, env, ctx)
       : __nf();`;
-  const listen =
-    preset === "fetch"
-      ? `
+};
+
+const buildListenBlock = function buildListenBlock(
+  preset: OxidejsPreset,
+  bodyLimit: number,
+  ws: boolean
+): string {
+  if (preset !== "fetch") {
+    return "";
+  }
+  const wsUpgrade = ws
+    ? `
+  import("crossws/adapters/node").then(({ default: crossws }) => {
+    const ws = crossws({ hooks: __ws });
+    server.on("upgrade", (req, socket, head) => {
+      if ((__actionMatch)(req.url?.split("?")[0] ?? "")) ws.handleUpgrade(req, socket, head);
+    });
+  });`
+    : "";
+  return `
 import { createServer } from "node:http";
 import { pathToFileURL } from "node:url";
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
@@ -415,17 +514,7 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       if (value) res.write(value);
     }
     res.end();
-  });${
-    ws
-      ? `
-  import("crossws/adapters/node").then(({ default: crossws }) => {
-    const ws = crossws({ hooks: __ws });
-    server.on("upgrade", (req, socket, head) => {
-      if ((__actionMatch)(req.url?.split("?")[0] ?? "")) ws.handleUpgrade(req, socket, head);
-    });
-  });`
-      : ""
-  }
+  });${wsUpgrade}
   server.listen(port, () => console.log(\`oxidejs listening on \${port}\`));
 }
   for (const signal of ["SIGTERM", "SIGINT"]) {
@@ -434,64 +523,148 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       setTimeout(() => process.exit(0), 5000).unref();
     });
   }
-`
-      : "";
-  const actionImports = hasActions
-    ? ws
-      ? `import { createWsHooks } from "oxidejs/rpc";
+`;
+};
+
+const buildActionImports = function buildActionImports(
+  hasActions: boolean,
+  ws: boolean,
+  actionPath: string,
+  sameOrigin: boolean
+): string {
+  if (!hasActions) {
+    return "";
+  }
+  if (ws) {
+    return `import { createWsHooks } from "oxidejs/rpc";
 import { actionsGroup, actionsHandlers } from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
 const __ws = createWsHooks(actionsGroup, actionsHandlers, { path: ${JSON.stringify(actionPath)}, sameOrigin: ${sameOrigin} });
-`
-      : `import { createActionHandler } from "oxidejs/rpc";
+`;
+  }
+  return `import { createActionHandler } from "oxidejs/rpc";
 import { actionsGroup, actionsHandlers } from ${JSON.stringify(VIRTUAL_ACTIONS_ID)};
 const __fetch = Symbol.for("oxidejs.fetch");
 const __rpc = createActionHandler(actionsGroup, actionsHandlers, { path: ${JSON.stringify(actionPath)}, sameOrigin: ${sameOrigin}, createContext: (req) => req[__fetch] ?? {} });
-`
-    : "";
-  const actionMatchFn = `const __actionMatch = (p) => p === ${JSON.stringify(actionPath)} || p === ${JSON.stringify(`${actionPath}/`)};`;
-  const actionGate =
-    hasActions && !ws
-      ? `if ((__actionMatch)(new URL(request.url).pathname)) {
-      return __rpc(request);
-    }
-    `
-      : "";
+`;
+};
+
+const normalizeMiddlewareEntries = function normalizeMiddlewareEntries(
+  middleware: (string | MiddlewareModuleConfig)[]
+): MiddlewareModuleConfig[] {
   // Establish the action context (env, fetch ctx) for every request — not just
   // /__oxide/action — so SSR middlewares (e.g. @ilha/router frames) render
   // islands with useEnv()/useRequest() intact.
   // Convention: the ilha SSR middleware needs its server route graph loaded
   // before it runs; inject its known side-effect specifiers automatically.
   const ILHA_SSR_IMPLICIT = ["ilha:pages/server", "ilha:loaders"];
-  const mwEntries = (opts.middleware ?? []).map((m) =>
-    typeof m === "string"
-      ? {
-          module: m,
-          imports: m === "@ilha/router/ssr" ? ILHA_SSR_IMPLICIT : ([] as string[]),
-        }
-      : m,
-  );
-  const middlewareImports =
-    mwEntries
-      .map(
-        (m, i) =>
-          (m.imports ?? []).map((spec) => `import ${JSON.stringify(spec)};`).join("\n") +
-          `\nimport __mw${i} from ${JSON.stringify(m.module)};`,
-      )
-      .join("\n") + "\n";
-  const middlewareList = (opts.middleware ?? []).map((_, i) => `__mw${i}`).join(", ");
-  const middlewareGate = opts.middleware?.length
-    ? `for (const __mw of [${middlewareList}]) {
+  return middleware.map((m) => {
+    if (isMiddlewareSpecifier(m)) {
+      return {
+        imports:
+          m === "@ilha/router/ssr"
+            ? ILHA_SSR_IMPLICIT
+            : EMPTY_MIDDLEWARE_IMPORTS,
+        module: m,
+      };
+    }
+    return m;
+  });
+};
+
+const buildMiddlewareImports = function buildMiddlewareImports(
+  mwEntries: MiddlewareModuleConfig[]
+): string {
+  return `${mwEntries
+    .map((m, i) => {
+      const sideEffects = (m.imports ?? [])
+        .map((spec) => `import ${JSON.stringify(spec)};`)
+        .join("\n");
+      return `${sideEffects}\nimport __mw${i} from ${JSON.stringify(m.module)};`;
+    })
+    .join("\n")}\n`;
+};
+
+const buildActionGate = function buildActionGate(
+  hasActions: boolean,
+  ws: boolean
+): string {
+  if (!(hasActions && !ws)) {
+    return "";
+  }
+  return `if ((__actionMatch)(new URL(request.url).pathname)) {
+      return __rpc(request);
+    }
+    `;
+};
+
+const buildMiddlewareGate = function buildMiddlewareGate(
+  middleware: (string | MiddlewareModuleConfig)[] | undefined
+): string {
+  if (!middleware?.length) {
+    return "";
+  }
+  const middlewareList = middleware.map((_, i) => `__mw${i}`).join(", ");
+  return `for (const __mw of [${middlewareList}]) {
       const hit = await __mw(request, { env, ctx });
       if (hit) return hit;
     }
-    `
-    : "";
+    `;
+};
+
+const buildCelldDomBlock = function buildCelldDomBlock(
+  preset: OxidejsPreset
+): string {
+  if (preset !== "celld") {
+    return "";
+  }
+  return `import "oxidejs/worker-dom/install";\n`;
+};
+
+export const generateWorkerWrapper = function generateWorkerWrapper(
+  userWorkerAbs: string,
+  opts: WorkerWrapperOpts = {}
+): string {
+  const preset = opts.preset ?? "fetch";
+  const clientDir = opts.clientDir ?? "client";
+  const actionPath = opts.actionPath ?? ACTION_PATH;
+  const sameOrigin = opts.actionSameOrigin ?? false;
+  const serveAssets =
+    preset === "fetch" && (opts.hasClient === true || opts.hasPublic === true);
+  const hasActions = opts.hasActions !== false;
+  const ws = hasActions && opts.actions === "ws";
+  const bodyLimit = opts.bodyLimit ?? 1_048_576;
+  const nfBody = JSON.stringify(opts.notFound ?? "<h1>404 Not Found</h1>");
+  const __nf = `() => new Response(${nfBody}, { status: 404, headers: { "content-type": "text/html; charset=utf-8" } })`;
+  // referenced by name inside the generated wrapper source
+  void __nf;
+  const nfBlock = `const __nf = ${__nf};\n`;
+  const assetBlock = buildAssetBlock(serveAssets, clientDir);
+  const envJson = JSON.stringify(opts.env ?? {});
+  const afterAction = buildAfterAction(serveAssets, preset, envJson);
+  const listen = buildListenBlock(preset, bodyLimit, ws);
+  const actionImports = buildActionImports(
+    hasActions,
+    ws,
+    actionPath,
+    sameOrigin
+  );
+  const actionMatchFn = `const __actionMatch = (p) => p === ${JSON.stringify(actionPath)} || p === ${JSON.stringify(`${actionPath}/`)};`;
+  const actionGate = buildActionGate(hasActions, ws);
+  const mwEntries = normalizeMiddlewareEntries(opts.middleware ?? []);
+  const middlewareImports = buildMiddlewareImports(mwEntries);
+  const middlewareGate = buildMiddlewareGate(opts.middleware);
   const sideEffectImports = (opts.imports ?? [])
     .map((spec) => `import ${JSON.stringify(spec)};`)
     .join("\n");
-  const celldDomBlock = preset === "celld" ? `import "oxidejs/worker-dom/install";\n` : "";
+  const celldDomBlock = buildCelldDomBlock(preset);
   return `${sideEffectImports}${celldDomBlock}export * from ${JSON.stringify(userWorkerAbs)};
-import user from ${JSON.stringify(userWorkerAbs)};
+import user, { fetch as __namedFetch } from ${JSON.stringify(userWorkerAbs)};
+const __userFetch =
+  user != null && typeof user.fetch === "function"
+    ? user.fetch.bind(user)
+    : typeof __namedFetch === "function"
+      ? __namedFetch
+      : undefined;
 ${middlewareImports}${actionImports}${hasActions ? `${actionMatchFn}\n` : ""}${assetBlock}${nfBlock}const app = {
   ...user,
   async fetch(request, env, ctx) {
@@ -501,85 +674,138 @@ ${middlewareImports}${actionImports}${hasActions ? `${actionMatchFn}\n` : ""}${a
 };
 export default app;
 ${listen}`;
-}
+};
 
-export type StubEnvironment = {
-  name?: string;
-  consumer?: string;
+export interface StubEnvironment {
   config?: { consumer?: string };
-};
+  consumer?: string;
+  name?: string;
+}
 
-export type StubExtra = {
+export interface StubExtra {
   ssr?: boolean;
   target?: string | string[];
-};
+}
 
-const SERVER_TARGETS = new Set(["node", "async-node", "webworker", "web-worker"]);
+const SERVER_TARGETS = new Set([
+  "node",
+  "async-node",
+  "webworker",
+  "web-worker",
+]);
 const CLIENT_TARGETS = new Set(["web", "browserslist"]);
 const SERVER_NAMES = new Set(["server", "ssr", "worker", "node"]);
 const CLIENT_NAMES = new Set(["client", "web"]);
 
 /** Stub unless the graph is a known server. Unknown graphs stub so *.server.ts never ships. */
-export function shouldStubServerModule(environment?: StubEnvironment, extra?: StubExtra): boolean {
-  if (extra?.ssr) return false;
+export const shouldStubServerModule = function shouldStubServerModule(
+  environment?: StubEnvironment,
+  extra?: StubExtra
+): boolean {
+  if (extra?.ssr) {
+    return false;
+  }
 
   const consumer = environment?.config?.consumer ?? environment?.consumer;
-  if (consumer === "server") return false;
-  if (consumer === "client") return true;
+  if (consumer === "server") {
+    return false;
+  }
+  if (consumer === "client") {
+    return true;
+  }
 
   const name = environment?.name;
-  if (name && CLIENT_NAMES.has(name)) return true;
-  if (name && SERVER_NAMES.has(name)) return false;
+  if (name && CLIENT_NAMES.has(name)) {
+    return true;
+  }
+  if (name && SERVER_NAMES.has(name)) {
+    return false;
+  }
 
-  const targets = extra?.target == null ? [] : [extra.target].flat();
-  if (targets.some((target) => SERVER_TARGETS.has(target))) return false;
-  if (targets.some((target) => CLIENT_TARGETS.has(target))) return true;
+  const targets =
+    extra?.target === undefined || extra.target === null
+      ? []
+      : [extra.target].flat();
+  if (targets.some((target) => SERVER_TARGETS.has(target))) {
+    return false;
+  }
+  if (targets.some((target) => CLIENT_TARGETS.has(target))) {
+    return true;
+  }
 
   return true;
-}
+};
 
-export function pluginShouldStub(pluginThis: unknown, options?: { ssr?: boolean }): boolean {
-  const ctx = pluginThis as {
-    environment?: StubEnvironment;
-    getNativeBuildContext?: () => {
-      compiler?: { name?: string; options?: { name?: string; target?: string | string[] } };
+interface PluginStubContext {
+  environment?: StubEnvironment;
+  getNativeBuildContext?: () => {
+    compiler?: {
+      name?: string;
+      options?: { name?: string; target?: string | string[] };
     };
   };
+}
+
+export const pluginShouldStub = function pluginShouldStub(
+  pluginThis: PluginStubContext,
+  options?: { ssr?: boolean }
+): boolean {
+  const ctx = pluginThis;
   const compiler = ctx.getNativeBuildContext?.()?.compiler;
   const env: StubEnvironment = {};
-  const name = ctx.environment?.name ?? compiler?.name ?? compiler?.options?.name;
-  if (name) env.name = name;
-  if (ctx.environment?.consumer) env.consumer = ctx.environment.consumer;
-  if (ctx.environment?.config) env.config = ctx.environment.config;
+  const name =
+    ctx.environment?.name ?? compiler?.name ?? compiler?.options?.name;
+  if (name) {
+    env.name = name;
+  }
+  if (ctx.environment?.consumer) {
+    env.consumer = ctx.environment.consumer;
+  }
+  if (ctx.environment?.config) {
+    env.config = ctx.environment.config;
+  }
   const extra: StubExtra = {};
-  if (options?.ssr) extra.ssr = true;
-  if (compiler?.options?.target) extra.target = compiler.options.target;
+  if (options?.ssr) {
+    extra.ssr = true;
+  }
+  if (compiler?.options?.target) {
+    extra.target = compiler.options.target;
+  }
   return shouldStubServerModule(env, extra);
-}
+};
 
-export function loadClientStub(id: string): string {
+export const loadClientStub = function loadClientStub(id: string): string {
   const file = id.split("?")[0] ?? id;
-  const source = fs.readFileSync(file, "utf8");
+  const source = fs.readFileSync(file, "utf-8");
   return generateClientStub({
-    key: moduleKey(file),
     exports: parseExportedNames(source),
+    key: moduleKey(file),
     streams: parseStreamExports(source),
   });
-}
+};
 
-export class RequestBodyTooLargeError extends Error {}
+export class RequestBodyTooLargeError extends Error {
+  constructor(message?: string) {
+    super(message);
+    this.name = "RequestBodyTooLargeError";
+  }
+}
 
-export async function nodeToWebRequest(
+export const nodeToWebRequest = async function nodeToWebRequest(
   req: IncomingMessage,
-  maxBytes = Number.POSITIVE_INFINITY,
+  maxBytes = Number.POSITIVE_INFINITY
 ): Promise<Request> {
   const host = req.headers.host ?? "localhost";
   const url = `http://${host}${req.url ?? "/"}`;
   const headers = new Headers();
   for (const [key, value] of Object.entries(req.headers)) {
-    if (value === undefined) continue;
+    if (value === undefined) {
+      continue;
+    }
     if (Array.isArray(value)) {
-      for (const item of value) headers.append(key, item);
+      for (const item of value) {
+        headers.append(key, item);
+      }
     } else {
       headers.set(key, value);
     }
@@ -587,29 +813,31 @@ export async function nodeToWebRequest(
   const ac = new AbortController();
   req.once("aborted", () => ac.abort());
   const method = req.method ?? "GET";
-  const init: RequestInit = { method, headers, signal: ac.signal };
-  if (method === "GET" || method === "HEAD") return new Request(url, init);
+  const init: RequestInit = { headers, method, signal: ac.signal };
+  if (method === "GET" || method === "HEAD") {
+    return new Request(url, init);
+  }
   const chunks: Buffer[] = [];
   let size = 0;
   for await (const chunk of req) {
-    const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
     size += buffer.length;
-    if (size > maxBytes) throw new RequestBodyTooLargeError();
+    if (size > maxBytes) {
+      throw new RequestBodyTooLargeError();
+    }
     chunks.push(buffer);
   }
   const body = Buffer.concat(chunks);
-  if (body.length > 0) init.body = body;
+  if (body.length > 0) {
+    init.body = body;
+  }
   return new Request(url, init);
-}
-
-export async function sendWebResponse(res: ServerResponse, response: Response): Promise<void> {
-  return pipeResponse({} as IncomingMessage, res, response);
-}
+};
 
-export async function sendWebResponseFrom(
+export const sendWebResponseFrom = function sendWebResponseFrom(
   req: IncomingMessage,
   res: ServerResponse,
-  response: Response,
+  response: Response
 ): Promise<void> {
   return pipeResponse(req, res, response);
-}
+};
diff --git a/packages/oxidejs/src/context.ts b/packages/oxidejs/src/context.ts
index 67ce4a7..b0b39be 100644
--- a/packages/oxidejs/src/context.ts
+++ b/packages/oxidejs/src/context.ts
@@ -1,31 +1,69 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import process from "node:process";
 
+import type { OxidejsJson } from "./types";
+
 const ALS_KEY = Symbol.for("oxidejs.requestContext");
 const FETCH_KEY = Symbol.for("oxidejs.fetch");
 
-export type ExecutionContext = {
-  waitUntil?(promise: Promise<unknown>): void;
-  passThroughOnException?(): void;
-};
+export interface ExecutionContext {
+  passThroughOnException?: () => void;
+  waitUntil?: (
+    promise: PromiseLike<OxidejsJson | object | null | undefined>
+  ) => void;
+}
+
+/** Return from `src/server.ts` `fetch`. `undefined` falls through to assets. */
+export type FetchResult = Response | undefined;
+
+/**
+ * `src/server.ts` fetch handler. The generated wrapper always calls
+ * `fetch(request, env, ctx)` — `env` may be `{}` on Node without the `env` option.
+ * Return `undefined` (or bare `return`) to fall through to assets.
+ */
+export type FetchHandler<
+  Env extends { [key: string]: OxidejsJson } = { [key: string]: OxidejsJson },
+> = (
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext
+) => FetchResult | Promise<FetchResult>;
+
+/** Default export shape for `src/server.ts`. */
+export interface ServerEntry<
+  Env extends { [key: string]: OxidejsJson } = { [key: string]: OxidejsJson },
+> {
+  fetch: FetchHandler<Env>;
+}
+
+/** Values middleware may attach on the request context bag. */
+export type ActionContextValue =
+  | Request
+  | ExecutionContext
+  | OxidejsJson
+  | { [key: string]: OxidejsJson }
+  | undefined;
 
 /** RPC procedure request context. Starts as `{ req }` plus Worker extras. Middleware can add fields. */
-export type ActionContext = {
+export interface ActionContext {
+  [key: string]: ActionContextValue;
   req: Request;
-  env?: unknown;
+  env?: { [key: string]: OxidejsJson };
   fetchCtx?: ExecutionContext;
-  [key: string]: unknown;
-};
-
-type AlsGlobal = typeof globalThis & { [key: symbol]: unknown };
+}
 
 /** Override for tests. `null` uses `process.versions.webcontainer`. */
 let webcontainerOverride: boolean | null = null;
 
 /** StackBlitz WebContainers lose AsyncLocalStorage across `async/await`. */
-export const inWebcontainer = (): boolean => {
-  if (webcontainerOverride !== null) return webcontainerOverride;
-  if (typeof process === "undefined") return false;
+export const inWebcontainer = function inWebcontainer(): boolean {
+  if (webcontainerOverride !== null) {
+    return webcontainerOverride;
+  }
+  if (process === undefined) {
+    return false;
+  }
+  // SAFETY: Node's process.versions is a string bag; WebContainer adds an optional key.
   const versions = process.versions as NodeJS.ProcessVersions & {
     webcontainer?: string;
   };
@@ -33,7 +71,9 @@ export const inWebcontainer = (): boolean => {
 };
 
 /** Test-only: force or clear the WebContainer detection path. */
-export const __setInWebcontainerForTests = (value: boolean | null): void => {
+export const __setInWebcontainerForTests = function __setInWebcontainerForTests(
+  value: boolean | null
+): void {
   webcontainerOverride = value;
 };
 
@@ -41,29 +81,56 @@ export const __setInWebcontainerForTests = (value: boolean | null): void => {
 let syncStore: ActionContext | null = null;
 
 /** Serialize handler *entry* on WebContainer so syncStore is not stomped. */
-let entryTail: Promise<void> = Promise.resolve();
+let entryTail: Promise<null> = Promise.resolve(null);
+
+const als = function als(): AsyncLocalStorage<ActionContext> {
+  // SAFETY: ALS_KEY is oxide-owned; the slot is only ever AsyncLocalStorage<ActionContext>.
+  const g = globalThis as typeof globalThis & {
+    [ALS_KEY]?: AsyncLocalStorage<ActionContext>;
+  };
+  const existing = g[ALS_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = new AsyncLocalStorage<ActionContext>();
+  g[ALS_KEY] = created;
+  return created;
+};
 
-function als(): AsyncLocalStorage<ActionContext> {
-  const g = globalThis as AlsGlobal;
-  return (g[ALS_KEY] ??=
-    new AsyncLocalStorage<ActionContext>()) as AsyncLocalStorage<ActionContext>;
+interface Thenable {
+  then: (
+    onfulfilled?:
+      | ((value: OxidejsJson | undefined) => OxidejsJson | Thenable | undefined)
+      | null,
+    onrejected?:
+      | ((
+          reason: OxidejsJson | undefined
+        ) => OxidejsJson | Thenable | undefined)
+      | null
+  ) => Thenable;
 }
 
-const isPromiseLike = (value: unknown): value is PromiseLike<unknown> =>
-  value !== null &&
-  (typeof value === "object" || typeof value === "function") &&
-  typeof (value as PromiseLike<unknown>).then === "function";
+const isPromiseLike = function isPromiseLike(
+  value: Thenable | null | undefined
+): value is Thenable {
+  if (value === null || value === undefined) {
+    return false;
+  }
+  return typeof value.then === "function";
+};
 
 /** Current request context: ALS first, then the WebContainer sync fallback. */
-export function getRequestStore(): ActionContext {
+export const getRequestStore = function getRequestStore(): ActionContext {
   const current = als().getStore() ?? syncStore;
-  if (!current) throw new Error("oxidejs: request context is unavailable");
+  if (!current) {
+    throw new Error("oxidejs: request context is unavailable");
+  }
   return current;
-}
+};
 
-function store(): ActionContext {
+const store = function store(): ActionContext {
   return getRequestStore();
-}
+};
 
 /**
  * Run `fn` with `store` on ALS and the sync fallback. On WebContainer the sync
@@ -71,17 +138,31 @@ function store(): ActionContext {
  * at invoke time and re-enter via this helper on each pull). Sync returns and
  * throws restore immediately so a completed request is not left visible.
  */
-export function withRequestStore<T>(ctx: ActionContext, fn: () => T): T {
+export const withRequestStore = function withRequestStore<T>(
+  ctx: ActionContext,
+  fn: () => T
+): T {
   const previous = syncStore;
   syncStore = ctx;
   let deferRestore = false;
   try {
     const result = als().run(ctx, fn);
-    if (inWebcontainer() && isPromiseLike(result)) {
+    // SAFETY: async handlers return Thenable; sync returns are not — only then defer restore.
+    if (
+      inWebcontainer() &&
+      isPromiseLike(result as Thenable | null | undefined)
+    ) {
       deferRestore = true;
-      return Promise.resolve(result).finally(() => {
-        if (syncStore === ctx) syncStore = previous;
-      }) as T;
+      // SAFETY: when result is Thenable, T is a Promise type; settle then restore syncStore.
+      return (async () => {
+        try {
+          return await result;
+        } finally {
+          if (syncStore === ctx) {
+            syncStore = previous;
+          }
+        }
+      })() as T;
     }
     return result;
   } finally {
@@ -89,56 +170,79 @@ export function withRequestStore<T>(ctx: ActionContext, fn: () => T): T {
       syncStore = previous;
     }
   }
-}
+};
 
 /**
  * Serialize async work that installs request context on WebContainer.
  * Release as soon as `fn` settles — do not wait for streamed response bodies.
  */
-export async function withRequestEntry<T>(fn: () => Promise<T>): Promise<T> {
-  if (!inWebcontainer()) return fn();
-  let release!: () => void;
-  const gate = new Promise<void>((resolve) => {
-    release = resolve;
-  });
+export const withRequestEntry = async function withRequestEntry<T>(
+  fn: () => Promise<T>
+): Promise<T> {
+  if (!inWebcontainer()) {
+    return fn();
+  }
+  const { promise: gate, resolve: release } = Promise.withResolvers<null>();
   const previous = entryTail;
   entryTail = gate;
   await previous;
   try {
     return await fn();
   } finally {
-    release();
+    release(null);
   }
-}
+};
 
 /** Current RPC or host request context. Throws outside request handling. */
-export function useCtx<C extends ActionContext = ActionContext>(): C {
+export const useCtx = function useCtx<
+  C extends ActionContext = ActionContext,
+>(): C {
+  // SAFETY: callers narrow ActionContext via C; the runtime store is always ActionContext.
   return store() as C;
-}
+};
 
 /** Current server `Request`. Available in actions, SSR, and frame renders. */
-export function useRequest(): Request {
+export const useRequest = function useRequest(): Request {
   return store().req;
-}
+};
 
 /** Worker `env` from `fetch(request, env, ctx)`. `undefined` on the Node fetch preset. */
-export function useEnv<E = unknown>(): E | undefined {
+export const useEnv = function useEnv<E = { [key: string]: OxidejsJson }>():
+  | E
+  | undefined {
+  // SAFETY: callers pick E; host env is a string-keyed binding bag stamped into ActionContext.
   return store().env as E | undefined;
-}
+};
 
 /** Worker `ctx` from `fetch(request, env, ctx)` (`waitUntil`). `undefined` on Node. */
-export function useFetchCtx(): ExecutionContext | undefined {
+export const useFetchCtx = function useFetchCtx():
+  | ExecutionContext
+  | undefined {
   return store().fetchCtx;
-}
+};
 
-export function runWithRequest<T>(req: Request, fn: () => T, extra?: Partial<ActionContext>): T {
+export const runWithRequest = function runWithRequest<T>(
+  req: Request,
+  fn: () => T,
+  extra?: Partial<ActionContext>
+): T {
   return withRequestStore({ ...extra, req }, fn);
-}
+};
+
+type RequestStoreHook = <T>(req: Request, fn: () => T) => T;
 
 const HOOK_KEY = Symbol.for("oxidejs.runWithRequest");
-(globalThis as AlsGlobal)[HOOK_KEY] ??= (req: Request, fn: () => unknown) => {
-  const extra = (req as unknown as Record<symbol, Partial<ActionContext> | undefined>)[FETCH_KEY];
-  return runWithRequest(req, fn as () => unknown, extra);
+// SAFETY: HOOK_KEY is oxide-owned; the slot is only ever RequestStoreHook.
+const hookGlobal = globalThis as typeof globalThis & {
+  [HOOK_KEY]?: RequestStoreHook;
+};
+hookGlobal[HOOK_KEY] ??= function oxideRunWithRequest<T>(
+  req: Request,
+  fn: () => T
+): T {
+  // SAFETY: fetch host stamps Partial<ActionContext> on Request under FETCH_KEY before dispatch.
+  const stamped = req as Request & { [FETCH_KEY]?: Partial<ActionContext> };
+  return runWithRequest(req, fn, stamped[FETCH_KEY]);
 };
 
 export {
diff --git a/packages/oxidejs/src/core.test.ts b/packages/oxidejs/src/core.test.ts
index 9dab691..7da60dc 100644
--- a/packages/oxidejs/src/core.test.ts
+++ b/packages/oxidejs/src/core.test.ts
@@ -2,19 +2,26 @@ import { afterEach, describe, expect, test } from "bun:test";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { copyPublicDir, createEmitState, resolveOptions, tryEmitWranglerConfig } from "./core";
 
-const wrangler = { name: "vite-cf", compatibility_date: "2026-01-01" };
+import {
+  copyPublicDir,
+  createEmitState,
+  resolveOptions,
+  tryEmitWranglerConfig,
+} from "./core";
+import type { OxidejsJson } from "./types";
 
-function makeTempRoot(): string {
+const wrangler = { compatibility_date: "2026-01-01", name: "vite-cf" };
+
+const makeTempRoot = function makeTempRoot(): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), "oxidejs-"));
-}
+};
 
 const temps: string[] = [];
 
 afterEach(() => {
   for (const dir of temps.splice(0)) {
-    fs.rmSync(dir, { recursive: true, force: true });
+    fs.rmSync(dir, { force: true, recursive: true });
   }
 });
 
@@ -39,13 +46,13 @@ describe("resolveOptions", () => {
   test("resolves custom action path and explicit cross-origin opt-out", () => {
     const resolved = resolveOptions(
       { actions: { path: "/rpc", sameOrigin: false } },
-      process.cwd(),
+      process.cwd()
     );
     expect(resolved.actionPath).toBe("/rpc");
     expect(resolved.actionSameOrigin).toBe(false);
-    expect(() => resolveOptions({ actions: { path: "rpc?bad" } }, process.cwd())).toThrow(
-      "actions.path",
-    );
+    expect(() =>
+      resolveOptions({ actions: { path: "rpc?bad" } }, process.cwd())
+    ).toThrow("actions.path");
   });
 
   test("detects public/", () => {
@@ -56,11 +63,15 @@ describe("resolveOptions", () => {
   });
 
   test("rejects unknown actions transport and ws+celld", () => {
-    expect(() => resolveOptions({ actions: "ftp" as never }, process.cwd())).toThrow(
-      "unknown actions transport",
-    );
+    // SAFETY: intentional invalid transport string to assert runtime rejection.
+    expect(() =>
+      resolveOptions({ actions: "ftp" as never }, process.cwd())
+    ).toThrow("unknown actions transport");
     expect(() =>
-      resolveOptions({ preset: "celld", actions: "ws", wrangler }, process.cwd()),
+      resolveOptions(
+        { actions: "ws", preset: "celld", wrangler },
+        process.cwd()
+      )
     ).toThrow('actions: "ws" is not supported with preset: "celld"');
   });
 
@@ -76,7 +87,9 @@ describe("resolveOptions", () => {
     temps.push(root);
     fs.writeFileSync(path.join(root, "app.html"), "<html></html>");
     expect(
-      resolveOptions({}, root, { build: { rollupOptions: { input: "app.html" } } }).hasClient,
+      resolveOptions({}, root, {
+        build: { rollupOptions: { input: "app.html" } },
+      }).hasClient
     ).toBe(true);
     expect(resolveOptions({}, root).hasClient).toBe(false);
   });
@@ -86,43 +99,58 @@ describe("resolveOptions", () => {
     temps.push(root);
     fs.writeFileSync(path.join(root, "index.html"), "<html></html>");
     expect(
-      resolveOptions({}, root, { build: { rolldownOptions: { input: "src/main.ts" } } }).hasClient,
+      resolveOptions({}, root, {
+        build: { rolldownOptions: { input: "src/main.ts" } },
+      }).hasClient
     ).toBe(false);
   });
 
   test("celld requires wrangler.name and compatibility_date", () => {
     expect(() => resolveOptions({ preset: "celld" }, process.cwd())).toThrow(
-      "wrangler.name and wrangler.compatibility_date are required",
+      "wrangler.name and wrangler.compatibility_date are required"
     );
     expect(() =>
-      resolveOptions({ preset: "celld", wrangler: { name: "x" } as never }, process.cwd()),
+      // SAFETY: incomplete wrangler fixture — name only — to assert required-field rejection.
+      resolveOptions(
+        { preset: "celld", wrangler: { name: "x" } as never },
+        process.cwd()
+      )
     ).toThrow("wrangler.name and wrangler.compatibility_date are required");
   });
 
   test("rejects unknown wrangler keys", () => {
     expect(() =>
       resolveOptions(
-        { preset: "celld", wrangler: { ...wrangler, kv_namespaces: [] } as never },
-        process.cwd(),
-      ),
+        // SAFETY: kv_namespaces is intentionally unsupported to assert key rejection.
+        {
+          preset: "celld",
+          wrangler: { ...wrangler, kv_namespaces: [] } as never,
+        },
+        process.cwd()
+      )
     ).toThrow("not supported by celld deploy: kv_namespaces");
   });
 
   test("rejects user-supplied main and assets", () => {
     expect(() =>
       resolveOptions(
-        { preset: "celld", wrangler: { ...wrangler, main: "./nope.js" } as never },
-        process.cwd(),
-      ),
+        // SAFETY: user-supplied main is forbidden; cast bypasses the OxidejsWranglerOptions type.
+        {
+          preset: "celld",
+          wrangler: { ...wrangler, main: "./nope.js" } as never,
+        },
+        process.cwd()
+      )
     ).toThrow("computed by the plugin");
     expect(() =>
       resolveOptions(
         {
           preset: "celld",
+          // SAFETY: user-supplied assets is forbidden; cast bypasses the OxidejsWranglerOptions type.
           wrangler: { ...wrangler, assets: { directory: "./nope" } } as never,
         },
-        process.cwd(),
-      ),
+        process.cwd()
+      )
     ).toThrow("computed by the plugin");
   });
 
@@ -131,7 +159,7 @@ describe("resolveOptions", () => {
     temps.push(root);
     fs.writeFileSync(path.join(root, "index.html"), "<html></html>");
     expect(() => resolveOptions({ clientDir: "../escape" }, root)).toThrow(
-      "clientDir must resolve inside outDir",
+      "clientDir must resolve inside outDir"
     );
   });
 
@@ -142,6 +170,15 @@ describe("resolveOptions", () => {
   });
 });
 
+interface EmittedWranglerJson {
+  assets?: { binding: string; directory: string };
+  compatibility_date: string;
+  compatibility_flags: string[];
+  main: string;
+  name: string;
+  vars?: { [key: string]: OxidejsJson };
+}
+
 describe("tryEmitWranglerConfig", () => {
   test("no-ops if server.js is missing", () => {
     const root = makeTempRoot();
@@ -149,7 +186,9 @@ describe("tryEmitWranglerConfig", () => {
     const resolved = resolveOptions({ preset: "celld", wrangler }, root);
     fs.mkdirSync(resolved.outDir, { recursive: true });
     tryEmitWranglerConfig(resolved, createEmitState());
-    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(false);
+    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(
+      false
+    );
   });
 
   test("no-ops if client dir is missing when index.html exists", () => {
@@ -160,7 +199,9 @@ describe("tryEmitWranglerConfig", () => {
     fs.mkdirSync(resolved.outDir, { recursive: true });
     fs.writeFileSync(path.join(resolved.outDir, "server.js"), "export {}");
     tryEmitWranglerConfig(resolved, createEmitState());
-    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(false);
+    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(
+      false
+    );
   });
 
   test("writes wrangler.jsonc without assets when there is no index.html", () => {
@@ -171,12 +212,14 @@ describe("tryEmitWranglerConfig", () => {
     fs.writeFileSync(path.join(resolved.outDir, "server.js"), "export {}");
     tryEmitWranglerConfig(resolved, createEmitState());
     expect(
-      JSON.parse(fs.readFileSync(path.join(resolved.outDir, "wrangler.jsonc"), "utf8")),
+      JSON.parse(
+        fs.readFileSync(path.join(resolved.outDir, "wrangler.jsonc"), "utf-8")
+      )
     ).toEqual({
-      name: "vite-cf",
-      main: "./server.js",
       compatibility_date: "2026-01-01",
       compatibility_flags: ["nodejs_compat"],
+      main: "./server.js",
+      name: "vite-cf",
     });
   });
 
@@ -193,7 +236,7 @@ describe("tryEmitWranglerConfig", () => {
           vars: { FOO: "bar" },
         },
       },
-      root,
+      root
     );
     fs.mkdirSync(path.join(resolved.outDir, resolved.clientDir), {
       recursive: true,
@@ -205,21 +248,22 @@ describe("tryEmitWranglerConfig", () => {
     tryEmitWranglerConfig(resolved, state);
 
     const file = path.join(resolved.outDir, "wrangler.jsonc");
-    const first = fs.readFileSync(file, "utf8");
-    const parsed = JSON.parse(first) as Record<string, unknown>;
+    const first = fs.readFileSync(file, "utf-8");
+    // SAFETY: emitted wrangler.jsonc matches EmittedWranglerJson; JSON.parse is untyped.
+    const parsed = JSON.parse(first) as EmittedWranglerJson;
     expect(parsed).toEqual({
-      name: "vite-cf",
-      main: "./server.js",
+      assets: { binding: "ASSETS", directory: "./client" },
       compatibility_date: "2026-01-01",
       compatibility_flags: ["nodejs_compat"],
+      main: "./server.js",
+      name: "vite-cf",
       vars: { FOO: "bar" },
-      assets: { directory: "./client", binding: "ASSETS" },
     });
     expect(state.emitted).toBe(true);
 
     fs.writeFileSync(file, "changed");
     tryEmitWranglerConfig(resolved, state);
-    expect(fs.readFileSync(file, "utf8")).toBe("changed");
+    expect(fs.readFileSync(file, "utf-8")).toBe("changed");
   });
 
   test("fetch never writes wrangler.jsonc", () => {
@@ -231,7 +275,9 @@ describe("tryEmitWranglerConfig", () => {
     });
     fs.writeFileSync(path.join(resolved.outDir, "server.js"), "export {}");
     tryEmitWranglerConfig(resolved, createEmitState());
-    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(false);
+    expect(fs.existsSync(path.join(resolved.outDir, "wrangler.jsonc"))).toBe(
+      false
+    );
   });
 });
 
@@ -243,9 +289,12 @@ describe("copyPublicDir", () => {
     fs.writeFileSync(path.join(root, "public", "favicon.ico"), "ico");
     const resolved = resolveOptions({}, root);
     copyPublicDir(resolved);
-    expect(fs.readFileSync(path.join(resolved.outDir, "client", "favicon.ico"), "utf8")).toBe(
-      "ico",
-    );
+    expect(
+      fs.readFileSync(
+        path.join(resolved.outDir, "client", "favicon.ico"),
+        "utf-8"
+      )
+    ).toBe("ico");
   });
 
   test("skips public/ on celld", () => {
@@ -254,7 +303,9 @@ describe("copyPublicDir", () => {
     fs.mkdirSync(path.join(root, "public"), { recursive: true });
     fs.writeFileSync(path.join(root, "public", "favicon.ico"), "ico");
     copyPublicDir(resolveOptions({ preset: "celld", wrangler }, root));
-    expect(fs.existsSync(path.join(root, "dist", "client", "favicon.ico"))).toBe(false);
+    expect(
+      fs.existsSync(path.join(root, "dist", "client", "favicon.ico"))
+    ).toBe(false);
   });
 });
 
@@ -264,13 +315,15 @@ describe("assertContained", () => {
     temps.push(root);
     const out = path.join(root, "dist");
     fs.mkdirSync(out, { recursive: true });
-    expect(() => resolveOptions({ clientDir: "../outside" }, root)).not.toThrow();
+    expect(() =>
+      resolveOptions({ clientDir: "../outside" }, root)
+    ).not.toThrow();
     fs.writeFileSync(path.join(root, "index.html"), "<html></html>");
     expect(() => resolveOptions({ clientDir: "../outside" }, root)).toThrow(
-      "clientDir must resolve inside outDir",
+      "clientDir must resolve inside outDir"
     );
     expect(() => resolveOptions({ clientDir: "/tmp" }, root)).toThrow(
-      "clientDir must resolve inside outDir",
+      "clientDir must resolve inside outDir"
     );
   });
 });
diff --git a/packages/oxidejs/src/core.ts b/packages/oxidejs/src/core.ts
index 60da6f8..4e4bd8f 100644
--- a/packages/oxidejs/src/core.ts
+++ b/packages/oxidejs/src/core.ts
@@ -1,5 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
+
+import { ACTION_PATH } from "./actions";
 import type {
   OxidejsActions,
   OxidejsActionTransport,
@@ -8,7 +10,6 @@ import type {
   OxidejsWranglerOptions,
   ResolvedOptions,
 } from "./types";
-import { ACTION_PATH } from "./actions";
 
 export const CELLD_ALLOWED_KEYS = [
   "name",
@@ -28,217 +29,341 @@ export interface EmitState {
   emitted: boolean;
 }
 
-export function createEmitState(): EmitState {
+export const createEmitState = function createEmitState(): EmitState {
   return { emitted: false };
-}
+};
 
-export function validateWranglerOptions(wrangler: Record<string, unknown>): void {
+export const validateWranglerOptions = function validateWranglerOptions(
+  wrangler: OxidejsWranglerOptions
+): void {
   const allowed: readonly string[] = CELLD_ALLOWED_KEYS;
   const invalid = Object.keys(wrangler).filter((key) => !allowed.includes(key));
   if (invalid.length) {
     throw new Error(
-      `oxidejs: these wrangler keys are not supported by celld deploy: ${invalid.join(", ")}`,
+      `oxidejs: these wrangler keys are not supported by celld deploy: ${invalid.join(", ")}`
     );
   }
 
   const forbidden = USER_FORBIDDEN_KEYS.filter((key) => key in wrangler);
   if (forbidden.length) {
     throw new Error(
-      `oxidejs: wrangler keys ${forbidden.join(", ")} are computed by the plugin and cannot be user-supplied`,
+      `oxidejs: wrangler keys ${forbidden.join(", ")} are computed by the plugin and cannot be user-supplied`
     );
   }
-}
+};
 
-export function assertContained(outDirAbs: string, childAbs: string, label: string): void {
+export const assertContained = function assertContained(
+  outDirAbs: string,
+  childAbs: string,
+  label: string
+): void {
   const outDir = path.resolve(outDirAbs);
   const child = path.resolve(childAbs);
   const relative = path.relative(outDir, child);
-  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
-    throw new Error(`oxidejs: ${label} must resolve inside outDir (got ${relative || "."})`);
+  if (
+    relative === "" ||
+    relative.startsWith("..") ||
+    path.isAbsolute(relative)
+  ) {
+    throw new Error(
+      `oxidejs: ${label} must resolve inside outDir (got ${relative || "."})`
+    );
   }
-}
+};
 
-function requireWranglerFields(
-  wrangler: OxidejsWranglerOptions | undefined,
+const requireWranglerFields = function requireWranglerFields(
+  wrangler: OxidejsWranglerOptions | undefined
 ): OxidejsWranglerOptions {
   if (!wrangler?.name || !wrangler.compatibility_date) {
     throw new Error(
-      "oxidejs: wrangler.name and wrangler.compatibility_date are required when emitConfig is true",
+      "oxidejs: wrangler.name and wrangler.compatibility_date are required when emitConfig is true"
     );
   }
   return wrangler;
-}
+};
 
-type HtmlInput = string | string[] | Record<string, string>;
+type HtmlInput = string | string[] | { [key: string]: string };
 
-interface HtmlEntryConfig {
+interface HtmlEnvironment {
+  input?: HtmlInput;
   build?: {
+    input?: HtmlInput;
     rolldownOptions?: { input?: HtmlInput };
     rollupOptions?: { input?: HtmlInput };
   };
-  environments?: Record<string, unknown>;
 }
 
-function flattenInput(input: HtmlInput | undefined): string[] {
-  if (!input) return [];
-  if (typeof input === "string") return [input];
-  if (Array.isArray(input)) return input;
-  return Object.values(input);
+interface HtmlEntryConfig {
+  build?: {
+    rolldownOptions?: { input?: HtmlInput };
+    rollupOptions?: { input?: HtmlInput };
+  };
+  environments?: { [key: string]: HtmlEnvironment | undefined };
 }
 
-function envInput(env: unknown): HtmlInput | undefined {
-  if (!env || typeof env !== "object") return;
-  const rec = env as {
-    input?: HtmlInput;
-    build?: {
-      input?: HtmlInput;
-      rolldownOptions?: { input?: HtmlInput };
-      rollupOptions?: { input?: HtmlInput };
-    };
-  };
+const flattenInput = function flattenInput(
+  input: HtmlInput | undefined
+): string[] {
+  if (input === undefined) {
+    return [];
+  }
+  if (Array.isArray(input)) {
+    return input;
+  }
+  if (Object.prototype.toString.call(input) === "[object Object]") {
+    // SAFETY: non-array object HtmlInput is a string record.
+    return Object.values(input as { [key: string]: string });
+  }
+  // SAFETY: remaining HtmlInput branch after array/object checks is string.
+  return [input as string];
+};
+
+const envInput = function envInput(
+  env: HtmlEnvironment | undefined
+): HtmlInput | undefined {
+  if (env === undefined) {
+    return;
+  }
   return (
-    rec.build?.rolldownOptions?.input ||
-    rec.build?.rollupOptions?.input ||
-    rec.build?.input ||
-    rec.input
+    env.build?.rolldownOptions?.input ||
+    env.build?.rollupOptions?.input ||
+    env.build?.input ||
+    env.input
   );
-}
+};
 
 /** Vite client input: rolldown/rollup `input`, else `path.resolve(root, "index.html")`. */
-function hasHtmlEntry(root: string, config?: unknown): boolean {
-  const cfg = config as HtmlEntryConfig | undefined;
+const hasHtmlEntry = function hasHtmlEntry(
+  root: string,
+  config?: HtmlEntryConfig
+): boolean {
   const explicit =
-    envInput(cfg?.environments?.["client"]) ||
-    envInput(cfg?.environments?.["web"]) ||
-    cfg?.build?.rolldownOptions?.input ||
-    cfg?.build?.rollupOptions?.input;
+    envInput(config?.environments?.["client"]) ||
+    envInput(config?.environments?.["web"]) ||
+    config?.build?.rolldownOptions?.input ||
+    config?.build?.rollupOptions?.input;
   const entries = flattenInput(explicit || path.resolve(root, "index.html"));
   return entries.some((entry) => {
     const file = path.resolve(root, entry);
     return file.endsWith(".html") && fs.existsSync(file);
   });
-}
+};
 
-function resolveActions(raw: OxidejsActions | undefined): {
-  transport: OxidejsActionTransport;
+interface ResolvedActions {
   path: string;
   sameOrigin: boolean;
-} {
-  if (raw === undefined || typeof raw === "string") {
-    const transport = raw ?? "http";
-    if (transport !== "http" && transport !== "ws") {
-      throw new Error(`oxidejs: unknown actions transport "${String(transport)}"`);
-    }
-    return { transport, path: ACTION_PATH, sameOrigin: true };
+  transport: OxidejsActionTransport;
+}
+
+const resolveActions = function resolveActions(
+  raw: OxidejsActions | undefined
+): ResolvedActions {
+  if (raw === undefined) {
+    return { path: ACTION_PATH, sameOrigin: true, transport: "http" };
+  }
+  if (raw === "http" || raw === "ws") {
+    return { path: ACTION_PATH, sameOrigin: true, transport: raw };
+  }
+  if (Object.prototype.toString.call(raw) !== "[object Object]") {
+    throw new Error(`oxidejs: unknown actions transport "${String(raw)}"`);
   }
   const transport = raw.transport ?? "http";
   if (transport !== "http" && transport !== "ws") {
-    throw new Error(`oxidejs: unknown actions transport "${String(transport)}"`);
+    throw new Error(
+      `oxidejs: unknown actions transport "${String(transport)}"`
+    );
   }
-  const path = raw.path ?? ACTION_PATH;
-  if (!path.startsWith("/") || path.includes("?")) {
+  const actionsPath = raw.path ?? ACTION_PATH;
+  if (!actionsPath.startsWith("/") || actionsPath.includes("?")) {
     throw new Error(
-      `oxidejs: actions.path must start with "/" and contain no query string (got "${path}")`,
+      `oxidejs: actions.path must start with "/" and contain no query string (got "${actionsPath}")`
     );
   }
-  return { transport, path, sameOrigin: raw.sameOrigin ?? true };
-}
+  return { path: actionsPath, sameOrigin: raw.sameOrigin ?? true, transport };
+};
 
-export function resolveOptions(
-  raw: OxidejsOptions | undefined,
-  root: string,
-  config?: unknown,
-): ResolvedOptions {
+const resolvePreset = function resolvePreset(
+  raw: OxidejsOptions | undefined
+): OxidejsPreset {
   const preset: OxidejsPreset = raw?.preset ?? "fetch";
   if (preset !== "fetch" && preset !== "celld") {
     throw new Error(`oxidejs: unknown preset "${String(preset)}"`);
   }
+  return preset;
+};
+
+interface ResolvedPaths {
+  clientDir: string;
+  outDir: string;
+  rootAbs: string;
+  workerEntry: string;
+  workerEntryAbs: string;
+}
+
+const resolvePaths = function resolvePaths(
+  raw: OxidejsOptions | undefined,
+  root: string
+): ResolvedPaths {
+  const workerEntry = raw?.workerEntry ?? "src/server.ts";
+  const outDirInput = raw?.outDir ?? "dist";
+  const clientDir = raw?.clientDir ?? "client";
+  const rootAbs = path.resolve(root);
+  return {
+    clientDir,
+    outDir: path.resolve(rootAbs, outDirInput),
+    rootAbs,
+    workerEntry,
+    workerEntryAbs: path.resolve(rootAbs, workerEntry),
+  };
+};
+
+const resolveWrangler = function resolveWrangler(
+  raw: OxidejsOptions | undefined,
+  emitConfig: boolean
+): OxidejsWranglerOptions | undefined {
+  if (raw?.wrangler) {
+    validateWranglerOptions(raw.wrangler);
+  }
+  return emitConfig ? requireWranglerFields(raw?.wrangler) : raw?.wrangler;
+};
+
+const assertClientDir = function assertClientDir(
+  outDir: string,
+  clientDir: string,
+  hasClient: boolean,
+  hasPublic: boolean
+): void {
+  if (hasClient || hasPublic) {
+    assertContained(outDir, path.resolve(outDir, clientDir), "clientDir");
+  }
+};
+
+export const resolveOptions = function resolveOptions(
+  raw: OxidejsOptions | undefined,
+  root: string,
+  config?: HtmlEntryConfig
+): ResolvedOptions {
+  const preset = resolvePreset(raw);
   const {
     transport: actions,
     path: actionPath,
     sameOrigin: actionSameOrigin,
   } = resolveActions(raw?.actions);
   if (actions === "ws" && preset === "celld") {
-    throw new Error('oxidejs: actions: "ws" is not supported with preset: "celld"');
+    throw new Error(
+      'oxidejs: actions: "ws" is not supported with preset: "celld"'
+    );
   }
-  const workerEntry = raw?.workerEntry ?? "src/server.ts";
-  const outDirInput = raw?.outDir ?? "dist";
-  const clientDir = raw?.clientDir ?? "client";
   const emitConfig = raw?.emitConfig ?? preset === "celld";
-
-  const rootAbs = path.resolve(root);
-  const outDir = path.resolve(rootAbs, outDirInput);
-  const workerEntryAbs = path.resolve(rootAbs, workerEntry);
+  const { clientDir, outDir, rootAbs, workerEntry, workerEntryAbs } =
+    resolvePaths(raw, root);
   const hasClient = hasHtmlEntry(rootAbs, config);
   const hasPublic = fs.existsSync(path.join(rootAbs, "public"));
-
-  if (hasClient || hasPublic) assertContained(outDir, path.resolve(outDir, clientDir), "clientDir");
-
-  if (raw?.wrangler) {
-    // SAFETY: validateWranglerOptions only reads Object.keys; OxidejsWranglerOptions is a plain object.
-    validateWranglerOptions(raw.wrangler as unknown as Record<string, unknown>);
-  }
-
-  const wrangler = emitConfig ? requireWranglerFields(raw?.wrangler) : raw?.wrangler;
+  assertClientDir(outDir, clientDir, hasClient, hasPublic);
+  const wrangler = resolveWrangler(raw, emitConfig);
 
   return {
-    root: rootAbs,
-    preset,
-    workerEntry,
-    workerEntryAbs,
-    outDir,
+    actionHeaders: raw?.actionHeaders,
+    actionPath,
+    actionSameOrigin,
+    actions,
+    bodyLimit: raw?.bodyLimit ?? 1_048_576,
     clientDir,
-    wrangler,
     emitConfig,
+    env: raw?.env,
     hasClient,
     hasPublic,
-    actions,
-    actionPath,
-    actionSameOrigin,
-    actionHeaders: raw?.actionHeaders,
-    middleware: raw?.middleware ?? [],
     imports: raw?.imports ?? [],
-    bodyLimit: raw?.bodyLimit ?? 1048576,
+    middleware: raw?.middleware ?? [],
     notFound: raw?.notFound,
-    env: raw?.env,
+    outDir,
+    preset,
+    root: rootAbs,
+    workerEntry,
+    workerEntryAbs,
+    wrangler,
   };
-}
+};
 
-export function copyPublicDir(opts: ResolvedOptions): void {
-  if (opts.preset !== "fetch") return;
+export const copyPublicDir = function copyPublicDir(
+  opts: ResolvedOptions
+): void {
+  if (opts.preset !== "fetch") {
+    return;
+  }
   const src = path.join(opts.root, "public");
-  if (!fs.existsSync(src)) return;
-  fs.cpSync(src, path.join(opts.outDir, opts.clientDir), { recursive: true, force: true });
+  if (!fs.existsSync(src)) {
+    return;
+  }
+  fs.cpSync(src, path.join(opts.outDir, opts.clientDir), {
+    force: true,
+    recursive: true,
+  });
+};
+
+interface EmittedWranglerConfig {
+  assets?: { binding: string; directory: string };
+  compatibility_date: string;
+  compatibility_flags: string[];
+  durable_objects?: OxidejsWranglerOptions["durable_objects"];
+  main: string;
+  migrations?: OxidejsWranglerOptions["migrations"];
+  name: string;
+  services?: OxidejsWranglerOptions["services"];
+  vars?: OxidejsWranglerOptions["vars"];
 }
 
-export function tryEmitWranglerConfig(opts: ResolvedOptions, state: EmitState): void {
-  if (state.emitted || opts.emitConfig === false) return;
+export const tryEmitWranglerConfig = function tryEmitWranglerConfig(
+  opts: ResolvedOptions,
+  state: EmitState
+): void {
+  if (state.emitted || opts.emitConfig === false) {
+    return;
+  }
 
   const wrangler = requireWranglerFields(opts.wrangler);
   const serverFile = path.join(opts.outDir, "server.js");
   const clientDirPath = path.join(opts.outDir, opts.clientDir);
 
-  if (!fs.existsSync(serverFile)) return;
-  if (opts.hasClient && !fs.existsSync(clientDirPath)) return;
+  if (!fs.existsSync(serverFile)) {
+    return;
+  }
+  if (opts.hasClient && !fs.existsSync(clientDirPath)) {
+    return;
+  }
 
   assertContained(opts.outDir, serverFile, "main");
-  if (opts.hasClient) assertContained(opts.outDir, clientDirPath, "assets.directory");
+  if (opts.hasClient) {
+    assertContained(opts.outDir, clientDirPath, "assets.directory");
+  }
 
-  const config = {
-    name: wrangler.name,
-    main: "./server.js",
+  const config: EmittedWranglerConfig = {
     compatibility_date: wrangler.compatibility_date,
-    compatibility_flags: [...new Set([...(wrangler.compatibility_flags ?? []), "nodejs_compat"])],
-    ...(wrangler.durable_objects ? { durable_objects: wrangler.durable_objects } : {}),
-    ...(wrangler.migrations ? { migrations: wrangler.migrations } : {}),
-    ...(wrangler.services ? { services: wrangler.services } : {}),
-    ...(wrangler.vars ? { vars: wrangler.vars } : {}),
-    ...(opts.hasClient ? { assets: { directory: `./${opts.clientDir}`, binding: "ASSETS" } } : {}),
+    compatibility_flags: [
+      ...new Set([...(wrangler.compatibility_flags ?? []), "nodejs_compat"]),
+    ],
+    main: "./server.js",
+    name: wrangler.name,
   };
+  if (wrangler.durable_objects) {
+    config.durable_objects = wrangler.durable_objects;
+  }
+  if (wrangler.migrations) {
+    config.migrations = wrangler.migrations;
+  }
+  if (wrangler.services) {
+    config.services = wrangler.services;
+  }
+  if (wrangler.vars) {
+    config.vars = wrangler.vars;
+  }
+  if (opts.hasClient) {
+    config.assets = { binding: "ASSETS", directory: `./${opts.clientDir}` };
+  }
 
   fs.writeFileSync(
     path.join(opts.outDir, "wrangler.jsonc"),
-    `${JSON.stringify(config, null, 2)}\n`,
+    `${JSON.stringify(config, null, 2)}\n`
   );
   state.emitted = true;
-}
+};
diff --git a/packages/oxidejs/src/index.test.ts b/packages/oxidejs/src/index.test.ts
index 3c23f73..832b722 100644
--- a/packages/oxidejs/src/index.test.ts
+++ b/packages/oxidejs/src/index.test.ts
@@ -2,134 +2,306 @@ import { describe, expect, test } from "bun:test";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+
 import { RESOLVED_VIRTUAL_ACTIONS_ID, VIRTUAL_WORKER_ID } from "./actions";
+import { resolveOptions } from "./core";
 import { oxidejs, unpluginFactory, vite } from "./plugin";
 import rsbuild from "./rsbuild";
-import { applyRsbuildEnvironments, applyViteEnvironments } from "./worker-build";
-import { resolveOptions } from "./core";
+import {
+  applyRsbuildEnvironments,
+  applyViteEnvironments,
+} from "./worker-build";
+
+const wrangler = { compatibility_date: "2026-01-01", name: "vite-cf" };
+
+interface DevContext {
+  ctx?: undefined;
+  env: { mode: string };
+}
+
+interface NodeReq {
+  emit: (event: string, ...args: unknown[]) => boolean;
+  headers: { host: string };
+  method: string;
+  url: string;
+}
+
+type ConnectResponse = Record<string, never>;
 
-const wrangler = { name: "vite-cf", compatibility_date: "2026-01-01" };
+interface ViteDevServerMock {
+  config: { logger: { error: (message?: string) => void } };
+  environments: Record<string, never>;
+  middlewares: { use: (handler: ConnectHandler) => void };
+  ssrLoadModule: () => Promise<{
+    default: AppHandler | { ping: () => string };
+  }>;
+  watcher: { on: () => void };
+}
+
+interface LoadThis {
+  addWatchFile: () => void;
+  environment: { config: { consumer: string } };
+}
 
-function rootWithHtml(): string {
+type AppHandler = (request: Request, context: DevContext) => undefined;
+type ViteConfigHook = (config: { root: string }) => undefined;
+type ConnectHandler = (
+  req: NodeReq,
+  res: ConnectResponse,
+  next: () => undefined
+) => undefined;
+type ConfigurePostHook = () => undefined | Promise<undefined>;
+type ConfigureServerHook = (
+  server: ViteDevServerMock
+) => ConfigurePostHook | undefined;
+type PluginLoad = (this: LoadThis, id: string) => string | undefined;
+type PluginTransform = (
+  this: LoadThis,
+  code: string,
+  id: string
+) => string | undefined;
+type ViteEnvConfig = ReturnType<typeof applyViteEnvironments>;
+type ResolvedOpts = ReturnType<typeof resolveOptions>;
+
+const rootWithHtml = function rootWithHtml(): string {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "oxidejs-"));
   fs.writeFileSync(path.join(root, "index.html"), "<html></html>");
   return root;
-}
+};
+
+const expectSinglePlugin = function expectSinglePlugin(
+  plugin: ReturnType<typeof unpluginFactory>
+) {
+  if (Array.isArray(plugin)) {
+    throw new TypeError("expected a single plugin");
+  }
+  return plugin;
+};
+
+/** Build the vite-shaped unplugin for unit tests. */
+const vitePlugin = function vitePlugin(
+  opts: Parameters<typeof unpluginFactory>[0] = {}
+) {
+  // SAFETY: unplugin meta is framework-tagged; tests only need the vite branch.
+  return expectSinglePlugin(
+    unpluginFactory(opts, { framework: "vite" } as never)
+  );
+};
+
+const invokeConnect = async function invokeConnect(
+  handler: ConnectHandler,
+  req: NodeReq
+) {
+  const { promise, resolve } = Promise.withResolvers<null>();
+  handler(req, {}, () => {
+    resolve(null);
+  });
+  await promise;
+};
+
+const expectClientEnv = function expectClientEnv(
+  config: ViteEnvConfig,
+  resolved: ResolvedOpts
+) {
+  expect(config.environments?.["client"]?.consumer).toBe("client");
+  expect(config.environments?.["client"]?.build?.outDir).toBe(
+    path.join(resolved.outDir, "client")
+  );
+};
+
+const expectSsrBuild = function expectSsrBuild(
+  config: ViteEnvConfig,
+  resolved: ResolvedOpts
+) {
+  expect(config.environments?.["ssr"]?.consumer).toBe("server");
+  expect(config.environments?.["ssr"]?.build?.ssr).toBe(true);
+  expect(config.environments?.["ssr"]?.build?.outDir).toBe(resolved.outDir);
+  expect(config.environments?.["ssr"]?.build?.emptyOutDir).toBe(false);
+};
+
+const expectSsrBundle = function expectSsrBundle(config: ViteEnvConfig) {
+  expect(config.environments?.["ssr"]?.build?.rollupOptions?.input).toBe(
+    VIRTUAL_WORKER_ID
+  );
+  expect(
+    config.environments?.["ssr"]?.build?.rollupOptions?.output?.entryFileNames
+  ).toBe("server.js");
+  expect(config.environments?.["ssr"]?.resolve).toEqual({
+    noExternal: ["effect", "oxidejs"],
+  });
+  expect(config.environments?.["ssr"]?.ssr).toEqual({
+    noExternal: ["effect", "oxidejs"],
+  });
+};
+
+const expectViteDeps = function expectViteDeps(
+  config: ViteEnvConfig,
+  resolved: ResolvedOpts
+) {
+  expect(config.builder).toEqual({});
+  expect(config.resolve?.dedupe).toEqual(["effect", "oxidejs"]);
+  expect(config.optimizeDeps?.include).toEqual([
+    "effect",
+    "effect/unstable/rpc",
+    "effect/unstable/http",
+    "effect/unstable/socket",
+    "oxidejs",
+    "oxidejs/rpc/client",
+  ]);
+  expect(config.build?.outDir).toBe(path.join(resolved.outDir, "client"));
+  expect(config.build?.manifest).toBe(true);
+};
+
+const expectFetchViteLayout = function expectFetchViteLayout(
+  config: ViteEnvConfig,
+  resolved: ResolvedOpts
+) {
+  expectClientEnv(config, resolved);
+  expectSsrBuild(config, resolved);
+  expectSsrBundle(config);
+  expectViteDeps(config, resolved);
+};
 
 describe("factory shape", () => {
   test("exposes vite and rsbuild adapters from the same factory", () => {
-    expect(typeof oxidejs.vite).toBe("function");
-    expect(typeof vite).toBe("function");
-    expect(typeof oxidejs.rsbuild).toBe("function");
-    expect(typeof rsbuild).toBe("function");
-    expect(typeof unpluginFactory).toBe("function");
+    expect(oxidejs.vite).toBeInstanceOf(Function);
+    expect(vite).toBeInstanceOf(Function);
+    expect(oxidejs.rsbuild).toBeInstanceOf(Function);
+    expect(rsbuild).toBeInstanceOf(Function);
+    expect(unpluginFactory).toBeInstanceOf(Function);
   });
 
   test("shared hooks include transform; both adapters wire config and /__oxide/action", () => {
-    const plugin = unpluginFactory({}, { framework: "vite" } as never);
-    if (Array.isArray(plugin)) throw new Error("expected a single plugin");
+    const plugin = vitePlugin();
     expect(plugin.name).toBe("oxidejs");
     expect(plugin.enforce).toBe("pre");
-    expect(typeof plugin.resolveId).toBe("function");
-    expect(typeof plugin.load).toBe("function");
-    expect(typeof plugin.transform).toBe("function");
-    expect(typeof plugin.writeBundle).toBe("function");
-    expect(typeof plugin.vite?.config).toBe("function");
-    expect(typeof plugin.vite?.configureServer).toBe("function");
-    expect(typeof plugin.vite?.configurePreviewServer).toBe("function");
-    expect(typeof plugin.rsbuild?.setup).toBe("function");
+    expect(plugin.resolveId).toBeInstanceOf(Function);
+    expect(plugin.load).toBeInstanceOf(Function);
+    expect(plugin.transform).toBeInstanceOf(Function);
+    expect(plugin.writeBundle).toBeInstanceOf(Function);
+    expect(plugin.vite?.config).toBeInstanceOf(Function);
+    expect(plugin.vite?.configureServer).toBeInstanceOf(Function);
+    expect(plugin.vite?.configurePreviewServer).toBeInstanceOf(Function);
+    expect(plugin.rsbuild?.setup).toBeInstanceOf(Function);
   });
 
   test("vite registers middleware and actions synchronously before Vite internals", async () => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "oxide-dev-"));
-    const seen: unknown[] = [];
-    const plugin = unpluginFactory({ middleware: ["./middleware"], env: { mode: "dev" } }, {
-      framework: "vite",
-    } as never);
-    if (Array.isArray(plugin)) throw new Error("expected a single plugin");
-    if (!plugin.vite) throw new Error("expected vite hooks");
-    (plugin.vite.config as (config: { root: string }) => void)({ root });
-
-    const handlers: Array<(req: never, res: never, next: () => void) => void> = [];
-    const server = {
+    const seen: DevContext[] = [];
+    const plugin = vitePlugin({
+      env: { mode: "dev" },
+      middleware: ["./middleware"],
+    });
+    if (!plugin.vite) {
+      throw new Error("expected vite hooks");
+    }
+    // SAFETY: vite.config accepts a partial UserConfig in this harness.
+    (plugin.vite.config as ViteConfigHook)({ root });
+
+    const handlers: ConnectHandler[] = [];
+    const server: ViteDevServerMock = {
+      config: { logger: { error() {} } },
       environments: {},
-      watcher: { on() {} },
-      middlewares: { use: (handler: (typeof handlers)[number]) => handlers.push(handler) },
-      ssrLoadModule: async () => ({
-        default: (_request: Request, context: unknown) => {
-          seen.push(context);
+      middlewares: {
+        use: (handler: ConnectHandler) => {
+          handlers.push(handler);
         },
-      }),
-      config: { logger: { error() {} } },
+      },
+      ssrLoadModule: () =>
+        Promise.resolve({
+          default: ((_request: Request, context: DevContext) => {
+            seen.push(context);
+          }) satisfies AppHandler,
+        }),
+      watcher: { on() {} },
     };
 
     try {
-      const post = (
-        plugin.vite.configureServer as (server: unknown) => (() => void | Promise<void>) | void
-      )(server);
+      // SAFETY: configureServer is invoked with a ViteDevServer-shaped mock.
+      const configureServer: ConfigureServerHook = plugin.vite
+        .configureServer as never;
+      const post = configureServer(server);
       expect(handlers).toHaveLength(2);
-      expect(typeof post).toBe("function");
-      handlers.push((_req, _res, next) => next()); // downstream framework middleware
+      expect(post).toBeInstanceOf(Function);
+      // Downstream framework middleware.
+      handlers.push((_req, _res, next) => {
+        next();
+      });
       const { EventEmitter } = await import("node:events");
-      const req = Object.assign(new EventEmitter(), {
+      // oxlint-disable-next-line unicorn/prefer-event-target -- Connect req uses EventEmitter
+      const reqBase = Object.assign(new EventEmitter(), {
+        headers: { host: "localhost" },
         method: "GET",
         url: "/other",
-        headers: { host: "localhost" },
       });
-      await new Promise<void>((resolve) => handlers[0]!(req as never, {} as never, resolve));
-      expect(seen).toEqual([{ env: { mode: "dev" }, ctx: undefined }]);
+      // SAFETY: EventEmitter + method/url/headers matches the Connect request shape.
+      const req = reqBase as NodeReq;
+      const [first] = handlers;
+      if (!first) {
+        throw new Error("expected middleware handler");
+      }
+      await invokeConnect(first, req);
+      expect(seen).toEqual([{ ctx: undefined, env: { mode: "dev" } }]);
 
       // Action path must skip the bridge so the body stays readable for RPC.
       let actionNext = false;
-      handlers[0]!(
-        Object.assign(new EventEmitter(), {
-          method: "POST",
-          url: "/__oxide/action",
-          headers: { host: "localhost" },
-        }) as never,
-        {} as never,
-        () => {
-          actionNext = true;
-        },
-      );
+      // oxlint-disable-next-line unicorn/prefer-event-target -- Connect req uses EventEmitter
+      const actionBase = Object.assign(new EventEmitter(), {
+        headers: { host: "localhost" },
+        method: "POST",
+        url: "/__oxide/action",
+      });
+      // SAFETY: EventEmitter + method/url/headers matches the Connect request shape.
+      const actionReq = actionBase as NodeReq;
+      first(actionReq, {}, () => {
+        actionNext = true;
+      });
       expect(actionNext).toBe(true);
       expect(seen).toHaveLength(1);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("vite retries a rejected action router on the next load", async () => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "oxide-retry-"));
-    const plugin = unpluginFactory({}, { framework: "vite" } as never);
-    if (Array.isArray(plugin)) throw new Error("expected a single plugin");
-    if (!plugin.vite) throw new Error("expected vite hooks");
-    (plugin.vite.config as (config: { root: string }) => void)({ root });
+    const plugin = vitePlugin();
+    if (!plugin.vite) {
+      throw new Error("expected vite hooks");
+    }
+    // SAFETY: vite.config accepts a partial UserConfig in this harness.
+    (plugin.vite.config as ViteConfigHook)({ root });
 
     let loads = 0;
     const errors: string[] = [];
-    const server = {
-      environments: {},
-      watcher: { on() {} },
-      middlewares: { use() {} },
-      ssrLoadModule: async () => {
-        loads += 1;
-        if (loads === 1) throw new Error("cold");
-        return { default: { ping: () => "ok" } };
-      },
+    const server: ViteDevServerMock = {
       config: {
         logger: {
-          error(message: string) {
+          error(message = "") {
             errors.push(message);
           },
         },
       },
+      environments: {},
+      middlewares: { use() {} },
+      ssrLoadModule: () => {
+        loads += 1;
+        if (loads === 1) {
+          return Promise.reject(new Error("cold"));
+        }
+        return Promise.resolve({ default: { ping: () => "ok" } });
+      },
+      watcher: { on() {} },
     };
 
     try {
-      const post = (plugin.vite.configureServer as (server: unknown) => () => Promise<void>)(
-        server,
-      );
+      // SAFETY: configureServer is invoked with a ViteDevServer-shaped mock.
+      const configureServer: ConfigureServerHook = plugin.vite
+        .configureServer as never;
+      const post = configureServer(server);
+      if (!post) {
+        throw new Error("expected configureServer post hook");
+      }
       await post();
       expect(errors.some((message) => message.includes("prewarm"))).toBe(true);
       expect(loads).toBe(1);
@@ -138,48 +310,55 @@ describe("factory shape", () => {
       expect(errors).toEqual([]);
       expect(loads).toBe(2);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("client load stubs *.server.tsx and blocks virtual actions", () => {
-    const plugin = unpluginFactory({}, { framework: "vite" } as never);
-    if (Array.isArray(plugin)) throw new Error("expected a single plugin");
+    const plugin = vitePlugin();
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "oxide-load-"));
     const file = path.join(root, "secret.server.tsx");
     const source = `import { action, useRequest } from "oxidejs";\nconst SECRET = "leak-me";\nexport const ping = action(async () => <div>{useRequest().url}{SECRET}</div>)\n`;
     fs.writeFileSync(file, source);
-    const load = plugin.load as (this: object, id: string) => unknown;
-    const ctx = {
-      environment: { config: { consumer: "client" } },
+    // SAFETY: load is called with a LoadThis-shaped unplugin context.
+    const load: PluginLoad = plugin.load as never;
+    const ctx: LoadThis = {
       addWatchFile() {},
+      environment: { config: { consumer: "client" } },
     };
     try {
       const stub = load.call(ctx, file);
-      expect(typeof stub).toBe("string");
+      expect(stub).toBeDefined();
       expect(String(stub)).toContain("virtual:oxide/client");
       expect(String(stub)).not.toContain("leak-me");
-      expect(String(load.call(ctx, "\0virtual:oxide/client"))).toContain("oxidejs/rpc/client");
-      const wsPlugin = unpluginFactory({ actions: "ws" }, { framework: "vite" } as never);
-      if (Array.isArray(wsPlugin)) throw new Error("expected a single plugin");
-      const wsLoad = wsPlugin.load as (this: object, id: string) => unknown;
-      expect(String(wsLoad.call(ctx, "\0virtual:oxide/client"))).toContain('"transport":"ws"');
-      expect(String(load.call(ctx, RESOLVED_VIRTUAL_ACTIONS_ID))).toContain("RpcGroup.make");
+      expect(String(load.call(ctx, "\0virtual:oxide/client"))).toContain(
+        "oxidejs/rpc/client"
+      );
+      const wsPlugin = vitePlugin({ actions: "ws" });
+      // SAFETY: load is called with a LoadThis-shaped unplugin context.
+      const wsLoad: PluginLoad = wsPlugin.load as never;
+      expect(String(wsLoad.call(ctx, "\0virtual:oxide/client"))).toContain(
+        '"transport":"ws"'
+      );
+      expect(String(load.call(ctx, RESOLVED_VIRTUAL_ACTIONS_ID))).toContain(
+        "RpcGroup.make"
+      );
       expect(String(load.call(ctx, RESOLVED_VIRTUAL_ACTIONS_ID))).not.toContain(
-        "AsyncLocalStorage",
+        "AsyncLocalStorage"
       );
-      const serverCtx = {
-        environment: { config: { consumer: "server" } },
+      const serverCtx: LoadThis = {
         addWatchFile() {},
+        environment: { config: { consumer: "server" } },
       };
       expect(load.call(serverCtx, file)).toBeUndefined();
-      const transform = plugin.transform as (this: object, code: string, id: string) => unknown;
+      // SAFETY: transform is called with a LoadThis-shaped unplugin context.
+      const transform: PluginTransform = plugin.transform as never;
       expect(transform.call(ctx, String(stub), file)).toBeUndefined();
       const leaked = transform.call(ctx, source, file);
       expect(String(leaked)).not.toContain("leak-me");
       expect(String(leaked)).toContain('client["secret"]["ping"]');
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
@@ -188,62 +367,47 @@ describe("factory shape", () => {
     try {
       const resolved = resolveOptions({}, root);
       const config = applyViteEnvironments({}, resolved);
-      expect(config.builder).toEqual({});
-      expect(config.environments?.["client"]?.consumer).toBe("client");
-      expect(config.environments?.["client"]?.build?.outDir).toBe(
-        path.join(resolved.outDir, "client"),
-      );
-      expect(config.environments?.["ssr"]?.consumer).toBe("server");
-      expect(config.environments?.["ssr"]?.build?.ssr).toBe(true);
-      expect(config.environments?.["ssr"]?.build?.outDir).toBe(resolved.outDir);
-      expect(config.environments?.["ssr"]?.build?.emptyOutDir).toBe(false);
-      expect(config.environments?.["ssr"]?.build?.rollupOptions?.input).toBe(VIRTUAL_WORKER_ID);
-      expect(config.environments?.["ssr"]?.build?.rollupOptions?.output?.entryFileNames).toBe(
-        "server.js",
-      );
-      expect(config.environments?.["ssr"]?.resolve).toEqual({ noExternal: ["effect", "oxidejs"] });
-      expect(config.environments?.["ssr"]?.ssr).toEqual({ noExternal: ["effect", "oxidejs"] });
-      expect(config.resolve?.dedupe).toEqual(["effect", "oxidejs"]);
-      expect(config.optimizeDeps?.include).toEqual([
-        "effect",
-        "effect/unstable/rpc",
-        "effect/unstable/http",
-        "effect/unstable/socket",
-        "oxidejs",
-        "oxidejs/rpc/client",
-      ]);
-      expect(config.build?.outDir).toBe(path.join(resolved.outDir, "client"));
-      expect(config.build?.manifest).toBe(true);
+      expectFetchViteLayout(config, resolved);
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("no index.html skips the client environment", () => {
-    const resolved = resolveOptions({}, fs.mkdtempSync(path.join(os.tmpdir(), "oxidejs-")));
-    const vite = applyViteEnvironments({}, resolved);
-    expect(vite.environments?.["client"]).toBeUndefined();
-    expect(vite.appType).toBe("custom");
-    expect(typeof vite.builder?.buildApp).toBe("function");
-    expect(vite.environments?.["ssr"]?.build?.outDir).toBe(resolved.outDir);
-    expect(vite.environments?.["ssr"]?.build?.emptyOutDir).toBe(true);
-    expect(vite.build?.outDir).toBe(resolved.outDir);
-    const rsbuild = applyRsbuildEnvironments({}, resolved);
-    expect(rsbuild.environments?.["web"]).toBeUndefined();
-    expect(rsbuild.environments?.["server"]?.output?.filename).toEqual({ js: "server.js" });
+    const resolved = resolveOptions(
+      {},
+      fs.mkdtempSync(path.join(os.tmpdir(), "oxidejs-"))
+    );
+    const viteConfig = applyViteEnvironments({}, resolved);
+    expect(viteConfig.environments?.["client"]).toBeUndefined();
+    expect(viteConfig.appType).toBe("custom");
+    expect(viteConfig.builder?.buildApp).toBeInstanceOf(Function);
+    expect(viteConfig.environments?.["ssr"]?.build?.outDir).toBe(
+      resolved.outDir
+    );
+    expect(viteConfig.environments?.["ssr"]?.build?.emptyOutDir).toBe(true);
+    expect(viteConfig.build?.outDir).toBe(resolved.outDir);
+    const rsbuildConfig = applyRsbuildEnvironments({}, resolved);
+    expect(rsbuildConfig.environments?.["web"]).toBeUndefined();
+    expect(rsbuildConfig.environments?.["server"]?.output?.filename).toEqual({
+      js: "server.js",
+    });
   });
 
   test("celld preset targets webworker", () => {
-    const resolved = resolveOptions({ preset: "celld", wrangler }, "/tmp/project");
+    const resolved = resolveOptions(
+      { preset: "celld", wrangler },
+      "/tmp/project"
+    );
     const config = applyViteEnvironments({}, resolved);
     expect(config.environments?.["ssr"]?.resolve).toEqual({
       conditions: ["worker"],
       noExternal: true,
     });
     expect(config.environments?.["ssr"]?.ssr).toEqual({
-      target: "webworker",
+      external: [/^cloudflare:/u],
       noExternal: true,
-      external: [/^cloudflare:/],
+      target: "webworker",
     });
   });
 
@@ -253,23 +417,26 @@ describe("factory shape", () => {
       const resolved = resolveOptions({}, root);
       const config = applyRsbuildEnvironments({}, resolved);
       expect(config.environments?.["web"]?.output?.distPath?.root).toBe(
-        path.join(resolved.outDir, "client"),
+        path.join(resolved.outDir, "client")
       );
       expect(config.environments?.["server"]?.source?.entry).toEqual({
-        server: { import: VIRTUAL_WORKER_ID, html: false },
+        server: { html: false, import: VIRTUAL_WORKER_ID },
       });
       expect(config.environments?.["server"]?.output).toEqual({
-        target: "node",
-        filename: { js: "server.js" },
         distPath: { root: resolved.outDir },
+        filename: { js: "server.js" },
+        target: "node",
       });
     } finally {
-      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(root, { force: true, recursive: true });
     }
   });
 
   test("rsbuild celld environment targets web-worker", () => {
-    const resolved = resolveOptions({ preset: "celld", wrangler }, "/tmp/project");
+    const resolved = resolveOptions(
+      { preset: "celld", wrangler },
+      "/tmp/project"
+    );
     const config = applyRsbuildEnvironments({}, resolved);
     expect(config.environments?.["server"]?.output?.target).toBe("web-worker");
     expect(config.environments?.["server"]?.resolve).toEqual({
diff --git a/packages/oxidejs/src/index.ts b/packages/oxidejs/src/index.ts
index 6674eaf..23277ec 100644
--- a/packages/oxidejs/src/index.ts
+++ b/packages/oxidejs/src/index.ts
@@ -14,7 +14,10 @@ export {
 export type {
   ActionContext,
   ExecutionContext,
+  FetchHandler,
+  FetchResult,
   ServerActionHandle,
+  ServerEntry,
   StreamActionHandle,
 } from "./context";
 export type {
diff --git a/packages/oxidejs/src/plugin.ts b/packages/oxidejs/src/plugin.ts
index 0461a38..31f094b 100644
--- a/packages/oxidejs/src/plugin.ts
+++ b/packages/oxidejs/src/plugin.ts
@@ -1,9 +1,11 @@
-import { createUnplugin } from "unplugin";
-import type { UnpluginFactory } from "unplugin";
-import type { IncomingMessage, ServerResponse } from "node:http";
 import fs from "node:fs";
+import type { IncomingMessage, ServerResponse } from "node:http";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+
+import { createUnplugin } from "unplugin";
+import type { UnpluginFactory } from "unplugin";
+
 import {
   generateActionsClientModule,
   generateActionsModule,
@@ -28,226 +30,518 @@ import {
   VIRTUAL_CLIENT_ID,
   VIRTUAL_WORKER_ID,
 } from "./actions";
-import { copyPublicDir, createEmitState, resolveOptions, tryEmitWranglerConfig } from "./core";
+import {
+  copyPublicDir,
+  createEmitState,
+  resolveOptions,
+  tryEmitWranglerConfig,
+} from "./core";
 import { createActionHandler, createWsHooks } from "./rpc";
 import type { OxidejsOptions, ResolvedOptions } from "./types";
 import {
   applyRsbuildEnvironments,
   applyViteEnvironments,
-  type RsbuildUserConfig,
-  type ViteUserConfig,
 } from "./worker-build";
+import type { RsbuildUserConfig } from "./worker-build";
 import { ensureWorkerDom } from "./worker-dom";
 
 type ConnectReq = IncomingMessage;
 type ConnectRes = ServerResponse;
-type ConnectNext = (err?: unknown) => void;
+type ConnectNext = (err?: Error) => void;
 
-type RpcDevModule = {
+interface RpcDevModule {
   createActionHandler: typeof createActionHandler;
   createWsHooks: typeof createWsHooks;
+}
+
+interface UpgradeSocket {
+  destroy: () => void;
+}
+
+interface HttpUpgradeServer {
+  on: (
+    event: "upgrade",
+    listener: (
+      req: IncomingMessage,
+      socket: UpgradeSocket,
+      head: Buffer
+    ) => void
+  ) => void;
+}
+
+interface PluginHookContext {
+  addWatchFile: (id: string) => void;
+  environment?: {
+    config?: { consumer?: string };
+    consumer?: string;
+    name?: string;
+  };
+  getNativeBuildContext?: () => {
+    compiler?: {
+      name?: string;
+      options?: { name?: string; target?: string | string[] };
+    };
+  };
+}
+
+interface MiddlewareContext {
+  ctx: undefined;
+  env: ResolvedOptions["env"];
+}
+
+type MiddlewareDefault = (
+  request: Request,
+  context: MiddlewareContext
+) => Response | undefined | Promise<Response | undefined>;
+
+type MwHandler = (
+  request: Request,
+  context: MiddlewareContext
+) => Promise<Response | undefined>;
+
+interface MiddlewareModule {
+  default?: MiddlewareDefault;
+}
+
+interface DevSsrServer {
+  config: { logger: { error: (msg: string) => void } };
+  ssrLoadModule: (id: string) => Promise<MiddlewareModule>;
+}
+
+const isString = function isString(value: unknown): value is string {
+  return typeof value === "string";
+};
+
+const isMiddlewareDefault = function isMiddlewareDefault(
+  value: unknown
+): value is MiddlewareDefault {
+  return typeof value === "function";
+};
+
+const isObject = function isObject(value: unknown): value is object {
+  return typeof value === "object" && value !== null;
+};
+
+const resolveActionTransport = function resolveActionTransport(
+  resolved: ResolvedOptions | undefined,
+  options: OxidejsOptions | undefined
+): "http" | "ws" {
+  if (resolved?.actions) {
+    return resolved.actions;
+  }
+  const actions = options?.actions;
+  if (isString(actions) || actions === undefined) {
+    return actions ?? "http";
+  }
+  return actions.transport ?? "http";
+};
+
+const loadRpcModule = function loadRpcModule(): Promise<RpcDevModule> {
+  return Promise.resolve({
+    createActionHandler,
+    createWsHooks,
+  });
 };
 
-function actionMiddleware(
-  loadRouter: () => Promise<{ default: unknown; actionsHandlers: unknown }>,
+const actionMiddleware = function actionMiddleware(
+  loadRouter: () => Promise<{ actionsHandlers: unknown; default: unknown }>,
   loadRpc: () => Promise<RpcDevModule>,
-  path: string,
+  actionPath: string,
   sameOrigin: boolean,
   bodyLimit: number,
-  onError?: (error: unknown) => void,
+  onError?: (error: Error) => void
 ) {
   return (req: ConnectReq, res: ConnectRes, next: ConnectNext) => {
-    if (!matchesActionPath((req.url ?? "").split("?")[0] ?? "", path)) {
-      next();
-      return;
+    if (!matchesActionPath((req.url ?? "").split("?")[0] ?? "", actionPath)) {
+      return next();
     }
     void (async () => {
-      const [mod, rpc] = await Promise.all([loadRouter(), loadRpc()]);
-      const handler = rpc.createActionHandler(mod.default as never, mod.actionsHandlers as never, {
-        path,
-        sameOrigin,
-      });
-      const response = await handler(await nodeToWebRequest(req, bodyLimit));
-      await sendWebResponseFrom(req, res, response);
-    })().catch((error) => {
-      if (res.headersSent) return;
-      if (error instanceof RequestBodyTooLargeError) {
-        res.statusCode = 413;
-        res.end();
-        return;
+      try {
+        const [mod, rpc] = await Promise.all([loadRouter(), loadRpc()]);
+        // SAFETY: Effect RpcGroup default export + handlers layer are opaque to the plugin; createActionHandler owns the runtime contract.
+        const handler = rpc.createActionHandler(
+          mod.default as never,
+          mod.actionsHandlers as never,
+          {
+            path: actionPath,
+            sameOrigin,
+          }
+        );
+        const response = await handler(await nodeToWebRequest(req, bodyLimit));
+        await sendWebResponseFrom(req, res, response);
+      } catch (error) {
+        if (res.headersSent) {
+          return;
+        }
+        if (error instanceof RequestBodyTooLargeError) {
+          res.statusCode = 413;
+          res.end();
+          return;
+        }
+        onError?.(error instanceof Error ? error : new Error(String(error)));
+        // Never fall through to Vite's HTML/404 stack for action POSTs —
+        // that surfaces as a misleading empty 404 when the SSR graph is still cold.
+        res.statusCode = 503;
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ error: "oxide action handler failed" }));
       }
-      onError?.(error);
-      // Never fall through to Vite's HTML/404 stack for action POSTs — that
-      // surfaces as a misleading empty 404 when the SSR graph is still cold.
-      res.statusCode = 503;
-      res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: "oxide action handler failed" }));
-    });
+    })();
   };
-}
+};
 
-function attachActionUpgrade(
-  httpServer:
-    | {
-        on(
-          event: "upgrade",
-          listener: (req: IncomingMessage, socket: { destroy(): void }, head: Buffer) => void,
-        ): void;
-      }
-    | null
-    | undefined,
-  loadRouter: () => Promise<{ default: unknown; actionsHandlers: unknown }>,
+const attachActionUpgrade = function attachActionUpgrade(
+  httpServer: HttpUpgradeServer | null | undefined,
+  loadRouter: () => Promise<{ actionsHandlers: unknown; default: unknown }>,
   loadRpc: () => Promise<RpcDevModule>,
-  path: string,
-  sameOrigin: boolean,
+  actionPath: string,
+  sameOrigin: boolean
 ) {
-  if (!httpServer) return;
+  if (!httpServer) {
+    return;
+  }
   const crosswsNode = "crossws/adapters/node";
-  void import(/* @vite-ignore */ crosswsNode).then(({ default: crossws }) => {
+  void (async () => {
+    const { default: crossws } = await import(
+      /* @vite-ignore */
+      crosswsNode
+    );
     httpServer.on("upgrade", (req, socket, head) => {
-      if (!matchesActionPath((req.url ?? "").split("?")[0] ?? "", path)) return;
-      void Promise.all([loadRouter(), loadRpc()])
-        .then(([mod, rpc]) =>
-          crossws({
-            hooks: rpc.createWsHooks(mod.default as never, mod.actionsHandlers as never, {
-              path,
+      if (!matchesActionPath((req.url ?? "").split("?")[0] ?? "", actionPath)) {
+        return;
+      }
+      void (async () => {
+        try {
+          const [mod, rpc] = await Promise.all([loadRouter(), loadRpc()]);
+          // SAFETY: Effect RpcGroup default export + handlers layer are opaque; createWsHooks owns the runtime contract.
+          const hooks = rpc.createWsHooks(
+            mod.default as never,
+            mod.actionsHandlers as never,
+            {
+              path: actionPath,
               sameOrigin,
-            }),
-          }).handleUpgrade(req, socket as never, head),
-        )
-        .catch(() => {
+            }
+          );
+          // SAFETY: Node upgrade socket is a Duplex; crossws handleUpgrade accepts the broader net.Socket shape.
+          await crossws({ hooks }).handleUpgrade(req, socket as never, head);
+        } catch {
           socket.destroy();
-        });
+        }
+      })();
     });
-  });
-}
+  })();
+};
 
-function previewMiddleware(file: string) {
+const previewMiddleware = function previewMiddleware(file: string) {
   return (req: ConnectReq, res: ConnectRes, next: ConnectNext) => {
     void (async () => {
-      const mod = (await import(/* @vite-ignore */ pathToFileURL(file).href)) as {
-        default: { fetch: (request: Request) => Promise<Response> };
-      };
-      await sendWebResponseFrom(req, res, await mod.default.fetch(await nodeToWebRequest(req)));
-    })().catch(next);
+      try {
+        // SAFETY: dist/server.js default export is the generated fetch app; preview only runs after a successful build.
+        const mod = (await import(
+          /* @vite-ignore */
+          pathToFileURL(file).href
+        )) as {
+          default: { fetch: (request: Request) => Promise<Response> };
+        };
+        await sendWebResponseFrom(
+          req,
+          res,
+          await mod.default.fetch(await nodeToWebRequest(req))
+        );
+      } catch (error) {
+        return next(error instanceof Error ? error : new Error(String(error)));
+      }
+    })();
   };
-}
+};
 
 interface RsbuildServer {
-  middlewares: { use: (fn: (req: ConnectReq, res: ConnectRes, next: ConnectNext) => void) => void };
-  httpServer?: {
-    on(
-      event: "upgrade",
-      listener: (req: IncomingMessage, socket: { destroy(): void }, head: Buffer) => void,
-    ): void;
+  httpServer?: HttpUpgradeServer;
+  middlewares: {
+    use: (
+      fn: (req: ConnectReq, res: ConnectRes, next: ConnectNext) => void
+    ) => void;
   };
 }
 
 interface RsbuildPluginApi {
   modifyRsbuildConfig: (fn: (config: RsbuildUserConfig) => void) => void;
-  onBeforeStartDevServer: (fn: (ctx: { server: RsbuildServer }) => void) => void;
-  onBeforeStartPreviewServer?: (fn: (ctx: { server: RsbuildServer }) => void) => void;
+  onBeforeStartDevServer: (
+    fn: (ctx: { server: RsbuildServer }) => void
+  ) => void;
+  onBeforeStartPreviewServer?: (
+    fn: (ctx: { server: RsbuildServer }) => void
+  ) => void;
 }
 
-function loadActions(root: string) {
+const loadActions = function loadActions(root: string) {
   const code = generateActionsModule(scanServerFiles(root), { bust: true });
   const dir = fs.mkdtempSync(path.join(root, ".oxide-actions-"));
   const file = path.join(dir, "actions.mjs");
   fs.writeFileSync(file, code);
-  return import(pathToFileURL(file).href).finally(() => {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }) as Promise<{
-    default: unknown;
-    actionsHandlers: unknown;
-  }>;
-}
+  return (async () => {
+    try {
+      // SAFETY: generated actions.mjs exports RpcGroup default + actionsHandlers; dynamic import has no static module type.
+      return (await import(pathToFileURL(file).href)) as {
+        actionsHandlers: unknown;
+        default: unknown;
+      };
+    } finally {
+      fs.rmSync(dir, { force: true, recursive: true });
+    }
+  })();
+};
+
+const loadVirtualClient = function loadVirtualClient(
+  resolved: ResolvedOptions | undefined,
+  options: OxidejsOptions | undefined
+): string {
+  const transport = resolveActionTransport(resolved, options);
+  return generateClientModule(
+    transport,
+    resolved?.actionHeaders ?? options?.actionHeaders,
+    resolved?.actionPath
+  );
+};
+
+const loadVirtualActions = function loadVirtualActions(
+  ctx: PluginHookContext,
+  resolved: ResolvedOptions | undefined,
+  extra?: { ssr?: boolean }
+): string {
+  const modules = scanServerFiles(resolved?.root ?? process.cwd());
+  if (pluginShouldStub(ctx, extra)) {
+    return generateActionsClientModule(modules);
+  }
+  for (const mod of modules) {
+    ctx.addWatchFile(mod.abs);
+  }
+  return generateActionsModule(modules);
+};
 
-export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (options) => {
+const loadVirtualWorker = function loadVirtualWorker(
+  ctx: PluginHookContext,
+  resolved: ResolvedOptions
+): string {
+  ctx.addWatchFile(resolved.workerEntryAbs);
+  const modules = scanServerFiles(resolved.root);
+  for (const mod of modules) {
+    ctx.addWatchFile(mod.abs);
+  }
+  return generateWorkerWrapper(resolved.workerEntryAbs, {
+    actionPath: resolved.actionPath,
+    actionSameOrigin: resolved.actionSameOrigin,
+    actions: resolved.actions,
+    bodyLimit: resolved.bodyLimit,
+    clientDir: resolved.clientDir,
+    env: resolved.env,
+    hasActions: modules.length > 0,
+    hasClient: resolved.hasClient,
+    hasPublic: resolved.hasPublic,
+    imports: resolved.imports,
+    // SAFETY: ResolvedOptions.middleware matches WorkerWrapperOpts.middleware (string | { module, imports? }).
+    middleware: resolved.middleware as never,
+    notFound: resolved.notFound,
+    preset: resolved.preset,
+  });
+};
+
+const loadPluginModule = function loadPluginModule(
+  ctx: PluginHookContext,
+  id: string,
+  resolved: ResolvedOptions | undefined,
+  options: OxidejsOptions | undefined,
+  extra?: { ssr?: boolean }
+): string | undefined {
+  if (id === RESOLVED_VIRTUAL_CLIENT_ID) {
+    return loadVirtualClient(resolved, options);
+  }
+  if (id === RESOLVED_VIRTUAL_WORKER_ID && pluginShouldStub(ctx, extra)) {
+    throw new Error(`oxidejs: ${VIRTUAL_WORKER_ID} is server-only`);
+  }
+  if (id === RESOLVED_VIRTUAL_ACTIONS_ID) {
+    return loadVirtualActions(ctx, resolved, extra);
+  }
+  if (id === RESOLVED_VIRTUAL_WORKER_ID) {
+    if (!resolved) {
+      return;
+    }
+    return loadVirtualWorker(ctx, resolved);
+  }
+  if (isServerFileId(id) && pluginShouldStub(ctx, extra)) {
+    const file = id.split("?")[0] ?? id;
+    ctx.addWatchFile(file);
+    return loadClientStub(id);
+  }
+  return undefined;
+};
+
+const runMiddlewareHandlers = async function runMiddlewareHandlers(
+  handlers: MwHandler[],
+  request: Request,
+  context: MiddlewareContext,
+  index: number
+): Promise<Response | undefined> {
+  if (index >= handlers.length) {
+    return;
+  }
+  const handler = handlers[index];
+  if (!handler) {
+    return runMiddlewareHandlers(handlers, request, context, index + 1);
+  }
+  const hit = await handler(request, context);
+  if (hit) {
+    return hit;
+  }
+  return runMiddlewareHandlers(handlers, request, context, index + 1);
+};
+
+const loadDevMiddlewareHandlers = async function loadDevMiddlewareHandlers(
+  server: DevSsrServer,
+  resolved: ResolvedOptions
+): Promise<MwHandler[]> {
+  try {
+    await Promise.all(
+      (resolved.imports ?? []).map((spec) => server.ssrLoadModule(spec))
+    );
+    const entries = resolved.middleware ?? [];
+    const mods = await Promise.all(
+      entries.map(async (entry) => {
+        const spec = isString(entry) ? entry : entry.module;
+        // SAFETY: user middleware modules export a default request handler; shape checked below.
+        return (await server.ssrLoadModule(spec)) as MiddlewareModule;
+      })
+    );
+    const handlers: MwHandler[] = [];
+    for (const mod of mods) {
+      if (!isMiddlewareDefault(mod.default)) {
+        continue;
+      }
+      const fn = mod.default;
+      handlers.push((request, context) =>
+        Promise.resolve(fn(request, context))
+      );
+    }
+    return handlers;
+  } catch (error) {
+    server.config.logger.error(
+      `oxidejs: failed to wire dev middleware: ${String(error)}`
+    );
+    return [];
+  }
+};
+
+export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (
+  options
+) => {
   let resolved: ResolvedOptions | undefined;
   const emitState = createEmitState();
 
   return {
-    name: "oxidejs",
-    enforce: "pre",
     buildStart() {
       resolved ??= resolveOptions(options, process.cwd());
       emitState.emitted = false;
     },
-    resolveId(id) {
-      if (id === VIRTUAL_ACTIONS_ID) return RESOLVED_VIRTUAL_ACTIONS_ID;
-      if (id === VIRTUAL_WORKER_ID) return RESOLVED_VIRTUAL_WORKER_ID;
-      if (id === VIRTUAL_CLIENT_ID) return RESOLVED_VIRTUAL_CLIENT_ID;
-      return null;
-    },
+    enforce: "pre",
     load(id, extra?: { ssr?: boolean }) {
-      if (id === RESOLVED_VIRTUAL_CLIENT_ID) {
-        const transport =
-          resolved?.actions ??
-          (typeof options?.actions === "string" || options?.actions === undefined
-            ? (options?.actions as "http" | "ws" | undefined)
-            : options.actions.transport) ??
-          "http";
-        return generateClientModule(
-          transport,
-          resolved?.actionHeaders ?? options?.actionHeaders,
-          resolved?.actionPath,
-        );
+      // SAFETY: unplugin binds `this` to the plugin context with addWatchFile / environment / getNativeBuildContext.
+      return loadPluginModule(
+        this as PluginHookContext,
+        id,
+        resolved,
+        options,
+        extra
+      );
+    },
+    name: "oxidejs",
+    resolveId(id) {
+      if (id === VIRTUAL_ACTIONS_ID) {
+        return RESOLVED_VIRTUAL_ACTIONS_ID;
       }
-      if (id === RESOLVED_VIRTUAL_WORKER_ID && pluginShouldStub(this, extra)) {
-        throw new Error(`oxidejs: ${VIRTUAL_WORKER_ID} is server-only`);
+      if (id === VIRTUAL_WORKER_ID) {
+        return RESOLVED_VIRTUAL_WORKER_ID;
       }
-      if (id === RESOLVED_VIRTUAL_ACTIONS_ID) {
-        const modules = scanServerFiles(resolved?.root ?? process.cwd());
-        if (pluginShouldStub(this, extra)) return generateActionsClientModule(modules);
-        for (const mod of modules) this.addWatchFile(mod.abs);
-        return generateActionsModule(modules);
+      if (id === VIRTUAL_CLIENT_ID) {
+        return RESOLVED_VIRTUAL_CLIENT_ID;
       }
-      if (id === RESOLVED_VIRTUAL_WORKER_ID) {
-        if (!resolved) return;
-        this.addWatchFile(resolved.workerEntryAbs);
-        const modules = scanServerFiles(resolved.root);
-        for (const mod of modules) this.addWatchFile(mod.abs);
-        return generateWorkerWrapper(resolved.workerEntryAbs, {
-          preset: resolved.preset,
-          clientDir: resolved.clientDir,
-          hasClient: resolved.hasClient,
-          hasPublic: resolved.hasPublic,
-          hasActions: modules.length > 0,
-          actions: resolved.actions,
-          actionPath: resolved.actionPath,
-          actionSameOrigin: resolved.actionSameOrigin,
-          middleware: resolved.middleware as never,
-          imports: resolved.imports,
-          bodyLimit: resolved.bodyLimit,
-          notFound: resolved.notFound,
-          env: resolved.env,
+      return null;
+    },
+    rsbuild: {
+      setup(api: RsbuildPluginApi) {
+        api.modifyRsbuildConfig((config) => {
+          const root = isString(config.root) ? config.root : process.cwd();
+          // SAFETY: RsbuildUserConfig is only probed for html entry paths (environments/build input).
+          resolved = resolveOptions(options, root, config as never);
+          applyRsbuildEnvironments(config, resolved);
         });
-      }
-      if (isServerFileId(id) && pluginShouldStub(this, extra)) {
-        const file = id.split("?")[0] ?? id;
-        this.addWatchFile(file);
-        return loadClientStub(id);
-      }
-      return;
+        api.onBeforeStartDevServer(({ server }) => {
+          const loadRouter = () => {
+            const root = resolved?.root ?? process.cwd();
+            return loadActions(root);
+          };
+          const opts = resolved;
+          if (!opts) {
+            return;
+          }
+          if (opts.actions === "ws") {
+            attachActionUpgrade(
+              server.httpServer,
+              loadRouter,
+              loadRpcModule,
+              opts.actionPath,
+              opts.actionSameOrigin
+            );
+          } else {
+            server.middlewares.use(
+              actionMiddleware(
+                loadRouter,
+                loadRpcModule,
+                opts.actionPath,
+                opts.actionSameOrigin,
+                opts.bodyLimit
+              )
+            );
+          }
+        });
+        api.onBeforeStartPreviewServer?.(({ server }) => {
+          if (resolved?.preset !== "fetch") {
+            return;
+          }
+          server.middlewares.use(
+            previewMiddleware(path.join(resolved.outDir, "server.js"))
+          );
+        });
+      },
     },
     transform(code, id, extra?: { ssr?: boolean }) {
+      // SAFETY: unplugin binds `this` to the plugin context used by pluginShouldStub.
+      const ctx = this as PluginHookContext;
       if (
         !isServerFileId(id) ||
-        !pluginShouldStub(this, extra) ||
+        !pluginShouldStub(ctx, extra) ||
         code.startsWith("// oxidejs:client-stub\n")
-      )
+      ) {
         return;
+      }
       return generateClientStub({
-        key: moduleKey(id.split("?")[0] ?? id),
         exports: parseExportedNames(code),
+        key: moduleKey(id.split("?")[0] ?? id),
         streams: parseStreamExports(code),
       });
     },
     vite: {
       config(config) {
-        const root = typeof config.root === "string" ? config.root : process.cwd();
+        const root = isString(config.root) ? config.root : process.cwd();
         resolved = resolveOptions(options, root, config);
-        applyViteEnvironments(config as ViteUserConfig, resolved);
+        // SAFETY: Vite UserConfig is passed through for the fields applyViteEnvironments reads (root, environments, build).
+        applyViteEnvironments(config as never, resolved);
+      },
+      configurePreviewServer(server) {
+        if (resolved?.preset !== "fetch") {
+          return;
+        }
+        server.middlewares.use(
+          previewMiddleware(path.join(resolved.outDir, "server.js"))
+        );
       },
       configureServer(server) {
         if (resolved?.preset === "celld") {
@@ -255,40 +549,54 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (opt
           // Celld builds target Workers, but dev SSR runs on Node. Worker export
           // conditions and noExternal:true pull in CJS deps (e.g. buffer-image-size)
           // that call `require` and break ilha frame renders.
-          const ssr = server.environments.ssr;
+          const { ssr } = server.environments;
           const resolve = ssr?.config?.resolve;
           if (resolve) {
             resolve.conditions = ["node", "import", "module", "default"];
             resolve.noExternal = ["effect", "oxidejs"];
           }
           const ssrOpts = ssr?.config?.ssr;
-          if (ssrOpts && typeof ssrOpts === "object") {
+          if (ssrOpts && isObject(ssrOpts)) {
             ssrOpts.target = "node";
             ssrOpts.noExternal = ["effect", "oxidejs"];
           }
         }
         const invalidateActions = () => {
           for (const env of Object.values(server.environments)) {
-            const mod = env.moduleGraph.getModuleById(RESOLVED_VIRTUAL_ACTIONS_ID);
-            if (mod) void env.moduleGraph.invalidateModule(mod);
+            const mod = env.moduleGraph.getModuleById(
+              RESOLVED_VIRTUAL_ACTIONS_ID
+            );
+            if (mod) {
+              void env.moduleGraph.invalidateModule(mod);
+            }
           }
         };
         const fetchRouter = async () => {
+          // SAFETY: virtual:oxide/actions SSR module exports RpcGroup default + actionsHandlers.
           const mod = (await server.ssrLoadModule(VIRTUAL_ACTIONS_ID)) as {
-            default: unknown;
             actionsHandlers: unknown;
+            default: unknown;
           };
           return mod;
         };
         // Lazy + clear-on-reject: never leave a rejected promise cached (sticky 503)
         // and never start a follow-up fetch nobody awaits (uncaught rejection → crash).
-        let routerReady: Promise<{ default: unknown; actionsHandlers: unknown }> | undefined;
-        const loadRouter = () => {
-          const current = (routerReady ??= fetchRouter());
-          return current.catch((error) => {
-            if (routerReady === current) routerReady = undefined;
+        let routerReady:
+          | Promise<{ actionsHandlers: unknown; default: unknown }>
+          | undefined;
+        const loadRouter = async () => {
+          if (routerReady === undefined) {
+            routerReady = fetchRouter();
+          }
+          const current = routerReady;
+          try {
+            return await current;
+          } catch (error) {
+            if (routerReady === current) {
+              routerReady = undefined;
+            }
             throw error;
-          });
+          }
         };
         const refreshRouter = () => {
           routerReady = undefined;
@@ -299,35 +607,46 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (opt
             refreshRouter();
           }
         });
-        const loadRpc = () => server.ssrLoadModule("oxidejs/rpc") as Promise<RpcDevModule>;
-        const logActionError = (error: unknown) => {
-          server.config.logger.error("oxidejs: action handler failed: " + String(error));
+        const loadRpc = () =>
+          // SAFETY: oxidejs/rpc SSR module exports createActionHandler + createWsHooks.
+          server.ssrLoadModule("oxidejs/rpc") as Promise<RpcDevModule>;
+        const logActionError = (error: Error) => {
+          server.config.logger.error(
+            `oxidejs: action handler failed: ${String(error)}`
+          );
         };
-        const wireActions = () =>
+        const opts = resolved;
+        const wireActions = () => {
+          if (!opts) {
+            return;
+          }
           server.middlewares.use(
             actionMiddleware(
               loadRouter,
               loadRpc,
-              resolved!.actionPath,
-              resolved!.actionSameOrigin,
-              resolved!.bodyLimit,
-              logActionError,
-            ),
+              opts.actionPath,
+              opts.actionSameOrigin,
+              opts.bodyLimit,
+              logActionError
+            )
           );
+        };
 
-        if (resolved?.actions === "ws") {
+        if (opts?.actions === "ws") {
           attachActionUpgrade(
             server.httpServer,
             loadRouter,
             loadRpc,
-            resolved.actionPath,
-            resolved.actionSameOrigin,
+            opts.actionPath,
+            opts.actionSameOrigin
           );
           return async () => {
             try {
               await loadRouter();
             } catch (error) {
-              server.config.logger.error("oxidejs: failed to prewarm actions: " + String(error));
+              server.config.logger.error(
+                `oxidejs: failed to prewarm actions: ${String(error)}`
+              );
             }
           };
         }
@@ -337,67 +656,59 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (opt
         // middleware modules is async; the bridge awaits that on first use.
         // Deferring `middlewares.use` until after `ssrLoadModule` used to put
         // actions behind Vite's catch-all → empty 404 on POST /__oxide/action.
-        type MwHandler = (
-          request: Request,
-          context: { env: unknown; ctx: unknown },
-        ) => Promise<Response | undefined>;
         let handlersPromise: Promise<MwHandler[]> = Promise.resolve([]);
 
-        if ((resolved?.middleware?.length ?? 0) > 0 || (resolved?.imports?.length ?? 0) > 0) {
-          handlersPromise = (async () => {
-            try {
-              for (const spec of resolved!.imports ?? []) await server.ssrLoadModule(spec);
-              const handlers: MwHandler[] = [];
-              for (const entry of resolved!.middleware ?? []) {
-                const spec = typeof entry === "string" ? entry : entry.module;
-                const mod = (await server.ssrLoadModule(spec)) as {
-                  default?: (
-                    request: Request,
-                    context: { env: unknown; ctx: unknown },
-                  ) => Response | undefined | Promise<Response | undefined>;
-                };
-                if (typeof mod.default !== "function") continue;
-                const fn = mod.default;
-                handlers.push((request, context) => Promise.resolve(fn(request, context)));
-              }
-              return handlers;
-            } catch (error) {
-              server.config.logger.error(
-                "oxidejs: failed to wire dev middleware: " + String(error),
-              );
-              return [];
-            }
-          })();
+        if (
+          opts &&
+          ((opts.middleware?.length ?? 0) > 0 ||
+            (opts.imports?.length ?? 0) > 0)
+        ) {
+          handlersPromise = loadDevMiddlewareHandlers(server, opts);
 
           server.middlewares.use((creq, cres, next) => {
             // Don't touch /__oxide/action — reading the body here would empty the
             // Node stream before the action middleware runs.
-            if (matchesActionPath((creq.url ?? "").split("?")[0] ?? "", resolved!.actionPath)) {
-              next();
-              return;
+            if (
+              matchesActionPath(
+                (creq.url ?? "").split("?")[0] ?? "",
+                opts.actionPath
+              )
+            ) {
+              return next();
             }
             void (async () => {
               try {
                 const handlers = await handlersPromise;
                 if (handlers.length === 0) {
-                  next();
-                  return;
+                  return next();
                 }
-                const { nodeToWebRequest, sendWebResponseFrom } = await import("./actions");
-                const request = await nodeToWebRequest(creq, resolved!.bodyLimit);
-                const context = { env: resolved!.env, ctx: undefined };
-                for (const handler of handlers) {
-                  const hit = await handler(request, context);
-                  if (hit) {
-                    await sendWebResponseFrom(creq, cres, hit);
-                    return;
-                  }
+                const request = await nodeToWebRequest(creq, opts.bodyLimit);
+                const context: MiddlewareContext = {
+                  ctx: undefined,
+                  env: opts.env,
+                };
+                const hit = await runMiddlewareHandlers(
+                  handlers,
+                  request,
+                  context,
+                  0
+                );
+                if (hit) {
+                  await sendWebResponseFrom(creq, cres, hit);
+                  return;
                 }
-                next();
+                return next();
               } catch (error) {
-                if (cres.headersSent) return;
-                cres.statusCode = error instanceof RequestBodyTooLargeError ? 413 : 500;
-                cres.end(error instanceof RequestBodyTooLargeError ? undefined : String(error));
+                if (cres.headersSent) {
+                  return;
+                }
+                cres.statusCode =
+                  error instanceof RequestBodyTooLargeError ? 413 : 500;
+                cres.end(
+                  error instanceof RequestBodyTooLargeError
+                    ? undefined
+                    : String(error)
+                );
               }
             })();
           });
@@ -413,66 +724,29 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (opt
             await loadRouter();
             await handlersPromise;
           } catch (error) {
-            server.config.logger.error("oxidejs: failed to prewarm dev server: " + String(error));
+            server.config.logger.error(
+              `oxidejs: failed to prewarm dev server: ${String(error)}`
+            );
           }
         };
       },
-      configurePreviewServer(server) {
-        if (resolved?.preset !== "fetch") return;
-        server.middlewares.use(previewMiddleware(path.join(resolved.outDir, "server.js")));
-      },
-    },
-    rsbuild: {
-      setup(api: RsbuildPluginApi) {
-        api.modifyRsbuildConfig((config) => {
-          const root = typeof config.root === "string" ? config.root : process.cwd();
-          resolved = resolveOptions(options, root, config);
-          applyRsbuildEnvironments(config, resolved);
-        });
-        api.onBeforeStartDevServer(({ server }) => {
-          const loadRouter = async () => {
-            const root = resolved?.root ?? process.cwd();
-            return loadActions(root);
-          };
-          const loadRpc = async (): Promise<RpcDevModule> => ({
-            createActionHandler,
-            createWsHooks,
-          });
-          if (resolved?.actions === "ws")
-            attachActionUpgrade(
-              server.httpServer,
-              loadRouter,
-              loadRpc,
-              resolved.actionPath,
-              resolved.actionSameOrigin,
-            );
-          else
-            server.middlewares.use(
-              actionMiddleware(
-                loadRouter,
-                loadRpc,
-                resolved!.actionPath,
-                resolved!.actionSameOrigin,
-                resolved!.bodyLimit,
-              ),
-            );
-        });
-        api.onBeforeStartPreviewServer?.(({ server }) => {
-          if (resolved?.preset !== "fetch") return;
-          server.middlewares.use(previewMiddleware(path.join(resolved.outDir, "server.js")));
-        });
-      },
     },
     writeBundle() {
-      if (!resolved) return;
+      if (!resolved) {
+        return;
+      }
       copyPublicDir(resolved);
       tryEmitWranglerConfig(resolved, emitState);
     },
   };
 };
 
-export const oxidejs = /* @__PURE__ */ createUnplugin(unpluginFactory);
+export const oxidejs =
+  /* @__PURE__ */
+  createUnplugin(unpluginFactory);
 
-export const vite = /* @__PURE__ */ (() => oxidejs.vite)();
+export const vite =
+  /* @__PURE__ */
+  (() => oxidejs.vite)();
 
 export default oxidejs;
diff --git a/packages/oxidejs/src/rpc/client.ts b/packages/oxidejs/src/rpc/client.ts
index 3a1c2f3..1ce2a4b 100644
--- a/packages/oxidejs/src/rpc/client.ts
+++ b/packages/oxidejs/src/rpc/client.ts
@@ -1,207 +1,335 @@
 import { Effect, Layer, Scope, Stream } from "effect";
-import type { Rpc } from "effect/unstable/rpc";
-import { RpcClient, type RpcGroup, RpcSchema, RpcSerialization } from "effect/unstable/rpc";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientRequest,
+} from "effect/unstable/http";
+import type { Rpc, RpcGroup } from "effect/unstable/rpc";
+import { RpcClient, RpcSchema, RpcSerialization } from "effect/unstable/rpc";
 import { Socket } from "effect/unstable/socket";
+
 import type { OxidejsActionHeaders } from "../types";
 import { streamToAsyncGen } from "./stream";
 
-export type RpcClientOptions = {
-  url: string;
-  transport?: "http" | "ws";
+export interface RpcClientOptions {
   headers?: OxidejsActionHeaders;
-};
+  transport?: "http" | "ws";
+  url: string;
+}
+
+interface CallOptions {
+  signal?: AbortSignal;
+}
 
-type CallOptions = { signal?: AbortSignal };
+/** Opaque action argument values (JSON-ish plus call options bags). */
+type ActionCallArg =
+  | string
+  | number
+  | boolean
+  | null
+  | ActionCallArg[]
+  | { [key: string]: ActionCallArg }
+  | CallOptions
+  | AbortSignal;
+
+/** Values returned from an action call before nesting. */
+type ActionCallResult =
+  | string
+  | number
+  | boolean
+  | null
+  | object
+  | undefined
+  | AsyncGenerator<ActionCallResult>;
 
 type RpcCaller = (
-  payload: { args: unknown[] },
-  options?: CallOptions,
-) => Effect.Effect<unknown, unknown, never> | Stream.Stream<unknown>;
+  payload: { args: ActionCallArg[] },
+  options?: CallOptions
+) =>
+  | Effect.Effect<ActionCallResult, Error, never>
+  | Stream.Stream<ActionCallResult>;
 
 type FlatClient = Record<string, RpcCaller>;
 
 type NestedClient = Record<
   string,
-  Record<string, (...args: unknown[]) => Promise<unknown> | AsyncGenerator<unknown>>
+  Record<
+    string,
+    (
+      ...args: ActionCallArg[]
+    ) => Promise<ActionCallResult> | AsyncGenerator<ActionCallResult>
+  >
 >;
 
 type ActionGroup = RpcGroup.RpcGroup<Rpc.Any>;
 
-type CacheEntry = {
+interface OxideClientGroup {
+  __oxideClientId?: number;
+}
+
+interface CacheEntry {
   pending: Promise<NestedClient>;
-};
+}
+
+interface RpcRequestMeta {
+  successSchema?: object;
+}
 
 const clientCache = new Map<string, CacheEntry>();
 let nextGroupId = 0;
 
-function cacheKey(group: ActionGroup, options: RpcClientOptions) {
-  const headerKey = options.headers
-    ? Object.entries(options.headers)
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([k, v]) => `${k}=${v}`)
-        .join("&")
-    : "";
-  let groupId = (group as { __oxideClientId?: number }).__oxideClientId;
+const isStringPropertyKey = function isStringPropertyKey(
+  key: string | symbol
+): key is string {
+  return typeof key === "string";
+};
+
+const cacheKey = function cacheKey(
+  group: ActionGroup,
+  options: RpcClientOptions
+) {
+  let headerKey = "";
+  if (options.headers) {
+    const entries = Object.entries(options.headers);
+    // oxlint-disable-next-line unicorn/no-array-sort -- Array#toSorted needs ES2023 lib; entries is already a copy
+    entries.sort(([a], [b]) => a.localeCompare(b));
+    headerKey = entries.map(([k, v]) => `${k}=${v}`).join("&");
+  }
+  // SAFETY: groups are mutable objects we stamp with a stable client cache id.
+  const stamped = group as ActionGroup & OxideClientGroup;
+  let groupId = stamped.__oxideClientId;
   if (groupId === undefined) {
-    groupId = ++nextGroupId;
-    (group as { __oxideClientId?: number }).__oxideClientId = groupId;
+    nextGroupId += 1;
+    groupId = nextGroupId;
+    stamped.__oxideClientId = groupId;
   }
   return `${groupId}|${options.transport ?? "http"}|${options.url}|${headerKey}`;
-}
+};
+
+const httpLayer = function httpLayer(options: RpcClientOptions) {
+  const { headers } = options;
+  if (!headers) {
+    return RpcClient.layerProtocolHttp({
+      url: options.url,
+    }).pipe(
+      Layer.provide(RpcSerialization.layerNdJsonRpc()),
+      Layer.provide(FetchHttpClient.layer)
+    );
+  }
 
-function httpLayer(options: RpcClientOptions) {
-  const headers = options.headers;
   return RpcClient.layerProtocolHttp({
-    url: options.url,
-    ...(headers
-      ? {
-          transformClient: <E, R>(client: HttpClient.HttpClient.With<E, R>) =>
-            HttpClient.mapRequest(client, (req) => {
-              for (const [key, value] of Object.entries(headers)) {
-                req = HttpClientRequest.setHeader(req, key, value);
-              }
-              return req;
-            }),
+    transformClient: <E, R>(client: HttpClient.HttpClient.With<E, R>) =>
+      HttpClient.mapRequest(client, (req) => {
+        let next = req;
+        for (const [key, value] of Object.entries(headers)) {
+          next = HttpClientRequest.setHeader(next, key, value);
         }
-      : {}),
-  }).pipe(Layer.provide(RpcSerialization.layerNdJsonRpc()), Layer.provide(FetchHttpClient.layer));
-}
+        return next;
+      }),
+    url: options.url,
+  }).pipe(
+    Layer.provide(RpcSerialization.layerNdJsonRpc()),
+    Layer.provide(FetchHttpClient.layer)
+  );
+};
 
-function wsLayer(url: string) {
+const wsLayer = function wsLayer(url: string) {
   return RpcClient.layerProtocolSocket().pipe(
     Layer.provide(RpcSerialization.layerNdJsonRpc()),
     Layer.provide(Socket.layerWebSocket(url)),
-    Layer.provide(Socket.layerWebSocketConstructorGlobal),
+    Layer.provide(Socket.layerWebSocketConstructorGlobal)
   );
-}
+};
 
-function clientLayer(options: RpcClientOptions) {
+const clientLayer = function clientLayer(options: RpcClientOptions) {
   return options.transport === "ws" ? wsLayer(options.url) : httpLayer(options);
-}
+};
 
-function loadClient(group: ActionGroup, options: RpcClientOptions) {
-  return Effect.gen(function* () {
+const loadClient = function loadClient(
+  group: ActionGroup,
+  options: RpcClientOptions
+) {
+  return Effect.gen(function* loadClientGen() {
     const scope = yield* Scope.make();
     // Build the layer inside the long-lived scope and provide its Context.
     // `Effect.provide(layer)` builds in a transient scope that closes as soon as
     // `RpcClient.make` returns — killing the socket protocol's forked read loop
     // before it ever dials, so every WS action call hangs forever.
-    const context = yield* Scope.provide(scope)(Layer.build(clientLayer(options)));
-    return yield* Scope.provide(scope)(RpcClient.make(group).pipe(Effect.provide(context)));
+    const context = yield* Scope.provide(scope)(
+      Layer.build(clientLayer(options))
+    );
+    return yield* Scope.provide(scope)(
+      RpcClient.make(group).pipe(Effect.provide(context))
+    );
   });
-}
+};
 
-function isStreamResult(value: unknown): value is Stream.Stream<unknown> {
+const isStreamResult = function isStreamResult(
+  value:
+    | Effect.Effect<ActionCallResult, Error, never>
+    | Stream.Stream<ActionCallResult>
+): value is Stream.Stream<ActionCallResult> {
   return Stream.isStream(value);
-}
+};
 
-function isStreamTag(group: ActionGroup, tag: string) {
-  const rpc = group.requests.get(tag) as { successSchema?: unknown } | undefined;
-  if (!rpc?.successSchema) return false;
+const isStreamTag = function isStreamTag(group: ActionGroup, tag: string) {
+  // SAFETY: Effect request map values expose optional successSchema used by isStreamSchema.
+  const rpc = group.requests.get(tag) as RpcRequestMeta | undefined;
+  if (!rpc?.successSchema) {
+    return false;
+  }
+  // SAFETY: isStreamSchema accepts Effect schema values; successSchema is that schema object.
   return RpcSchema.isStreamSchema(rpc.successSchema as never);
-}
+};
 
-function streamToAsyncGenerator<T>(stream: Stream.Stream<T>, signal?: AbortSignal) {
+const streamToAsyncGenerator = function streamToAsyncGenerator<T>(
+  stream: Stream.Stream<T>,
+  signal?: AbortSignal
+) {
   const iterable = streamToAsyncGen(stream);
-  return (async function* () {
-    if (signal?.aborted) throw new DOMException("Aborted", "AbortError");
+  return (async function* streamProxy() {
+    if (signal?.aborted) {
+      throw new DOMException("Aborted", "AbortError");
+    }
     const iterator = iterable[Symbol.asyncIterator]();
-    const onAbort = () => {
+    const onAbort = function onAbort() {
       void iterator.return?.();
     };
     signal?.addEventListener("abort", onAbort, { once: true });
-    try {
-      while (true) {
-        if (signal?.aborted) throw new DOMException("Aborted", "AbortError");
-        const next = await iterator.next();
-        if (next.done) return undefined as undefined;
-        yield next.value;
+
+    const pull = async function* pull(): AsyncGenerator<T> {
+      if (signal?.aborted) {
+        throw new DOMException("Aborted", "AbortError");
+      }
+      const next = await iterator.next();
+      if (next.done) {
+        return;
       }
+      yield next.value;
+      yield* pull();
+    };
+
+    try {
+      yield* pull();
     } finally {
       signal?.removeEventListener("abort", onAbort);
     }
   })();
-}
+};
 
-function callFlat(client: FlatClient, tag: string, args: unknown[], callOpts?: CallOptions) {
+const callFlat = function callFlat(
+  client: FlatClient,
+  tag: string,
+  args: ActionCallArg[],
+  callOpts?: CallOptions
+) {
   const caller = client[tag];
-  if (!caller) return Promise.reject(new Error(`Unknown action ${tag}`));
+  if (!caller) {
+    return Promise.reject(new Error(`Unknown action ${tag}`));
+  }
   const result = caller({ args }, callOpts);
   if (isStreamResult(result)) {
     return streamToAsyncGenerator(result, callOpts?.signal);
   }
-  return Effect.runPromise(result as Effect.Effect<unknown>, { signal: callOpts?.signal });
-}
+  // SAFETY: non-stream RpcCaller results are Effects runnable via Effect.runPromise.
+  return Effect.runPromise(result as Effect.Effect<ActionCallResult>, {
+    signal: callOpts?.signal,
+  });
+};
 
-function nestClient(group: ActionGroup, flat: FlatClient): NestedClient {
+const isCallOptions = function isCallOptions(
+  value: ActionCallArg
+): value is CallOptions {
+  return (
+    value !== null &&
+    typeof value === "object" &&
+    "signal" in value &&
+    value.signal instanceof AbortSignal &&
+    Object.keys(value).length === 1
+  );
+};
+
+const nestClient = function nestClient(group: ActionGroup, flat: FlatClient) {
   const nested: NestedClient = {};
   for (const tag of group.requests.keys()) {
     const dot = tag.indexOf(".");
-    if (dot === -1) continue;
+    if (dot === -1) {
+      continue;
+    }
     const mod = tag.slice(0, dot);
     const name = tag.slice(dot + 1);
     nested[mod] ??= {};
-    nested[mod][name] = (...args: unknown[]) => {
+    nested[mod][name] = (...args: ActionCallArg[]) => {
       const opts = args.at(-1);
-      const hasSignal =
-        opts &&
-        typeof opts === "object" &&
-        "signal" in opts &&
-        opts.signal instanceof AbortSignal &&
-        Object.keys(opts).length === 1;
+      const hasSignal = opts !== undefined && isCallOptions(opts);
       const params = hasSignal ? args.slice(0, -1) : args;
-      const callOpts = hasSignal ? (opts as CallOptions) : undefined;
+      const callOpts = hasSignal ? opts : undefined;
       return callFlat(flat, tag, params, callOpts);
     };
   }
   return nested;
-}
+};
 
-export function createClient(group: ActionGroup, options: RpcClientOptions): NestedClient {
+export const createClient = function createClient(
+  group: ActionGroup,
+  options: RpcClientOptions
+) {
   const key = cacheKey(group, options);
   let entry = clientCache.get(key);
   if (!entry) {
-    const pending = Effect.runPromise(loadClient(group, options))
-      .then((flat) => {
-        // SAFETY: RpcClient yields a tag-keyed flat client; cast collapses the generated service shape to the string-keyed callers nestClient builds.
-        return nestClient(group, flat as unknown as FlatClient);
-      })
-      .catch((error) => {
+    const pending = (async function loadNestedClient() {
+      try {
+        const flat = await Effect.runPromise(loadClient(group, options));
+        // SAFETY: RpcClient.make yields a tag-keyed service; never bridges Effect's generated client to FlatClient.
+        return nestClient(group, flat as never);
+      } catch (error) {
         clientCache.delete(key);
         throw error;
-      });
+      }
+    })();
     entry = { pending };
     clientCache.set(key, entry);
   }
 
+  const cached = entry;
+
+  // SAFETY: empty target; NestedClient shape is enforced by the get traps below.
   return new Proxy({} as NestedClient, {
     get(_target, mod) {
-      if (typeof mod !== "string") return undefined;
+      if (!isStringPropertyKey(mod)) {
+        return;
+      }
       return new Proxy(
         {},
         {
           get(_inner, name) {
-            if (typeof name !== "string") return undefined;
+            if (!isStringPropertyKey(name)) {
+              return;
+            }
             const tag = `${mod}.${name}`;
             if (isStreamTag(group, tag)) {
-              return (...args: unknown[]) =>
-                (async function* () {
-                  const client = await entry!.pending;
+              return (...args: ActionCallArg[]) =>
+                (async function* streamAction() {
+                  const client = await cached.pending;
                   const out = client[mod]?.[name]?.(...args);
-                  if (!out) throw new Error(`Unknown action ${mod}.${name}`);
-                  yield* out as AsyncGenerator<unknown>;
+                  if (!out) {
+                    throw new Error(`Unknown action ${mod}.${name}`);
+                  }
+                  // SAFETY: stream actions return AsyncGenerator from callFlat.
+                  yield* out as AsyncGenerator<ActionCallResult>;
                 })();
             }
-            return (...args: unknown[]) =>
-              entry!.pending.then(
-                (client) =>
-                  (client[mod]?.[name]?.(...args) as Promise<unknown>) ??
-                  Promise.reject(new Error(`Unknown action ${mod}.${name}`)),
-              );
+            return async (...args: ActionCallArg[]) => {
+              const client = await cached.pending;
+              const out = client[mod]?.[name]?.(...args);
+              if (!out) {
+                throw new Error(`Unknown action ${mod}.${name}`);
+              }
+              return out;
+            };
           },
-        },
+        }
       );
     },
   });
-}
+};
diff --git a/packages/oxidejs/src/rpc/same-origin.ts b/packages/oxidejs/src/rpc/same-origin.ts
index 78904c6..658cc4d 100644
--- a/packages/oxidejs/src/rpc/same-origin.ts
+++ b/packages/oxidejs/src/rpc/same-origin.ts
@@ -1,13 +1,22 @@
-export function isSameOrigin(request: Request): boolean {
+export const isSameOrigin = function isSameOrigin(request: Request): boolean {
   const site = request.headers.get("sec-fetch-site");
   const origin = request.headers.get("origin");
   // Browsers always send at least one of these for credentialed/fetch actions.
-  if (!origin && !site) return false;
-  if (site && site !== "same-origin" && site !== "none") return false;
-  if (!origin) return site === "same-origin" || site === "none";
+  if (!origin && !site) {
+    return false;
+  }
+  if (site && site !== "same-origin" && site !== "none") {
+    return false;
+  }
+  if (!origin) {
+    return site === "same-origin" || site === "none";
+  }
   try {
-    return new URL(origin).host === (request.headers.get("host") ?? new URL(request.url).host);
+    return (
+      new URL(origin).host ===
+      (request.headers.get("host") ?? new URL(request.url).host)
+    );
   } catch {
     return false;
   }
-}
+};
diff --git a/packages/oxidejs/src/rpc/scrub.test.ts b/packages/oxidejs/src/rpc/scrub.test.ts
index 0241d91..1282edc 100644
--- a/packages/oxidejs/src/rpc/scrub.test.ts
+++ b/packages/oxidejs/src/rpc/scrub.test.ts
@@ -1,27 +1,42 @@
 import { expect, test } from "bun:test";
 
 import {
-  extractJsonRpcRequestId,
   extractJsonRpcRequestIds,
   scrubNdjsonTransform,
   scrubRpcJson,
 } from "./scrub";
 
+const readAll = async function readAll(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  decoder: TextDecoder,
+  out = ""
+): Promise<string> {
+  const { done, value } = await reader.read();
+  if (done) {
+    return out;
+  }
+  return readAll(
+    reader,
+    decoder,
+    out + decoder.decode(value, { stream: true })
+  );
+};
+
 test("scrubRpcJson strips Defect and restores request id", () => {
   const raw = JSON.stringify({
-    jsonrpc: "2.0",
-    id: -32603,
     error: {
       _tag: "Defect",
       code: 1,
+      data: { message: "secret", name: "Error" },
       message: "A defect occurred",
-      data: { name: "Error", message: "secret" },
     },
+    id: -32_603,
+    jsonrpc: "2.0",
   });
   expect(JSON.parse(scrubRpcJson(raw, [42]))).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_603, message: "Internal error" },
     id: 42,
-    error: { code: -32603, message: "Internal error" },
+    jsonrpc: "2.0",
   });
 });
 
@@ -30,76 +45,81 @@ test("scrubRpcJson maps Cause unknown-method and invalid-params", () => {
     JSON.parse(
       scrubRpcJson(
         JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
           error: {
             _tag: "Cause",
-            message: '[{"_tag":"Die","defect":"Unknown request tag: x"}]',
             data: [{ _tag: "Die", defect: "Unknown request tag: x" }],
+            message: '[{"_tag":"Die","defect":"Unknown request tag: x"}]',
           },
-        }),
-      ),
-    ),
+          id: 1,
+          jsonrpc: "2.0",
+        })
+      )
+    )
   ).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_601, message: "Method not found" },
     id: 1,
-    error: { code: -32601, message: "Method not found" },
+    jsonrpc: "2.0",
   });
 
   expect(
     JSON.parse(
       scrubRpcJson(
         JSON.stringify({
-          jsonrpc: "2.0",
+          error: {
+            _tag: "Cause",
+            data: [],
+            message: 'Missing key\n  at ["args"]',
+          },
           id: 1,
-          error: { _tag: "Cause", message: 'Missing key\n  at ["args"]', data: [] },
-        }),
-      ),
-    ),
+          jsonrpc: "2.0",
+        })
+      )
+    )
   ).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_602, message: "Invalid params" },
     id: 1,
-    error: { code: -32602, message: "Invalid params" },
+    jsonrpc: "2.0",
   });
 
   expect(
     JSON.parse(
       scrubRpcJson(
         JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
           error: {
             _tag: "Cause",
-            message: '[{"_tag":"Die","defect":"Expected never\\n  at [\\"cause\\"]"}]',
             data: [],
+            message:
+              '[{"_tag":"Die","defect":"Expected never\\n  at [\\"cause\\"]"}]',
           },
-        }),
-      ),
-    ),
+          id: 1,
+          jsonrpc: "2.0",
+        })
+      )
+    )
   ).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_603, message: "Internal error" },
     id: 1,
-    error: { code: -32603, message: "Internal error" },
+    jsonrpc: "2.0",
   });
 
   expect(
     JSON.parse(
       scrubRpcJson(
         JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
           error: {
             _tag: "Cause",
-            message: '[{"_tag":"Interrupt"}]',
             data: [{ _tag: "Interrupt" }],
+            message: '[{"_tag":"Interrupt"}]',
           },
-        }),
-      ),
-    ),
+          id: 1,
+          jsonrpc: "2.0",
+        })
+      )
+    )
   ).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_603, message: "Internal error" },
     id: 1,
-    error: { code: -32603, message: "Internal error" },
+    jsonrpc: "2.0",
   });
 });
 
@@ -108,37 +128,41 @@ test("scrubRpcJson keeps plain Forbidden errors (no data)", () => {
     JSON.parse(
       scrubRpcJson(
         JSON.stringify({
-          jsonrpc: "2.0",
+          error: { code: -32_600, data: { sneak: true }, message: "Forbidden" },
           id: null,
-          error: { code: -32600, message: "Forbidden", data: { sneak: true } },
-        }),
-      ),
-    ),
+          jsonrpc: "2.0",
+        })
+      )
+    )
   ).toEqual({
-    jsonrpc: "2.0",
+    error: { code: -32_600, message: "Forbidden" },
     id: null,
-    error: { code: -32600, message: "Forbidden" },
+    jsonrpc: "2.0",
   });
 });
 
 test("scrubRpcJson rewrites each NDJSON frame independently", () => {
-  const raw =
-    JSON.stringify({
-      jsonrpc: "2.0",
+  const raw = `${JSON.stringify({
+    chunk: true,
+    id: 1,
+    jsonrpc: "2.0",
+    result: [0],
+  })}\n${JSON.stringify({
+    error: { _tag: "Defect", data: { message: "secret" } },
+    id: -32_603,
+    jsonrpc: "2.0",
+  })}\n`;
+  expect(scrubRpcJson(raw, [1])).toBe(
+    `${JSON.stringify({
       chunk: true,
       id: 1,
+      jsonrpc: "2.0",
       result: [0],
-    }) +
-    "\n" +
-    JSON.stringify({
+    })}\n${JSON.stringify({
+      error: { code: -32_603, message: "Internal error" },
+      id: 1,
       jsonrpc: "2.0",
-      id: -32603,
-      error: { _tag: "Defect", data: { message: "secret" } },
-    }) +
-    "\n";
-  expect(scrubRpcJson(raw, [1])).toBe(
-    '{"jsonrpc":"2.0","chunk":true,"id":1,"result":[0]}\n' +
-      '{"jsonrpc":"2.0","id":1,"error":{"code":-32603,"message":"Internal error"}}\n',
+    })}\n`
   );
 });
 
@@ -151,12 +175,12 @@ test("scrubNdjsonTransform flushes frames without waiting for the stream end", a
     start(controller) {
       controller.enqueue(
         encoder.encode(
-          JSON.stringify({
-            jsonrpc: "2.0",
-            id: -32603,
+          `${JSON.stringify({
             error: { _tag: "Defect", data: { message: "secret" } },
-          }) + "\n",
-        ),
+            id: -32_603,
+            jsonrpc: "2.0",
+          })}\n`
+        )
       );
       // Leave the stream open briefly so flush is not required for the first frame.
     },
@@ -165,7 +189,11 @@ test("scrubNdjsonTransform flushes frames without waiting for the stream end", a
   const reader = input.pipeThrough(transform).getReader();
   const { value } = await reader.read();
   expect(decoder.decode(value)).toBe(
-    '{"jsonrpc":"2.0","id":9,"error":{"code":-32603,"message":"Internal error"}}\n',
+    `${JSON.stringify({
+      error: { code: -32_603, message: "Internal error" },
+      id: 9,
+      jsonrpc: "2.0",
+    })}\n`
   );
   await reader.cancel();
 });
@@ -174,12 +202,11 @@ test("scrubNdjsonTransform reassembles a line split across multi-byte UTF-8", as
   const transform = scrubNdjsonTransform([3]);
   const encoder = new TextEncoder();
   const decoder = new TextDecoder();
-  const line =
-    JSON.stringify({
-      jsonrpc: "2.0",
-      id: -32603,
-      error: { _tag: "Defect", data: { message: "sécret-café" } },
-    }) + "\n";
+  const line = `${JSON.stringify({
+    error: { _tag: "Defect", data: { message: "sécret-café" } },
+    id: -32_603,
+    jsonrpc: "2.0",
+  })}\n`;
   const bytes = encoder.encode(line);
   // Split inside the multi-byte UTF-8 sequence for é (C3 A9).
   const é = bytes.indexOf(0xc3);
@@ -195,63 +222,77 @@ test("scrubNdjsonTransform reassembles a line split across multi-byte UTF-8", as
   });
 
   const reader = input.pipeThrough(transform).getReader();
-  let out = "";
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    out += decoder.decode(value, { stream: true });
-  }
-  expect(out).toBe('{"jsonrpc":"2.0","id":3,"error":{"code":-32603,"message":"Internal error"}}\n');
+  const out = await readAll(reader, decoder);
+  expect(out).toBe(
+    `${JSON.stringify({
+      error: { code: -32_603, message: "Internal error" },
+      id: 3,
+      jsonrpc: "2.0",
+    })}\n`
+  );
   expect(out).not.toContain("sécret");
 });
 
 test("scrubRpcJson repairs distinct Defect ids for multi-request batches", () => {
   const batch = JSON.stringify([
     {
-      jsonrpc: "2.0",
-      id: -32603,
       error: { _tag: "Defect", data: { message: "first" } },
+      id: -32_603,
+      jsonrpc: "2.0",
     },
     {
-      jsonrpc: "2.0",
-      id: -32603,
       error: { _tag: "Defect", data: { message: "second" } },
+      id: -32_603,
+      jsonrpc: "2.0",
     },
   ]);
   expect(JSON.parse(scrubRpcJson(batch, [10, 20]))).toEqual([
-    { jsonrpc: "2.0", id: 10, error: { code: -32603, message: "Internal error" } },
-    { jsonrpc: "2.0", id: 20, error: { code: -32603, message: "Internal error" } },
+    {
+      error: { code: -32_603, message: "Internal error" },
+      id: 10,
+      jsonrpc: "2.0",
+    },
+    {
+      error: { code: -32_603, message: "Internal error" },
+      id: 20,
+      jsonrpc: "2.0",
+    },
   ]);
 
-  const ndjson =
-    JSON.stringify({
-      jsonrpc: "2.0",
+  const ndjson = `${JSON.stringify({
+    id: 10,
+    jsonrpc: "2.0",
+    result: "ok",
+  })}\n${JSON.stringify({
+    error: { _tag: "Defect", data: { message: "boom" } },
+    id: -32_603,
+    jsonrpc: "2.0",
+  })}\n`;
+  expect(scrubRpcJson(ndjson, [10, 20])).toBe(
+    `${JSON.stringify({
       id: 10,
+      jsonrpc: "2.0",
       result: "ok",
-    }) +
-    "\n" +
-    JSON.stringify({
+    })}\n${JSON.stringify({
+      error: { code: -32_603, message: "Internal error" },
+      id: 20,
       jsonrpc: "2.0",
-      id: -32603,
-      error: { _tag: "Defect", data: { message: "boom" } },
-    }) +
-    "\n";
-  expect(scrubRpcJson(ndjson, [10, 20])).toBe(
-    '{"jsonrpc":"2.0","id":10,"result":"ok"}\n' +
-      '{"jsonrpc":"2.0","id":20,"error":{"code":-32603,"message":"Internal error"}}\n',
+    })}\n`
   );
 });
 
 test("extractJsonRpcRequestIds reads unary, batch array, and NDJSON ids", () => {
-  expect(extractJsonRpcRequestId('{"jsonrpc":"2.0","id":7,"method":"x"}')).toBe(7);
+  expect(
+    extractJsonRpcRequestIds('{"jsonrpc":"2.0","id":7,"method":"x"}')
+  ).toEqual([7]);
   expect(
     extractJsonRpcRequestIds(
-      '[{"jsonrpc":"2.0","id":3,"method":"a"},{"jsonrpc":"2.0","id":4,"method":"b"}]',
-    ),
+      '[{"jsonrpc":"2.0","id":3,"method":"a"},{"jsonrpc":"2.0","id":4,"method":"b"}]'
+    )
   ).toEqual([3, 4]);
   expect(
     extractJsonRpcRequestIds(
-      '{"jsonrpc":"2.0","id":1,"method":"a"}\n{"jsonrpc":"2.0","id":2,"method":"b"}\n',
-    ),
+      '{"jsonrpc":"2.0","id":1,"method":"a"}\n{"jsonrpc":"2.0","id":2,"method":"b"}\n'
+    )
   ).toEqual([1, 2]);
 });
diff --git a/packages/oxidejs/src/rpc/scrub.ts b/packages/oxidejs/src/rpc/scrub.ts
index b1d558f..bb33bea 100644
--- a/packages/oxidejs/src/rpc/scrub.ts
+++ b/packages/oxidejs/src/rpc/scrub.ts
@@ -1,93 +1,167 @@
 /** Strip Effect RPC `Defect` / `Cause` payloads down to plain JSON-RPC errors. */
 
-const INTERNAL = { code: -32603, message: "Internal error" } as const;
-const NDJSON_CONTENT = "application/json-rpc";
+import type { OxidejsJson } from "../types";
+
+/** JSON-RPC request/response id. */
+export type JsonRpcId = string | number | null;
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === "object";
+interface JsonRpcErrorBody {
+  code: number;
+  message: string;
 }
 
-function classifyCause(error: Record<string, unknown>): { code: number; message: string } {
+interface JsonObject {
+  [key: string]: OxidejsJson;
+}
+
+const INTERNAL: JsonRpcErrorBody = { code: -32_603, message: "Internal error" };
+const NDJSON_CONTENT = "application/json-rpc";
+
+const isJsonObject = function isJsonObject(
+  value: OxidejsJson
+): value is JsonObject {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+};
+
+const classifyCause = function classifyCause(
+  error: JsonObject
+): JsonRpcErrorBody {
   const blob = `${String(error["message"] ?? "")}${JSON.stringify(error["data"] ?? "")}`;
-  if (/Unknown request tag/i.test(blob)) {
-    return { code: -32601, message: "Method not found" };
+  if (/Unknown request tag/iu.test(blob)) {
+    return { code: -32_601, message: "Method not found" };
   }
   // Payload decode failures (not Effect's "Expected never" on typed Fail/Die exits).
   if (
-    /Missing key/i.test(blob) ||
-    (/Expected/i.test(blob) && /\["args"\]|\[\\"args\\"\]/.test(blob))
+    /Missing key/iu.test(blob) ||
+    (/Expected/iu.test(blob) && /\["args"\]|\[\\"args\\"\]/u.test(blob))
   ) {
-    return { code: -32602, message: "Invalid params" };
+    return { code: -32_602, message: "Invalid params" };
   }
   // Interrupt / Empty / sequential|parallel Die trees → opaque internal error.
   return { ...INTERNAL };
-}
+};
 
-function scrubError(error: unknown): { code: number; message: string } {
-  if (!isRecord(error)) return { ...INTERNAL };
+const isPlainJsonRpcError = function isPlainJsonRpcError(
+  error: JsonObject
+): error is JsonObject & { code: number; message: string } {
+  return (
+    typeof error["code"] === "number" && typeof error["message"] === "string"
+  );
+};
+
+const scrubError = function scrubError(error: OxidejsJson): JsonRpcErrorBody {
+  if (!isJsonObject(error)) {
+    return { ...INTERNAL };
+  }
 
-  if (error["_tag"] === "Defect") return { ...INTERNAL };
-  if (error["_tag"] === "Cause") return classifyCause(error);
+  if (error["_tag"] === "Defect") {
+    return { ...INTERNAL };
+  }
+  if (error["_tag"] === "Cause") {
+    return classifyCause(error);
+  }
 
   // Plain JSON-RPC (Forbidden, parse errors, etc.) — keep code/message, drop data.
-  if (typeof error["code"] === "number" && typeof error["message"] === "string") {
+  if (isPlainJsonRpcError(error)) {
     return { code: error["code"], message: error["message"] };
   }
   return { ...INTERNAL };
-}
+};
 
 /** Mutable repair state so each Defect can claim a distinct originating request id. */
-export type IdRepairState = {
+export interface IdRepairState {
   /** Request ids not yet claimed by a terminal (non-chunk) response. */
-  remaining: Set<unknown>;
-};
+  remaining: Set<JsonRpcId>;
+}
 
-export function createIdRepairState(requestIds: readonly unknown[] = []): IdRepairState {
+export const createIdRepairState = function createIdRepairState(
+  requestIds: readonly JsonRpcId[] = []
+): IdRepairState {
   return { remaining: new Set(requestIds) };
-}
+};
+
+const parseOxidejsJson = function parseOxidejsJson(raw: string): OxidejsJson {
+  // SAFETY: JSON.parse yields JSON values; OxidejsJson is the repo's JSON union.
+  return JSON.parse(raw) as OxidejsJson;
+};
 
 /**
  * Scrub one JSON-RPC response object.
  * Effect encodes Defects with `id: -32603`; reclaim the originating request id from `state.remaining`.
  */
-export function scrubRpcMessage(
-  msg: unknown,
-  requestIds: readonly unknown[] = [],
-  state: IdRepairState = createIdRepairState(requestIds),
-): unknown {
-  if (!isRecord(msg) || !("error" in msg) || msg["error"] == null) {
+export const scrubRpcMessage = function scrubRpcMessage(
+  msg: OxidejsJson,
+  requestIds: readonly JsonRpcId[] = [],
+  state: IdRepairState = createIdRepairState(requestIds)
+): OxidejsJson {
+  if (
+    !isJsonObject(msg) ||
+    !("error" in msg) ||
+    msg["error"] === null ||
+    msg["error"] === undefined
+  ) {
     // Terminal success / chunk frames with a real id consume that id so later Defects don't steal it.
-    if (isRecord(msg) && msg["chunk"] !== true && msg["id"] !== -32603 && "id" in msg) {
-      state.remaining.delete(msg["id"]);
+    if (
+      isJsonObject(msg) &&
+      msg["chunk"] !== true &&
+      msg["id"] !== -32_603 &&
+      "id" in msg
+    ) {
+      // SAFETY: JSON-RPC id values are string | number | null.
+      state.remaining.delete(msg["id"] as JsonRpcId);
     }
     return msg;
   }
 
-  const error = scrubError(msg["error"]);
-  let id = msg["id"];
-  if (id === -32603) {
+  const scrubbedError = scrubError(msg["error"]);
+  let { id } = msg;
+  if (id === -32_603) {
     const next = state.remaining.values().next();
-    if (!next.done) {
-      id = next.value;
-      state.remaining.delete(next.value);
-    } else {
+    if (next.done) {
       id = null;
+    } else {
+      ({ value: id } = next);
+      state.remaining.delete(next.value);
     }
   } else if (id !== undefined && id !== null) {
-    state.remaining.delete(id);
+    // SAFETY: remaining ids were collected as JsonRpcId from request frames.
+    state.remaining.delete(id as JsonRpcId);
+  }
+  if (id === undefined) {
+    id = null;
   }
-  if (id === undefined) id = null;
 
-  return { jsonrpc: "2.0", id, error };
-}
+  // SAFETY: JSON-RPC error envelopes only carry JSON values (code/message/id).
+  return {
+    error: { code: scrubbedError.code, message: scrubbedError.message },
+    id,
+    jsonrpc: "2.0",
+  } as OxidejsJson;
+};
+
+const scrubRpcLine = function scrubRpcLine(
+  line: string,
+  state: IdRepairState
+): string {
+  try {
+    return JSON.stringify(scrubRpcMessage(parseOxidejsJson(line), [], state));
+  } catch {
+    return line;
+  }
+};
 
 /**
  * Rewrite a JSON / NDJSON body so clients never see Effect `_tag` / `data` trees.
  * Accepts a single object, a JSON array, or newline-delimited frames.
  */
-export function scrubRpcJson(body: string, requestIds: readonly unknown[] = []): string {
-  const trimmed = body.replace(/^\uFEFF/, "");
-  if (!trimmed) return body;
+export const scrubRpcJson = function scrubRpcJson(
+  body: string,
+  requestIds: readonly JsonRpcId[] = []
+): string {
+  const trimmed = body.replace(/^\uFEFF/u, "");
+  if (!trimmed) {
+    return body;
+  }
   const state = createIdRepairState(requestIds);
 
   // NDJSON: one or more newline-terminated frames (possibly without a final newline).
@@ -106,79 +180,104 @@ export function scrubRpcJson(body: string, requestIds: readonly unknown[] = []):
   }
 
   try {
-    const parsed: unknown = JSON.parse(trimmed);
+    const parsed = parseOxidejsJson(trimmed);
     if (Array.isArray(parsed)) {
-      return JSON.stringify(parsed.map((msg) => scrubRpcMessage(msg, requestIds, state)));
+      return JSON.stringify(
+        parsed.map((msg) => scrubRpcMessage(msg, requestIds, state))
+      );
     }
     return JSON.stringify(scrubRpcMessage(parsed, requestIds, state));
   } catch {
     return body;
   }
-}
+};
 
-function scrubRpcLine(line: string, state: IdRepairState): string {
-  try {
-    return JSON.stringify(scrubRpcMessage(JSON.parse(line), [], state));
-  } catch {
-    return line;
+const requestBodyText = function requestBodyText(
+  body: ArrayBuffer | Uint8Array | string
+): string {
+  if (body instanceof Uint8Array) {
+    return new TextDecoder().decode(body);
   }
-}
+  if (body instanceof ArrayBuffer) {
+    return new TextDecoder().decode(new Uint8Array(body));
+  }
+  return body;
+};
+
+const isJsonRpcId = function isJsonRpcId(
+  value: OxidejsJson
+): value is JsonRpcId {
+  return (
+    value === null || typeof value === "string" || typeof value === "number"
+  );
+};
 
 /** Collect JSON-RPC request ids from a unary object or batch array body. */
-export function extractJsonRpcRequestIds(body: ArrayBuffer | Uint8Array | string): unknown[] {
+export const extractJsonRpcRequestIds = function extractJsonRpcRequestIds(
+  body: ArrayBuffer | Uint8Array | string
+): JsonRpcId[] {
   try {
-    let text =
-      typeof body === "string"
-        ? body
-        : new TextDecoder().decode(body instanceof Uint8Array ? body : new Uint8Array(body));
-    text = text.replace(/^\uFEFF/, "").trimEnd();
+    let text = requestBodyText(body);
+    text = text.replace(/^\uFEFF/u, "").trimEnd();
     // NDJSON request batch: one object per line.
     if (text.includes("\n")) {
-      const ids: unknown[] = [];
+      const ids: JsonRpcId[] = [];
       for (const line of text.split("\n")) {
-        if (!line) continue;
-        const parsed: unknown = JSON.parse(line);
-        if (isRecord(parsed) && "id" in parsed) ids.push(parsed["id"]);
+        if (!line) {
+          continue;
+        }
+        const parsed = parseOxidejsJson(line);
+        if (
+          isJsonObject(parsed) &&
+          "id" in parsed &&
+          isJsonRpcId(parsed["id"])
+        ) {
+          ids.push(parsed["id"]);
+        }
       }
       return ids;
     }
-    const parsed: unknown = JSON.parse(text);
+    const parsed = parseOxidejsJson(text);
     if (Array.isArray(parsed)) {
-      return parsed
-        .filter(isRecord)
-        .filter((item) => "id" in item)
-        .map((item) => item["id"]);
+      const ids: JsonRpcId[] = [];
+      for (const item of parsed) {
+        if (isJsonObject(item) && "id" in item && isJsonRpcId(item["id"])) {
+          ids.push(item["id"]);
+        }
+      }
+      return ids;
+    }
+    if (isJsonObject(parsed) && "id" in parsed && isJsonRpcId(parsed["id"])) {
+      return [parsed["id"]];
     }
-    if (isRecord(parsed) && "id" in parsed) return [parsed["id"]];
   } catch {
     /* ignore */
   }
   return [];
-}
-
-/** @deprecated use extractJsonRpcRequestIds */
-export function extractJsonRpcRequestId(body: ArrayBuffer | string): unknown {
-  return extractJsonRpcRequestIds(body)[0];
-}
+};
 
 /** Ensure a body is a valid NDJSON frame (Effect's ndJsonRpc decode requires a trailing newline). */
-export function ensureNdjsonBody(buf: ArrayBuffer): Uint8Array<ArrayBuffer> {
+export const ensureNdjsonBody = function ensureNdjsonBody(
+  buf: ArrayBuffer
+): Uint8Array<ArrayBuffer> {
   const bytes = new Uint8Array(buf);
-  if (bytes.length > 0 && bytes[bytes.length - 1] === 0x0a) {
+  if (bytes.length > 0 && bytes.at(-1) === 0x0a) {
+    // SAFETY: Uint8Array view over ArrayBuffer is the same buffer brand Effect expects.
     return bytes as Uint8Array<ArrayBuffer>;
   }
   const out = new Uint8Array(bytes.length + 1);
   out.set(bytes);
   out[bytes.length] = 0x0a;
+  // SAFETY: newly allocated Uint8Array is backed by a plain ArrayBuffer.
   return out as Uint8Array<ArrayBuffer>;
-}
+};
 
 /**
  * TransformStream that scrubs Effect defect payloads one NDJSON line at a time,
  * so long-running stream actions stay incremental.
  */
-export function scrubNdjsonTransform(
-  requestIds: readonly unknown[] = [],
+export const scrubNdjsonTransform = function scrubNdjsonTransform(
+  requestIds: readonly JsonRpcId[] = []
 ): TransformStream<Uint8Array, Uint8Array> {
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
@@ -186,6 +285,13 @@ export function scrubNdjsonTransform(
   let pending = "";
 
   return new TransformStream<Uint8Array, Uint8Array>({
+    flush(controller) {
+      pending += decoder.decode();
+      if (pending.length > 0) {
+        controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
+        pending = "";
+      }
+    },
     transform(chunk, controller) {
       pending += decoder.decode(chunk, { stream: true });
       let nl = pending.indexOf("\n");
@@ -198,14 +304,7 @@ export function scrubNdjsonTransform(
         nl = pending.indexOf("\n");
       }
     },
-    flush(controller) {
-      pending += decoder.decode();
-      if (pending.length > 0) {
-        controller.enqueue(encoder.encode(`${scrubRpcLine(pending, state)}\n`));
-        pending = "";
-      }
-    },
   });
-}
+};
 
 export { NDJSON_CONTENT };
diff --git a/packages/oxidejs/src/rpc/server.ts b/packages/oxidejs/src/rpc/server.ts
index 66513f5..1a0b2bd 100644
--- a/packages/oxidejs/src/rpc/server.ts
+++ b/packages/oxidejs/src/rpc/server.ts
@@ -1,10 +1,11 @@
 import { Layer } from "effect";
-import type { Rpc } from "effect/unstable/rpc";
-import { RpcGroup, RpcSerialization, RpcServer } from "effect/unstable/rpc";
 import { HttpRouter } from "effect/unstable/http";
+import type { Rpc, RpcGroup } from "effect/unstable/rpc";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+
 import { ACTION_PATH, matchesActionPath } from "../actions";
-import { runWithRequest, withRequestEntry } from "../context";
 import type { ActionContext } from "../context";
+import { runWithRequest, withRequestEntry } from "../context";
 import { isSameOrigin } from "./same-origin";
 import {
   ensureNdjsonBody,
@@ -14,23 +15,23 @@ import {
   scrubRpcJson,
 } from "./scrub";
 
-export type ActionHandlerOptions = {
+export interface ActionHandlerOptions {
+  createContext?: (req: Request) => ActionContext | Promise<ActionContext>;
   path?: string;
   sameOrigin?: boolean;
   transport?: "http" | "ws";
-  createContext?: (req: Request) => ActionContext | Promise<ActionContext>;
-};
+}
 
 const JSON_RPC_FORBIDDEN = {
-  jsonrpc: "2.0",
-  error: { code: -32600, message: "Forbidden" },
+  error: { code: -32_600, message: "Forbidden" },
   id: null,
+  jsonrpc: "2.0",
 } as const;
 
-type HandlerBundle = {
-  handler: (request: Request, ...args: unknown[]) => Promise<Response>;
+interface HandlerBundle {
   dispose: () => Promise<void>;
-};
+  handler: (request: Request) => Promise<Response>;
+}
 
 type ActionGroup = RpcGroup.RpcGroup<Rpc.Any>;
 
@@ -40,101 +41,125 @@ let nextGroupId = 0;
 
 const serialization = RpcSerialization.layerNdJsonRpc();
 
-function bundleKey(group: ActionGroup, path: string, transport: "http" | "ws") {
+const bundleKey = function bundleKey(
+  group: ActionGroup,
+  path: string,
+  transport: "http" | "ws"
+) {
   let id = groupIds.get(group);
   if (id === undefined) {
-    id = nextGroupId++;
+    id = nextGroupId;
+    nextGroupId += 1;
     groupIds.set(group, id);
   }
   return `${id}:${path}:${transport}`;
-}
+};
 
-function forbidden(): Response {
-  return new Response(JSON.stringify(JSON_RPC_FORBIDDEN), {
-    status: 403,
+const forbidden = function forbidden(): Response {
+  return Response.json(JSON_RPC_FORBIDDEN, {
     headers: { "content-type": "application/json" },
+    status: 403,
   });
-}
+};
 
-function methodNotAllowed(): Response {
+const methodNotAllowed = function methodNotAllowed(): Response {
   return new Response("Method Not Allowed", {
-    status: 405,
     headers: { Allow: "POST" },
+    status: 405,
   });
-}
+};
 
-function buildBundle(
+const buildBundle = function buildBundle(
   group: ActionGroup,
   handlers: Layer.Layer<unknown, unknown, unknown>,
   path: string,
-  transport: "http" | "ws",
+  transport: "http" | "ws"
 ): HandlerBundle {
   const app = RpcServer.layerHttp({
     group,
+    // SAFETY: Effect's path branded type accepts our runtime action path string.
     path: path as never,
     protocol: transport === "ws" ? "websocket" : "http",
   }).pipe(Layer.provide(handlers), Layer.provide(serialization));
 
-  return HttpRouter.toWebHandler(app as never, { disableLogger: true }) as HandlerBundle;
-}
+  // SAFETY: toWebHandler's web adapter is structurally a HandlerBundle (handler + dispose).
+  return HttpRouter.toWebHandler(app as never, {
+    disableLogger: true,
+  }) as HandlerBundle;
+};
 
-function bundleFor(
+const bundleFor = function bundleFor(
   group: ActionGroup,
   handlers: Layer.Layer<unknown, unknown, unknown>,
   path: string,
-  transport: "http" | "ws",
+  transport: "http" | "ws"
 ) {
   const key = bundleKey(group, path, transport);
   const cached = bundles.get(key);
-  if (cached) return cached;
+  if (cached) {
+    return cached;
+  }
   const built = buildBundle(group, handlers, path, transport);
   bundles.set(key, built);
   return built;
-}
+};
 
-function scrubJsonResponse(response: Response, requestIds: readonly unknown[]): Response {
+const scrubJsonResponse = function scrubJsonResponse(
+  response: Response,
+  requestIds: ReturnType<typeof extractJsonRpcRequestIds>
+): Response {
   const contentType = response.headers.get("content-type") ?? "";
-  if (!contentType.includes("json")) return response;
+  if (!contentType.includes("json")) {
+    return response;
+  }
 
   // Framed NDJSON stream — scrub line-by-line without buffering the generator.
-  if (response.body && (contentType.includes(NDJSON_CONTENT) || contentType.includes("ndjson"))) {
+  if (
+    response.body &&
+    (contentType.includes(NDJSON_CONTENT) || contentType.includes("ndjson"))
+  ) {
     const headers = new Headers(response.headers);
     headers.delete("content-length");
-    return new Response(response.body.pipeThrough(scrubNdjsonTransform(requestIds)), {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    });
+    return new Response(
+      response.body.pipeThrough(scrubNdjsonTransform(requestIds)),
+      {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+      }
+    );
   }
 
   // Non-stream fallback (e.g. plain application/json from our own Forbidden helper).
   return response;
-}
+};
 
-async function scrubBufferedJson(
+const scrubBufferedJson = async function scrubBufferedJson(
   response: Response,
-  requestIds: readonly unknown[],
+  requestIds: ReturnType<typeof extractJsonRpcRequestIds>
 ): Promise<Response> {
   const text = await response.text();
   const headers = new Headers(response.headers);
   headers.delete("content-length");
   return new Response(scrubRpcJson(text, requestIds), {
+    headers,
     status: response.status,
     statusText: response.statusText,
-    headers,
   });
-}
+};
 
-export function createActionHandler(
+export const createActionHandler = function createActionHandler(
   group: ActionGroup,
   handlers: Layer.Layer<unknown, unknown, unknown>,
-  options: ActionHandlerOptions = {},
+  options: ActionHandlerOptions = {}
 ) {
   const path = options.path ?? ACTION_PATH;
   const transport = options.transport ?? "http";
   const sameOrigin = options.sameOrigin ?? true;
 
-  return async (request: Request): Promise<Response> => {
+  return async function handleActionRequest(
+    request: Request
+  ): Promise<Response> {
     if (!matchesActionPath(new URL(request.url).pathname, path)) {
       return new Response("Not Found", { status: 404 });
     }
@@ -145,7 +170,7 @@ export function createActionHandler(
       return forbidden();
     }
 
-    return withRequestEntry(async () => {
+    return await withRequestEntry(async () => {
       const rawBody = ensureNdjsonBody(await request.arrayBuffer());
       const requestIds = extractJsonRpcRequestIds(rawBody);
       const headers = new Headers(request.headers);
@@ -153,18 +178,25 @@ export function createActionHandler(
       headers.set("content-type", NDJSON_CONTENT);
 
       const forwarded = new Request(request.url, {
-        method: request.method,
-        headers,
         body: rawBody,
+        headers,
+        method: request.method,
         signal: request.signal,
       });
 
       const extra = (await options.createContext?.(forwarded)) ?? {};
       const { handler } = bundleFor(group, handlers, path, transport);
-      const response = await runWithRequest(forwarded, () => handler(forwarded), extra);
+      const response = await runWithRequest(
+        forwarded,
+        () => handler(forwarded),
+        extra
+      );
 
       const contentType = response.headers.get("content-type") ?? "";
-      if (contentType.includes(NDJSON_CONTENT) || contentType.includes("ndjson")) {
+      if (
+        contentType.includes(NDJSON_CONTENT) ||
+        contentType.includes("ndjson")
+      ) {
         return scrubJsonResponse(response, requestIds);
       }
       if (contentType.includes("json")) {
@@ -173,15 +205,15 @@ export function createActionHandler(
       return response;
     });
   };
-}
+};
 
-export function disposeActionHandler(
+export const disposeActionHandler = function disposeActionHandler(
   group: ActionGroup,
   path: string = ACTION_PATH,
-  transport: "http" | "ws" = "http",
+  transport: "http" | "ws" = "http"
 ) {
   const key = bundleKey(group, path, transport);
   const bundle = bundles.get(key);
   bundles.delete(key);
   return bundle?.dispose() ?? Promise.resolve();
-}
+};
diff --git a/packages/oxidejs/src/rpc/stream.ts b/packages/oxidejs/src/rpc/stream.ts
index d6053da..8ebb48e 100644
--- a/packages/oxidejs/src/rpc/stream.ts
+++ b/packages/oxidejs/src/rpc/stream.ts
@@ -1,14 +1,21 @@
 import { Effect, Stream } from "effect";
+
 import { inWebcontainer } from "../context";
 
-export function asyncGenToStream<T>(gen: AsyncGenerator<T, unknown, unknown>) {
-  return Stream.fromAsyncIterable(gen, (error) =>
-    error instanceof Error ? error : new Error(String(error)),
-  );
-}
+const onAsyncIterableError = function onAsyncIterableError(
+  cause: unknown
+): Error {
+  return cause instanceof Error ? cause : new Error(String(cause));
+};
+
+export const asyncGenToStream = function asyncGenToStream<T>(
+  gen: AsyncGenerator<T, unknown, unknown>
+) {
+  return Stream.fromAsyncIterable(gen, onAsyncIterableError);
+};
 
 /** Serialize WebContainer stream pulls so the shared syncStore is not stomped. */
-let pullTail: Promise<void> = Promise.resolve();
+let pullTail: Promise<null> = Promise.resolve(null);
 
 /**
  * Re-enter `run` for every generator pull so request context stays available
@@ -17,53 +24,62 @@ let pullTail: Promise<void> = Promise.resolve();
  * On WebContainer, pulls are serialized through settlement so concurrent streams
  * cannot replace the sync fallback mid-pull. `withRequestEntry` is unchanged.
  */
-export function bindAsyncGenContext<T>(
+export const bindAsyncGenContext = function bindAsyncGenContext<T>(
   gen: AsyncGenerator<T, unknown, unknown>,
-  run: <R>(fn: () => R) => R,
+  run: <R>(fn: () => R) => R
 ): AsyncGenerator<T, unknown, unknown> {
-  const runPull = <R>(fn: () => R): R => {
-    if (!inWebcontainer()) return run(fn);
+  const runPull = function runPull<R>(fn: () => R): R {
+    if (!inWebcontainer()) {
+      return run(fn);
+    }
 
-    let release!: () => void;
-    const gate = new Promise<void>((resolve) => {
-      release = resolve;
-    });
+    const { promise: gate, resolve: release } = Promise.withResolvers<null>();
     const prev = pullTail;
     pullTail = gate;
 
-    return prev
-      .then(() => Promise.resolve(run(fn)))
-      .finally(() => {
-        release();
-      }) as R;
+    const runSerialized = async function runSerialized() {
+      await prev;
+      try {
+        return await run(fn);
+      } finally {
+        release(null);
+      }
+    };
+
+    // SAFETY: Callers only use runPull for gen.next/return/throw, which always return Promise; the serialized Promise is assignable to that R.
+    return runSerialized() as R;
   };
 
-  const wrapped = {
-    next: (value?: unknown) => runPull(() => gen.next(value)),
-    return: (value?: unknown) => runPull(() => gen.return(value)),
-    throw: (error?: unknown) => runPull(() => gen.throw(error)),
+  return {
+    next: (...args) => runPull(() => gen.next(...args)),
+    return: (...args) => runPull(() => gen.return(...args)),
+    throw: (...args) => runPull(() => gen.throw(...args)),
     [Symbol.asyncIterator]() {
       return this;
     },
     async [Symbol.asyncDispose]() {
+      // AsyncGenerator.return requires a TReturn argument under TypeScript 6.
+      // oxlint-disable-next-line unicorn/no-useless-undefined
       await runPull(() => gen.return(undefined));
     },
   };
-  return wrapped as AsyncGenerator<T, unknown, unknown>;
-}
+};
 
 /** Create a generator inside `run`, then keep every subsequent pull inside `run`. */
-export function asyncGenToStreamInContext<T>(
+export const asyncGenToStreamInContext = function asyncGenToStreamInContext<T>(
   create: () => AsyncGenerator<T, unknown, unknown>,
-  run: <R>(fn: () => R) => R,
+  run: <R>(fn: () => R) => R
 ) {
   return asyncGenToStream(bindAsyncGenContext(run(create), run));
-}
+};
 
-export function streamToAsyncGen<T>(stream: Stream.Stream<T>) {
+export const streamToAsyncGen = function streamToAsyncGen<T>(
+  stream: Stream.Stream<T>
+) {
   return Stream.toAsyncIterable(stream);
-}
+};
 
-export function runStream<A>(stream: Stream.Stream<A>) {
-  return Effect.runPromise(Stream.runCollect(stream)).then((chunk) => chunk.values());
-}
+export const runStream = async function runStream<A>(stream: Stream.Stream<A>) {
+  const chunk = await Effect.runPromise(Stream.runCollect(stream));
+  return chunk.values();
+};
diff --git a/packages/oxidejs/src/rpc/test-harness.ts b/packages/oxidejs/src/rpc/test-harness.ts
new file mode 100644
index 0000000..32deb21
--- /dev/null
+++ b/packages/oxidejs/src/rpc/test-harness.ts
@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { generateActionsModule, scanServerFiles } from "../actions";
+
+const RPC_MODULE = path.join(import.meta.dir, "index.ts");
+const OXIDE_RUNTIME = path.join(import.meta.dir, "../context.ts");
+
+export const writeGeneratedActions = function writeGeneratedActions(
+  root: string
+) {
+  const out = path.join(root, "actions.mjs");
+  fs.writeFileSync(
+    out,
+    generateActionsModule(scanServerFiles(root))
+      .replaceAll("oxidejs/rpc", RPC_MODULE)
+      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`)
+  );
+  return out;
+};
+
+export const waitUntil = async function waitUntil(
+  predicate: () => boolean,
+  remainingMs: number
+): Promise<void> {
+  if (predicate() || remainingMs <= 0) {
+    return;
+  }
+  await Bun.sleep(5);
+  await waitUntil(predicate, remainingMs - 5);
+};
diff --git a/packages/oxidejs/src/rpc/ws-crossws.test.ts b/packages/oxidejs/src/rpc/ws-crossws.test.ts
index 8069252..329fc4f 100644
--- a/packages/oxidejs/src/rpc/ws-crossws.test.ts
+++ b/packages/oxidejs/src/rpc/ws-crossws.test.ts
@@ -1,23 +1,47 @@
 import { expect, test } from "bun:test";
-import http from "node:http";
 import fs from "node:fs";
+import http from "node:http";
+import type { AddressInfo } from "node:net";
 import path from "node:path";
-import { generateActionsModule, scanServerFiles } from "../actions";
+
+import type { ActionContext } from "../context";
+import { createClient } from "./client";
+import { waitUntil, writeGeneratedActions } from "./test-harness";
 import { createWsHooks } from "./ws";
 
-const RPC_MODULE = path.join(import.meta.dir, "index.ts");
-const OXIDE_RUNTIME = path.join(import.meta.dir, "../context.ts");
+const listenPort = function listenPort(server: http.Server) {
+  const { promise, resolve } = Promise.withResolvers<number>();
+  server.listen(0, "127.0.0.1", () => {
+    const address = server.address();
+    if (address === null) {
+      resolve(0);
+      return;
+    }
+    // SAFETY: listen(0, host) binds TCP; address is AddressInfo, not a pipe path string.
+    resolve((address as AddressInfo).port);
+  });
+  return promise;
+};
 
-function writeGeneratedActions(root: string) {
-  const out = path.join(root, "actions.mjs");
-  fs.writeFileSync(
-    out,
-    generateActionsModule(scanServerFiles(root))
-      .replaceAll("oxidejs/rpc", RPC_MODULE)
-      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`),
+const openWebSocket = function openWebSocket(url: string) {
+  const ws = new WebSocket(url);
+  const { promise, reject, resolve } = Promise.withResolvers<WebSocket>();
+  ws.addEventListener(
+    "open",
+    () => {
+      resolve(ws);
+    },
+    { once: true }
+  );
+  ws.addEventListener(
+    "error",
+    () => {
+      reject(new Error("WebSocket failed to open"));
+    },
+    { once: true }
   );
-  return out;
-}
+  return promise;
+};
 
 test("createClient over ws transport resolves calls through a real socket", async () => {
   // Regression: loadClient used to build the protocol layer in a transient
@@ -27,10 +51,8 @@ test("createClient over ws transport resolves calls through a real socket", asyn
   fs.writeFileSync(
     path.join(root, "hello.server.ts"),
     `import { action } from ${ctx};
-export const hello = action(async (name: string) => ` +
-      "`hi ${name}`" +
-      `)
-`,
+export const hello = action(async (name: string) => \`hi \${name}\`)
+`
   );
   const out = writeGeneratedActions(root);
 
@@ -45,32 +67,35 @@ export const hello = action(async (name: string) => ` +
     }) as never,
   });
   server.on("upgrade", (req, socket, head) => {
+    // SAFETY: Node upgrade socket is Duplex; crossws adapter accepts it at runtime.
     wss.handleUpgrade(req, socket as never, head);
   });
-  const port = await new Promise<number>((resolve) => {
-    server.listen(0, "127.0.0.1", () => {
-      resolve((server.address() as { port: number }).port);
-    });
-  });
+  const port = await listenPort(server);
 
-  const { createClient } = await import("./client");
   const client = createClient(mod.default, {
     transport: "ws",
     url: `ws://127.0.0.1:${port}/__oxide/action`,
   });
   try {
-    const result = await Promise.race([
-      (client as Record<string, Record<string, (...args: unknown[]) => Promise<unknown>>>)[
-        "hello"
-      ]!["hello"]!("Regression"),
-      new Promise((_, reject) =>
-        setTimeout(() => reject(new Error("ws client call timed out")), 5000),
-      ),
-    ]);
-    expect(result).toBe("hi Regression");
+    const helloMod = client["hello"];
+    const helloFn = helloMod?.["hello"];
+    if (helloFn === undefined) {
+      throw new Error("hello.hello action missing from client");
+    }
+    const { promise: timeout, reject: rejectTimeout } =
+      Promise.withResolvers<never>();
+    const timer = setTimeout(() => {
+      rejectTimeout(new Error("ws client call timed out"));
+    }, 5000);
+    try {
+      const result = await Promise.race([helloFn("Regression"), timeout]);
+      expect(result).toBe("hi Regression");
+    } finally {
+      clearTimeout(timer);
+    }
   } finally {
     server.close();
-    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(root, { force: true, recursive: true });
   }
 });
 
@@ -85,80 +110,81 @@ import fs from "node:fs";
 export const ticks = action(async function* () {
   yield 0;
   while (!fs.existsSync(${JSON.stringify(gateFile)})) {
-    await new Promise((r) => setTimeout(r, 5));
+    await Bun.sleep(5);
   }
   yield 1;
 })
-`,
+`
   );
   const out = writeGeneratedActions(root);
 
   const mod = await import(out);
   const server = http.createServer();
   const { default: crossws } = await import("crossws/adapters/node");
-  // Same cast shape as plugin.ts: crossws' hook types are structurally looser than ours.
+  // SAFETY: crossws hook types are structurally looser than ours (see plugin.ts).
   const wss = crossws({
     hooks: createWsHooks(mod.default as never, mod.actionsHandlers as never, {
-      path: "/__oxide/action",
-      sameOrigin: false,
       createContext: () =>
+        // SAFETY: test peer context only needs req + a marker field for this assertion.
         ({
-          req: new Request("http://localhost/__oxide/action"),
           marker: "from-peer",
-        }) as import("../context").ActionContext,
+          req: new Request("http://localhost/__oxide/action"),
+        }) as ActionContext,
+      path: "/__oxide/action",
+      sameOrigin: false,
     }) as never,
   });
   server.on("upgrade", (req, socket, head) => {
+    // SAFETY: Node upgrade socket is Duplex; crossws adapter accepts it at runtime.
     wss.handleUpgrade(req, socket as never, head);
   });
-  const port = await new Promise<number>((resolve) => {
-    server.listen(0, "127.0.0.1", () => {
-      resolve((server.address() as { port: number }).port);
-    });
-  });
+  const port = await listenPort(server);
 
   const frames: string[] = [];
-  const ws = new WebSocket(`ws://127.0.0.1:${port}/__oxide/action`);
-  ws.onmessage = (event) => frames.push(String(event.data));
-
-  const openPromise = new Promise<void>((resolve, reject) => {
-    ws.onopen = () => resolve();
-    ws.onerror = () => reject(new Error("WebSocket failed to open"));
+  const ws = await openWebSocket(`ws://127.0.0.1:${port}/__oxide/action`);
+  ws.addEventListener("message", (event) => {
+    frames.push(String(event.data));
   });
-  await openPromise;
 
   try {
-    ws.send(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "ticks.ticks", params: { args: [] } }));
+    ws.send(
+      JSON.stringify({
+        id: 1,
+        jsonrpc: "2.0",
+        method: "ticks.ticks",
+        params: { args: [] },
+      })
+    );
 
-    const started = Date.now();
-    while (frames.length === 0 && Date.now() - started < 5000) {
-      await new Promise((r) => setTimeout(r, 5));
-    }
-    if (frames.length === 0) {
+    await waitUntil(() => frames.length > 0, 5000);
+    const first = frames.at(0);
+    if (first === undefined) {
       throw new Error("timed out waiting for first WebSocket NDJSON frame");
     }
     expect(frames.length).toBe(1);
-    expect(JSON.parse(frames[0]!.trim())).toEqual({
-      jsonrpc: "2.0",
+    expect(JSON.parse(first.trim())).toEqual({
       chunk: true,
       id: 1,
+      jsonrpc: "2.0",
       result: [0],
     });
 
     fs.writeFileSync(gateFile, "go");
-    while (frames.length < 2 && Date.now() - started < 5000) {
-      await new Promise((r) => setTimeout(r, 5));
-    }
+    await waitUntil(() => frames.length >= 2, 5000);
     expect(frames.length).toBeGreaterThanOrEqual(2);
-    expect(JSON.parse(frames[1]!.trim())).toEqual({
-      jsonrpc: "2.0",
+    const second = frames.at(1);
+    if (second === undefined) {
+      throw new Error("missing second WebSocket NDJSON frame");
+    }
+    expect(JSON.parse(second.trim())).toEqual({
       chunk: true,
       id: 1,
+      jsonrpc: "2.0",
       result: [1],
     });
   } finally {
     ws.close();
     server.close();
-    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(root, { force: true, recursive: true });
   }
 });
diff --git a/packages/oxidejs/src/rpc/ws.test.ts b/packages/oxidejs/src/rpc/ws.test.ts
index aef64b4..98e2225 100644
--- a/packages/oxidejs/src/rpc/ws.test.ts
+++ b/packages/oxidejs/src/rpc/ws.test.ts
@@ -1,22 +1,10 @@
 import { expect, test } from "bun:test";
 import fs from "node:fs";
 import path from "node:path";
-import { generateActionsModule, scanServerFiles } from "../actions";
-import { createWsHooks } from "./ws";
-
-const RPC_MODULE = path.join(import.meta.dir, "index.ts");
-const OXIDE_RUNTIME = path.join(import.meta.dir, "../context.ts");
 
-function writeGeneratedActions(root: string) {
-  const out = path.join(root, "actions.mjs");
-  fs.writeFileSync(
-    out,
-    generateActionsModule(scanServerFiles(root))
-      .replaceAll("oxidejs/rpc", RPC_MODULE)
-      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`),
-  );
-  return out;
-}
+import type { ActionContext } from "../context";
+import { waitUntil, writeGeneratedActions } from "./test-harness";
+import { createWsHooks } from "./ws";
 
 test("WebSocket answers effect keepalive pings without touching the action handler", async () => {
   const root = fs.mkdtempSync(path.join(import.meta.dir, "oxide-ws-ping-"));
@@ -27,7 +15,7 @@ test("WebSocket answers effect keepalive pings without touching the action handl
 export const boom = action(() => {
   throw new Error("ping must not reach the action handler");
 })
-`,
+`
   );
   const out = writeGeneratedActions(root);
 
@@ -39,16 +27,21 @@ export const boom = action(() => {
     });
     const sent: string[] = [];
     const peer = {
-      request: new Request("http://localhost/__oxide/action"),
       context: {},
-      send: (data: unknown) => sent.push(String(data)),
+      request: new Request("http://localhost/__oxide/action"),
+      send: (data: string) => {
+        sent.push(data);
+      },
     };
     await hooks.message(peer, {
-      text: () => JSON.stringify({ jsonrpc: "2.0", method: "@effect/rpc/Ping" }),
+      text: () =>
+        JSON.stringify({ jsonrpc: "2.0", method: "@effect/rpc/Ping" }),
     });
-    expect(sent).toEqual([JSON.stringify({ jsonrpc: "2.0", method: "@effect/rpc/Pong" })]);
+    expect(sent).toEqual([
+      JSON.stringify({ jsonrpc: "2.0", method: "@effect/rpc/Pong" }),
+    ]);
   } finally {
-    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(root, { force: true, recursive: true });
   }
 });
 
@@ -63,71 +56,74 @@ import fs from "node:fs";
 export const ticks = action(async function* () {
   yield 0;
   while (!fs.existsSync(${JSON.stringify(gateFile)})) {
-    await new Promise((r) => setTimeout(r, 5));
+    await Bun.sleep(5);
   }
   yield 1;
 })
-`,
+`
   );
   const out = writeGeneratedActions(root);
 
   try {
     const mod = await import(out);
     const hooks = createWsHooks(mod.default, mod.actionsHandlers, {
-      path: "/__oxide/action",
-      sameOrigin: false,
       createContext: () =>
+        // SAFETY: test peer context only needs req + a marker field for this assertion.
         ({
-          req: new Request("http://localhost/__oxide/action"),
           marker: "from-peer",
-        }) as import("../context").ActionContext,
+          req: new Request("http://localhost/__oxide/action"),
+        }) as ActionContext,
+      path: "/__oxide/action",
+      sameOrigin: false,
     });
     const sent: string[] = [];
     const peer = {
+      context: {},
       request: new Request("http://localhost/__oxide/action", {
-        headers: { origin: "http://localhost", host: "localhost" },
+        headers: { host: "localhost", origin: "http://localhost" },
       }),
-      context: {},
-      send: (data: unknown) => {
-        sent.push(String(data));
+      send: (data: string) => {
+        sent.push(data);
       },
     };
 
     const pending = hooks.message(peer, {
       text: () =>
         JSON.stringify({
-          jsonrpc: "2.0",
           id: 1,
+          jsonrpc: "2.0",
           method: "ticks.ticks",
           params: { args: [] },
         }),
     });
 
-    const started = Date.now();
-    while (sent.length === 0 && Date.now() - started < 5000) {
-      await new Promise((r) => setTimeout(r, 5));
-    }
-    if (sent.length === 0) {
+    await waitUntil(() => sent.length > 0, 5000);
+    const first = sent.at(0);
+    if (first === undefined) {
       throw new Error("timed out waiting for first WebSocket NDJSON frame");
     }
     expect(sent.length).toBe(1);
-    expect(JSON.parse(sent[0]!.trim())).toEqual({
-      jsonrpc: "2.0",
+    expect(JSON.parse(first.trim())).toEqual({
       chunk: true,
       id: 1,
+      jsonrpc: "2.0",
       result: [0],
     });
 
     fs.writeFileSync(gateFile, "go");
     await pending;
     expect(sent.length).toBeGreaterThanOrEqual(2);
-    expect(JSON.parse(sent[1]!.trim())).toEqual({
-      jsonrpc: "2.0",
+    const second = sent.at(1);
+    if (second === undefined) {
+      throw new Error("missing second WebSocket NDJSON frame");
+    }
+    expect(JSON.parse(second.trim())).toEqual({
       chunk: true,
       id: 1,
+      jsonrpc: "2.0",
       result: [1],
     });
   } finally {
-    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(root, { force: true, recursive: true });
   }
 });
diff --git a/packages/oxidejs/src/rpc/ws.ts b/packages/oxidejs/src/rpc/ws.ts
index 33913bc..0baa747 100644
--- a/packages/oxidejs/src/rpc/ws.ts
+++ b/packages/oxidejs/src/rpc/ws.ts
@@ -1,148 +1,171 @@
 import type { Layer } from "effect";
-import type { Rpc } from "effect/unstable/rpc";
-import type { RpcGroup } from "effect/unstable/rpc";
-import type { ActionContext } from "../context";
-import { isSameOrigin } from "./same-origin";
+import type { Rpc, RpcGroup } from "effect/unstable/rpc";
+
 import { matchesActionPath } from "../actions";
-import { createActionHandler, type ActionHandlerOptions } from "./server";
+import type { ActionContext, ActionContextValue } from "../context";
+import type { OxidejsJson } from "../types";
+import { isSameOrigin } from "./same-origin";
 import { NDJSON_CONTENT } from "./scrub";
+import type { ActionHandlerOptions } from "./server";
+import { createActionHandler } from "./server";
 
-type WsPeer = {
-  request?: Request;
-  context: Record<string, unknown>;
-  send: (data: unknown) => unknown;
+interface WsPeerContext {
+  [key: string]: ActionContextValue;
+}
+
+interface WsPeer {
+  context: WsPeerContext;
   /** Optional: register a listener when the peer disconnects. */
   onClose?: (fn: () => void) => void;
-};
+  request?: Request;
+  send: (data: string) => void;
+}
 
-type WsMessage = {
+interface WsMessage {
   text: () => string;
-};
+}
 
-export type WsHooksOptions = {
+export interface WsHooksOptions {
+  createContext?: (peer: WsPeer) => ActionContext | Promise<ActionContext>;
+  maxMessageSize?: number;
   path?: string;
   sameOrigin?: boolean;
-  maxMessageSize?: number;
-  createContext?: (peer: WsPeer) => ActionContext | Promise<ActionContext>;
-};
+}
 
-function parseMessage(message: WsMessage, maxBytes: number) {
+const parseMessage = function parseMessage(
+  message: WsMessage,
+  maxBytes: number
+) {
   try {
     const raw = message.text();
     const size = new TextEncoder().encode(raw).byteLength;
-    if (size > maxBytes) return { ok: false as const, tooLarge: true };
+    if (size > maxBytes) {
+      return { ok: false as const, tooLarge: true };
+    }
     return { ok: true as const, value: raw };
   } catch {
     return { ok: false as const };
   }
-}
+};
+
+const isJsonRpcPing = function isJsonRpcPing(
+  value: OxidejsJson
+): value is { [key: string]: OxidejsJson } {
+  return (
+    value !== null &&
+    !Array.isArray(value) &&
+    typeof value === "object" &&
+    value["method"] === "@effect/rpc/Ping"
+  );
+};
 
 /**
  * Effect's socket client sends `@effect/rpc/Ping` keepalives (no id) and hangs
  * up unless the server answers `@effect/rpc/Pong`. Handle control messages here
  * so they never reach the action handler.
  */
-function controlReply(raw: string): string | undefined {
+const controlReply = function controlReply(raw: string): string | undefined {
   try {
-    const parsed: unknown = JSON.parse(raw);
-    if (
-      parsed &&
-      typeof parsed === "object" &&
-      (parsed as { method?: unknown }).method === "@effect/rpc/Ping"
-    ) {
+    // SAFETY: JSON.parse yields JSON values; OxidejsJson is the repo's JSON union.
+    const parsed = JSON.parse(raw) as OxidejsJson;
+    if (isJsonRpcPing(parsed)) {
       return JSON.stringify({ jsonrpc: "2.0", method: "@effect/rpc/Pong" });
     }
   } catch {
     // Not JSON — let the action handler produce the parse error.
   }
+  // oxlint-disable-next-line unicorn/no-useless-undefined -- required by noImplicitReturns
   return undefined;
-}
+};
 
 /** Forward each complete NDJSON line as its own WS message (keeps streams incremental). */
-async function sendNdjsonFrames(peer: WsPeer, response: Response, signal: AbortSignal) {
+const sendNdjsonFrames = async function sendNdjsonFrames(
+  peer: WsPeer,
+  response: Response,
+  signal: AbortSignal
+) {
   if (signal.aborted) {
     await response.body?.cancel();
     return;
   }
   if (!response.body) {
     const text = await response.text();
-    if (text && !signal.aborted) peer.send(text);
+    if (text && !signal.aborted) {
+      peer.send(text);
+    }
     return;
   }
 
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let pending = "";
-  const onAbort = () => {
+  const onAbort = function onAbort() {
     void reader.cancel();
   };
   signal.addEventListener("abort", onAbort, { once: true });
 
-  try {
-    while (!signal.aborted) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      pending += decoder.decode(value, { stream: true });
-      let nl = pending.indexOf("\n");
-      while (nl !== -1) {
-        const line = pending.slice(0, nl);
-        pending = pending.slice(nl + 1);
-        if (line.length > 0 && !signal.aborted) peer.send(`${line}\n`);
-        nl = pending.indexOf("\n");
+  const pump = async function pump(): Promise<void> {
+    if (signal.aborted) {
+      return;
+    }
+    const { done, value } = await reader.read();
+    if (done) {
+      return;
+    }
+    pending += decoder.decode(value, { stream: true });
+    let nl = pending.indexOf("\n");
+    while (nl !== -1) {
+      const line = pending.slice(0, nl);
+      pending = pending.slice(nl + 1);
+      if (line.length > 0 && !signal.aborted) {
+        peer.send(`${line}\n`);
       }
+      nl = pending.indexOf("\n");
     }
+    await pump();
+  };
+
+  try {
+    await pump();
 
     if (!signal.aborted) {
       pending += decoder.decode();
-      if (pending.length > 0) peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
+      if (pending.length > 0) {
+        peer.send(pending.endsWith("\n") ? pending : `${pending}\n`);
+      }
     }
   } finally {
     signal.removeEventListener("abort", onAbort);
   }
-}
+};
 
-export function createWsHooks(
+export const createWsHooks = function createWsHooks(
   group: RpcGroup.RpcGroup<Rpc.Any>,
   handlers: Layer.Layer<unknown, unknown, unknown>,
-  options: WsHooksOptions = {},
+  options: WsHooksOptions = {}
 ) {
   const path = options.path ?? "/__oxide/action";
   const maxBytes = options.maxMessageSize ?? 1_048_576;
   const sameOrigin = options.sameOrigin ?? true;
   const baseOptions: ActionHandlerOptions = {
     path,
-    transport: "http",
     sameOrigin,
+    transport: "http",
   };
 
   return {
-    upgrade(req: Request) {
-      let pathname: string;
-      try {
-        pathname = new URL(req.url).pathname;
-      } catch {
-        return new Response("Bad Request", { status: 400 });
-      }
-      if (!matchesActionPath(pathname, path)) {
-        return new Response("Not Found", { status: 404 });
-      }
-      if (sameOrigin && !isSameOrigin(req)) {
-        return new Response("Forbidden", { status: 403 });
-      }
-      return undefined;
-    },
     async message(peer: WsPeer, message: WsMessage) {
       const parsed = parseMessage(message, maxBytes);
       if (!parsed.ok) {
         peer.send(
           JSON.stringify({
-            jsonrpc: "2.0",
             error: {
-              code: -32600,
+              code: -32_600,
               message: parsed.tooLarge ? "Payload too large" : "Parse error",
             },
             id: null,
-          }),
+            jsonrpc: "2.0",
+          })
         );
         return;
       }
@@ -161,21 +184,40 @@ export function createWsHooks(
       headers.set("content-type", NDJSON_CONTENT);
 
       // Resolve once per message. Handler clones the Request, so do not key context by Request identity.
-      const peerCtx = (await options.createContext?.(peer)) ?? (peer.context as ActionContext);
+      // SAFETY: peer.context is the host-supplied ActionContext bag; req is attached below.
+      const peerCtx =
+        (await options.createContext?.(peer)) ??
+        (peer.context as ActionContext);
       const rpc = createActionHandler(group, handlers, {
         ...baseOptions,
         createContext: (req) => ({ ...peerCtx, req }),
       });
 
       const request = new Request(`http://${host}${path}`, {
-        method: "POST",
-        headers,
         body: parsed.value,
+        headers,
+        method: "POST",
         signal: abort.signal,
       });
 
       const response = await rpc(request);
       await sendNdjsonFrames(peer, response, abort.signal);
     },
+    upgrade(req: Request): Response | undefined {
+      let pathname: string;
+      try {
+        ({ pathname } = new URL(req.url));
+      } catch {
+        return new Response("Bad Request", { status: 400 });
+      }
+      if (!matchesActionPath(pathname, path)) {
+        return new Response("Not Found", { status: 404 });
+      }
+      if (sameOrigin && !isSameOrigin(req)) {
+        return new Response("Forbidden", { status: 403 });
+      }
+      // oxlint-disable-next-line unicorn/no-useless-undefined -- required by noImplicitReturns
+      return undefined;
+    },
   };
-}
+};
diff --git a/packages/oxidejs/src/types.ts b/packages/oxidejs/src/types.ts
index 8e6c46d..7f2182b 100644
--- a/packages/oxidejs/src/types.ts
+++ b/packages/oxidejs/src/types.ts
@@ -1,13 +1,22 @@
 export type OxidejsPreset = "fetch" | "celld";
 
+/** JSON-compatible value used for opaque wrangler / env bags. */
+export type OxidejsJson =
+  | string
+  | number
+  | boolean
+  | null
+  | OxidejsJson[]
+  | { [key: string]: OxidejsJson };
+
 export interface OxidejsWranglerOptions {
   name: string;
   compatibility_date: string;
   compatibility_flags?: string[];
-  durable_objects?: Record<string, unknown>;
-  migrations?: unknown[];
-  services?: unknown[];
-  vars?: Record<string, unknown>;
+  durable_objects?: { [key: string]: OxidejsJson };
+  migrations?: OxidejsJson[];
+  services?: OxidejsJson[];
+  vars?: { [key: string]: OxidejsJson };
 }
 
 export type OxidejsActionTransport = "http" | "ws";
@@ -24,7 +33,9 @@ export type OxidejsActions =
     };
 
 /** Static headers inlined into the shared action client. Functions cannot ship to the browser. */
-export type OxidejsActionHeaders = Record<string, string> | [string, string][];
+export type OxidejsActionHeaders =
+  | { [key: string]: string }
+  | [string, string][];
 
 export interface OxidejsOptions {
   /** "fetch" (default) skips wrangler.jsonc and serves client assets. "celld" emits wrangler.jsonc. */
@@ -70,7 +81,7 @@ export interface OxidejsOptions {
 
   /** Extra env passed as the second argument to fetch(request, env, ctx) on
    * the Node fetch preset — read it with useEnv(). */
-  env?: Record<string, unknown>;
+  env?: { [key: string]: OxidejsJson };
 }
 
 export interface ResolvedOptions {
@@ -98,5 +109,5 @@ export interface ResolvedOptions {
   imports: string[];
   bodyLimit: number;
   notFound: string | undefined;
-  env: Record<string, unknown> | undefined;
+  env: { [key: string]: OxidejsJson } | undefined;
 }
diff --git a/packages/oxidejs/src/worker-build.ts b/packages/oxidejs/src/worker-build.ts
index 9b7d63d..f69960e 100644
--- a/packages/oxidejs/src/worker-build.ts
+++ b/packages/oxidejs/src/worker-build.ts
@@ -1,24 +1,37 @@
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+
 import { VIRTUAL_WORKER_ID } from "./actions";
 import type { ResolvedOptions } from "./types";
 
-type ViteAlias = { find: string | RegExp; replacement: string };
+interface ViteAlias {
+  find: string | RegExp;
+  replacement: string;
+}
 
 /** Dev aliases so Vite transforms RPC helpers with the app's single effect copy. */
-function oxideRpcAliases(): ViteAlias[] {
-  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const oxideRpcAliases = function oxideRpcAliases(): ViteAlias[] {
+  const root = path.resolve(import.meta.dirname, "..");
   const client = path.join(root, "src/rpc/client.ts");
-  if (!fs.existsSync(client)) return [];
+  if (!fs.existsSync(client)) {
+    return [];
+  }
   return [
-    { find: /^oxidejs\/rpc\/client$/, replacement: client },
-    { find: /^oxidejs\/rpc$/, replacement: path.join(root, "src/rpc/index.ts") },
+    { find: /^oxidejs\/rpc\/client$/u, replacement: client },
+    {
+      find: /^oxidejs\/rpc$/u,
+      replacement: path.join(root, "src/rpc/index.ts"),
+    },
   ];
-}
+};
 
-function mergeAliases(config: ViteUserConfig, extra: ViteAlias[]) {
-  if (extra.length === 0) return;
+const mergeAliases = function mergeAliases(
+  config: ViteUserConfig,
+  extra: ViteAlias[]
+) {
+  if (extra.length === 0) {
+    return;
+  }
   config.resolve ??= {};
   const current = config.resolve.alias;
   if (!current) {
@@ -30,26 +43,34 @@ function mergeAliases(config: ViteUserConfig, extra: ViteAlias[]) {
     return;
   }
   config.resolve.alias = [
-    ...Object.entries(current).map(([find, replacement]) => ({ find, replacement })),
+    ...Object.entries(current).map(([find, replacement]) => ({
+      find,
+      replacement,
+    })),
     ...extra,
   ];
-}
+};
 
 /** Minimal Vite config surface used by this plugin. Avoids a hard vite runtime dep. */
-export type ViteInput = string | string[] | Record<string, string>;
+export type ViteInput = string | string[] | { [key: string]: string };
+
+export interface ViteBuilder {
+  build: (environment: ViteEnvironmentConfig) => Promise<void>;
+  environments: { [key: string]: ViteEnvironmentConfig | undefined };
+}
 
 export interface ViteUserConfig {
   root?: string;
   appType?: string;
-  resolve?: { dedupe?: string[]; alias?: ViteAlias[] | Record<string, string> };
+  resolve?: {
+    dedupe?: string[];
+    alias?: ViteAlias[] | { [key: string]: string };
+  };
   optimizeDeps?: { include?: string[] };
   builder?: {
-    buildApp?: (builder: {
-      environments: Record<string, unknown>;
-      build: (environment: unknown) => Promise<unknown>;
-    }) => Promise<void>;
+    buildApp?: (builder: ViteBuilder) => Promise<void>;
   };
-  environments?: Record<string, ViteEnvironmentConfig | undefined>;
+  environments?: { [key: string]: ViteEnvironmentConfig | undefined };
   build?: {
     outDir?: string;
     manifest?: boolean;
@@ -86,7 +107,11 @@ export interface ViteEnvironmentConfig {
     };
   };
   resolve?: { conditions?: string[]; noExternal?: boolean | string[] };
-  ssr?: { target?: string; noExternal?: boolean | string[]; external?: (string | RegExp)[] };
+  ssr?: {
+    target?: string;
+    noExternal?: boolean | string[];
+    external?: (string | RegExp)[];
+  };
 }
 
 // Pre-bundle so Vite does not discover these mid-load and reload the page
@@ -101,9 +126,9 @@ const OPTIMIZE_DEPS = [
   "oxidejs/rpc/client",
 ] as const;
 
-export function applyViteEnvironments(
+export const applyViteEnvironments = function applyViteEnvironments(
   config: ViteUserConfig,
-  opts: ResolvedOptions,
+  opts: ResolvedOptions
 ): ViteUserConfig {
   // Opt `vite build` into building every environment (same as `vite build --app`).
   config.builder ??= {};
@@ -118,7 +143,9 @@ export function applyViteEnvironments(
 
   config.optimizeDeps ??= {};
   const optimizeInclude = new Set([
-    ...(Array.isArray(config.optimizeDeps.include) ? config.optimizeDeps.include : []),
+    ...(Array.isArray(config.optimizeDeps.include)
+      ? config.optimizeDeps.include
+      : []),
     ...OPTIMIZE_DEPS,
   ]);
   config.optimizeDeps.include = [...optimizeInclude];
@@ -128,36 +155,38 @@ export function applyViteEnvironments(
 
   config.environments ??= {};
 
-  config.environments["ssr"] = {
-    consumer: "server",
-    build: {
-      outDir: opts.outDir,
-      emptyOutDir: true,
-      ssr: true,
-      rolldownOptions: {
-        input: VIRTUAL_WORKER_ID,
-        external: celld ? [/^cloudflare:/] : [],
-        output: {
-          format: "es",
-          entryFileNames: "server.js",
-        },
+  const ssrBuild = {
+    emptyOutDir: true,
+    outDir: opts.outDir,
+    rolldownOptions: {
+      external: celld ? [/^cloudflare:/u] : [],
+      input: VIRTUAL_WORKER_ID,
+      output: {
+        entryFileNames: "server.js",
+        format: "es",
       },
-      rollupOptions: {
-        input: VIRTUAL_WORKER_ID,
-        external: celld ? [/^cloudflare:/] : [],
-        output: {
-          format: "es",
-          entryFileNames: "server.js",
-        },
+    },
+    rollupOptions: {
+      external: celld ? [/^cloudflare:/u] : [],
+      input: VIRTUAL_WORKER_ID,
+      output: {
+        entryFileNames: "server.js",
+        format: "es",
       },
     },
+    ssr: true,
+  };
+  const ssrEnvironment: ViteEnvironmentConfig = {
+    build: ssrBuild,
+    consumer: "server",
     resolve: celld
       ? { conditions: ["worker"], noExternal: true }
       : { noExternal: ["effect", "oxidejs"] },
     ssr: celld
-      ? { target: "webworker", noExternal: true, external: [/^cloudflare:/] }
+      ? { external: [/^cloudflare:/u], noExternal: true, target: "webworker" }
       : { noExternal: ["effect", "oxidejs"] },
   };
+  config.environments["ssr"] = ssrEnvironment;
 
   config.build ??= {};
   if (opts.hasClient) {
@@ -165,15 +194,15 @@ export function applyViteEnvironments(
     const existingClient = config.environments["client"];
     config.environments["client"] = {
       ...existingClient,
-      consumer: "client",
       build: {
         ...existingClient?.build,
-        outDir: clientOutDir,
         emptyOutDir: true,
         manifest: true,
+        outDir: clientOutDir,
       },
+      consumer: "client",
     };
-    config.environments["ssr"]!.build!.emptyOutDir = false;
+    ssrBuild.emptyOutDir = false;
     config.build.outDir ??= clientOutDir;
     config.build.manifest ??= true;
   } else {
@@ -183,20 +212,24 @@ export function applyViteEnvironments(
     config.build.emptyOutDir ??= true;
     config.builder.buildApp ??= async (builder) => {
       const server = builder.environments["ssr"];
-      if (server) await builder.build(server);
+      if (server) {
+        await builder.build(server);
+      }
     };
   }
   return config;
-}
+};
 
 /** Minimal Rsbuild config surface. Avoids a hard @rsbuild/core runtime dep. */
 export interface RsbuildUserConfig {
   root?: string;
-  environments?: Record<string, RsbuildEnvironmentConfig | undefined>;
+  environments?: { [key: string]: RsbuildEnvironmentConfig | undefined };
 }
 
 export interface RsbuildEnvironmentConfig {
-  source?: { entry?: Record<string, string | { import: string; html?: boolean }> };
+  source?: {
+    entry?: { [key: string]: string | { import: string; html?: boolean } };
+  };
   output?: {
     target?: string;
     filename?: string | { js?: string };
@@ -206,21 +239,22 @@ export interface RsbuildEnvironmentConfig {
   resolve?: { conditionNames?: string[] };
 }
 
-export function applyRsbuildEnvironments(
+export const applyRsbuildEnvironments = function applyRsbuildEnvironments(
   config: RsbuildUserConfig,
-  opts: ResolvedOptions,
+  opts: ResolvedOptions
 ): RsbuildUserConfig {
   config.environments ??= {};
   if (opts.hasClient) {
     const clientOutDir = path.join(opts.outDir, opts.clientDir);
-    const existingClient = config.environments["web"] ?? config.environments["client"];
+    const existingClient =
+      config.environments["web"] ?? config.environments["client"];
     config.environments["web"] = {
       ...existingClient,
       output: {
         ...existingClient?.output,
-        target: "web",
         distPath: { ...existingClient?.output?.distPath, root: clientOutDir },
         manifest: true,
+        target: "web",
       },
     };
   } else {
@@ -229,17 +263,16 @@ export function applyRsbuildEnvironments(
   }
 
   const server: RsbuildEnvironmentConfig = {
-    source: { entry: { server: { import: VIRTUAL_WORKER_ID, html: false } } },
     output: {
-      target: opts.preset === "celld" ? "web-worker" : "node",
-      filename: { js: "server.js" },
       distPath: { root: opts.outDir },
+      filename: { js: "server.js" },
+      target: opts.preset === "celld" ? "web-worker" : "node",
     },
+    source: { entry: { server: { html: false, import: VIRTUAL_WORKER_ID } } },
   };
-  if (opts.preset === "celld") server.resolve = { conditionNames: ["worker", "..."] };
+  if (opts.preset === "celld") {
+    server.resolve = { conditionNames: ["worker", "..."] };
+  }
   config.environments["server"] = server;
   return config;
-}
-
-/** @deprecated Use applyViteEnvironments. Kept for existing call sites. */
-export const applyViteWorkerEnvironment = applyViteEnvironments;
+};
diff --git a/packages/oxidejs/src/worker-dom.test.ts b/packages/oxidejs/src/worker-dom.test.ts
index 707557a..65b2305 100644
--- a/packages/oxidejs/src/worker-dom.test.ts
+++ b/packages/oxidejs/src/worker-dom.test.ts
@@ -1,31 +1,51 @@
 import { describe, expect, test } from "bun:test";
+
 import { ensureWorkerDom } from "./worker-dom";
 
+/** Hosts `ensureWorkerDom` may install or remove on `globalThis` during the test. */
+interface WorkerDomHosts {
+  Element?: abstract new (...args: never[]) => object;
+  document?: object;
+  window?: object;
+}
+
 describe("ensureWorkerDom", () => {
   test("installs document and Element globals", () => {
+    // SAFETY: this test owns a temporary install/restore of the same hosts ensureWorkerDom writes.
+    const g = globalThis as typeof globalThis & WorkerDomHosts;
     const saved = {
-      document: globalThis.document,
-      window: globalThis.window,
-      Element: (globalThis as { Element?: unknown }).Element,
+      Element: g.Element,
+      document: g.document,
+      window: g.window,
     };
-    delete (globalThis as { document?: unknown }).document;
-    delete (globalThis as { window?: unknown }).window;
-    delete (globalThis as { Element?: unknown }).Element;
+    delete g.document;
+    delete g.window;
+    delete g.Element;
 
     try {
       ensureWorkerDom();
-      expect(typeof globalThis.document).toBe("object");
-      expect(typeof (globalThis as { Element?: unknown }).Element).toBe("function");
+      expect(g.document).toBeDefined();
+      expect(g.Element).toBeDefined();
+      expect(g.Element?.prototype).toBeDefined();
       const el = document.createElement("div");
       el.innerHTML = "<span>ok</span>";
       expect(el.innerHTML).toBe("<span>ok</span>");
     } finally {
-      if (saved.document) globalThis.document = saved.document;
-      else delete (globalThis as { document?: unknown }).document;
-      if (saved.window) globalThis.window = saved.window;
-      else delete (globalThis as { window?: unknown }).window;
-      if (saved.Element) (globalThis as { Element: unknown }).Element = saved.Element;
-      else delete (globalThis as { Element?: unknown }).Element;
+      if (saved.document === undefined) {
+        delete g.document;
+      } else {
+        g.document = saved.document;
+      }
+      if (saved.window === undefined) {
+        delete g.window;
+      } else {
+        g.window = saved.window;
+      }
+      if (saved.Element === undefined) {
+        delete g.Element;
+      } else {
+        g.Element = saved.Element;
+      }
     }
   });
 });
diff --git a/packages/oxidejs/src/worker-dom.ts b/packages/oxidejs/src/worker-dom.ts
index a50f858..3ce1976 100644
--- a/packages/oxidejs/src/worker-dom.ts
+++ b/packages/oxidejs/src/worker-dom.ts
@@ -1,15 +1,35 @@
 import * as linkedom from "linkedom";
 
+const SKIP_LINKEDOM_KEYS = new Set([
+  "parseHTML",
+  "parseJSON",
+  "toJSON",
+  "Document",
+]);
+
 /** Install a minimal DOM on `globalThis` for Ilha `renderToString` in Workers. */
-export function ensureWorkerDom() {
-  if (typeof globalThis.document !== "undefined") return;
-  const window = linkedom.parseHTML("<!DOCTYPE html><html><body></body></html>");
-  const g = globalThis as typeof globalThis & Record<string, unknown>;
-  g.document = window.document;
-  g.window = window;
+export const ensureWorkerDom = function ensureWorkerDom() {
+  if (globalThis.document !== undefined) {
+    return;
+  }
+  const window = linkedom.parseHTML(
+    "<!DOCTYPE html><html><body></body></html>"
+  );
+  Reflect.set(globalThis, "document", window.document);
+  Reflect.set(globalThis, "window", window);
   for (const [key, value] of Object.entries(linkedom)) {
-    if (key === "parseHTML" || key === "parseJSON" || key === "toJSON" || key === "Document")
+    if (SKIP_LINKEDOM_KEYS.has(key)) {
+      continue;
+    }
+    if (!/^[A-Z]/u.test(key)) {
+      continue;
+    }
+    // Constructors own a `.prototype`; linkedom also exports plain objects (Facades, HTMLClasses).
+    // SAFETY: PascalCase linkedom exports are objects or functions — never null/primitives here.
+    const candidate = value as object;
+    if (!("prototype" in candidate)) {
       continue;
-    if (typeof value === "function" && /^[A-Z]/.test(key)) g[key] = value;
+    }
+    Reflect.set(globalThis, key, value);
   }
-}
+};
diff --git a/packages/oxidejs/src/wrapper.test.ts b/packages/oxidejs/src/wrapper.test.ts
index c5f320d..8e307d7 100644
--- a/packages/oxidejs/src/wrapper.test.ts
+++ b/packages/oxidejs/src/wrapper.test.ts
@@ -2,7 +2,12 @@ import { describe, expect, test } from "bun:test";
 
 import { generateWorkerWrapper } from "./actions";
 
-const BASE = { preset: "fetch" as const, clientDir: "client", hasClient: true, hasPublic: true };
+const BASE = {
+  clientDir: "client",
+  hasClient: true,
+  hasPublic: true,
+  preset: "fetch" as const,
+};
 
 describe("generateWorkerWrapper", () => {
   test("middleware handlers run before the action gate", () => {
@@ -21,22 +26,32 @@ describe("generateWorkerWrapper", () => {
   });
 
   test("imports option emits side-effect imports at the top", () => {
-    const out = generateWorkerWrapper("/x/server.ts", { ...BASE, imports: ["ilha:pages/server"] });
+    const out = generateWorkerWrapper("/x/server.ts", {
+      ...BASE,
+      imports: ["ilha:pages/server"],
+    });
     const firstImport = out.indexOf("import");
-    expect(out.slice(firstImport, firstImport + 60)).toContain('"ilha:pages/server"');
+    expect(out.slice(firstImport, firstImport + 60)).toContain(
+      '"ilha:pages/server"'
+    );
   });
 
   test("middleware object entries emit their side-effect imports", () => {
     const out = generateWorkerWrapper("/x/server.ts", {
       ...BASE,
-      middleware: [{ module: "@ilha/router/ssr", imports: ["ilha:pages/server"] }],
+      middleware: [
+        { imports: ["ilha:pages/server"], module: "@ilha/router/ssr" },
+      ],
     });
     expect(out).toContain('"ilha:pages/server"');
     expect(out).toContain('"@ilha/router/ssr"');
   });
 
   test("bodyLimit interpolates into the request cap", () => {
-    const out = generateWorkerWrapper("/x/server.ts", { ...BASE, bodyLimit: 4096 });
+    const out = generateWorkerWrapper("/x/server.ts", {
+      ...BASE,
+      bodyLimit: 4096,
+    });
     expect(out).toContain("if (size > 4096)");
   });
 
@@ -52,13 +67,19 @@ describe("generateWorkerWrapper", () => {
   });
 
   test("notFound option replaces the plain 404 body", () => {
-    const out = generateWorkerWrapper("/x/server.ts", { ...BASE, notFound: "<h1>custom</h1>" });
+    const out = generateWorkerWrapper("/x/server.ts", {
+      ...BASE,
+      notFound: "<h1>custom</h1>",
+    });
     expect(out).toContain("<h1>custom</h1>");
     expect(out).not.toContain('"Not Found"');
   });
 
   test("env option passes through to user fetch", () => {
-    const out = generateWorkerWrapper("/x/server.ts", { ...BASE, env: { FOO: "1" } });
+    const out = generateWorkerWrapper("/x/server.ts", {
+      ...BASE,
+      env: { FOO: "1" },
+    });
     expect(out).toContain('"FOO":"1"');
   });
 
diff --git a/packages/oxidejs/tsconfig.json b/packages/oxidejs/tsconfig.json
index 2fcace0..5e1890c 100644
--- a/packages/oxidejs/tsconfig.json
+++ b/packages/oxidejs/tsconfig.json
@@ -5,7 +5,8 @@
     "moduleResolution": "Bundler",
     "target": "ES2022",
     "noEmit": true,
-    "types": ["bun"]
+    "types": ["bun"],
+    "strictNullChecks": true
   },
   "include": ["src/**/*.ts"]
 }
diff --git a/packages/oxidejs/tsdown.config.ts b/packages/oxidejs/tsdown.config.ts
index df853d4..f41ddda 100644
--- a/packages/oxidejs/tsdown.config.ts
+++ b/packages/oxidejs/tsdown.config.ts
@@ -1,19 +1,17 @@
 import { defineConfig } from "tsdown";
 
 export default defineConfig({
+  dts: true,
   entry: {
     index: "src/index.ts",
     plugin: "src/plugin.ts",
-    vite: "src/vite.ts",
-    rsbuild: "src/rsbuild.ts",
-    "rpc/client": "src/rpc/client.ts",
     rpc: "src/rpc/index.ts",
+    "rpc/client": "src/rpc/client.ts",
+    rsbuild: "src/rsbuild.ts",
+    vite: "src/vite.ts",
     "worker-dom": "src/worker-dom.ts",
     "worker-dom/install": "src/worker-dom/install.ts",
   },
-  dts: true,
-  format: "esm",
-  platform: "node",
   external: [
     "unplugin",
     "effect",
@@ -22,4 +20,6 @@ export default defineConfig({
     "effect/unstable/socket",
     "crossws/adapters/node",
   ],
+  format: "esm",
+  platform: "node",
 });
diff --git a/packages/oxidejs/virtual.d.ts b/packages/oxidejs/virtual.d.ts
index db17a82..3e2f4c0 100644
--- a/packages/oxidejs/virtual.d.ts
+++ b/packages/oxidejs/virtual.d.ts
@@ -1,13 +1,15 @@
 declare module "virtual:oxide/actions" {
-  import type { Rpc, RpcGroup } from "effect/unstable/rpc";
   import type { Layer } from "effect";
+  import type { Rpc, RpcGroup } from "effect/unstable/rpc";
 
   const actionsGroup: RpcGroup.RpcGroup<Rpc.Any>;
-  export const actionsHandlers: Layer.Layer<unknown, unknown, unknown>;
+  export const actionsHandlers: Layer.Layer<Rpc.Any, never, never>;
   export default actionsGroup;
   export { actionsGroup as actions };
 }
 
 declare module "virtual:oxide/client" {
-  export const client: Record<string, Record<string, (...args: unknown[]) => Promise<unknown>>>;
+  type ActionFn = (...args: never[]) => Promise<never>;
+  type ActionModule = Record<string, ActionFn>;
+  export const client: Record<string, ActionModule>;
 }
diff --git a/scripts/release.ts b/scripts/release.ts
index 0ca1a24..2f5b29f 100755
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -5,15 +5,21 @@
  * Any ^/~/"latest-like" prefix is kept; only the version part changes.
  * Formatting of untouched lines is preserved.
  *
- *   bun run release -n tacho -b minor
+ *   bun run release -n oxidejs -b minor
  */
-import { readdirSync, readFileSync, writeFileSync, statSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import {
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+  statSync,
+  existsSync,
+} from "node:fs";
+import path from "node:path";
 
 const argv = Bun.argv.slice(2);
 const arg = (flag: string) => {
   const i = argv.indexOf(flag);
-  return i >= 0 ? argv[i + 1] : undefined;
+  return i === -1 ? undefined : argv[i + 1];
 };
 
 const name = arg("-n");
@@ -23,22 +29,27 @@ if (!name || (bump !== "minor" && bump !== "patch")) {
   process.exit(1);
 }
 
-const pkgPath = join("packages", name, "package.json");
+const pkgPath = path.join("packages", name, "package.json");
 if (!existsSync(pkgPath)) {
   console.error(`no package ${name} under packages/`);
   process.exit(1);
 }
-const pkgText = readFileSync(pkgPath, "utf8");
+const pkgText = readFileSync(pkgPath, "utf-8");
 const old = String(JSON.parse(pkgText).version);
 const parts = old.split(".");
-if (parts.length !== 3 || parts.some((p) => !/^\d+$/.test(p))) {
+if (parts.length !== 3 || parts.some((p) => !/^\d+$/u.test(p))) {
   console.error(`${name} version is not plain semver: ${old}`);
   process.exit(1);
 }
 const [maj, min, pat] = parts.map(Number);
-const next = bump === "minor" ? `${maj}.${min + 1}.0` : `${maj}.${min}.${pat + 1}`;
+const next =
+  bump === "minor" ? `${maj}.${min + 1}.0` : `${maj}.${min}.${pat + 1}`;
 
-type DepField = "dependencies" | "devDependencies" | "peerDependencies" | "optionalDependencies";
+type DepField =
+  | "dependencies"
+  | "devDependencies"
+  | "peerDependencies"
+  | "optionalDependencies";
 const DEP_FIELDS: DepField[] = [
   "dependencies",
   "devDependencies",
@@ -46,61 +57,82 @@ const DEP_FIELDS: DepField[] = [
   "optionalDependencies",
 ];
 
+interface PackageJsonDeps {
+  dependencies?: { [key: string]: string };
+  devDependencies?: { [key: string]: string };
+  optionalDependencies?: { [key: string]: string };
+  peerDependencies?: { [key: string]: string };
+  version?: string;
+}
+
 // Structurally detect what to change, then rewrite just those `"key": "value"`
 // substrings so untouched formatting survives byte-for-byte.
 const updated: string[] = [];
 
-function sync(path: string): boolean {
-  const text = readFileSync(path, "utf8");
-  const json = JSON.parse(text) as Record<string, Record<string, string> | undefined>;
+const sync = function sync(filePath: string): boolean {
+  const text = readFileSync(filePath, "utf-8");
+  // SAFETY: workspace package.json dep maps are string-keyed version ranges.
+  const json = JSON.parse(text) as PackageJsonDeps;
   let out = text;
   for (const field of DEP_FIELDS) {
     const deps = json[field];
-    if (!deps || !(name in deps)) continue;
+    if (!deps || !(name in deps)) {
+      continue;
+    }
     const cur = String(deps[name]);
-    if (!cur.endsWith(old)) continue;
+    if (!cur.endsWith(old)) {
+      continue;
+    }
     const replacement = cur.slice(0, cur.length - old.length) + next;
-    const escapedCur = cur.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const escapedCur = cur.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
     const key = name.replaceAll("/", "\\/");
     out = out.replaceAll(
-      new RegExp(`("${key}"(\\s*:\\s*"))${escapedCur}",`, "g"),
-      `$1${replacement}",`,
+      new RegExp(`("${key}"(\\s*:\\s*"))${escapedCur}",`, "gu"),
+      `$1${replacement}",`
     );
     // last-dep entries lack the trailing comma
     out = out.replaceAll(
-      new RegExp(`("${key}"(\\s*:\\s*"))${escapedCur}"`, "g"),
-      `$1${replacement}"`,
+      new RegExp(`("${key}"(\\s*:\\s*"))${escapedCur}"`, "gu"),
+      `$1${replacement}"`
     );
   }
-  if (out === text) return false;
-  writeFileSync(path, out);
-  updated.push(`  synced ${path}`);
+  if (out === text) {
+    return false;
+  }
+  writeFileSync(filePath, out);
+  updated.push(`  synced ${filePath}`);
   return true;
-}
+};
 
 const walk = (dir: string): void => {
   for (const e of readdirSync(dir)) {
-    if (e === "node_modules" || e === ".git" || e.startsWith(".")) continue;
-    const p = join(dir, e);
-    if (!statSync(p).isDirectory()) {
-      if (e === "package.json" && p !== pkgPath) sync(p);
-    } else walk(p);
+    if (e === "node_modules" || e === ".git" || e.startsWith(".")) {
+      continue;
+    }
+    const p = path.join(dir, e);
+    if (statSync(p).isDirectory()) {
+      walk(p);
+    } else if (e === "package.json" && p !== pkgPath) {
+      sync(p);
+    }
   }
 };
 
-for (const root of ["packages", "templates", "apps"]) walk(root);
+for (const root of ["packages", "templates", "apps"]) {
+  walk(root);
+}
 
 if (
   !pkgText.includes(`"version": "${old}"`) &&
-  !new RegExp('"version":\\s*"' + old + '"').test(pkgText)
+  !new RegExp(`"version":\\s*"${old}"`, "u").test(pkgText)
 ) {
   console.error(`version mismatch: ${pkgPath} does not contain "${old}"`);
   process.exit(1);
 }
 writeFileSync(
   pkgPath,
-  pkgText.replace(new RegExp('("version"\\s*:\\s*")' + old + '"'), `$1${next}"`),
+  pkgText.replace(new RegExp(`("version"\\s*:\\s*")${old}"`, "u"), `$1${next}"`)
 );
 console.log(
-  `${pkgPath}: ${old} -> ${next}\n${updated.join("\n")}\nPublish with: bun publish --cwd packages/${name}, then bun install to refresh bun.lock.`,
+  `${pkgPath}: ${old} -> ${next}\n${updated.join("\n")}\nPublish with: bun publish --cwd packages/${name}, then bun install to refresh bun.lock.`
 );
diff --git a/templates/simple/package.json b/templates/simple/package.json
index f7ffcd3..b32be4b 100644
--- a/templates/simple/package.json
+++ b/templates/simple/package.json
@@ -15,7 +15,7 @@
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.3",
     "daisyui": "^5.7.22",
-    "oxidejs": "^0.3.2",
+    "oxidejs": "^0.3.3",
     "tailwindcss": "^4.3.3",
     "typescript": "^6",
     "vite": "^8.2.1"
diff --git a/templates/simple/src/lib/greet.server.tsx b/templates/simple/src/lib/greet.server.tsx
index 0fee77f..04a6fed 100644
--- a/templates/simple/src/lib/greet.server.tsx
+++ b/templates/simple/src/lib/greet.server.tsx
@@ -1,3 +1,15 @@
-export const Greeting = async function Greeting(props: Record<string, unknown>) {
-  return <p>Hello, {props.name == null ? "Ilha" : String(props.name)}!</p>;
+interface GreetingProps {
+  name?: string | number | boolean | null;
+}
+
+export const Greeting = function Greeting(props: GreetingProps) {
+  return (
+    <p>
+      Hello,{" "}
+      {props.name === undefined || props.name === null
+        ? "Ilha"
+        : String(props.name)}
+      !
+    </p>
+  );
 };
diff --git a/templates/simple/src/pages/index.tsx b/templates/simple/src/pages/index.tsx
index 1c78488..fb1daba 100644
--- a/templates/simple/src/pages/index.tsx
+++ b/templates/simple/src/pages/index.tsx
@@ -1,8 +1,8 @@
-import { atom } from "ilha";
 import { Greeting } from "$lib/greet.server";
 import { head } from "@ilha/router";
+import { atom } from "ilha";
 
-export default async function Home() {
+export default function Home() {
   head({ title: "Home" });
   const name = atom("");
 
@@ -16,7 +16,12 @@ export default async function Home() {
             class="input input-bordered"
             name="name"
             value={name()}
-            oninput={(event: Event) => name.set((event.currentTarget as HTMLInputElement).value)}
+            oninput={(event: Event) => {
+              const target = event.currentTarget;
+              if (target instanceof HTMLInputElement) {
+                name.set(target.value);
+              }
+            }}
           />
         </label>
         <Greeting name={name() || "Ilha"} />
diff --git a/templates/simple/src/server.ts b/templates/simple/src/server.ts
index 2afe3c3..3275ddd 100644
--- a/templates/simple/src/server.ts
+++ b/templates/simple/src/server.ts
@@ -6,6 +6,6 @@ setFrameAuth({ defaultAction: "open" });
 
 export default {
   fetch() {
-    return undefined;
+    // Fall through to static assets / index.html.
   },
 };
diff --git a/templates/simple/tsconfig.json b/templates/simple/tsconfig.json
index b414650..04b3273 100644
--- a/templates/simple/tsconfig.json
+++ b/templates/simple/tsconfig.json
@@ -6,7 +6,8 @@
     "paths": {
       "$lib/*": ["./src/lib/*"]
     },
-    "types": ["vite/client"]
+    "types": ["vite/client"],
+    "strictNullChecks": true
   },
   "include": ["src", "vite.config.ts", ".ilha/pages.d.ts"]
 }
diff --git a/templates/simple/vite.config.ts b/templates/simple/vite.config.ts
index f75677d..ea25d36 100644
--- a/templates/simple/vite.config.ts
+++ b/templates/simple/vite.config.ts
@@ -4,7 +4,11 @@ import oxide from "oxidejs/vite";
 import { defineConfig } from "vite";
 
 export default defineConfig({
-  plugins: [oxide({ middleware: ["@ilha/router/ssr"] }), pages(), tailwindcss()],
+  plugins: [
+    oxide({ middleware: ["@ilha/router/ssr"] }),
+    pages(),
+    tailwindcss(),
+  ],
   resolve: {
     tsconfigPaths: true,
   },
diff --git a/templates/tasks/package.json b/templates/tasks/package.json
index c8c8f7a..f30d3fb 100644
--- a/templates/tasks/package.json
+++ b/templates/tasks/package.json
@@ -19,7 +19,7 @@
     "@cloudflare/workers-types": "^5.20260818.1",
     "@tailwindcss/vite": "^4.3.3",
     "daisyui": "^5.7.22",
-    "oxidejs": "^0.3.2",
+    "oxidejs": "^0.3.3",
     "tailwindcss": "^4.3.3",
     "typescript": "^6",
     "vite": "^8.2.1"
diff --git a/templates/tasks/src/lib/tasks.server.tsx b/templates/tasks/src/lib/tasks.server.tsx
index 7bf80c1..fb241f0 100644
--- a/templates/tasks/src/lib/tasks.server.tsx
+++ b/templates/tasks/src/lib/tasks.server.tsx
@@ -3,99 +3,131 @@ import * as PubSub from "effect/PubSub";
 import * as Stream from "effect/Stream";
 import { action } from "oxidejs";
 import { createStorage } from "unstorage";
+
 import type { Task } from "../server";
 
+// SAFETY: process-global demo store; Bun may reuse the isolate across reloads.
 const g = globalThis as typeof globalThis & {
   __tasks?: ReturnType<typeof createStorage<Task>>;
   __taskHub?: PubSub.PubSub<Task[]>;
-  __taskMutate?: Promise<void>;
+  __taskMutate?: Promise<null>;
 };
 
-const tasks = (g.__tasks ??= createStorage<Task>());
+let tasks = g.__tasks;
+if (!tasks) {
+  tasks = createStorage<Task>();
+  g.__tasks = tasks;
+}
+
 /** Sliding hub: slow consumers drop old snapshots; replay keeps the latest for late subscribers. */
-const hub = (g.__taskHub ??= Effect.runSync(PubSub.sliding<Task[]>({ capacity: 16, replay: 1 })));
+let hub = g.__taskHub;
+if (!hub) {
+  hub = Effect.runSync(PubSub.sliding<Task[]>({ capacity: 16, replay: 1 }));
+  g.__taskHub = hub;
+}
 
 const snapshot = async () => {
-  const items = await Promise.all((await tasks.getKeys()).map((id) => tasks.getItem(id)));
-  return items.filter((task) => task != null);
+  const keys = await tasks.getKeys();
+  const items = await Promise.all(keys.map((id) => tasks.getItem(id)));
+  return items.filter(
+    (task): task is Task => task !== null && task !== undefined
+  );
 };
 
 /** Run a storage mutation and its snapshot publish as one critical section. */
-const mutate = async (fn: () => Promise<void>) => {
-  const prev = g.__taskMutate ?? Promise.resolve();
-  let release!: () => void;
-  g.__taskMutate = new Promise<void>((resolve) => {
-    release = resolve;
-  });
+const mutate = async (fn: () => Promise<null>) => {
+  const prev = g.__taskMutate ?? Promise.resolve(null);
+  const { promise, resolve } = Promise.withResolvers<null>();
+  g.__taskMutate = promise;
   await prev;
   try {
     await fn();
     Effect.runSync(PubSub.publish(hub, await snapshot()));
   } finally {
-    release();
+    resolve(null);
   }
 };
 
-void mutate(async () => {});
+void mutate(() => Promise.resolve(null));
 
 export const add = action(async (text: string) => {
   const trimmed = text.trim();
-  if (!trimmed) return;
+  if (!trimmed) {
+    return;
+  }
   const id = crypto.randomUUID();
   await mutate(async () => {
-    await tasks.setItem(id, { id, text: trimmed, completed: false });
+    await tasks.setItem(id, { completed: false, id, text: trimmed });
+    return null;
   });
 });
 
 export const toggle = action(async (id: string) => {
   await mutate(async () => {
     const task = await tasks.getItem(id);
-    if (!task) return;
+    if (!task) {
+      return null;
+    }
     await tasks.setItem(id, { ...task, completed: !task.completed });
+    return null;
   });
 });
 
 export const remove = action(async (id: string) => {
   await mutate(async () => {
     await tasks.removeItem(id);
+    return null;
   });
 });
 
-export const list = action(async function* () {
+export const list = action(async function* list() {
   yield* Stream.toAsyncIterable(Stream.fromPubSub(hub));
 });
 
-const streamError = (error: unknown) => (error instanceof Error ? error : new Error(String(error)));
+const toStreamError = (cause: unknown): Error =>
+  cause instanceof Error ? cause : new Error(String(cause));
 
-export const TaskCount = async function TaskCount() {
-  return Stream.map(Stream.fromAsyncIterable(list(), streamError), (items) => (
-    <span class="badge badge-primary">{items.filter((task) => !task.completed).length}</span>
-  ));
+export const TaskCount = function TaskCount() {
+  return Stream.map(
+    Stream.fromAsyncIterable(list(), toStreamError),
+    (items) => (
+      <span class="badge badge-primary">
+        {items.filter((task) => !task.completed).length}
+      </span>
+    )
+  );
 };
 
-export const TaskList = async function TaskList() {
-  return Stream.map(Stream.fromAsyncIterable(list(), streamError), (items) => (
-    <div class="flex flex-col gap-2">
-      {items.length > 0 ? (
-        items.map((todo) => (
-          <div key={todo.id} class="flex items-center justify-between gap-2">
-            <label class="label cursor-pointer justify-start gap-2">
-              <input
-                type="checkbox"
-                class="checkbox"
-                checked={todo.completed}
-                onchange={toggle.bind(todo.id)}
-              />
-              <span>{todo.text}</span>
-            </label>
-            <button type="button" class="btn btn-sm btn-ghost" onclick={remove.bind(todo.id)}>
-              Delete
-            </button>
-          </div>
-        ))
-      ) : (
-        <p>No todos.</p>
-      )}
-    </div>
-  ));
+export const TaskList = function TaskList() {
+  return Stream.map(
+    Stream.fromAsyncIterable(list(), toStreamError),
+    (items) => (
+      <div class="flex flex-col gap-2">
+        {items.length > 0 ? (
+          items.map((todo) => (
+            <div key={todo.id} class="flex items-center justify-between gap-2">
+              <label class="label cursor-pointer justify-start gap-2">
+                <input
+                  type="checkbox"
+                  class="checkbox"
+                  checked={todo.completed}
+                  onchange={toggle.bind(todo.id)}
+                />
+                <span>{todo.text}</span>
+              </label>
+              <button
+                type="button"
+                class="btn btn-sm btn-ghost"
+                onclick={remove.bind(todo.id)}
+              >
+                Delete
+              </button>
+            </div>
+          ))
+        ) : (
+          <p>No todos.</p>
+        )}
+      </div>
+    )
+  );
 };
diff --git a/templates/tasks/src/pages/index.tsx b/templates/tasks/src/pages/index.tsx
index d2cbcd8..89a9f5b 100644
--- a/templates/tasks/src/pages/index.tsx
+++ b/templates/tasks/src/pages/index.tsx
@@ -1,17 +1,22 @@
 import { add, TaskCount, TaskList } from "$lib/tasks.server";
 import { head } from "@ilha/router";
 
+const addItem = async (event: SubmitEvent) => {
+  event.preventDefault();
+  const form = event.currentTarget;
+  if (!(form instanceof HTMLFormElement)) {
+    return;
+  }
+  const text = String(new FormData(form).get("text") ?? "").trim();
+  if (text) {
+    await add(text);
+  }
+  form.reset();
+};
+
 export default function Home() {
   head({ title: "Home" });
 
-  const addItem = async (event: SubmitEvent) => {
-    event.preventDefault();
-    const form = event.currentTarget as HTMLFormElement;
-    const text = String(new FormData(form).get("text") ?? "").trim();
-    if (text) await add(text);
-    form.reset();
-  };
-
   return (
     <div class="mx-auto mt-8 flex max-w-xl flex-col gap-4">
       <div class="card bg-base-100 shadow">
@@ -21,7 +26,11 @@ export default function Home() {
             <TaskCount />
           </div>
           <form onsubmit={addItem} class="flex items-center gap-2">
-            <input name="text" class="input input-bordered w-full" placeholder="Add a new todo" />
+            <input
+              name="text"
+              class="input input-bordered w-full"
+              placeholder="Add a new todo"
+            />
             <button type="submit" class="btn btn-primary">
               Add
             </button>
diff --git a/templates/tasks/src/server.ts b/templates/tasks/src/server.ts
index 599d56c..e6a1dc6 100644
--- a/templates/tasks/src/server.ts
+++ b/templates/tasks/src/server.ts
@@ -2,10 +2,14 @@ import { setFrameAuth } from "@ilha/router/ssr";
 
 setFrameAuth({ defaultAction: "open" });
 
-export type Task = { id: string; text: string; completed: boolean };
+export interface Task {
+  completed: boolean;
+  id: string;
+  text: string;
+}
 
 export default {
   fetch() {
-    return undefined;
+    // Fall through to static assets / index.html.
   },
 };
diff --git a/templates/tasks/tsconfig.json b/templates/tasks/tsconfig.json
index be95964..7798ad3 100644
--- a/templates/tasks/tsconfig.json
+++ b/templates/tasks/tsconfig.json
@@ -8,7 +8,8 @@
       "oxidejs": ["../../packages/oxidejs/src/index.ts"],
       "oxidejs/*": ["../../packages/oxidejs/src/*"]
     },
-    "types": ["@cloudflare/workers-types", "vite/client"]
+    "types": ["@cloudflare/workers-types", "vite/client"],
+    "strictNullChecks": true
   },
   "include": ["src", "vite.config.ts", ".ilha/pages.d.ts"]
 }
diff --git a/templates/tasks/vite.config.ts b/templates/tasks/vite.config.ts
index c746fd1..044ee10 100644
--- a/templates/tasks/vite.config.ts
+++ b/templates/tasks/vite.config.ts
@@ -9,8 +9,8 @@ export default defineConfig({
       middleware: ["@ilha/router/ssr"],
       preset: "celld",
       wrangler: {
-        name: "celld-tasks",
         compatibility_date: "2026-01-01",
+        name: "celld-tasks",
       },
     }),
     pages(),
diff --git a/tsconfig.json b/tsconfig.json
index c9c11ad..6a67e1b 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -6,6 +6,7 @@
     "paths": {
       "oxidejs": ["./packages/oxidejs/src/index.ts"],
       "tacho": ["./packages/tacho/src/index.ts"]
-    }
+    },
+    "strictNullChecks": true
   }
 }

From 88679368894785d208ab8abfbd6ef643d790e42b Mon Sep 17 00:00:00 2001
From: Ryuz <ryuzer@proton.me>
Date: Sat, 5 Sep 2026 11:25:25 +0200
Subject: [PATCH 2/2] fix(pr): improvements

---
 .husky/pre-commit                        |  17 ++-
 apps/website/docs/oxide/security.mdx     |   2 +-
 apps/website/docs/oxide/server-entry.mdx |  23 ++--
 packages/oxidejs/package.json            |   2 +-
 packages/oxidejs/src/action.test.ts      |   8 +-
 packages/oxidejs/src/actions.test.ts     |  22 ++--
 packages/oxidejs/src/actions.ts          |  38 ++++---
 packages/oxidejs/src/context.ts          |  15 ++-
 packages/oxidejs/src/plugin.ts           | 134 +++++++++++------------
 packages/oxidejs/src/rpc/client.ts       |  41 +++++--
 packages/oxidejs/src/rpc/test-harness.ts |  18 ++-
 packages/oxidejs/src/rpc/ws.ts           |  35 +++---
 packages/oxidejs/virtual.d.ts            |  13 ++-
 13 files changed, 216 insertions(+), 152 deletions(-)
 mode change 100644 => 100755 .husky/pre-commit

diff --git a/.husky/pre-commit b/.husky/pre-commit
old mode 100644
new mode 100755
index a0f5a4f..63163ac
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -7,9 +7,18 @@ if [ -z "$STAGED_FILES" ]; then
   exit 0
 fi
 
-# Run formatter, capturing the exit code so we can still re-stage and report
+# Park unstaged hunks so formatting cannot stage them by accident.
+STASHED=0
+if ! git diff --quiet; then
+  if git stash push --keep-index --quiet -m "husky-pre-commit-unstaged"; then
+    STASHED=1
+  fi
+fi
+
+# Format only the staged paths, capturing the exit code so we can still re-stage and report
 FORMAT_EXIT_CODE=0
-bun x ultracite fix || FORMAT_EXIT_CODE=$?
+# shellcheck disable=SC2086
+printf '%s\n' "$STAGED_FILES" | tr '\n' '\0' | xargs -0 bun x ultracite fix || FORMAT_EXIT_CODE=$?
 
 # Re-stage files that were already staged
 echo "$STAGED_FILES" | while IFS= read -r file; do
@@ -18,6 +27,10 @@ echo "$STAGED_FILES" | while IFS= read -r file; do
   fi
 done
 
+if [ "$STASHED" -eq 1 ]; then
+  git stash pop --quiet || true
+fi
+
 if [ $FORMAT_EXIT_CODE -ne 0 ]; then
   echo "Ultracite found issues that could not be auto-fixed."
   exit $FORMAT_EXIT_CODE
diff --git a/apps/website/docs/oxide/security.mdx b/apps/website/docs/oxide/security.mdx
index 5b4454e..abb1a58 100644
--- a/apps/website/docs/oxide/security.mdx
+++ b/apps/website/docs/oxide/security.mdx
@@ -16,7 +16,7 @@ The generated server serves static files from `dist/client/` (or the `public/` d
 | **Traversal** (`%2e%2e/`, `..%2f`) | `__rel()` rejects paths containing `..` segments. |
 | **Double-slash** (`///etc/passwd`) | `__rel()` rejects results that still start with `/` after `slice(1)`. |
 | **Null byte** (`%00`, `\0`) | `__rel()` rejects paths containing null bytes before and after `decodeURIComponent`. |
-| **Absolute path** (`/etc/passwd`) | `__rel()` returns `null` for paths not starting with `/`. |
+| **Absolute path** (`/etc/passwd`) | `__rel()` strips the leading `/` (`etc/passwd`) and keeps serving relative to the asset root; containment is the `..` / double-slash checks, not rejecting `/`. |
 | **SPA fallback** | Unknown paths → `index.html`, never a directory listing. |
 | **`clientDir` escape** | `resolveOptions` throws at build time if `clientDir` resolves outside `outDir`. |
 | **Hashed assets** | Files matching `[-.][0-9a-f]{8,}.ext` get `Cache-Control: public, max-age=31536000, immutable`. Other files are not cached by default. |
diff --git a/apps/website/docs/oxide/server-entry.mdx b/apps/website/docs/oxide/server-entry.mdx
index c4fbb38..bc12858 100644
--- a/apps/website/docs/oxide/server-entry.mdx
+++ b/apps/website/docs/oxide/server-entry.mdx
@@ -14,10 +14,10 @@ import type { FetchHandler } from "oxidejs";
 
 type Env = { SECRET?: string };
 
-export const fetch = ((request, env, ctx) => {
+export const fetch = ((request, _env, ctx) => {
   if (new URL(request.url).pathname === "/api/ok") {
     ctx.waitUntil?.(Promise.resolve(null));
-    return new Response(env.SECRET ?? "ok");
+    return new Response("ok");
   }
   return;
 }) satisfies FetchHandler<Env>;
@@ -36,11 +36,12 @@ On the Node preset the generated server also handles `SIGTERM`/`SIGINT`: it stop
 ## `FetchHandler`
 
 ```ts
-type FetchHandler<Env = { [key: string]: OxidejsJson }> = (
-  request: Request,
-  env: Env,
-  ctx: ExecutionContext
-) => FetchResult | Promise<FetchResult>;
+type FetchHandler<Env extends object = { [key: string]: OxidejsJson }> =
+  (
+    request: Request,
+    env: Env,
+    ctx: ExecutionContext
+  ) => FetchResult | Promise<FetchResult>;
 ```
 
 `Env` defaults to a JSON-compatible binding bag. Pass your Worker / [`env`](/oxide/configuration#env) shape as the type argument. The wrapper always supplies `env` and `ctx`.
@@ -50,7 +51,9 @@ Prefer `satisfies FetchHandler<Env>` on the function so `request`, `env`, and `c
 ## `ServerEntry`
 
 ```ts
-interface ServerEntry<Env = { [key: string]: OxidejsJson }> {
+interface ServerEntry<
+  Env extends object = { [key: string]: OxidejsJson },
+> {
   fetch: FetchHandler<Env>;
 }
 ```
@@ -62,9 +65,9 @@ import type { FetchHandler, ServerEntry } from "oxidejs";
 
 type Env = { SECRET?: string };
 
-const fetch = ((request, env) => {
+const fetch = ((request, _env) => {
   if (new URL(request.url).pathname === "/api/ok") {
-    return new Response(env.SECRET ?? "ok");
+    return new Response("ok");
   }
   return;
 }) satisfies FetchHandler<Env>;
diff --git a/packages/oxidejs/package.json b/packages/oxidejs/package.json
index 38ef136..205b1d6 100644
--- a/packages/oxidejs/package.json
+++ b/packages/oxidejs/package.json
@@ -93,6 +93,6 @@
     }
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.11"
   }
 }
diff --git a/packages/oxidejs/src/action.test.ts b/packages/oxidejs/src/action.test.ts
index 8381243..6b7feab 100644
--- a/packages/oxidejs/src/action.test.ts
+++ b/packages/oxidejs/src/action.test.ts
@@ -61,12 +61,16 @@ test("wrapClientRpc rest stubs preserve argument lists on call and set", async (
 });
 
 test("with is an alias for bind", () => {
-  const echo = action((value: string) => value);
+  const echo = brandServerAction(
+    "x:echo",
+    action((value: string) => value)
+  );
   // SAFETY: with attaches ACTION_CALL payload for ilha capture.
   const viaWith = actionCall(echo.with("hi") as ActionCallCarrier);
   // SAFETY: bind attaches ACTION_CALL payload for ilha capture.
   const viaBind = actionCall(echo.bind("hi") as ActionCallCarrier);
-  expect(viaWith?.a).toEqual(viaBind?.a);
+  expect(viaWith).toEqual({ a: ["hi"], k: "x:echo" });
+  expect(viaBind).toEqual({ a: ["hi"], k: "x:echo" });
 });
 
 test("stream actions return async generators", async () => {
diff --git a/packages/oxidejs/src/actions.test.ts b/packages/oxidejs/src/actions.test.ts
index cdfedd0..ba191e7 100644
--- a/packages/oxidejs/src/actions.test.ts
+++ b/packages/oxidejs/src/actions.test.ts
@@ -31,6 +31,7 @@ import {
   withRequestStore,
 } from "./context";
 import { createActionHandler } from "./rpc/server";
+import { writeGeneratedActions } from "./rpc/test-harness";
 
 const RPC_MODULE = path.join(import.meta.dir, "rpc/index.ts");
 const OXIDE_RUNTIME = path.join(import.meta.dir, "context.ts");
@@ -73,14 +74,11 @@ const writeActionsModule = function writeActionsModule(
   root: string,
   code: string
 ) {
-  const out = path.join(root, "actions.mjs");
-  fs.writeFileSync(
-    out,
-    code
-      .replaceAll("oxidejs/rpc", RPC_MODULE)
-      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`)
-  );
-  return out;
+  return writeGeneratedActions(root, {
+    code,
+    oxideRuntime: OXIDE_RUNTIME,
+    rpcModule: RPC_MODULE,
+  });
 };
 
 const loadGeneratedRouter = async function loadGeneratedRouter(root: string) {
@@ -443,9 +441,7 @@ ${stubSource}`
       preset: "fetch",
     });
     expect(code).toContain('export * from "/app/src/server.ts"');
-    expect(code).toContain(
-      'import user, { fetch as __namedFetch } from "/app/src/server.ts"'
-    );
+    expect(code).toContain('import * as __userMod from "/app/src/server.ts"');
     expect(code).toContain(
       'import { actionsGroup, actionsHandlers } from "virtual:oxide/actions"'
     );
@@ -464,7 +460,7 @@ ${stubSource}`
     expect(code).toContain("signal: ac.signal");
     expect(code).toContain('req.once("aborted"');
     expect(code).toContain("response.body.getReader()");
-    expect(code).toContain("...user");
+    expect(code).toContain("...(user ?? {})");
   });
 
   test("fetch wrapper without client skips assets", () => {
@@ -492,7 +488,7 @@ ${stubSource}`
     expect(code).not.toContain("ensureWorkerDom()");
     expect(code).not.toContain(": __nf()");
     expect(code).toContain("export * from");
-    expect(code).toContain("...user");
+    expect(code).toContain("...(user ?? {})");
   });
 
   test("fetch wrapper with public/ still serves assets", () => {
diff --git a/packages/oxidejs/src/actions.ts b/packages/oxidejs/src/actions.ts
index a03fe8f..fbc1062 100644
--- a/packages/oxidejs/src/actions.ts
+++ b/packages/oxidejs/src/actions.ts
@@ -336,19 +336,22 @@ const pipeResponse = async function pipeResponse(
     void reader.cancel();
   };
   req.once("aborted", abort);
-  const pull = async function pull(): Promise<void> {
-    const { done, value } = await reader.read();
-    if (done) {
-      req.off("aborted", abort);
-      res.end();
-      return;
-    }
-    if (value) {
-      res.write(value);
+  try {
+    for (;;) {
+      // Sequential stream pull — must await each chunk before the next.
+      // oxlint-disable-next-line eslint/no-await-in-loop -- body must be drained in order
+      const { done, value } = await reader.read();
+      if (done) {
+        res.end();
+        return;
+      }
+      if (value) {
+        res.write(value);
+      }
     }
-    await pull();
-  };
-  await pull();
+  } finally {
+    req.off("aborted", abort);
+  }
 };
 
 interface WorkerWrapperOpts {
@@ -516,13 +519,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     res.end();
   });${wsUpgrade}
   server.listen(port, () => console.log(\`oxidejs listening on \${port}\`));
-}
   for (const signal of ["SIGTERM", "SIGINT"]) {
     process.on(signal, () => {
       server.close(() => process.exit(0));
       setTimeout(() => process.exit(0), 5000).unref();
     });
   }
+}
 `;
 };
 
@@ -658,15 +661,16 @@ export const generateWorkerWrapper = function generateWorkerWrapper(
     .join("\n");
   const celldDomBlock = buildCelldDomBlock(preset);
   return `${sideEffectImports}${celldDomBlock}export * from ${JSON.stringify(userWorkerAbs)};
-import user, { fetch as __namedFetch } from ${JSON.stringify(userWorkerAbs)};
+import * as __userMod from ${JSON.stringify(userWorkerAbs)};
+const user = __userMod.default;
 const __userFetch =
   user != null && typeof user.fetch === "function"
     ? user.fetch.bind(user)
-    : typeof __namedFetch === "function"
-      ? __namedFetch
+    : typeof __userMod.fetch === "function"
+      ? __userMod.fetch
       : undefined;
 ${middlewareImports}${actionImports}${hasActions ? `${actionMatchFn}\n` : ""}${assetBlock}${nfBlock}const app = {
-  ...user,
+  ...(user ?? {}),
   async fetch(request, env, ctx) {
     request[__fetch] = { env, fetchCtx: ctx };
     ${middlewareGate}${actionGate}${afterAction}
diff --git a/packages/oxidejs/src/context.ts b/packages/oxidejs/src/context.ts
index b0b39be..854387f 100644
--- a/packages/oxidejs/src/context.ts
+++ b/packages/oxidejs/src/context.ts
@@ -21,17 +21,16 @@ export type FetchResult = Response | undefined;
  * `fetch(request, env, ctx)` — `env` may be `{}` on Node without the `env` option.
  * Return `undefined` (or bare `return`) to fall through to assets.
  */
-export type FetchHandler<
-  Env extends { [key: string]: OxidejsJson } = { [key: string]: OxidejsJson },
-> = (
-  request: Request,
-  env: Env,
-  ctx: ExecutionContext
-) => FetchResult | Promise<FetchResult>;
+export type FetchHandler<Env extends object = { [key: string]: OxidejsJson }> =
+  (
+    request: Request,
+    env: Env,
+    ctx: ExecutionContext
+  ) => FetchResult | Promise<FetchResult>;
 
 /** Default export shape for `src/server.ts`. */
 export interface ServerEntry<
-  Env extends { [key: string]: OxidejsJson } = { [key: string]: OxidejsJson },
+  Env extends object = { [key: string]: OxidejsJson },
 > {
   fetch: FetchHandler<Env>;
 }
diff --git a/packages/oxidejs/src/plugin.ts b/packages/oxidejs/src/plugin.ts
index 31f094b..06b49bc 100644
--- a/packages/oxidejs/src/plugin.ts
+++ b/packages/oxidejs/src/plugin.ts
@@ -430,6 +430,63 @@ const loadDevMiddlewareHandlers = async function loadDevMiddlewareHandlers(
   }
 };
 
+/** Register the Connect bridge that runs production middleware modules in Vite dev. */
+const attachDevMiddlewareBridge = function attachDevMiddlewareBridge(
+  server: DevSsrServer & {
+    middlewares: {
+      use: (
+        handler: (req: ConnectReq, res: ConnectRes, next: ConnectNext) => void
+      ) => void;
+    };
+  },
+  opts: ResolvedOptions
+): Promise<MwHandler[]> {
+  if (
+    (opts.middleware?.length ?? 0) === 0 &&
+    (opts.imports?.length ?? 0) === 0
+  ) {
+    return Promise.resolve([]);
+  }
+  const handlersPromise = loadDevMiddlewareHandlers(server, opts);
+  server.middlewares.use((creq, cres, next) => {
+    // Don't touch /__oxide/action — reading the body here would empty the
+    // Node stream before the action middleware runs.
+    if (
+      matchesActionPath((creq.url ?? "").split("?")[0] ?? "", opts.actionPath)
+    ) {
+      return next();
+    }
+    void (async () => {
+      try {
+        const handlers = await handlersPromise;
+        if (handlers.length === 0) {
+          return next();
+        }
+        const request = await nodeToWebRequest(creq, opts.bodyLimit);
+        const context: MiddlewareContext = {
+          ctx: undefined,
+          env: opts.env,
+        };
+        const hit = await runMiddlewareHandlers(handlers, request, context, 0);
+        if (hit) {
+          await sendWebResponseFrom(creq, cres, hit);
+          return;
+        }
+        return next();
+      } catch (error) {
+        if (cres.headersSent) {
+          return;
+        }
+        cres.statusCode = error instanceof RequestBodyTooLargeError ? 413 : 500;
+        cres.end(
+          error instanceof RequestBodyTooLargeError ? undefined : String(error)
+        );
+      }
+    })();
+  });
+  return handlersPromise;
+};
+
 export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (
   options
 ) => {
@@ -640,15 +697,6 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (
             opts.actionPath,
             opts.actionSameOrigin
           );
-          return async () => {
-            try {
-              await loadRouter();
-            } catch (error) {
-              server.config.logger.error(
-                `oxidejs: failed to prewarm actions: ${String(error)}`
-              );
-            }
-          };
         }
 
         // Register both the production-middleware bridge and /__oxide/action
@@ -656,65 +704,17 @@ export const unpluginFactory: UnpluginFactory<OxidejsOptions | undefined> = (
         // middleware modules is async; the bridge awaits that on first use.
         // Deferring `middlewares.use` until after `ssrLoadModule` used to put
         // actions behind Vite's catch-all → empty 404 on POST /__oxide/action.
-        let handlersPromise: Promise<MwHandler[]> = Promise.resolve([]);
-
-        if (
-          opts &&
-          ((opts.middleware?.length ?? 0) > 0 ||
-            (opts.imports?.length ?? 0) > 0)
-        ) {
-          handlersPromise = loadDevMiddlewareHandlers(server, opts);
-
-          server.middlewares.use((creq, cres, next) => {
-            // Don't touch /__oxide/action — reading the body here would empty the
-            // Node stream before the action middleware runs.
-            if (
-              matchesActionPath(
-                (creq.url ?? "").split("?")[0] ?? "",
-                opts.actionPath
-              )
-            ) {
-              return next();
-            }
-            void (async () => {
-              try {
-                const handlers = await handlersPromise;
-                if (handlers.length === 0) {
-                  return next();
-                }
-                const request = await nodeToWebRequest(creq, opts.bodyLimit);
-                const context: MiddlewareContext = {
-                  ctx: undefined,
-                  env: opts.env,
-                };
-                const hit = await runMiddlewareHandlers(
-                  handlers,
-                  request,
-                  context,
-                  0
-                );
-                if (hit) {
-                  await sendWebResponseFrom(creq, cres, hit);
-                  return;
-                }
-                return next();
-              } catch (error) {
-                if (cres.headersSent) {
-                  return;
-                }
-                cres.statusCode =
-                  error instanceof RequestBodyTooLargeError ? 413 : 500;
-                cres.end(
-                  error instanceof RequestBodyTooLargeError
-                    ? undefined
-                    : String(error)
-                );
-              }
-            })();
-          });
-        }
+        const handlersPromise = opts
+          ? attachDevMiddlewareBridge(
+              // SAFETY: ViteDevServer exposes ssrLoadModule, logger, and Connect middlewares.
+              server as never,
+              opts
+            )
+          : Promise.resolve([]);
 
-        wireActions();
+        if (opts?.actions !== "ws") {
+          wireActions();
+        }
 
         // Prewarm the SSR action router (and production middleware imports)
         // before Vite prints "ready", so the first client hydration RPC does
diff --git a/packages/oxidejs/src/rpc/client.ts b/packages/oxidejs/src/rpc/client.ts
index 1ce2a4b..0ec7bb0 100644
--- a/packages/oxidejs/src/rpc/client.ts
+++ b/packages/oxidejs/src/rpc/client.ts
@@ -84,13 +84,30 @@ const isStringPropertyKey = function isStringPropertyKey(
   return typeof key === "string";
 };
 
+interface ActionHeaderMap {
+  [key: string]: string;
+}
+
+const normalizeActionHeaders = function normalizeActionHeaders(
+  headers: OxidejsActionHeaders
+): ActionHeaderMap {
+  if (Array.isArray(headers)) {
+    const out: ActionHeaderMap = {};
+    for (const [key, value] of headers) {
+      out[key] = value;
+    }
+    return out;
+  }
+  return headers;
+};
+
 const cacheKey = function cacheKey(
   group: ActionGroup,
   options: RpcClientOptions
 ) {
   let headerKey = "";
   if (options.headers) {
-    const entries = Object.entries(options.headers);
+    const entries = Object.entries(normalizeActionHeaders(options.headers));
     // oxlint-disable-next-line unicorn/no-array-sort -- Array#toSorted needs ES2023 lib; entries is already a copy
     entries.sort(([a], [b]) => a.localeCompare(b));
     headerKey = entries.map(([k, v]) => `${k}=${v}`).join("&");
@@ -117,11 +134,12 @@ const httpLayer = function httpLayer(options: RpcClientOptions) {
     );
   }
 
+  const headerMap = normalizeActionHeaders(headers);
   return RpcClient.layerProtocolHttp({
     transformClient: <E, R>(client: HttpClient.HttpClient.With<E, R>) =>
       HttpClient.mapRequest(client, (req) => {
         let next = req;
-        for (const [key, value] of Object.entries(headers)) {
+        for (const [key, value] of Object.entries(headerMap)) {
           next = HttpClientRequest.setHeader(next, key, value);
         }
         return next;
@@ -198,15 +216,18 @@ const streamToAsyncGenerator = function streamToAsyncGenerator<T>(
     signal?.addEventListener("abort", onAbort, { once: true });
 
     const pull = async function* pull(): AsyncGenerator<T> {
-      if (signal?.aborted) {
-        throw new DOMException("Aborted", "AbortError");
-      }
-      const next = await iterator.next();
-      if (next.done) {
-        return;
+      for (;;) {
+        if (signal?.aborted) {
+          throw new DOMException("Aborted", "AbortError");
+        }
+        // Sequential iterator pull — must await each step before the next.
+        // oxlint-disable-next-line eslint/no-await-in-loop -- async iterator is ordered
+        const next = await iterator.next();
+        if (next.done) {
+          return;
+        }
+        yield next.value;
       }
-      yield next.value;
-      yield* pull();
     };
 
     try {
diff --git a/packages/oxidejs/src/rpc/test-harness.ts b/packages/oxidejs/src/rpc/test-harness.ts
index 32deb21..b371630 100644
--- a/packages/oxidejs/src/rpc/test-harness.ts
+++ b/packages/oxidejs/src/rpc/test-harness.ts
@@ -6,15 +6,25 @@ import { generateActionsModule, scanServerFiles } from "../actions";
 const RPC_MODULE = path.join(import.meta.dir, "index.ts");
 const OXIDE_RUNTIME = path.join(import.meta.dir, "../context.ts");
 
+export interface WriteGeneratedActionsOptions {
+  code?: string;
+  oxideRuntime?: string;
+  rpcModule?: string;
+}
+
 export const writeGeneratedActions = function writeGeneratedActions(
-  root: string
+  root: string,
+  opts: WriteGeneratedActionsOptions = {}
 ) {
   const out = path.join(root, "actions.mjs");
+  const source = opts.code ?? generateActionsModule(scanServerFiles(root));
+  const rpcModule = opts.rpcModule ?? RPC_MODULE;
+  const oxideRuntime = opts.oxideRuntime ?? OXIDE_RUNTIME;
   fs.writeFileSync(
     out,
-    generateActionsModule(scanServerFiles(root))
-      .replaceAll("oxidejs/rpc", RPC_MODULE)
-      .replaceAll('from "oxidejs"', `from ${JSON.stringify(OXIDE_RUNTIME)}`)
+    source
+      .replaceAll("oxidejs/rpc", rpcModule)
+      .replaceAll('from "oxidejs"', `from ${JSON.stringify(oxideRuntime)}`)
   );
   return out;
 };
diff --git a/packages/oxidejs/src/rpc/ws.ts b/packages/oxidejs/src/rpc/ws.ts
index 0baa747..d216a7c 100644
--- a/packages/oxidejs/src/rpc/ws.ts
+++ b/packages/oxidejs/src/rpc/ws.ts
@@ -105,24 +105,27 @@ const sendNdjsonFrames = async function sendNdjsonFrames(
   signal.addEventListener("abort", onAbort, { once: true });
 
   const pump = async function pump(): Promise<void> {
-    if (signal.aborted) {
-      return;
-    }
-    const { done, value } = await reader.read();
-    if (done) {
-      return;
-    }
-    pending += decoder.decode(value, { stream: true });
-    let nl = pending.indexOf("\n");
-    while (nl !== -1) {
-      const line = pending.slice(0, nl);
-      pending = pending.slice(nl + 1);
-      if (line.length > 0 && !signal.aborted) {
-        peer.send(`${line}\n`);
+    for (;;) {
+      if (signal.aborted) {
+        return;
+      }
+      // Sequential stream pull — must await each chunk before the next.
+      // oxlint-disable-next-line eslint/no-await-in-loop -- body must be drained in order
+      const { done, value } = await reader.read();
+      if (done) {
+        return;
+      }
+      pending += decoder.decode(value, { stream: true });
+      let nl = pending.indexOf("\n");
+      while (nl !== -1) {
+        const line = pending.slice(0, nl);
+        pending = pending.slice(nl + 1);
+        if (line.length > 0 && !signal.aborted) {
+          peer.send(`${line}\n`);
+        }
+        nl = pending.indexOf("\n");
       }
-      nl = pending.indexOf("\n");
     }
-    await pump();
   };
 
   try {
diff --git a/packages/oxidejs/virtual.d.ts b/packages/oxidejs/virtual.d.ts
index 3e2f4c0..501af88 100644
--- a/packages/oxidejs/virtual.d.ts
+++ b/packages/oxidejs/virtual.d.ts
@@ -9,7 +9,18 @@ declare module "virtual:oxide/actions" {
 }
 
 declare module "virtual:oxide/client" {
-  type ActionFn = (...args: never[]) => Promise<never>;
+  type ActionValue =
+    | string
+    | number
+    | boolean
+    | null
+    | ActionValue[]
+    | { [key: string]: ActionValue };
+  type ActionFn = (
+    ...args: ActionValue[]
+  ) =>
+    | Promise<ActionValue>
+    | AsyncGenerator<ActionValue, ActionValue | undefined, undefined>;
   type ActionModule = Record<string, ActionFn>;
   export const client: Record<string, ActionModule>;
 }