Oxide

One Rust core. Every framework.

Install · Features · Architecture · Adapters · CLI · Docs · Status

Note

A demo GIF lands here on tag day. Until then: cargo build --release -p oxide-fw-cli && ./target/release/oxide doctor.

Oxide is a full-stack meta-framework with a Rust core. React, Vue, Svelte and Solid are first-class adapters over one shared engine that owns routing, data, caching, bundling, serving and deployment — so anything framework-neutral behaves identically on all four. The server is a static Rust binary (hyper + rustls); SSR runs in a worker pool of Node ≥ 24 child processes that the binary spawns and supervises. Builds ship to twelve deploy targets.

Install

Prerequisites: Rust stable (edition 2024) to build the CLI, and Node ≥ 24 at runtime (production SSR spawns a Node worker pool by default; server.backend = "v8" embeds V8 but is not yet the production default — see the deviations log).

# Option A — prebuilt binary (recommended)
npm install -g @oxide-fw/cli          # npm wrapper: downloads the release binary, verifies SHA-256
oxide --version

# Option B — from source
cargo install oxide-fw-cli            # or: cargo build --release -p oxide-fw-cli

oxide doctor                     # env check: node, cargo, config, cache, secrets

pnpm create oxide my-app --framework react --template blog
cd my-app
oxide dev                        # dev server with HMR
oxide build                      # production build
oxide start --port 3000          # production server

Prebuilt binaries for linux x64/arm64 (gnu + musl), macOS x64/arm64 and Windows x64 are attached to every GitHub Release with SHA256SUMS, an SBOM and build provenance (.github/workflows/release-binaries.yml). The scaffold adds @oxide-fw/cli as a dependency, so a fresh project needs no global install.

Note

Not yet published to the registries. v0.9.0 is tagged on this repo, but oxide-fw-cli does not yet resolve on crates.io and create-oxide is not on npm yet — build from source (see Building from source). Every command above works the same against ./target/release/oxide.

create-oxide is the separate npm scaffolder (npmjs.com/package/create-oxide).

Features

One engine, four frameworks	One versioned adapter contract (contract: 1). Real streaming SSR is the default; framework libraries are optional peers.
Fast paths skip JS	Redirects, rewrites, headers, auth and rate limits evaluate natively in Rust. oxide.config.ts is statically extracted — the config path never runs JavaScript.
One wire format	ODF is a devalue-compatible binary format encoded in Rust, decoded by a zero-dependency TS module. Date, Map, Set, BigInt survive a cache round trip.
Three-tier cache	L0 in-process, L1 data cache, L2 pluggable remote (Redis, S3, HTTP). Tags, stale-while-revalidate, single-flight, MAC-sealed remote payloads.
Static Rust server + Node SSR pool	hyper 1.x + rustls: HTTP/1.1, HTTP/2, HTTP/3 over QUIC. Precompressed static serving (zstd → brotli → gzip), range requests, zero-downtime reload via SO_REUSEPORT. SSR runs in supervised Node ≥ 24 workers; the embedded-V8 backend is opt-in.
Twelve deploy targets	Binary, Node, Static, Docker, Cloudflare (Workers + Pages), Lambda, Vercel (+ Functions), Netlify, Deno, Bun — behind a capability matrix that refuses at build time what the target cannot honour.

Architecture

request → hyper → limits → static → native rules → route match
        → L0 cache → middleware → loaders → dispatch → streaming SSR

Cached, redirected, rewritten and static answers never enter a JavaScript runtime. Four traits sit between the pipeline and every external engine:

Trait	Purpose
PageRenderer	page module + data → HTML, buffered or streamed
LoaderRunner	run page.server.ts loaders in the layout chain
MiddlewareDispatcher	outer→inner; short-circuit, rewrite, or contribute locals
ActionDispatcher	form POST routed to a named action

Nineteen Rust crates: server (hyper, static, compression, TLS), render (streaming SSR, HTML injection), router (tree, matcher, typegen), cache (three tiers), odf (wire format), compiler (Oxc passes), bundler (rolldown), jshost (V8 + Node), graph (incremental), plugin (Wasm), adapters (deploy), cli, dispatch (V8-free request orchestration), plus assets, config, dev, diagnostics, schema, core-wasm.

Framework adapters

Adapter	Package	Extensions	Peer deps
React	@oxide-fw/react	.tsx	react@^19, react-dom@^19
Vue (preview)	@oxide-fw/vue	.vue	vue@^3.6, @vue/server-renderer@^3.6
Svelte	@oxide-fw/svelte	.svelte	svelte@^5
Solid (preview)	@oxide-fw/solid	.tsx	solid-js@^2, @solidjs/web@^2

Vue and Solid are labelled preview because their peer ranges pin release candidates (vue@^3.6.0-rc, solid-js@^2.0.0-rc). They work, but the RC dependencies can churn under them — pin exact versions in production until the adapters track stable releases.

The loader is framework-neutral. It lives in page.server.ts and returns a plain object; only the component dialect differs:

// src/routes/blog/[slug]/page.server.ts — same for all four adapters
export async function load({ params }) {
  return { post: await getPost(params.slug) }
}

// src/routes/blog/[slug]/page.tsx — React
export default function Post({ data }) {
  return <article><h1>{data.post.title}</h1></article>
}

See examples/smoke-app-{react,vue,svelte,solid} for the four-way comparison.

The CLI

One binary. Grouped by intent:

• Dev loop — oxide dev oxide build oxide start oxide preview
• Inspect — oxide routes oxide analyze oxide why oxide doctor oxide check oxide config oxide render
• Author — oxide generate oxide add oxide migrate oxide schema oxide docs
• Operate — oxide secrets oxide cache oxide audit oxide test oxide mcp oxide perf oxide verify

oxide doctor          # 7 env checks: node, cargo, config, routes, cache, secrets, cookie keys
oxide build --attest  # bundles, prerender, typegen, manifests + dist/attest/ (SBOM, provenance, signature)
oxide verify dist     # canonical form, ed25519 signature (--pubkey), subject digests, --rebuild
oxide routes          # scan routes, infer render modes, emit typegen, print table
oxide mcp             # expose routes, config, audit, graph as MCP tools for agents

Building from source

git clone https://github.com/elcoosp/oxide
cd oxide
cargo build --release -p oxide-fw-cli
./target/release/oxide doctor

Four end-to-end fixtures ship under examples/:

oxide build --root examples/smoke-app-react
oxide start --root examples/smoke-app-react --port 3100

Project status

Pre-alpha. Built against a published specification and audited against it.

Spec compliance	95 / 100 on a 21-section scorecard — every finding public
CI	20 jobs on Linux, macOS, Windows — 17 per pull request; nightly Miri, the release-profile check and smoke-deploy run on schedule/main
Rust	1,904 test functions; clippy-clean at -D warnings with zero #[allow(clippy::*)]
Security	cargo audit exits 0; one advisory suppressed with a reachability analysis

v0.2.0 through v0.9.0 are tagged; the crates.io / npm publication step is still pending. Releases follow a 48-hour / 5-consecutive-green-CI soak rule — see PUBLISHING.md.

Documentation

• docs/spec-v0.1.md — the specification this release implements
• docs/spec-v0.2-draft.md — the working draft for the next release
• docs/architecture.md — how the crates fit together
• docs/deviations.md — every known gap between spec and code
• docs/plugin-compat.md — plugin API surface and Vite/Rollup compatibility
• benchmarks/report.md — the perf table with the deterministic-vs-informational split

Contributing

Read CONTRIBUTING.md — workflow, local gate list (identical to CI), pnpm config model, soak rule.

License

MIT OR Apache-2.0 — see LICENSE.

---

_{Built against the Oxide Technical Specification v0.1}