@solidjs/vite-plugin 3.0.0-next.38 → 3.0.0-next.40

package/dist/esm/index.mjs

@@ -1,11 +1,12 @@
 import * as babel from '@babel/core';
 import remapping from '@ampproject/remapping';
 import solid from '@solidjs/babel-plugin';
-import fs, { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import fs, { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync, realpathSync } from 'fs';
 import { mergeAndConcat } from 'merge-anything';
 import { createRequire } from 'module';
 import path from 'path';
 import { Readable } from 'node:stream';
+import { randomBytes } from 'crypto';
 import { createFilter, normalizePath, loadEnv, runnerImport, transformWithOxc, defaultClientConditions, defaultServerConditions, defaultExternalConditions } from 'vite';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { crawlFrameworkPkgs } from 'vitefu';
@@ -733,6 +734,22 @@ function solidDiagnostics(mode = 'auto') {
     apply(_config, env) {
       return env.command === 'serve' && !env.isPreview && env.mode !== 'test';
     },
+    // The bridge module is virtual and reaches the page behind the
+    // scanner's back (a script injected into index.html at transform time,
+    // or an import the generated start entry adds), so the optimizer never
+    // sees its two package imports up front. Pre-bundle them: otherwise the
+    // first page load discovers them, re-optimizes and full-reloads — a
+    // flash at best, and a broken page whenever anything else on the page
+    // was resolved against the first optimizer pass.
+    config(userConfig) {
+      const rootDir = path.resolve(userConfig.root || process.cwd());
+      if (mode !== true && !detectDiagnosticsPackage(rootDir)) return;
+      return {
+        optimizeDeps: {
+          include: [`${DIAGNOSTICS_PACKAGE}/browser`, `${DIAGNOSTICS_PACKAGE}/protocol`]
+        }
+      };
+    },
     configResolved(config) {
       root = config.root;
       base = config.base;
@@ -1078,29 +1095,50 @@ const HANDLER_ID$1 = 'virtual:solid-server-function-handler';
 // (`vite build` then `vite build --ssr`) does not, so the client build
 // persists its findings for the SSR build to merge (mirroring the plugin's
 // dist/client/.vite/manifest.json convention).
+//
+// The file doubles as the build's statement of which server functions the
+// CLIENT can reach — every reference the client compile emitted, by wire id
+// — for build tooling that needs that set without re-deriving it from
+// compiled output (a static-site prerenderer checking that each reachable
+// function was captured, for example). Paths are root-relative, posix.
 const PERSISTED_MANIFEST_PATH = '.vite/solid-server-functions.json';
+
+/** The persisted manifest's on-disk shape (the array form is the pre-`functions` legacy). */
+
 function readPersistedManifest(root) {
   const file = path.resolve(root, 'dist/client', PERSISTED_MANIFEST_PATH);
   if (!existsSync(file)) return new Set();
   try {
-    const entries = JSON.parse(readFileSync(file, 'utf-8'));
+    const parsed = JSON.parse(readFileSync(file, 'utf-8'));
+    const entries = Array.isArray(parsed) ? parsed : parsed.modules;
     return new Set(entries.map(entry => path.resolve(root, entry)).filter(entry => existsSync(entry)));
   } catch {
     return new Set();
   }
 }
-function writePersistedManifest(root, outDir, entries) {
+function writePersistedManifest(root, outDir, entries, functions) {
   const file = path.resolve(root, outDir, PERSISTED_MANIFEST_PATH);
   mkdirSync(path.dirname(file), {
     recursive: true
   });
-  const relative = [...entries].map(entry => path.relative(root, entry).split(path.sep).join('/'));
-  writeFileSync(file, JSON.stringify(relative, null, 2));
+  const relative = entry => path.relative(root, entry).split(path.sep).join('/');
+  const manifest = {
+    modules: [...entries].map(relative),
+    functions: [...functions].map(([id, record]) => ({
+      id,
+      name: record.name,
+      module: relative(record.module)
+    }))
+  };
+  writeFileSync(file, JSON.stringify(manifest, null, 2));
 }
 function createManifest() {
   return {
-    server: new Set(),
-    client: new Set()
+    modules: {
+      server: new Set(),
+      client: new Set()
+    },
+    clientFunctions: new Map()
   };
 }
 function createDeferredPromise() {
@@ -1208,6 +1246,23 @@ function serverFunctions(options = {}, internal = {}) {
     client: undefined
   };
   let currentServer;
+
+  // THE DEPLOYMENT SECRET (solidjs/solid#3239): the runtime's flash cookie
+  // — the no-JS form outcome — carries the submitted input, so it is
+  // AES-GCM encrypted under a key derived from a deployment-wide secret,
+  // and without one the outcome is withheld entirely. This plugin provides
+  // that secret with zero configuration through the internal
+  // `globalThis.__SOLID_SECRET__ ??=` contract: generated once per plugin
+  // instance, so a production build bakes one value into the emitted server
+  // chunk — every instance of that deployment shares it (a per-process
+  // value would silently lose flashes behind a load balancer) — and a dev
+  // session holds one for its lifetime (a restart invalidates in-flight
+  // flashes, which are 60-second one-shot cookies; the next render just
+  // reads "no flash"). Server output only, never the client graph. The
+  // `??=` keeps an explicit `configureServerFunctionsServer({ secret })` —
+  // or a value injected by an outer harness — authoritative.
+  const deploymentSecret = randomBytes(32).toString('hex');
+  const deploymentSecretSnippet = `globalThis.__SOLID_SECRET__ ??= ${JSON.stringify(deploymentSecret)};`;
   const clientOptions = {
     directive,
     definitions: {
@@ -1267,6 +1322,14 @@ function serverFunctions(options = {}, internal = {}) {
     // import is only emitted when the option is on, so disabled setups keep
     // a server-component-free graph.
     return [
+    // The deployment secret. Imports are hoisted above it, but nothing
+    // reads the global at module evaluation — the runtime resolves it
+    // lazily per encode/decode — so leading textually is just the honest
+    // placement. This module is loaded before any dispatch on both
+    // surfaces, and the generated SSR handler imports it at module load,
+    // so the secret is in place for the flash's encode (the form POST)
+    // and its decode (the render that follows the redirect) alike.
+    deploymentSecretSnippet,
     // The user's `configure` module comes first: a side-effect import in
     // the handler graph, evaluated before any dispatch on both surfaces
     // (dev middleware and prod handler) and bundled into the handler
@@ -1308,13 +1371,13 @@ function serverFunctions(options = {}, internal = {}) {
   const hashIndex = new Map();
   let hashIndexSize = -1;
   function moduleForFunctionId(functionId) {
-    if (manifest.server.size !== hashIndexSize) {
+    if (manifest.modules.server.size !== hashIndexSize) {
       hashIndex.clear();
-      for (const entry of manifest.server) {
+      for (const entry of manifest.modules.server) {
         const relative = path.relative(root, entry).split(path.sep).join('/');
         hashIndex.set(xxHash32(relative).toString(16), entry);
       }
-      hashIndexSize = manifest.server.size;
+      hashIndexSize = manifest.modules.server.size;
     }
     return hashIndex.get(functionId.split('-')[1]);
   }
@@ -1438,9 +1501,25 @@ function serverFunctions(options = {}, internal = {}) {
       sourceMap: !tsrx || !!internal.tsrxSourceMap
     });
     if (!result.valid) return null;
+
+    // The client compile is the authority on what the browser can dispatch:
+    // record every reference it emitted, by wire id, for the persisted
+    // manifest. A module is re-transformed on change, so its previous ids
+    // are dropped first (a renamed function must not linger as reachable).
+    if (mode === 'client') {
+      for (const [functionId, record] of manifest.clientFunctions) {
+        if (record.module === id) manifest.clientFunctions.delete(functionId);
+      }
+      for (const fn of result.functions) {
+        manifest.clientFunctions.set(fn.id, {
+          name: fn.name,
+          module: id
+        });
+      }
+    }
     const preloader = preload[mode];
     if (preloader) preloader.defer();
-    invalidateModules(currentServer, mergeManifestRecord(manifest.server, new Set([id])), manifestId);
+    invalidateModules(currentServer, mergeManifestRecord(manifest.modules.server, new Set([id])), manifestId);
     return {
       // Appended (not prepended) so the source map for the compiled module
       // stays valid; imports hoist and the endpoint is only read at call time.
@@ -1488,7 +1567,7 @@ function serverFunctions(options = {}, internal = {}) {
         // build discovered so the server manifest registers them even when
         // the SSR module graph never imports them.
         for (const entry of readPersistedManifest(root)) {
-          manifest.server.add(entry);
+          manifest.modules.server.add(entry);
         }
       }
     },
@@ -1503,7 +1582,7 @@ function serverFunctions(options = {}, internal = {}) {
       const consumer = ctx.environment?.config?.consumer;
       const isClient = consumer ? consumer === 'client' : !isSsrBuild;
       if (isBuild && isClient) {
-        writePersistedManifest(root, outDir, manifest.server);
+        writePersistedManifest(root, outDir, manifest.modules.server, manifest.clientFunctions);
       }
     }
   }, {
@@ -1528,10 +1607,10 @@ function serverFunctions(options = {}, internal = {}) {
           // configs resolve before the client build has written the file,
           // but this load runs once the SSR environment builds — after it.
           for (const entry of readPersistedManifest(root)) {
-            manifest.server.add(entry);
+            manifest.modules.server.add(entry);
           }
         }
-        const current = new Debouncer(() => [...manifest[mode]].map(entry => `import ${JSON.stringify(entry)};`).join('\n'));
+        const current = new Debouncer(() => [...manifest.modules[mode]].map(entry => `import ${JSON.stringify(entry)};`).join('\n'));
         preload[mode] = current;
         const result = await current.promise.reference;
         return result;
@@ -1580,6 +1659,11 @@ function devtoolsMountModuleCode() {
 //   it, and page responses go through the runtime's `createSSRResponse`
 //   head lifecycle (commit at shell flush, real pre-flush redirects, the
 //   script fallback post-flush).
+// - `start.renderMode` decides how a page render becomes a body: `'stream'`
+//   (default) flushes the shell with fallbacks and streams boundaries in
+//   behind it; `'async'` awaits the settled document (no fallbacks or swap
+//   scripts — complete for no-JS clients); a module path decides per
+//   request, and `handleRequest(request, { renderMode })` overrides both.
 // - `vite preview` serves dist/client statically and dispatches everything
 //   else through the built handler — the production path, middleware
 //   included, with no server file needed.
@@ -1655,6 +1739,37 @@ function normalizeUserPath(root, spec, option) {
   }
   return relative;
 }
+/**
+ * Resolves `start.renderMode` at config time: a literal mode, or the
+ * absolute path of a per-request module (`mode` stays the `'stream'`
+ * default then; the module decides per request). Anything else is a
+ * config error with the fix in the message — an unknown literal is far
+ * more likely a typo than a file, so the message names both readings.
+ */
+function resolveRenderMode(root, value) {
+  if (value === undefined) return {
+    mode: 'stream',
+    path: null
+  };
+  // (`string & {}` keeps editor completion for the literals; TS cannot
+  // narrow it away by equality, hence the assertion.)
+  if (value === 'stream' || value === 'async') return {
+    mode: value,
+    path: null
+  };
+  const usage = `start.renderMode must be 'stream' (the default), 'async', or the path of a module ` + `(relative to the Vite root) default-exporting a per-request function ` + `((event) => 'stream' | 'async' | Promise<...>)`;
+  if (typeof value !== 'string') {
+    throw new Error(`[@solidjs/vite-plugin] ${usage}; got ${typeof value}. A Vite config cannot serialize a ` + `closure into the generated handler — put the function in a module (e.g. ` + `./src/render-mode.ts) and pass its path instead.`);
+  }
+  const absolute = path.isAbsolute(value) ? value : path.resolve(root, value);
+  if (!existsSync(absolute)) {
+    throw new Error(`[@solidjs/vite-plugin] ${usage}; got ${JSON.stringify(value)}, which is neither a mode ` + `nor an existing file.`);
+  }
+  return {
+    mode: 'stream',
+    path: path.resolve(root, normalizeUserPath(root, value, 'renderMode'))
+  };
+}
 function resolveEntries(root, options, clientMode) {
   const explicitClient = options.entryClient ? normalizeUserPath(root, options.entryClient, 'entryClient') : null;
   if (clientMode) {
@@ -1747,8 +1862,11 @@ function startServe(options, internal = {}) {
   // any of the (lazy) uses in entry codegen and the entry transform.
   let diagnostics = internal.diagnostics === true;
   let devtoolsEnabled = false;
-  let devtoolsResolutions = {};
-  let devtoolsIds = {};
+  // Toolbar detection, memoized per consumer: whether @solidjs/start-devtools
+  // resolves at all, and the app importer it was probed from. Only the
+  // verdict is kept — the resolved id is deliberately not (see resolveId).
+  let devtoolsDetections = {};
+  let devtoolsImporters = {};
   // `external` is server-mode-only (documented no-op in client mode, so a
   // host-integrated config survives the `ssr` boolean flip untouched).
   const externalServer = !clientMode && !!options.external;
@@ -1760,31 +1878,45 @@ function startServe(options, internal = {}) {
   let middlewarePath = null;
   /** Absolute path of the per-request setup module, when configured (server mode). */
   let setupPath = null;
+  /**
+   * `start.renderMode`, resolved at config time: the static mode baked into
+   * the handler, or the absolute path of the per-request module deciding it
+   * (server mode only — a documented no-op in client mode, whose shell has
+   * no boundaries to settle).
+   */
+  let renderMode = 'stream';
+  let renderModePath = null;
   function requireEntries() {
     // config() always runs before resolveId/load/configureServer.
     if (!entries) throw new Error('[@solidjs/vite-plugin] SSR entries not resolved yet');
     return entries;
   }
+  /**
+   * Resolve @solidjs/start-devtools for generated code: from the app graph
+   * first (the documented install location), then from the plugin's own
+   * file — in pnpm-isolated apps a copy that is only a dependency of the
+   * plugin is not reachable from the app's importers. Resolving from the
+   * plugin's own file never yields null when the package is absent: it is
+   * declared an optional peer dependency, so Vite answers with its
+   * `__vite-optional-peer-dep:` stub (an empty module). That stub counts as
+   * "not installed".
+   */
+  async function resolveDevtoolsId(resolve, importer) {
+    const realId = resolved => resolved && !resolved.id.startsWith('__vite-optional-peer-dep:') ? resolved.id : null;
+    return realId(await resolve(DEVTOOLS_PACKAGE, importer)) ?? realId(await resolve(DEVTOOLS_PACKAGE, fileURLToPath(import.meta.url)));
+  }
   async function resolveDevtools(resolve, importer, consumer) {
     if (!devtoolsEnabled) return false;
-    // Detect from the app graph first (the documented install location), then
-    // from the plugin's own file: in pnpm-isolated apps a copy that is only a
-    // dependency of the plugin is not reachable from the app's importers. The
-    // resolved id is kept so imports from generated modules can use it.
-    devtoolsResolutions[consumer] ??= (async () => {
-      // Resolving from the plugin's own file never yields null when the
-      // package is absent: it is declared an optional peer dependency, so
-      // Vite answers with its `__vite-optional-peer-dep:` stub (an empty
-      // module). Treat that stub as "not installed".
-      const realId = resolved => resolved && !resolved.id.startsWith('__vite-optional-peer-dep:') ? resolved.id : null;
-      return realId(await resolve(DEVTOOLS_PACKAGE, importer)) ?? realId(await resolve(DEVTOOLS_PACKAGE, fileURLToPath(import.meta.url)));
-    })();
-    const id = await devtoolsResolutions[consumer];
-    devtoolsIds[consumer] = id;
-    if (!id && options.devtools === true) {
+    // An install cannot change under a running server, so the verdict is
+    // memoized per consumer. The id it was reached with is not reused for
+    // generated imports: resolveId resolves afresh from the same importer.
+    devtoolsImporters[consumer] ??= importer;
+    devtoolsDetections[consumer] ??= resolveDevtoolsId(resolve, importer).then(id => id !== null);
+    const detected = await devtoolsDetections[consumer];
+    if (!detected && options.devtools === true) {
       throw new Error('[@solidjs/vite-plugin] start.devtools requires @solidjs/start-devtools. ' + 'Install it as a development dependency or set start.devtools to false.');
     }
-    return id !== null;
+    return detected;
   }
 
   /**
@@ -1959,7 +2091,7 @@ function startServe(options, internal = {}) {
       entryClient
     } = requireEntries();
     const composeServerFunctions = internal.serverFunctions;
-    const lines = [`import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`, `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`, `import * as entry from ${JSON.stringify(entryServerSpec())};`, ...(middlewarePath ? [`import middlewareModule from ${JSON.stringify(middlewarePath)};`] : []), ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []), ...(composeServerFunctions ? [`import { handleServerFunctionRequest, endpoint } from ${JSON.stringify(SERVER_FUNCTION_HANDLER_ID)};`] : [])];
+    const lines = [`import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`, `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`, `import * as entry from ${JSON.stringify(entryServerSpec())};`, ...(middlewarePath ? [`import middlewareModule from ${JSON.stringify(middlewarePath)};`] : []), ...(renderModePath ? [`import renderModeModule from ${JSON.stringify(renderModePath)};`] : []), ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []), ...(composeServerFunctions ? [`import { handleServerFunctionRequest, endpoint } from ${JSON.stringify(SERVER_FUNCTION_HANDLER_ID)};`] : [])];
     if (isBuild) {
       lines.push(`import manifest from ${JSON.stringify(MANIFEST_ID)};`);
       lines.push(``, `function joinAssetPath(base, file) {`, `  if (typeof base !== 'string' || !base) base = '/';`, `  if (base[base.length - 1] !== '/') base += '/';`, `  return base + (file[0] === '/' ? file.slice(1) : file);`, `}`, ``, `let clientEntryUrl;`, `function resolveClientEntry() {`, `  if (clientEntryUrl !== undefined) return clientEntryUrl;`, `  clientEntryUrl = null;`,
@@ -1981,6 +2113,21 @@ function startServe(options, internal = {}) {
       lines.push(`const runMiddleware = (request, next) => next(request);`);
     }
 
+    // Render mode (`start.renderMode`): 'stream' flushes the shell with
+    // fallbacks in place and streams boundary content after it; 'async'
+    // adopts the renderToStream result's thenable — which waits for the
+    // complete render — so one settled document goes out (the fix for
+    // no-JS clients, solidjs/solid#3280). Precedence per request: the
+    // `handleRequest` option (hosts driving the handler directly), then the
+    // configured module's per-request result, then the static config. Every
+    // source is validated against the two literals with the offender named.
+    lines.push(``, `function assertRenderMode(mode, source) {`, `  if (mode !== 'stream' && mode !== 'async') {`, `    throw new Error('[@solidjs/vite-plugin] ' + source + " must be 'stream' or 'async', got " + JSON.stringify(mode));`, `  }`, `  return mode;`, `}`);
+    if (renderModePath) {
+      lines.push(`if (typeof renderModeModule !== 'function') {`, `  throw new Error('[@solidjs/vite-plugin] start.renderMode must default-export a function ' +`, `    "((event) => 'stream' | 'async' | Promise<...>): " + ${JSON.stringify(renderModePath)});`, `}`, `async function resolveRenderMode(event, options) {`, `  if (options.renderMode !== undefined) return assertRenderMode(options.renderMode, 'handleRequest options.renderMode');`, `  return assertRenderMode(await renderModeModule(event), 'the start.renderMode module (' + ${JSON.stringify(renderModePath)} + ') result');`, `}`);
+    } else {
+      lines.push(`function resolveRenderMode(event, options) {`, `  if (options.renderMode !== undefined) return assertRenderMode(options.renderMode, 'handleRequest options.renderMode');`, `  return ${JSON.stringify(renderMode)};`, `}`);
+    }
+
     // No `_$SC` bootstrap injection: the runtime's serialized
     // server-component references self-bootstrap the registry (each
     // hydration script's first reference carries it as an idempotent
@@ -2061,7 +2208,11 @@ function startServe(options, internal = {}) {
       // flag, so external-host dispatch and preview stay render-always.
       lines.push(`  if (options.pageRequest === false) {`, `    return new Response(null, { status: 404, headers: { ${JSON.stringify(DEV_FALLTHROUGH_HEADER)}: '1' } });`, `  }`);
     }
-    lines.push(isBuild ? `  const clientEntry = options.clientEntry || resolveClientEntry();` : `  const clientEntry = options.clientEntry || ${JSON.stringify(devClientEntryUrl())};`, `  let result = entry.render(request, { clientEntry, ...options.context });`,
+    lines.push(isBuild ? `  const clientEntry = options.clientEntry || resolveClientEntry();` : `  const clientEntry = options.clientEntry || ${JSON.stringify(devClientEntryUrl())};`,
+    // Decided before the render starts (the module form may be async),
+    // inside the request scope and after the middleware chain, so a
+    // per-request policy sees the decorated event.
+    `  const renderMode = await resolveRenderMode(event, options);`, `  let result = entry.render(request, { clientEntry, ...options.context });`,
     // renderToStream results are thenables whose then() waits for the
     // *complete* render — check for pipe first so streaming survives, and
     // only await plain promises (async render functions).
@@ -2070,6 +2221,14 @@ function startServe(options, internal = {}) {
     // entry): a bare promise resolution would adopt the stream's
     // thenable and buffer the whole render.
     `  if (result && result.${STREAM_BOX}) result = result.${STREAM_BOX};`] : []),
+    // Async mode adopts the thenable deliberately — the very thing the
+    // pipe-first check and the setup box exist to avoid in stream mode.
+    // It resolves with the full HTML once every boundary settled, each
+    // spliced in place pre-flush (no fallbacks, no swap scripts; hydration
+    // data still serialized), and the string then takes
+    // createSSRResponse's string path below: stub commit, transformChunk
+    // on the whole document, and a mid-render Location as a real 3xx.
+    `  if (renderMode === 'async' && result && typeof result.then === 'function') {`, `    result = await result;`, `  }`,
     // Raw Responses fold at the handler edge (handleRequest), after the
     // middleware chain unwinds — not here, where middleware above this
     // frame could still legitimately mutate headers.
@@ -2108,8 +2267,8 @@ function startServe(options, internal = {}) {
     config(userConfig, env) {
       root = path.resolve(userConfig.root || process.cwd());
       devtoolsEnabled = env.command === 'serve' && !env.isPreview && options.devtools !== false;
-      devtoolsResolutions = {};
-      devtoolsIds = {};
+      devtoolsDetections = {};
+      devtoolsImporters = {};
       entries = resolveEntries(root, options, clientMode);
       internal.onDocumentResolved?.(entries.document);
       middlewarePath = options.middleware ? path.resolve(root, normalizeUserPath(root, options.middleware, 'middleware')) : null;
@@ -2121,6 +2280,17 @@ function startServe(options, internal = {}) {
         // hook needs does not exist there.
         throw new Error('[@solidjs/vite-plugin] start.setup only applies to generated entries: your ' + 'entry-server owns render() already, so call your setup step there instead ' + `(remove start.setup or the authored entry): ${options.setup}`);
       }
+      // Server-mode only as well: the client-mode shell renders no app,
+      // so there is nothing to settle. Validated in every mode though —
+      // a typo should not hide behind the `ssr` boolean.
+      ({
+        mode: renderMode,
+        path: renderModePath
+      } = resolveRenderMode(root, options.renderMode));
+      if (clientMode) {
+        renderMode = 'stream';
+        renderModePath = null;
+      }
       if (env.isPreview) {
         if (clientMode) {
           // Client-mode builds emit a real dist/client/index.html (the
@@ -2262,7 +2432,7 @@ function startServe(options, internal = {}) {
         diagnostics = detectDiagnosticsPackage(root);
       }
     },
-    resolveId(source, importer, opts) {
+    async resolveId(source, importer, opts) {
       if (source === HANDLER_ID) {
         return {
           id: HANDLER_ID,
@@ -2287,13 +2457,25 @@ function startServe(options, internal = {}) {
           moduleSideEffects: true
         };
       }
-      // Generated modules have no directory for bare-package resolution.
-      // Reuse the app-relative id captured during detection.
-      const devtoolsId = devtoolsIds[getEnvironmentConsumer(this.environment, opts)];
-      if (devtoolsId && source === DEVTOOLS_PACKAGE && (importer === ENTRY_SERVER_ID || importer === ENTRY_CLIENT_ID || importer === DEVTOOLS_MOUNT_ID)) {
-        return {
-          id: devtoolsId
-        };
+      if (source === DEVTOOLS_PACKAGE && (importer === ENTRY_SERVER_ID || importer === ENTRY_CLIENT_ID || importer === DEVTOOLS_MOUNT_ID)) {
+        // Generated modules have no directory for bare-package resolution:
+        // resolve from the app importer detection probed. Resolve afresh on
+        // every request rather than reusing detection's id — in the client
+        // environment that id is the optimizer's pre-bundled URL, stamped
+        // with the browserHash of the pass that produced it. Any dependency
+        // discovered after the initial scan re-optimizes: the toolbar's
+        // chunks are re-emitted under new names and the hash moves on, and
+        // a frozen id would keep the entry on the previous pass — its lazy
+        // chunks answer 504 (Outdated Optimize Dep) and the stale bundle
+        // brings a second solid-js instance into the page.
+        const from = devtoolsImporters[getEnvironmentConsumer(this.environment, opts)];
+        if (!from) return null;
+        const id = await resolveDevtoolsId((s, i) => this.resolve(s, i, {
+          skipSelf: true
+        }), from);
+        return id ? {
+          id
+        } : null;
       }
       return null;
     },
@@ -3345,7 +3527,69 @@ function combineSourcemaps(maps) {
   // remapping expects most-recent-first.
   return JSON.parse(remapping(chain.reverse(), () => null).toString());
 }
+function toPosixPath(p) {
+  return p.split(path.sep).join('/');
+}
+function tryRealpath(p) {
+  try {
+    return realpathSync.native(p);
+  } catch {
+    return null;
+  }
+}
+
+/** The `input` a build environment's config resolves to, in any spelling. */
+function configuredBuildInput(build) {
+  if (!build) return undefined;
+  return build.rolldownOptions?.input ?? build.rollupOptions?.input ?? build.lib?.entry;
+}
 
+/**
+ * The genuine entries of a client build, derived from its configured input
+ * (`build.rollupOptions.input` as a string / array / record, or Vite's
+ * default `index.html`). Rollup and rolldown only ever flag two kinds of
+ * chunk `isEntry`: those facades and chunks plugins emit with
+ * `emitFile({ type: 'chunk' })` — so this is exactly the knowledge that
+ * tells a real application entry apart from an emitted lazy facade.
+ *
+ * `moduleIds` — every spelling the entry's facade module id can take: as
+ * written (virtual ids resolve to themselves), resolved against the root
+ * (Vite resolves relative file inputs there), and the real path of either
+ * (Vite's resolver follows symlinks).
+ * `manifestKeys` — the manifest.json keys Vite derives from those facades
+ * (root-relative, `\0` stripped), matching Vite's own `getChunkName`.
+ */
+function resolveConfiguredEntries(input, root) {
+  const raw = input == null ? ['index.html'] : typeof input === 'string' ? [input] : Array.isArray(input) ? input : Object.values(input);
+  const moduleIds = new Set();
+  for (const id of raw) {
+    if (typeof id !== 'string') continue;
+    const clean = id.replace(/\0/g, '');
+    const candidates = [clean, path.resolve(root, clean)];
+    for (const candidate of candidates) {
+      moduleIds.add(candidate);
+      moduleIds.add(toPosixPath(candidate));
+      const real = tryRealpath(candidate);
+      if (real) {
+        moduleIds.add(real);
+        moduleIds.add(toPosixPath(real));
+      }
+    }
+  }
+  const manifestKeys = new Set();
+  for (const id of moduleIds) manifestKeys.add(toPosixPath(path.relative(root, id)));
+  return {
+    moduleIds,
+    manifestKeys,
+    isEntryModule(id) {
+      if (!id) return false;
+      const clean = id.replace(/\0/g, '');
+      if (moduleIds.has(clean) || moduleIds.has(toPosixPath(clean))) return true;
+      const real = tryRealpath(clean);
+      return !!real && (moduleIds.has(real) || moduleIds.has(toPosixPath(real)));
+    }
+  };
+}
 /**
  * Chunks emitted for lazy() targets are marked `isEntry` by Rollup even
  * though they are semantically dynamic entries. Reclassify any entry that is
@@ -3354,18 +3598,57 @@ function combineSourcemaps(maps) {
  * the real client entry. Works on both the Vite manifest.json shape and the
  * raw Rollup output bundle — both key entries by name and expose
  * `dynamicImports` / `isEntry` with the same meaning.
+ *
+ * Being a dynamic-import target alone does not make a chunk a lazy facade,
+ * though: the real client entry becomes one whenever it absorbs a module
+ * that is also dynamically imported somewhere else. Solid 2 produces that
+ * shape on its own — `@solidjs/web/frames/client` lazily imports the
+ * serialization decoder (`loadCodec()`), so a static import of
+ * `@solidjs/web/serialization/decode` anywhere in the client graph merges
+ * the decoder into the entry chunk, and the entry then lists itself (or is
+ * listed by another lazy chunk) under `dynamicImports`. Stripping `isEntry`
+ * there leaves the bundle with no entry at all ("No entry file found"
+ * downstream, e.g. TanStack Start's manifest capture, #342). Genuine
+ * configured entries are therefore never reclassified, and a chunk's
+ * dynamic import of itself is not an edge worth acting on.
+ *
+ * Rolldown caveat: of the flags written here only `isEntry` is synced back
+ * to the native bundle after the hook (rolldown's `update_output_chunk`
+ * copies `code`, `map`, `imports`, `dynamicImports`, `isEntry` and the file
+ * name; `isDynamicEntry` is kept from the original chunk). Later plugins
+ * and Vite's manifest plugin therefore see reclassified facades as neither
+ * entry nor dynamic entry under rolldown. The manifest `load` path repairs
+ * `isDynamicEntry` on the plugin's own manifest module, the one place it
+ * controls end to end.
  */
-function normalizeEmittedLazyEntries(manifest) {
-  const dynamicKeys = new Set();
+function normalizeEmittedLazyEntries(manifest, {
+  isConfiguredEntry,
+  knownLazyKeys,
+  warn,
+  repairDynamicEntries
+}) {
+  const dynamicKeys = new Map();
   for (const key in manifest) {
     const imports = manifest[key].dynamicImports;
-    if (imports) for (const dep of imports) dynamicKeys.add(dep);
+    if (!imports) continue;
+    for (const dep of imports) {
+      // A chunk that absorbed one of its own lazy targets imports itself;
+      // that says nothing about whether it is an entry.
+      if (dep !== key && !dynamicKeys.has(dep)) dynamicKeys.set(dep, key);
+    }
   }
-  for (const key of dynamicKeys) {
+  for (const [key, importer] of dynamicKeys) {
     const entry = manifest[key];
-    if (entry && entry.isEntry) {
+    if (!entry || entry.type === 'asset') continue;
+    if (isConfiguredEntry(key, entry)) continue;
+    if (entry.isEntry) {
       entry.isEntry = false;
       entry.isDynamicEntry = true;
+      if (warn && !knownLazyKeys?.has(key)) {
+        warn(`[@solidjs/vite-plugin] Reclassified the entry chunk "${key}" as a dynamic entry ` + `because "${importer}" dynamically imports it and it does not match a configured ` + `build input. If "${key}" is the application entry, its chunk absorbed a module ` + 'that is also imported dynamically elsewhere (for example a static import of ' + '"@solidjs/web/serialization/decode" alongside Solid\'s own lazy import of it); ' + 'list the entry in `build.rollupOptions.input` so the plugin can recognize it.');
+      }
+    } else if (repairDynamicEntries && !entry.isDynamicEntry) {
+      entry.isDynamicEntry = true;
     }
   }
 }
@@ -3427,6 +3710,11 @@ function solidPlugin(options = {}) {
   let isSsrBuild = false;
   let base = '/';
   let clientOutDir = null;
+  // The client environment's resolved build options, for the configured
+  // entry input. Read off the resolved config so the SSR half of a
+  // two-invocation build (`vite build --ssr`) still knows the client's
+  // entries when it bakes the client manifest in.
+  let clientBuildConfig = null;
   let solidPkgsConfig;
   const tsrxCss = new Map();
 
@@ -3732,6 +4020,29 @@ function solidPlugin(options = {}) {
       // So the dev flag has to reach both lists.
       if (replaceDev && config.consumer !== 'client' && name !== 'client') {
         config.resolve.externalConditions = ['development', ...(config.resolve.externalConditions ?? defaultExternalConditions)];
+
+        // `externalConditions` only reaches the imports the module runner
+        // resolves itself. An externalized package's OWN imports are resolved
+        // by Node, with Node's conditions — never `development`. Since
+        // solid 2.0.0-rc.7 both `solid-js` and `@solidjs/web` ship a
+        // `dist/server.dev.*` behind that condition, so leaving them external
+        // splits the framework in two under `vite dev`: the app's `solid-js`
+        // is the runner's dev copy while `@solidjs/web`'s `import "solid-js"`
+        // lands on Node's prod copy. `renderToStream` then installs the asset
+        // resolver on one `sharedConfig` and `lazy()` reads the other ("no
+        // asset manifest is set"), with every other module-level singleton
+        // (owner tracking, request events, hydration keys) split the same
+        // way. Inlining the two core packages makes every resolution — theirs
+        // included — go through the environment's conditions, so one dev
+        // build is loaded end to end. Framework packages that declare the
+        // `solid` export condition are already inlined via vitefu below and
+        // reach the same copy. Vitest projects manage their own inlining
+        // (`test.server.deps` above) and are left alone, as is a host that
+        // set `noExternal: true` (everything is inlined already).
+        if (!isTestMode && config.resolve.noExternal !== true) {
+          const noExternal = config.resolve.noExternal;
+          config.resolve.noExternal = [...(Array.isArray(noExternal) ? noExternal : noExternal ? [noExternal] : []), 'solid-js', '@solidjs/web'];
+        }
       }
 
       // Set resolve.noExternal and resolve.external for the SSR environment.
@@ -3748,6 +4059,7 @@ function solidPlugin(options = {}) {
       isSsrBuild = !!config.build.ssr;
       base = config.base;
       projectRoot = config.root;
+      clientBuildConfig = config.environments?.client?.build ?? config.build;
       filter = createFilter(options.include, options.exclude, {
         resolve: projectRoot
       });
@@ -3881,7 +4193,23 @@ function solidPlugin(options = {}) {
         const manifestPath = clientManifestPath();
         if (manifestPath) {
           const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
-          normalizeEmittedLazyEntries(manifest);
+          // Manifest records are keyed the way Vite keys entry chunks (the
+          // root-relative facade path, also carried as `src`), so the
+          // configured client inputs identify the genuine entries here too —
+          // independent of `isEntry`, which the serialized manifest may have
+          // lost already (older plugin builds stripped it; see #342).
+          const entries = resolveConfiguredEntries(configuredBuildInput(clientBuildConfig), projectRoot);
+          const isConfiguredEntry = (key, record) => entries.manifestKeys.has(key) || typeof record.src === 'string' && entries.manifestKeys.has(record.src);
+          for (const key in manifest) {
+            if (isConfiguredEntry(key, manifest[key]) && manifest[key].file) {
+              manifest[key].isEntry = true;
+            }
+          }
+          normalizeEmittedLazyEntries(manifest, {
+            isConfiguredEntry,
+            warn: message => this.warn(message),
+            repairDynamicEntries: true
+          });
           manifest._base = base;
           return `export default ${JSON.stringify(manifest)};`;
         }
@@ -3898,6 +4226,12 @@ function solidPlugin(options = {}) {
       // the bundle don't mistake them for application entries. Must precede
       // the client asset map build, which keys off dynamic entries.
       if (options.ssr) {
+        // The genuine entries are the configured inputs of this very
+        // environment — the plugin injects the client entry itself in start
+        // mode, and Vite's default is index.html — so their facade chunks
+        // are recognizable regardless of what dynamically imports them.
+        const entries = resolveConfiguredEntries(configuredBuildInput(this.environment?.config?.build ?? clientBuildConfig), projectRoot);
+        const knownLazyKeys = new Set();
         for (const ref of emittedLazyChunkRefs) {
           let fileName;
           try {
@@ -3908,10 +4242,17 @@ function solidPlugin(options = {}) {
           }
           const chunk = bundle[fileName];
           if (!chunk || chunk.type !== 'chunk') continue;
+          // An entry that is also lazily imported stays an entry.
+          if (entries.isEntryModule(chunk.facadeModuleId)) continue;
+          knownLazyKeys.add(fileName);
           chunk.isEntry = false;
           chunk.isDynamicEntry = true;
         }
-        normalizeEmittedLazyEntries(bundle);
+        normalizeEmittedLazyEntries(bundle, {
+          isConfiguredEntry: (_key, chunk) => entries.isEntryModule(chunk.facadeModuleId),
+          knownLazyKeys,
+          warn: message => this.warn(message)
+        });
       }
     },
     async transform(source, id, transformOptions) {