@solidjs/vite-plugin 3.0.0-next.39 → 3.0.0-next.41

package/dist/cjs/index.cjs

@@ -10,6 +10,7 @@ var mergeAnything = require('merge-anything');
 var module$1 = require('module');
 var path = require('path');
 var node_stream = require('node:stream');
+var crypto = require('crypto');
 var vite = require('vite');
 var node_url = require('node:url');
 var vitefu = require('vitefu');
@@ -757,6 +758,22 @@ function solidDiagnostics(mode = 'auto') {
     apply(_config, env) {
       return env.command === 'serve' && !env.isPreview && env.mode !== 'test';
     },
+    // The bridge module is virtual and reaches the page behind the
+    // scanner's back (a script injected into index.html at transform time,
+    // or an import the generated start entry adds), so the optimizer never
+    // sees its two package imports up front. Pre-bundle them: otherwise the
+    // first page load discovers them, re-optimizes and full-reloads — a
+    // flash at best, and a broken page whenever anything else on the page
+    // was resolved against the first optimizer pass.
+    config(userConfig) {
+      const rootDir = path.resolve(userConfig.root || process.cwd());
+      if (mode !== true && !detectDiagnosticsPackage(rootDir)) return;
+      return {
+        optimizeDeps: {
+          include: [`${DIAGNOSTICS_PACKAGE}/browser`, `${DIAGNOSTICS_PACKAGE}/protocol`]
+        }
+      };
+    },
     configResolved(config) {
       root = config.root;
       base = config.base;
@@ -1253,6 +1270,23 @@ function serverFunctions(options = {}, internal = {}) {
     client: undefined
   };
   let currentServer;
+
+  // THE DEPLOYMENT SECRET (solidjs/solid#3239): the runtime's flash cookie
+  // — the no-JS form outcome — carries the submitted input, so it is
+  // AES-GCM encrypted under a key derived from a deployment-wide secret,
+  // and without one the outcome is withheld entirely. This plugin provides
+  // that secret with zero configuration through the internal
+  // `globalThis.__SOLID_SECRET__ ??=` contract: generated once per plugin
+  // instance, so a production build bakes one value into the emitted server
+  // chunk — every instance of that deployment shares it (a per-process
+  // value would silently lose flashes behind a load balancer) — and a dev
+  // session holds one for its lifetime (a restart invalidates in-flight
+  // flashes, which are 60-second one-shot cookies; the next render just
+  // reads "no flash"). Server output only, never the client graph. The
+  // `??=` keeps an explicit `configureServerFunctionsServer({ secret })` —
+  // or a value injected by an outer harness — authoritative.
+  const deploymentSecret = crypto.randomBytes(32).toString('hex');
+  const deploymentSecretSnippet = `globalThis.__SOLID_SECRET__ ??= ${JSON.stringify(deploymentSecret)};`;
   const clientOptions = {
     directive,
     definitions: {
@@ -1312,6 +1346,14 @@ function serverFunctions(options = {}, internal = {}) {
     // import is only emitted when the option is on, so disabled setups keep
     // a server-component-free graph.
     return [
+    // The deployment secret. Imports are hoisted above it, but nothing
+    // reads the global at module evaluation — the runtime resolves it
+    // lazily per encode/decode — so leading textually is just the honest
+    // placement. This module is loaded before any dispatch on both
+    // surfaces, and the generated SSR handler imports it at module load,
+    // so the secret is in place for the flash's encode (the form POST)
+    // and its decode (the render that follows the redirect) alike.
+    deploymentSecretSnippet,
     // The user's `configure` module comes first: a side-effect import in
     // the handler graph, evaluated before any dispatch on both surfaces
     // (dev middleware and prod handler) and bundled into the handler
@@ -1641,6 +1683,11 @@ function devtoolsMountModuleCode() {
 //   it, and page responses go through the runtime's `createSSRResponse`
 //   head lifecycle (commit at shell flush, real pre-flush redirects, the
 //   script fallback post-flush).
+// - `start.renderMode` decides how a page render becomes a body: `'stream'`
+//   (default) flushes the shell with fallbacks and streams boundaries in
+//   behind it; `'async'` awaits the settled document (no fallbacks or swap
+//   scripts — complete for no-JS clients); a module path decides per
+//   request, and `handleRequest(request, { renderMode })` overrides both.
 // - `vite preview` serves dist/client statically and dispatches everything
 //   else through the built handler — the production path, middleware
 //   included, with no server file needed.
@@ -1716,6 +1763,37 @@ function normalizeUserPath(root, spec, option) {
   }
   return relative;
 }
+/**
+ * Resolves `start.renderMode` at config time: a literal mode, or the
+ * absolute path of a per-request module (`mode` stays the `'stream'`
+ * default then; the module decides per request). Anything else is a
+ * config error with the fix in the message — an unknown literal is far
+ * more likely a typo than a file, so the message names both readings.
+ */
+function resolveRenderMode(root, value) {
+  if (value === undefined) return {
+    mode: 'stream',
+    path: null
+  };
+  // (`string & {}` keeps editor completion for the literals; TS cannot
+  // narrow it away by equality, hence the assertion.)
+  if (value === 'stream' || value === 'async') return {
+    mode: value,
+    path: null
+  };
+  const usage = `start.renderMode must be 'stream' (the default), 'async', or the path of a module ` + `(relative to the Vite root) default-exporting a per-request function ` + `((event) => 'stream' | 'async' | Promise<...>)`;
+  if (typeof value !== 'string') {
+    throw new Error(`[@solidjs/vite-plugin] ${usage}; got ${typeof value}. A Vite config cannot serialize a ` + `closure into the generated handler — put the function in a module (e.g. ` + `./src/render-mode.ts) and pass its path instead.`);
+  }
+  const absolute = path.isAbsolute(value) ? value : path.resolve(root, value);
+  if (!fs.existsSync(absolute)) {
+    throw new Error(`[@solidjs/vite-plugin] ${usage}; got ${JSON.stringify(value)}, which is neither a mode ` + `nor an existing file.`);
+  }
+  return {
+    mode: 'stream',
+    path: path.resolve(root, normalizeUserPath(root, value, 'renderMode'))
+  };
+}
 function resolveEntries(root, options, clientMode) {
   const explicitClient = options.entryClient ? normalizeUserPath(root, options.entryClient, 'entryClient') : null;
   if (clientMode) {
@@ -1808,8 +1886,11 @@ function startServe(options, internal = {}) {
   // any of the (lazy) uses in entry codegen and the entry transform.
   let diagnostics = internal.diagnostics === true;
   let devtoolsEnabled = false;
-  let devtoolsResolutions = {};
-  let devtoolsIds = {};
+  // Toolbar detection, memoized per consumer: whether @solidjs/start-devtools
+  // resolves at all, and the app importer it was probed from. Only the
+  // verdict is kept — the resolved id is deliberately not (see resolveId).
+  let devtoolsDetections = {};
+  let devtoolsImporters = {};
   // `external` is server-mode-only (documented no-op in client mode, so a
   // host-integrated config survives the `ssr` boolean flip untouched).
   const externalServer = !clientMode && !!options.external;
@@ -1821,31 +1902,45 @@ function startServe(options, internal = {}) {
   let middlewarePath = null;
   /** Absolute path of the per-request setup module, when configured (server mode). */
   let setupPath = null;
+  /**
+   * `start.renderMode`, resolved at config time: the static mode baked into
+   * the handler, or the absolute path of the per-request module deciding it
+   * (server mode only — a documented no-op in client mode, whose shell has
+   * no boundaries to settle).
+   */
+  let renderMode = 'stream';
+  let renderModePath = null;
   function requireEntries() {
     // config() always runs before resolveId/load/configureServer.
     if (!entries) throw new Error('[@solidjs/vite-plugin] SSR entries not resolved yet');
     return entries;
   }
+  /**
+   * Resolve @solidjs/start-devtools for generated code: from the app graph
+   * first (the documented install location), then from the plugin's own
+   * file — in pnpm-isolated apps a copy that is only a dependency of the
+   * plugin is not reachable from the app's importers. Resolving from the
+   * plugin's own file never yields null when the package is absent: it is
+   * declared an optional peer dependency, so Vite answers with its
+   * `__vite-optional-peer-dep:` stub (an empty module). That stub counts as
+   * "not installed".
+   */
+  async function resolveDevtoolsId(resolve, importer) {
+    const realId = resolved => resolved && !resolved.id.startsWith('__vite-optional-peer-dep:') ? resolved.id : null;
+    return realId(await resolve(DEVTOOLS_PACKAGE, importer)) ?? realId(await resolve(DEVTOOLS_PACKAGE, node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)))));
+  }
   async function resolveDevtools(resolve, importer, consumer) {
     if (!devtoolsEnabled) return false;
-    // Detect from the app graph first (the documented install location), then
-    // from the plugin's own file: in pnpm-isolated apps a copy that is only a
-    // dependency of the plugin is not reachable from the app's importers. The
-    // resolved id is kept so imports from generated modules can use it.
-    devtoolsResolutions[consumer] ??= (async () => {
-      // Resolving from the plugin's own file never yields null when the
-      // package is absent: it is declared an optional peer dependency, so
-      // Vite answers with its `__vite-optional-peer-dep:` stub (an empty
-      // module). Treat that stub as "not installed".
-      const realId = resolved => resolved && !resolved.id.startsWith('__vite-optional-peer-dep:') ? resolved.id : null;
-      return realId(await resolve(DEVTOOLS_PACKAGE, importer)) ?? realId(await resolve(DEVTOOLS_PACKAGE, node_url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)))));
-    })();
-    const id = await devtoolsResolutions[consumer];
-    devtoolsIds[consumer] = id;
-    if (!id && options.devtools === true) {
+    // An install cannot change under a running server, so the verdict is
+    // memoized per consumer. The id it was reached with is not reused for
+    // generated imports: resolveId resolves afresh from the same importer.
+    devtoolsImporters[consumer] ??= importer;
+    devtoolsDetections[consumer] ??= resolveDevtoolsId(resolve, importer).then(id => id !== null);
+    const detected = await devtoolsDetections[consumer];
+    if (!detected && options.devtools === true) {
       throw new Error('[@solidjs/vite-plugin] start.devtools requires @solidjs/start-devtools. ' + 'Install it as a development dependency or set start.devtools to false.');
     }
-    return id !== null;
+    return detected;
   }
 
   /**
@@ -2020,13 +2115,17 @@ function startServe(options, internal = {}) {
       entryClient
     } = requireEntries();
     const composeServerFunctions = internal.serverFunctions;
-    const lines = [`import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`, `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`, `import * as entry from ${JSON.stringify(entryServerSpec())};`, ...(middlewarePath ? [`import middlewareModule from ${JSON.stringify(middlewarePath)};`] : []), ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []), ...(composeServerFunctions ? [`import { handleServerFunctionRequest, endpoint } from ${JSON.stringify(SERVER_FUNCTION_HANDLER_ID)};`] : [])];
+    const lines = [`import { createRequestEvent, createSSRResponse, commitEventResponse${middlewarePath ? ', composeMiddleware' : ''} } from '@solidjs/web';`, `import { provideRequestEvent } from ${JSON.stringify(STORAGE_SOURCE)};`, `import * as entry from ${JSON.stringify(entryServerSpec())};`, ...(middlewarePath ? [`import middlewareModule from ${JSON.stringify(middlewarePath)};`] : []), ...(renderModePath ? [`import renderModeModule from ${JSON.stringify(renderModePath)};`] : []), ...(externalDev ? [`import DEV_STYLES_HEAD from ${JSON.stringify(DEV_STYLES_ID)};`] : []), ...(composeServerFunctions ? [`import { handleServerFunctionRequest, endpoint } from ${JSON.stringify(SERVER_FUNCTION_HANDLER_ID)};`] : [])];
     if (isBuild) {
       lines.push(`import manifest from ${JSON.stringify(MANIFEST_ID)};`);
       lines.push(``, `function joinAssetPath(base, file) {`, `  if (typeof base !== 'string' || !base) base = '/';`, `  if (base[base.length - 1] !== '/') base += '/';`, `  return base + (file[0] === '/' ? file.slice(1) : file);`, `}`, ``, `let clientEntryUrl;`, `function resolveClientEntry() {`, `  if (clientEntryUrl !== undefined) return clientEntryUrl;`, `  clientEntryUrl = null;`,
-      // The plugin's manifest module normalizes lazy facade chunks
-      // (isDynamicEntry) so exactly one real entry remains flagged.
-      `  for (const key in manifest) {`, `    const chunk = manifest[key];`, `    if (chunk && chunk.isEntry && chunk.file) {`, `      clientEntryUrl = joinAssetPath(manifest._base, chunk.file);`, `      break;`, `    }`, `  }`, `  return clientEntryUrl;`, `}`);
+      // The plugin's manifest module names the client entry it injected
+      // into the build (`_entry`): every configured input is a genuine
+      // `isEntry` record (a filesystem router's `buildInputs` lists every
+      // route module), so scanning for the first flagged record would pick
+      // whichever sorts first (#353). The scan stays as the fallback for
+      // hand-rolled manifests without the stamp.
+      `  const stamped = manifest._entry && manifest[manifest._entry];`, `  if (stamped && stamped.file) {`, `    return (clientEntryUrl = joinAssetPath(manifest._base, stamped.file));`, `  }`, `  for (const key in manifest) {`, `    const chunk = manifest[key];`, `    if (chunk && chunk.isEntry && chunk.file) {`, `      clientEntryUrl = joinAssetPath(manifest._base, chunk.file);`, `      break;`, `    }`, `  }`, `  return clientEntryUrl;`, `}`);
     } else {
       const devHead = `<script>${devStylePatch}</script>` + `<script type="module" src="${joinBase(base, '/@vite/client')}"></script>`;
       lines.push(``, `const DEV_HEAD = ${JSON.stringify(devHead)};`);
@@ -2042,6 +2141,21 @@ function startServe(options, internal = {}) {
       lines.push(`const runMiddleware = (request, next) => next(request);`);
     }
 
+    // Render mode (`start.renderMode`): 'stream' flushes the shell with
+    // fallbacks in place and streams boundary content after it; 'async'
+    // adopts the renderToStream result's thenable — which waits for the
+    // complete render — so one settled document goes out (the fix for
+    // no-JS clients, solidjs/solid#3280). Precedence per request: the
+    // `handleRequest` option (hosts driving the handler directly), then the
+    // configured module's per-request result, then the static config. Every
+    // source is validated against the two literals with the offender named.
+    lines.push(``, `function assertRenderMode(mode, source) {`, `  if (mode !== 'stream' && mode !== 'async') {`, `    throw new Error('[@solidjs/vite-plugin] ' + source + " must be 'stream' or 'async', got " + JSON.stringify(mode));`, `  }`, `  return mode;`, `}`);
+    if (renderModePath) {
+      lines.push(`if (typeof renderModeModule !== 'function') {`, `  throw new Error('[@solidjs/vite-plugin] start.renderMode must default-export a function ' +`, `    "((event) => 'stream' | 'async' | Promise<...>): " + ${JSON.stringify(renderModePath)});`, `}`, `async function resolveRenderMode(event, options) {`, `  if (options.renderMode !== undefined) return assertRenderMode(options.renderMode, 'handleRequest options.renderMode');`, `  return assertRenderMode(await renderModeModule(event), 'the start.renderMode module (' + ${JSON.stringify(renderModePath)} + ') result');`, `}`);
+    } else {
+      lines.push(`function resolveRenderMode(event, options) {`, `  if (options.renderMode !== undefined) return assertRenderMode(options.renderMode, 'handleRequest options.renderMode');`, `  return ${JSON.stringify(renderMode)};`, `}`);
+    }
+
     // No `_$SC` bootstrap injection: the runtime's serialized
     // server-component references self-bootstrap the registry (each
     // hydration script's first reference carries it as an idempotent
@@ -2122,7 +2236,11 @@ function startServe(options, internal = {}) {
       // flag, so external-host dispatch and preview stay render-always.
       lines.push(`  if (options.pageRequest === false) {`, `    return new Response(null, { status: 404, headers: { ${JSON.stringify(DEV_FALLTHROUGH_HEADER)}: '1' } });`, `  }`);
     }
-    lines.push(isBuild ? `  const clientEntry = options.clientEntry || resolveClientEntry();` : `  const clientEntry = options.clientEntry || ${JSON.stringify(devClientEntryUrl())};`, `  let result = entry.render(request, { clientEntry, ...options.context });`,
+    lines.push(isBuild ? `  const clientEntry = options.clientEntry || resolveClientEntry();` : `  const clientEntry = options.clientEntry || ${JSON.stringify(devClientEntryUrl())};`,
+    // Decided before the render starts (the module form may be async),
+    // inside the request scope and after the middleware chain, so a
+    // per-request policy sees the decorated event.
+    `  const renderMode = await resolveRenderMode(event, options);`, `  let result = entry.render(request, { clientEntry, ...options.context });`,
     // renderToStream results are thenables whose then() waits for the
     // *complete* render — check for pipe first so streaming survives, and
     // only await plain promises (async render functions).
@@ -2131,6 +2249,14 @@ function startServe(options, internal = {}) {
     // entry): a bare promise resolution would adopt the stream's
     // thenable and buffer the whole render.
     `  if (result && result.${STREAM_BOX}) result = result.${STREAM_BOX};`] : []),
+    // Async mode adopts the thenable deliberately — the very thing the
+    // pipe-first check and the setup box exist to avoid in stream mode.
+    // It resolves with the full HTML once every boundary settled, each
+    // spliced in place pre-flush (no fallbacks, no swap scripts; hydration
+    // data still serialized), and the string then takes
+    // createSSRResponse's string path below: stub commit, transformChunk
+    // on the whole document, and a mid-render Location as a real 3xx.
+    `  if (renderMode === 'async' && result && typeof result.then === 'function') {`, `    result = await result;`, `  }`,
     // Raw Responses fold at the handler edge (handleRequest), after the
     // middleware chain unwinds — not here, where middleware above this
     // frame could still legitimately mutate headers.
@@ -2169,8 +2295,8 @@ function startServe(options, internal = {}) {
     config(userConfig, env) {
       root = path.resolve(userConfig.root || process.cwd());
       devtoolsEnabled = env.command === 'serve' && !env.isPreview && options.devtools !== false;
-      devtoolsResolutions = {};
-      devtoolsIds = {};
+      devtoolsDetections = {};
+      devtoolsImporters = {};
       entries = resolveEntries(root, options, clientMode);
       internal.onDocumentResolved?.(entries.document);
       middlewarePath = options.middleware ? path.resolve(root, normalizeUserPath(root, options.middleware, 'middleware')) : null;
@@ -2182,6 +2308,17 @@ function startServe(options, internal = {}) {
         // hook needs does not exist there.
         throw new Error('[@solidjs/vite-plugin] start.setup only applies to generated entries: your ' + 'entry-server owns render() already, so call your setup step there instead ' + `(remove start.setup or the authored entry): ${options.setup}`);
       }
+      // Server-mode only as well: the client-mode shell renders no app,
+      // so there is nothing to settle. Validated in every mode though —
+      // a typo should not hide behind the `ssr` boolean.
+      ({
+        mode: renderMode,
+        path: renderModePath
+      } = resolveRenderMode(root, options.renderMode));
+      if (clientMode) {
+        renderMode = 'stream';
+        renderModePath = null;
+      }
       if (env.isPreview) {
         if (clientMode) {
           // Client-mode builds emit a real dist/client/index.html (the
@@ -2212,6 +2349,7 @@ function startServe(options, internal = {}) {
       }
       const build = env.command === 'build';
       const clientInput = entries.generated ? ENTRY_CLIENT_ID : path.resolve(root, entries.entryClient);
+      internal.onClientEntryResolved?.(clientInput);
       // Real files only — the dep scanner can't crawl virtual modules.
       // (In client mode the resolved document joins the scan/style roots
       // even with an authored client entry; in SSR mode authored entries
@@ -2323,7 +2461,7 @@ function startServe(options, internal = {}) {
         diagnostics = detectDiagnosticsPackage(root);
       }
     },
-    resolveId(source, importer, opts) {
+    async resolveId(source, importer, opts) {
       if (source === HANDLER_ID) {
         return {
           id: HANDLER_ID,
@@ -2348,13 +2486,25 @@ function startServe(options, internal = {}) {
           moduleSideEffects: true
         };
       }
-      // Generated modules have no directory for bare-package resolution.
-      // Reuse the app-relative id captured during detection.
-      const devtoolsId = devtoolsIds[getEnvironmentConsumer(this.environment, opts)];
-      if (devtoolsId && source === DEVTOOLS_PACKAGE && (importer === ENTRY_SERVER_ID || importer === ENTRY_CLIENT_ID || importer === DEVTOOLS_MOUNT_ID)) {
-        return {
-          id: devtoolsId
-        };
+      if (source === DEVTOOLS_PACKAGE && (importer === ENTRY_SERVER_ID || importer === ENTRY_CLIENT_ID || importer === DEVTOOLS_MOUNT_ID)) {
+        // Generated modules have no directory for bare-package resolution:
+        // resolve from the app importer detection probed. Resolve afresh on
+        // every request rather than reusing detection's id — in the client
+        // environment that id is the optimizer's pre-bundled URL, stamped
+        // with the browserHash of the pass that produced it. Any dependency
+        // discovered after the initial scan re-optimizes: the toolbar's
+        // chunks are re-emitted under new names and the hash moves on, and
+        // a frozen id would keep the entry on the previous pass — its lazy
+        // chunks answer 504 (Outdated Optimize Dep) and the stale bundle
+        // brings a second solid-js instance into the page.
+        const from = devtoolsImporters[getEnvironmentConsumer(this.environment, opts)];
+        if (!from) return null;
+        const id = await resolveDevtoolsId((s, i) => this.resolve(s, i, {
+          skipSelf: true
+        }), from);
+        return id ? {
+          id
+        } : null;
       }
       return null;
     },
@@ -3305,6 +3455,23 @@ function getExtension(filename) {
   const index = filename.lastIndexOf('.');
   return index < 0 ? '' : filename.substring(index).replace(/\?.+$/, '');
 }
+// The packages whose dev/production server builds are selected by the
+// `development` export condition. A dependency on either means the package
+// consumes the runtime and must resolve it through Vite in dev.
+const SOLID_RUNTIME_PKGS = ['solid-js', '@solidjs/web'];
+
+// Tooling that declares solid-js as a peer but never runs inside the SSR
+// module runner. Kept out of the crawl entirely: classifying them as
+// semi-framework would also crawl THEIR dependencies, which vitefu deep-
+// includes in the client optimizer (`@solidjs/vite-plugin > @babel/core`
+// pre-bundled for the browser — ~2.6 MB of dead weight per cold start).
+// Mirrors vite-plugin-svelte's isCommonDepWithoutSvelteField list.
+const NON_RUNTIME_SOLID_PKGS = ['@solidjs/vite-plugin', 'vite', 'vitest', 'eslint-plugin-solid'];
+const NON_RUNTIME_SOLID_PREFIXES = ['vite-plugin-', 'eslint-plugin-', 'prettier-plugin-', '@types/'];
+function isNonRuntimeSolidPkg(name) {
+  const bare = name.slice(name.lastIndexOf('/') + 1);
+  return NON_RUNTIME_SOLID_PKGS.includes(name) || NON_RUNTIME_SOLID_PREFIXES.some(p => (p.startsWith('@') ? name : bare).startsWith(p));
+}
 function containsSolidField(fields) {
   const keys = Object.keys(fields);
   for (let i = 0; i < keys.length; i++) {
@@ -3406,7 +3573,69 @@ function combineSourcemaps(maps) {
   // remapping expects most-recent-first.
   return JSON.parse(remapping(chain.reverse(), () => null).toString());
 }
+function toPosixPath(p) {
+  return p.split(path.sep).join('/');
+}
+function tryRealpath(p) {
+  try {
+    return fs.realpathSync.native(p);
+  } catch {
+    return null;
+  }
+}
+
+/** The `input` a build environment's config resolves to, in any spelling. */
+function configuredBuildInput(build) {
+  if (!build) return undefined;
+  return build.rolldownOptions?.input ?? build.rollupOptions?.input ?? build.lib?.entry;
+}
 
+/**
+ * The genuine entries of a client build, derived from its configured input
+ * (`build.rollupOptions.input` as a string / array / record, or Vite's
+ * default `index.html`). Rollup and rolldown only ever flag two kinds of
+ * chunk `isEntry`: those facades and chunks plugins emit with
+ * `emitFile({ type: 'chunk' })` — so this is exactly the knowledge that
+ * tells a real application entry apart from an emitted lazy facade.
+ *
+ * `moduleIds` — every spelling the entry's facade module id can take: as
+ * written (virtual ids resolve to themselves), resolved against the root
+ * (Vite resolves relative file inputs there), and the real path of either
+ * (Vite's resolver follows symlinks).
+ * `manifestKeys` — the manifest.json keys Vite derives from those facades
+ * (root-relative, `\0` stripped), matching Vite's own `getChunkName`.
+ */
+function resolveConfiguredEntries(input, root) {
+  const raw = input == null ? ['index.html'] : typeof input === 'string' ? [input] : Array.isArray(input) ? input : Object.values(input);
+  const moduleIds = new Set();
+  for (const id of raw) {
+    if (typeof id !== 'string') continue;
+    const clean = id.replace(/\0/g, '');
+    const candidates = [clean, path.resolve(root, clean)];
+    for (const candidate of candidates) {
+      moduleIds.add(candidate);
+      moduleIds.add(toPosixPath(candidate));
+      const real = tryRealpath(candidate);
+      if (real) {
+        moduleIds.add(real);
+        moduleIds.add(toPosixPath(real));
+      }
+    }
+  }
+  const manifestKeys = new Set();
+  for (const id of moduleIds) manifestKeys.add(toPosixPath(path.relative(root, id)));
+  return {
+    moduleIds,
+    manifestKeys,
+    isEntryModule(id) {
+      if (!id) return false;
+      const clean = id.replace(/\0/g, '');
+      if (moduleIds.has(clean) || moduleIds.has(toPosixPath(clean))) return true;
+      const real = tryRealpath(clean);
+      return !!real && (moduleIds.has(real) || moduleIds.has(toPosixPath(real)));
+    }
+  };
+}
 /**
  * Chunks emitted for lazy() targets are marked `isEntry` by Rollup even
  * though they are semantically dynamic entries. Reclassify any entry that is
@@ -3415,20 +3644,119 @@ function combineSourcemaps(maps) {
  * the real client entry. Works on both the Vite manifest.json shape and the
  * raw Rollup output bundle — both key entries by name and expose
  * `dynamicImports` / `isEntry` with the same meaning.
+ *
+ * Being a dynamic-import target alone does not make a chunk a lazy facade,
+ * though: the real client entry becomes one whenever it absorbs a module
+ * that is also dynamically imported somewhere else. Solid 2 produces that
+ * shape on its own — `@solidjs/web/frames/client` lazily imports the
+ * serialization decoder (`loadCodec()`), so a static import of
+ * `@solidjs/web/serialization/decode` anywhere in the client graph merges
+ * the decoder into the entry chunk, and the entry then lists itself (or is
+ * listed by another lazy chunk) under `dynamicImports`. Stripping `isEntry`
+ * there leaves the bundle with no entry at all ("No entry file found"
+ * downstream, e.g. TanStack Start's manifest capture, #342). Genuine
+ * configured entries are therefore never reclassified, and a chunk's
+ * dynamic import of itself is not an edge worth acting on.
+ *
+ * Rolldown caveat: of the flags written here only `isEntry` is synced back
+ * to the native bundle after the hook (rolldown's `update_output_chunk`
+ * copies `code`, `map`, `imports`, `dynamicImports`, `isEntry` and the file
+ * name; `isDynamicEntry` is kept from the original chunk). Later plugins
+ * and Vite's manifest plugin therefore see reclassified facades as neither
+ * entry nor dynamic entry under rolldown. The manifest `load` path repairs
+ * `isDynamicEntry` on the plugin's own manifest module, the one place it
+ * controls end to end.
  */
-function normalizeEmittedLazyEntries(manifest) {
-  const dynamicKeys = new Set();
+function normalizeEmittedLazyEntries(manifest, {
+  isConfiguredEntry,
+  knownLazyKeys,
+  warn,
+  repairDynamicEntries
+}) {
+  const dynamicKeys = new Map();
   for (const key in manifest) {
     const imports = manifest[key].dynamicImports;
-    if (imports) for (const dep of imports) dynamicKeys.add(dep);
+    if (!imports) continue;
+    for (const dep of imports) {
+      // A chunk that absorbed one of its own lazy targets imports itself;
+      // that says nothing about whether it is an entry.
+      if (dep !== key && !dynamicKeys.has(dep)) dynamicKeys.set(dep, key);
+    }
   }
-  for (const key of dynamicKeys) {
+  for (const [key, importer] of dynamicKeys) {
     const entry = manifest[key];
-    if (entry && entry.isEntry) {
+    if (!entry || entry.type === 'asset') continue;
+    if (isConfiguredEntry(key, entry)) continue;
+    if (entry.isEntry) {
       entry.isEntry = false;
       entry.isDynamicEntry = true;
+      if (warn && !knownLazyKeys?.has(key)) {
+        warn(`[@solidjs/vite-plugin] Reclassified the entry chunk "${key}" as a dynamic entry ` + `because "${importer}" dynamically imports it and it does not match a configured ` + `build input. If "${key}" is the application entry, its chunk absorbed a module ` + 'that is also imported dynamically elsewhere (for example a static import of ' + '"@solidjs/web/serialization/decode" alongside Solid\'s own lazy import of it); ' + 'list the entry in `build.rollupOptions.input` so the plugin can recognize it.');
+      }
+    } else if (repairDynamicEntries && !entry.isDynamicEntry) {
+      entry.isDynamicEntry = true;
+    }
+  }
+}
+
+/**
+ * The manifest key of THE client entry — the chunk whose `<script
+ * type="module">` boots the page and whose static import graph carries the
+ * global CSS. `isEntry` cannot answer this: every configured build input is
+ * a genuine entry (#347 keeps them flagged), and plugins routinely add more
+ * inputs than the application entry (filesystem-routing's `buildInputs`
+ * lists every route module, and route keys sort ahead of the plugin's own
+ * `virtual:` entry). So the identity comes from configuration instead: the
+ * entry start mode injected itself, or — outside start mode — the single
+ * configured input when there is exactly one (including Vite's default
+ * `index.html`). Several inputs and no start entry: no answer (null), and
+ * consumers keep their first-`isEntry` scan.
+ *
+ * Matched by key or `src`, the same two spellings `isConfiguredEntry` uses.
+ */
+function resolveClientEntryKey(manifest, startClientEntryId, clientBuild, root) {
+  let entryId = startClientEntryId;
+  if (!entryId) {
+    const input = configuredBuildInput(clientBuild);
+    const raw = input == null ? ['index.html'] : typeof input === 'string' ? [input] : Array.isArray(input) ? input : Object.values(input);
+    if (raw.length !== 1 || typeof raw[0] !== 'string') return null;
+    entryId = raw[0];
+  }
+  const {
+    manifestKeys
+  } = resolveConfiguredEntries(entryId, root);
+  for (const key in manifest) {
+    const record = manifest[key];
+    if (!record || typeof record !== 'object' || !record.file) continue;
+    if (manifestKeys.has(key) || typeof record.src === 'string' && manifestKeys.has(record.src)) {
+      return key;
     }
   }
+  return null;
+}
+
+/**
+ * Serializes the plugin's manifest module with the client entry made
+ * explicit: `_entry` names its key (the generated handler reads it before
+ * falling back to scanning for `isEntry`), and its record is moved to the
+ * front. The ordering matters for consumers that still identify the entry
+ * by the first `isEntry` record — `@solidjs/web`'s `registerEntryAssets`,
+ * which links the entry graph's stylesheets and modulepreloads into
+ * `<head>`, and hand-rolled server entries — so they and `_entry` agree on
+ * the same chunk. Other configured inputs keep `isEntry`; they are genuine
+ * entries, just not the one the document boots.
+ */
+function stampClientEntry(manifest, entryKey, base) {
+  const ordered = {};
+  if (entryKey && manifest[entryKey]) {
+    ordered[entryKey] = manifest[entryKey];
+  }
+  for (const key in manifest) {
+    if (key !== entryKey) ordered[key] = manifest[key];
+  }
+  ordered._base = base;
+  if (entryKey && manifest[entryKey]) ordered._entry = entryKey;
+  return ordered;
 }
 function solidPlugin(options = {}) {
   if (typeof options.ssr === 'object') {
@@ -3488,6 +3816,16 @@ function solidPlugin(options = {}) {
   let isSsrBuild = false;
   let base = '/';
   let clientOutDir = null;
+  // The client environment's resolved build options, for the configured
+  // entry input. Read off the resolved config so the SSR half of a
+  // two-invocation build (`vite build --ssr`) still knows the client's
+  // entries when it bakes the client manifest in.
+  let clientBuildConfig = null;
+  // The client entry start mode injects into the client build's input
+  // (reported by startServe): the one input that IS the application entry,
+  // as opposed to further inputs other plugins add (e.g. filesystem-routing's
+  // `buildInputs`, which lists every route module). Null outside start mode.
+  let startClientEntryId = null;
   let solidPkgsConfig;
   const tsrxCss = new Map();
 
@@ -3649,6 +3987,28 @@ function solidPlugin(options = {}) {
         isBuild: command === 'build',
         isFrameworkPkgByJson(pkgJson) {
           return containsSolidField(pkgJson.exports || {});
+        },
+        // `false` = neither framework nor semi-framework, and don't crawl
+        // its deps; `undefined` = unknown, fall through to the json checks.
+        isFrameworkPkgByName(name) {
+          return isNonRuntimeSolidPkg(name) ? false : undefined;
+        },
+        // Under `vite dev` the runtime must not be split in two. Inlined
+        // modules resolve `solid-js` through Vite with `development` (its dev
+        // server build); an externalized package's own imports are resolved by
+        // Node, which has no `development` condition, so it loads the
+        // production build instead. Both then run, each with its own
+        // `sharedConfig` — the manifest `renderToStream` sets lands on one and
+        // `lazy()` reads the other. `resolve.externalConditions` below only
+        // fixes the external's own entry, not what it imports, so every
+        // package that consumes the runtime has to go through Vite as well.
+        // Semi-framework is the right class: `ssr.noExternal` without
+        // `optimizeDeps.exclude`, since these hold no raw Solid components.
+        isSemiFrameworkPkgByJson(pkgJson) {
+          // Same gate as the core inlining in configEnvironment: dev serve
+          // only, never vitest (it manages inlining via test.server.deps).
+          if (!replaceDev || isTestMode) return false;
+          return SOLID_RUNTIME_PKGS.some(name => pkgJson.dependencies?.[name] || pkgJson.peerDependencies?.[name]);
         }
       });
 
@@ -3793,14 +4153,45 @@ function solidPlugin(options = {}) {
       // So the dev flag has to reach both lists.
       if (replaceDev && config.consumer !== 'client' && name !== 'client') {
         config.resolve.externalConditions = ['development', ...(config.resolve.externalConditions ?? vite.defaultExternalConditions)];
+
+        // `externalConditions` only reaches the imports the module runner
+        // resolves itself. An externalized package's OWN imports are resolved
+        // by Node, with Node's conditions — never `development`. Since
+        // solid 2.0.0-rc.7 both `solid-js` and `@solidjs/web` ship a
+        // `dist/server.dev.*` behind that condition, so leaving them external
+        // splits the framework in two under `vite dev`: the app's `solid-js`
+        // is the runner's dev copy while `@solidjs/web`'s `import "solid-js"`
+        // lands on Node's prod copy. `renderToStream` then installs the asset
+        // resolver on one `sharedConfig` and `lazy()` reads the other ("no
+        // asset manifest is set"), with every other module-level singleton
+        // (owner tracking, request events, hydration keys) split the same
+        // way. Inlining the two core packages makes every resolution — theirs
+        // included — go through the environment's conditions, so one dev
+        // build is loaded end to end. Framework packages that declare the
+        // `solid` export condition are already inlined via vitefu below and
+        // reach the same copy. Vitest projects manage their own inlining
+        // (`test.server.deps` above) and are left alone, as is a host that
+        // set `noExternal: true` (everything is inlined already).
+        if (!isTestMode && config.resolve.noExternal !== true) {
+          const noExternal = config.resolve.noExternal;
+          config.resolve.noExternal = [...(Array.isArray(noExternal) ? noExternal : noExternal ? [noExternal] : []), 'solid-js', '@solidjs/web'];
+        }
       }
 
       // Set resolve.noExternal and resolve.external for the SSR environment.
       // Only set resolve.external if noExternal is not true (to avoid conflicts with plugins like Cloudflare)
       if (name === 'ssr' && solidPkgsConfig) {
         if (config.resolve.noExternal !== true) {
-          config.resolve.noExternal = [...(Array.isArray(config.resolve.noExternal) ? config.resolve.noExternal : []), ...solidPkgsConfig.ssr.noExternal];
-          config.resolve.external = [...(Array.isArray(config.resolve.external) ? config.resolve.external : []), ...solidPkgsConfig.ssr.external];
+          const noExternal = [...(Array.isArray(config.resolve.noExternal) ? config.resolve.noExternal : []), ...solidPkgsConfig.ssr.noExternal];
+          config.resolve.noExternal = noExternal;
+          // vitefu externalizes the non-framework deps of every framework
+          // package in dev, and Vite gives `external` precedence over
+          // `noExternal`. A framework package that lists solid-js or
+          // @solidjs/web under `dependencies` (not peer — e.g.
+          // @tanstack/solid-router 2.0.0-rc.7 → @solidjs/web) would therefore
+          // re-externalize a core inlined above and split the runtime again.
+          // Nothing inlined may appear in `external`.
+          config.resolve.external = [...(Array.isArray(config.resolve.external) ? config.resolve.external : []), ...solidPkgsConfig.ssr.external.filter(dep => !noExternal.includes(dep))];
         }
       }
     },
@@ -3809,6 +4200,7 @@ function solidPlugin(options = {}) {
       isSsrBuild = !!config.build.ssr;
       base = config.base;
       projectRoot = config.root;
+      clientBuildConfig = config.environments?.client?.build ?? config.build;
       filter = vite.createFilter(options.include, options.exclude, {
         resolve: projectRoot
       });
@@ -3942,9 +4334,24 @@ function solidPlugin(options = {}) {
         const manifestPath = clientManifestPath();
         if (manifestPath) {
           const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
-          normalizeEmittedLazyEntries(manifest);
-          manifest._base = base;
-          return `export default ${JSON.stringify(manifest)};`;
+          // Manifest records are keyed the way Vite keys entry chunks (the
+          // root-relative facade path, also carried as `src`), so the
+          // configured client inputs identify the genuine entries here too —
+          // independent of `isEntry`, which the serialized manifest may have
+          // lost already (older plugin builds stripped it; see #342).
+          const entries = resolveConfiguredEntries(configuredBuildInput(clientBuildConfig), projectRoot);
+          const isConfiguredEntry = (key, record) => entries.manifestKeys.has(key) || typeof record.src === 'string' && entries.manifestKeys.has(record.src);
+          for (const key in manifest) {
+            if (isConfiguredEntry(key, manifest[key]) && manifest[key].file) {
+              manifest[key].isEntry = true;
+            }
+          }
+          normalizeEmittedLazyEntries(manifest, {
+            isConfiguredEntry,
+            warn: message => this.warn(message),
+            repairDynamicEntries: true
+          });
+          return `export default ${JSON.stringify(stampClientEntry(manifest, resolveClientEntryKey(manifest, startClientEntryId, clientBuildConfig, projectRoot), base))};`;
         }
         // SSR build before the client build produced a manifest: bake in the
         // dev-shaped fallback (registry miss degrades to js-only resolution).
@@ -3959,6 +4366,12 @@ function solidPlugin(options = {}) {
       // the bundle don't mistake them for application entries. Must precede
       // the client asset map build, which keys off dynamic entries.
       if (options.ssr) {
+        // The genuine entries are the configured inputs of this very
+        // environment — the plugin injects the client entry itself in start
+        // mode, and Vite's default is index.html — so their facade chunks
+        // are recognizable regardless of what dynamically imports them.
+        const entries = resolveConfiguredEntries(configuredBuildInput(this.environment?.config?.build ?? clientBuildConfig), projectRoot);
+        const knownLazyKeys = new Set();
         for (const ref of emittedLazyChunkRefs) {
           let fileName;
           try {
@@ -3969,10 +4382,17 @@ function solidPlugin(options = {}) {
           }
           const chunk = bundle[fileName];
           if (!chunk || chunk.type !== 'chunk') continue;
+          // An entry that is also lazily imported stays an entry.
+          if (entries.isEntryModule(chunk.facadeModuleId)) continue;
+          knownLazyKeys.add(fileName);
           chunk.isEntry = false;
           chunk.isDynamicEntry = true;
         }
-        normalizeEmittedLazyEntries(bundle);
+        normalizeEmittedLazyEntries(bundle, {
+          isConfiguredEntry: (_key, chunk) => entries.isEntryModule(chunk.facadeModuleId),
+          knownLazyKeys,
+          warn: message => this.warn(message)
+        });
       }
     },
     async transform(source, id, transformOptions) {
@@ -4243,6 +4663,9 @@ function solidPlugin(options = {}) {
       onDocumentResolved(documentPath) {
         // Normalize to forward slashes to match Vite's transform ids.
         documentModuleId = documentPath ? documentPath.split(path.sep).join('/') : null;
+      },
+      onClientEntryResolved(entryId) {
+        startClientEntryId = entryId;
       }
     }));
   }