zudoku 0.77.0 → 0.78.1

package/dist/cli/cli.js

@@ -131,7 +131,7 @@ import { stat } from "node:fs/promises";
 var fileExists;
 var init_file_exists = __esm({
   "src/config/file-exists.ts"() {
-    fileExists = (path28) => stat(path28).then(() => true).catch(() => false);
+    fileExists = (path30) => stat(path30).then(() => true).catch(() => false);
   }
 });
 
@@ -815,6 +815,7 @@ var init_icon_types = __esm({
       "arrows-up-from-line",
       "asterisk",
       "asterisk-square",
+      "astroid",
       "at-sign",
       "atom",
       "audio-lines",
@@ -882,6 +883,7 @@ var init_icon_types = __esm({
       "beer",
       "beer-off",
       "bell",
+      "bell-check",
       "bell-dot",
       "bell-electric",
       "bell-minus",
@@ -903,6 +905,7 @@ var init_icon_types = __esm({
       "birdhouse",
       "bitcoin",
       "blend",
+      "blender",
       "blinds",
       "blocks",
       "bluetooth",
@@ -968,6 +971,7 @@ var init_icon_types = __esm({
       "briefcase-conveyor-belt",
       "briefcase-medical",
       "bring-to-front",
+      "broccoli",
       "brush",
       "brush-cleaning",
       "bubbles",
@@ -1460,6 +1464,7 @@ var init_icon_types = __esm({
       "fold-vertical",
       "folder",
       "folder-archive",
+      "folder-bookmark",
       "folder-check",
       "folder-clock",
       "folder-closed",
@@ -1609,6 +1614,7 @@ var init_icon_types = __esm({
       "heart-off",
       "heart-plus",
       "heart-pulse",
+      "heart-x",
       "heater",
       "helicopter",
       "help-circle",
@@ -1686,6 +1692,7 @@ var init_icon_types = __esm({
       "layers",
       "layers-2",
       "layers-3",
+      "layers-minus",
       "layers-plus",
       "layout",
       "layout-dashboard",
@@ -2094,6 +2101,7 @@ var init_icon_types = __esm({
       "repeat",
       "repeat-1",
       "repeat-2",
+      "repeat-off",
       "replace",
       "replace-all",
       "reply",
@@ -2353,6 +2361,12 @@ var init_icon_types = __esm({
       "stethoscope",
       "sticker",
       "sticky-note",
+      "sticky-note-check",
+      "sticky-note-minus",
+      "sticky-note-off",
+      "sticky-note-plus",
+      "sticky-note-x",
+      "sticky-notes",
       "stone",
       "stop-circle",
       "store",
@@ -2433,6 +2447,7 @@ var init_icon_types = __esm({
       "ticket-x",
       "tickets",
       "tickets-plane",
+      "timeline",
       "timer",
       "timer-off",
       "timer-reset",
@@ -2572,7 +2587,9 @@ var init_icon_types = __esm({
       "waves",
       "waves-arrow-down",
       "waves-arrow-up",
+      "waves-horizontal",
       "waves-ladder",
+      "waves-vertical",
       "waypoints",
       "webcam",
       "webhook",
@@ -2836,6 +2853,16 @@ var init_joinUrl = __esm({
   }
 });
 
+// src/lib/util/url.ts
+import { matchPath } from "react-router";
+var matchesProtectedPattern, matchesAnyProtectedPattern;
+var init_url = __esm({
+  "src/lib/util/url.ts"() {
+    matchesProtectedPattern = (pattern, path30) => matchPath({ path: pattern, end: true }, path30) != null;
+    matchesAnyProtectedPattern = (patterns, path30) => patterns.some((p) => matchesProtectedPattern(p, path30));
+  }
+});
+
 // src/lib/core/ZudokuContext.ts
 import { createNanoEvents } from "nanoevents";
 var normalizeProtectedRoutes;
@@ -2963,7 +2990,10 @@ var init_ZudokuConfig = __esm({
       showVersionSelect: z7.enum(["always", "if-available", "hide"]),
       expandAllTags: z7.boolean(),
       showInfoPage: z7.boolean(),
-      schemaDownload: z7.object({ enabled: z7.boolean() }).partial(),
+      schemaDownload: z7.object({
+        enabled: z7.boolean(),
+        fileName: z7.string().regex(/^[A-Za-z0-9_-]+$/).optional()
+      }).partial(),
       transformExamples: z7.custom(
         (val) => typeof val === "function"
       ),
@@ -3112,7 +3142,7 @@ var init_ZudokuConfig = __esm({
     }).partial();
     DocsConfigSchema = z7.object({
       files: z7.union([z7.string(), z7.array(z7.string())]).transform((val) => typeof val === "string" ? [val] : val).default([DEFAULT_DOCS_FILES]),
-      publishMarkdown: z7.boolean().default(false).describe(
+      publishMarkdown: z7.boolean().default(true).describe(
         "When enabled, generates .md files for each document during build. Access documents at their URL path with .md extension (e.g., /foo/hello.md). Markdown files are generated without frontmatter."
       ),
       defaultOptions: z7.object({
@@ -3214,6 +3244,7 @@ var init_ZudokuConfig = __esm({
         issuer: z7.string(),
         audience: z7.string().optional(),
         scopes: z7.array(z7.string()).optional(),
+        allowInsecureRequests: z7.boolean().optional(),
         redirectToAfterSignUp: z7.string().optional(),
         redirectToAfterSignIn: z7.string().optional(),
         redirectToAfterSignOut: z7.string().optional(),
@@ -3350,6 +3381,9 @@ var init_ZudokuConfig = __esm({
     PlacementPosition = z7.enum(["start", "center", "end"]);
     HeaderConfigSchema = z7.object({
       navigation: HeaderNavigationSchema,
+      themeSwitcher: z7.object({
+        enabled: z7.boolean()
+      }).partial().optional(),
       placements: z7.object({
         navigation: PlacementPosition,
         search: PlacementPosition,
@@ -3589,8 +3623,8 @@ var llms_exports = {};
 __export(llms_exports, {
   generateLlmsTxtFiles: () => generateLlmsTxtFiles
 });
-import { writeFile as writeFile4 } from "node:fs/promises";
-import path19 from "node:path";
+import { writeFile as writeFile5 } from "node:fs/promises";
+import path20 from "node:path";
 import colors6 from "picocolors";
 async function generateLlmsTxtFiles({
   markdownFileInfos,
@@ -3625,7 +3659,7 @@ async function generateLlmsTxtFiles({
       }
     }
     const llmsTxt2 = llmsTxtParts.join("\n");
-    await writeFile4(path19.join(baseOutputDir, "llms.txt"), llmsTxt2, "utf-8");
+    await writeFile5(path20.join(baseOutputDir, "llms.txt"), llmsTxt2, "utf-8");
     console.log(colors6.blue("\u2713 generated llms.txt"));
   }
   if (llmsTxtFull) {
@@ -3650,8 +3684,8 @@ ${info.content}
 `);
     }
     const llmsFull = llmsFullParts.join("\n");
-    await writeFile4(
-      path19.join(baseOutputDir, "llms-full.txt"),
+    await writeFile5(
+      path20.join(baseOutputDir, "llms-full.txt"),
       llmsFull,
       "utf-8"
     );
@@ -3670,11 +3704,12 @@ import { hideBin } from "yargs/helpers";
 import yargs from "yargs/yargs";
 
 // src/cli/build/handler.ts
-import path23 from "node:path";
+import path25 from "node:path";
 
 // src/vite/build.ts
-import { mkdir as mkdir5, readFile as readFile3, rename, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
-import path21 from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { mkdir as mkdir6, readFile as readFile4, rename as rename2, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import path23 from "node:path";
 import { build as esbuild } from "esbuild";
 import { createBuilder } from "vite";
 
@@ -3818,7 +3853,7 @@ import {
 // package.json
 var package_default = {
   name: "zudoku",
-  version: "0.76.0",
+  version: "0.78.0",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -3877,6 +3912,11 @@ var package_default = {
     "./react-query": "./src/lib/core/react-query.ts",
     "./icons": "./src/lib/icons.ts",
     "./vite": "./src/vite/index.ts",
+    "./server": "./src/app/entry.server.tsx",
+    "./server/adapters/lambda": "./src/app/adapters/lambda.ts",
+    "./server/adapters/node": "./src/app/adapters/node.ts",
+    "./server/adapters/vercel": "./src/app/adapters/vercel.ts",
+    "./server/adapters/cloudflare": "./src/app/adapters/cloudflare.ts",
     "./app/*": "./src/app/*",
     "./hooks": "./src/lib/hooks/index.ts",
     "./processors/*": "./src/lib/plugins/openapi/processors/*.ts",
@@ -3896,10 +3936,10 @@ var package_default = {
   },
   dependencies: {
     "@apidevtools/json-schema-ref-parser": "15.3.5",
-    "@base-ui/react": "^1.4.0",
+    "@base-ui/react": "^1.4.1",
     "@envelop/core": "5.5.1",
     "@graphql-typed-document-node/core": "3.2.0",
-    "@hono/node-server": "1.19.13",
+    "@hono/node-server": "2.0.2",
     "@lekoarts/rehype-meta-as-attributes": "3.0.3",
     "@mdx-js/react": "3.1.1",
     "@mdx-js/rollup": "3.1.1",
@@ -3929,7 +3969,8 @@ var package_default = {
     "@radix-ui/react-tooltip": "1.2.8",
     "@radix-ui/react-visually-hidden": "1.2.4",
     "@scalar/openapi-parser": "0.23.13",
-    "@sentry/node": "10.49.0",
+    "@scalar/snippetz": "0.9.6",
+    "@sentry/node": "10.52.0",
     "@shikijs/langs": "4.0.2",
     "@shikijs/rehype": "4.0.2",
     "@shikijs/themes": "4.0.2",
@@ -3942,7 +3983,6 @@ var package_default = {
     "@types/react-dom": "catalog:",
     "@vitejs/plugin-react": "6.0.1",
     "@x0k/json-schema-merge": "1.0.2",
-    "@zudoku/httpsnippet": "10.0.9",
     "@zudoku/react-helmet-async": "2.0.5",
     "@zuplo/mcp": "0.0.32",
     bs58: "6.0.0",
@@ -3957,24 +3997,25 @@ var package_default = {
     "fast-equals": "6.0.0",
     glob: "13.0.6",
     "glob-parent": "6.0.2",
-    graphql: "16.13.2",
+    graphql: "16.14.0",
     "graphql-type-json": "0.3.2",
     "graphql-yoga": "5.18.0",
     "gray-matter": "4.0.3",
     "hast-util-heading-rank": "3.0.0",
     "hast-util-to-jsx-runtime": "2.3.6",
     "hast-util-to-string": "3.0.1",
-    hono: "4.12.14",
+    hono: "4.12.18",
     "http-terminator": "3.2.0",
     "javascript-stringify": "2.1.0",
+    jose: "6.2.2",
     "json-schema-to-typescript-lite": "15.0.0",
     loglevel: "1.9.2",
-    "lucide-react": "1.8.0",
+    "lucide-react": "1.16.0",
     "mdast-util-from-markdown": "2.0.2",
     "mdast-util-mdx": "3.0.0",
     "mdast-util-mdx-jsx": "3.2.0",
     "micromark-extension-mdxjs": "3.0.0",
-    motion: "12.35.1",
+    motion: "12.38.0",
     nanoevents: "9.1.0",
     "next-themes": "0.4.6",
     oauth4webapi: "3.8.5",
@@ -3982,13 +4023,14 @@ var package_default = {
     pagefind: "1.5.2",
     picocolors: "1.1.1",
     piscina: "5.1.4",
-    "posthog-node": "5.26.0",
+    "posthog-node": "5.33.4",
+    "quick-lru": "7.3.0",
     "react-error-boundary": "6.1.1",
-    "react-hook-form": "7.71.2",
+    "react-hook-form": "7.75.0",
     "react-is": "catalog:",
     "react-markdown": "10.1.0",
     "react-router": "7.14.1",
-    "rehype-mdx-import-media": "1.2.0",
+    "rehype-mdx-import-media": "1.4.0",
     "rehype-raw": "7.0.0",
     "rehype-slug": "6.0.0",
     "remark-comment": "1.0.0",
@@ -3997,33 +4039,33 @@ var package_default = {
     "remark-frontmatter": "5.0.0",
     "remark-gfm": "4.0.1",
     "remark-mdx-frontmatter": "5.2.0",
-    semver: "7.7.4",
+    semver: "7.8.0",
     shiki: "4.0.2",
     sitemap: "9.0.1",
     "strip-ansi": "7.2.0",
-    "tailwind-merge": "3.5.0",
-    tailwindcss: "4.2.1",
+    "tailwind-merge": "3.6.0",
+    tailwindcss: "4.3.0",
     "tw-animate-css": "1.4.0",
     unified: "11.0.5",
     "unist-util-visit": "5.1.0",
     vaul: "1.1.2",
     vfile: "6.0.3",
-    vite: "8.0.9",
-    yaml: "2.8.3",
+    vite: "8.0.13",
+    yaml: "2.8.4",
     yargs: "18.0.0",
     zod: "4.3.6",
-    zustand: "5.0.12"
+    zustand: "5.0.13"
   },
   devDependencies: {
-    "@clerk/clerk-js": "^6.7.4",
-    "@graphql-codegen/cli": "6.3.0",
+    "@graphql-codegen/cli": "7.0.0",
     "@inkeep/cxkit-types": "0.5.117",
     "@testing-library/dom": "catalog:",
     "@testing-library/jest-dom": "catalog:",
     "@testing-library/react": "catalog:",
     "@testing-library/user-event": "catalog:",
-    "@types/estree": "1.0.8",
+    "@types/estree": "1.0.9",
     "@types/glob-parent": "5.1.3",
+    "@types/har-format": "^1.2.16",
     "@types/hast": "3.0.4",
     "@types/json-schema": "7.0.15",
     "@types/mdast": "4.0.4",
@@ -4074,6 +4116,46 @@ init_logger();
 init_package_json();
 init_loader();
 init_ZudokuConfig();
+
+// src/lib/manifest.ts
+init_ProtectedRoutesSchema();
+
+// src/lib/authentication/cookies.ts
+var ACCESS_TOKEN_COOKIE = "zudoku-access-token";
+var REFRESH_TOKEN_COOKIE = "zudoku-refresh-token";
+var AUTH_PROFILE_COOKIE = "zudoku-auth-profile";
+
+// src/lib/manifest.ts
+init_joinUrl();
+var PROTECTED_CHUNK_DIR = "_protected";
+var MANIFEST_VERSION = 1;
+var MANIFEST_FILENAME = "zudoku-manifest.json";
+var buildManifest = (config2) => {
+  const protectedRoutes = ProtectedRoutesSchema.parse(config2.protectedRoutes);
+  const routePatterns = protectedRoutes ? Object.keys(protectedRoutes) : [];
+  return {
+    version: MANIFEST_VERSION,
+    basePath: config2.basePath ?? "/",
+    ssrEntry: "server/entry.js",
+    static: {
+      prefixes: [joinUrl(config2.basePath, "assets")]
+    },
+    protected: {
+      chunkPrefix: joinUrl(config2.basePath, PROTECTED_CHUNK_DIR),
+      routePatterns
+    },
+    auth: {
+      sessionEndpoint: joinUrl(config2.basePath, "/__z/auth/session"),
+      cookies: {
+        access: ACCESS_TOKEN_COOKIE,
+        refresh: REFRESH_TOKEN_COOKIE,
+        profile: AUTH_PROFILE_COOKIE
+      }
+    }
+  };
+};
+
+// src/vite/config.ts
 init_joinUrl();
 
 // src/vite/package-root.ts
@@ -4362,7 +4444,20 @@ import {
 var { compareSchemaDefinitions, compareSchemaValues } = createComparator();
 var { mergeArrayOfSchemaDefinitions } = createMerger({
   intersectJson: createIntersector(compareSchemaValues),
-  deduplicateJsonSchemaDef: createDeduplicator(compareSchemaDefinitions)
+  deduplicateJsonSchemaDef: createDeduplicator(compareSchemaDefinitions),
+  // Default mergers throw on incompatible type/enum pairs, which aborts the
+  // whole flatten even when the bad pair is one branch of a pairwise `anyOf`
+  // combination. Union instead.
+  mergers: {
+    type: (a, b) => {
+      if (a === b) return a;
+      const aArr = Array.isArray(a) ? a : [a];
+      const bArr = Array.isArray(b) ? b : [b];
+      const set = /* @__PURE__ */ new Set([...aArr, ...bArr]);
+      return set.size === 1 ? [...set][0] : [...set];
+    },
+    enum: (a, b) => Array.from(/* @__PURE__ */ new Set([...a, ...b]))
+  }
 });
 var shallowAllOfMerge = createShallowAllOfMerge(
   mergeArrayOfSchemaDefinitions
@@ -4406,14 +4501,14 @@ var flattenAllOf = (schema2) => {
 };
 
 // src/lib/util/traverse.ts
-var traverse = (specification, transform, path28 = []) => {
-  const transformed = transform(specification, path28);
+var traverse = (specification, transform, path30 = []) => {
+  const transformed = transform(specification, path30);
   if (typeof transformed !== "object" || transformed === null) {
     return transformed;
   }
   const result = Array.isArray(transformed) ? [] : {};
   for (const [key, value] of Object.entries(transformed)) {
-    const currentPath = [...path28, key];
+    const currentPath = [...path30, key];
     if (Array.isArray(value)) {
       result[key] = value.map(
         (item, index) => typeof item === "object" && item != null ? traverse(item, transform, [...currentPath, index.toString()]) : item
@@ -4432,7 +4527,7 @@ var CIRCULAR_REF = "$[Circular Reference]";
 var SCHEMA_REF_PREFIX = "$ref:";
 
 // src/lib/oas/parser/dereference/resolveRef.ts
-var cache = /* @__PURE__ */ new Map();
+var cache = /* @__PURE__ */ new WeakMap();
 var resolveLocalRef = (schema2, ref) => {
   if (!cache.has(schema2)) {
     cache.set(schema2, /* @__PURE__ */ new Map());
@@ -4441,9 +4536,9 @@ var resolveLocalRef = (schema2, ref) => {
   if (schemaCache?.has(ref)) {
     return schemaCache.get(ref);
   }
-  const path28 = ref.split("/").slice(1);
+  const path30 = ref.split("/").slice(1);
   let current = schema2;
-  for (const segment of path28) {
+  for (const segment of path30) {
     if (!current || typeof current !== "object") {
       current = null;
     }
@@ -4454,7 +4549,7 @@ var resolveLocalRef = (schema2, ref) => {
 };
 
 // src/lib/oas/parser/dereference/index.ts
-var cache2 = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new WeakMap();
 var isIndexableObject = (obj) => obj !== null && typeof obj === "object";
 var dereference = async (schema2, resolvers = []) => {
   if (cache2.has(schema2)) {
@@ -4462,7 +4557,7 @@ var dereference = async (schema2, resolvers = []) => {
   }
   const cloned = structuredClone(schema2);
   const visited = /* @__PURE__ */ new Set();
-  const resolve = async (current, path28) => {
+  const resolve = async (current, path30) => {
     if (isIndexableObject(current)) {
       if (visited.has(current)) {
         return CIRCULAR_REF;
@@ -4470,7 +4565,7 @@ var dereference = async (schema2, resolvers = []) => {
       visited.add(current);
       if (Array.isArray(current)) {
         for (let index = 0; index < current.length; index++) {
-          current[index] = await resolve(current[index], `${path28}/${index}`);
+          current[index] = await resolve(current[index], `${path30}/${index}`);
         }
       } else {
         if ("$ref" in current && typeof current.$ref === "string") {
@@ -4481,13 +4576,13 @@ var dereference = async (schema2, resolvers = []) => {
           for (const resolver of resolvers) {
             const resolved = await resolver($ref);
             if (resolved) {
-              result2 = await resolve(resolved, path28);
+              result2 = await resolve(resolved, path30);
               break;
             }
           }
           if (result2 === void 0) {
             const resolved = await resolveLocalRef(cloned, $ref);
-            result2 = await resolve(resolved, path28);
+            result2 = await resolve(resolved, path30);
           }
           if (hasSiblings) {
             if (result2 === CIRCULAR_REF) {
@@ -4500,7 +4595,7 @@ var dereference = async (schema2, resolvers = []) => {
           return result2;
         }
         for (const key in current) {
-          current[key] = await resolve(current[key], `${path28}/${key}`);
+          current[key] = await resolve(current[key], `${path30}/${key}`);
         }
       }
       visited.delete(current);
@@ -4539,9 +4634,9 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (sub, path28) => {
+  schema2 = traverse(schema2, (sub, path30) => {
     if (sub.example !== void 0) {
-      if (isSchemaPath(path28 ?? [])) {
+      if (isSchemaPath(path30 ?? [])) {
         sub.examples = [sub.example];
       } else {
         sub.examples = {
@@ -4554,11 +4649,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path28) => {
+  schema2 = traverse(schema2, (schema3, path30) => {
     if (schema3.type === "object" && schema3.properties !== void 0) {
-      const parentPath = path28?.slice(0, -1);
+      const parentPath = path30?.slice(0, -1);
       const isMultipart = parentPath?.some((segment, index) => {
-        return segment === "content" && path28?.[index + 1] === "multipart/form-data";
+        return segment === "content" && path30?.[index + 1] === "multipart/form-data";
       });
       if (isMultipart) {
         const entries = Object.entries(schema3.properties);
@@ -4572,8 +4667,8 @@ var upgradeSchema = (schema2) => {
     }
     return schema3;
   });
-  schema2 = traverse(schema2, (schema3, path28) => {
-    if (path28?.includes("content") && path28.includes("application/octet-stream")) {
+  schema2 = traverse(schema2, (schema3, path30) => {
+    if (path30?.includes("content") && path30.includes("application/octet-stream")) {
       return {};
     }
     if (schema3.type === "string" && schema3.format === "binary") {
@@ -4599,11 +4694,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path28) => {
+  schema2 = traverse(schema2, (schema3, path30) => {
     if (schema3.type === "string" && schema3.format === "byte") {
-      const parentPath = path28?.slice(0, -1);
+      const parentPath = path30?.slice(0, -1);
       const contentMediaType = parentPath?.find(
-        (_, index) => path28?.[index - 1] === "content"
+        (_, index) => path30?.[index - 1] === "content"
       );
       return {
         type: "string",
@@ -4615,7 +4710,7 @@ var upgradeSchema = (schema2) => {
   });
   return schema2;
 };
-function isSchemaPath(path28) {
+function isSchemaPath(path30) {
   const schemaLocations = [
     ["components", "schemas"],
     "properties",
@@ -4628,10 +4723,10 @@ function isSchemaPath(path28) {
   ];
   return schemaLocations.some((location) => {
     if (Array.isArray(location)) {
-      return location.every((segment, index) => path28[index] === segment);
+      return location.every((segment, index) => path30[index] === segment);
     }
-    return path28.includes(location);
-  }) || path28.includes("schema") || path28.some((segment) => segment.endsWith("Schema"));
+    return path30.includes(location);
+  }) || path30.includes("schema") || path30.some((segment) => segment.endsWith("Schema"));
 }
 
 // src/lib/oas/parser/index.ts
@@ -4651,7 +4746,7 @@ var parseSchemaInput = async (schemaInput) => {
       let response;
       try {
         response = await fetch(schemaInput, {
-          cache: "force-cache"
+          cache: typeof window !== "undefined" ? "force-cache" : void 0
         });
       } catch (err) {
         throw new GraphQLError("Failed to fetch schema", {
@@ -4713,13 +4808,13 @@ var OPENAPI_PROPS = /* @__PURE__ */ new Set([
   "anyOf",
   "oneOf"
 ]);
-var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path28 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
+var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path30 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
   if (obj === null || typeof obj !== "object") return obj;
   const refPath = obj.__$ref;
   const isCircular = currentPath.has(obj) || typeof refPath === "string" && currentRefPaths.has(refPath);
   if (isCircular) {
     if (typeof refPath === "string") return SCHEMA_REF_PREFIX + refPath;
-    const circularProp = path28.find((p) => !OPENAPI_PROPS.has(p)) || path28[0];
+    const circularProp = path30.find((p) => !OPENAPI_PROPS.has(p)) || path30[0];
     return [CIRCULAR_REF, circularProp].filter(Boolean).join(":");
   }
   if (refs.has(obj)) return refs.get(obj);
@@ -4729,7 +4824,7 @@ var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs
     value,
     currentPath,
     refs,
-    [...path28, key],
+    [...path30, key],
     currentRefPaths
   );
   const result = Array.isArray(obj) ? obj.map((item, i) => recurse(item, i.toString())) : Object.fromEntries(
@@ -4767,7 +4862,7 @@ var resolveExtensions = (obj) => Object.fromEntries(
 var getAllTags = (schema2) => {
   const rootTags = schema2.tags ?? [];
   const operations = Object.values(schema2.paths ?? {}).flatMap(
-    (path28) => HttpMethods.map((k) => path28?.[k]).filter((op) => op != null)
+    (path30) => HttpMethods.map((k) => path30?.[k]).filter((op) => op != null)
   );
   const operationTags = new Set(operations.flatMap((op) => op.tags ?? []));
   const hasUntaggedOperations = operations.some(
@@ -4822,7 +4917,7 @@ var getAllSlugs = (ops, schemaTags = []) => {
 var getOperationSlugKey = (op) => [op.path, op.method, op.operationId, op.summary].filter(Boolean).join("-");
 var getAllOperations = (paths) => {
   const operations = Object.entries(paths ?? {}).flatMap(
-    ([path28, value]) => HttpMethods.flatMap((method) => {
+    ([path30, value]) => HttpMethods.flatMap((method) => {
       if (!value?.[method]) return [];
       const operation = value[method];
       const pathParameters = value.parameters ?? [];
@@ -4842,7 +4937,7 @@ var getAllOperations = (paths) => {
       return {
         ...operation,
         method,
-        path: path28,
+        path: path30,
         parameters,
         servers,
         tags: operation.tags ?? []
@@ -5044,10 +5139,10 @@ var resolveSecuritySchemes = (schema2) => {
 var resolveSecurityRequirements = (securityArray, securitySchemes) => {
   if (!securityArray) return [];
   return securityArray.map((req) => ({
-    schemes: Object.entries(req).filter(([key]) => !key.startsWith("__")).flatMap(([schemeName, scopes]) => {
+    schemes: Object.entries(req).filter(([key]) => !key.startsWith("__")).flatMap(([schemeName, scopes2]) => {
       const scheme = securitySchemes.find((s) => s.name === schemeName);
       if (!scheme) return [];
-      return [{ scheme, scopes }];
+      return [{ scheme, scopes: scopes2 }];
     })
   }));
 };
@@ -5340,8 +5435,8 @@ var Schema = builder.objectRef("Schema").implement({
     }),
     paths: t.field({
       type: [PathItem],
-      resolve: (root) => Object.entries(root.paths ?? {}).map(([path28, value]) => ({
-        path: path28,
+      resolve: (root) => Object.entries(root.paths ?? {}).map(([path30, value]) => ({
+        path: path30,
         // biome-ignore lint/style/noNonNullAssertion: value is guaranteed to be defined
         methods: Object.keys(value)
       }))
@@ -5497,7 +5592,7 @@ init_joinUrl();
 
 // src/vite/api/schema-codegen.ts
 var unescapeJsonPointer = (uri) => decodeURIComponent(uri.replace(/~1/g, "/").replace(/~0/g, "~"));
-var getSegmentsFromPath = (path28) => path28.split("/").slice(1).map(unescapeJsonPointer);
+var getSegmentsFromPath = (path30) => path30.split("/").slice(1).map(unescapeJsonPointer);
 var createLocalRefMap = (obj) => {
   const refMap = /* @__PURE__ */ new Map();
   const siblingsMap = /* @__PURE__ */ new Map();
@@ -5528,16 +5623,16 @@ var replaceMarkers = (code, mergedRefs) => code.replace(/"__refMap:(.*?)"/g, '__
   /"__refMap\+Siblings:(.*?)"/g,
   (_, key) => mergedRefs.get(key) ?? `__refMap["${key}"]`
 );
-var lookup = (schema2, path28, filePath) => {
-  const parts = getSegmentsFromPath(path28);
+var lookup = (schema2, path30, filePath) => {
+  const parts = getSegmentsFromPath(path30);
   let val = schema2;
   for (const part of parts) {
     while (val.$ref?.startsWith("#/")) {
-      val = val.$ref === path28 ? val : lookup(schema2, val.$ref, filePath);
+      val = val.$ref === path30 ? val : lookup(schema2, val.$ref, filePath);
     }
     if (val[part] === void 0) {
       throw new Error(
-        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path28}`
+        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path30}`
       );
     }
     val = val[part];
@@ -5705,6 +5800,9 @@ var SchemaManager = class {
     const existingSchema = schemas[index];
     const schemaVersion = processedSchema.info.version ?? FALLBACK_VERSION;
     const versionPath = existingSchema?.path && existingSchema.path.length > 0 ? existingSchema.path : paramsPath(params) || schemaVersion;
+    const config2 = ensureArray(this.config.apis ?? []).find(
+      (c) => c.path === configuredPath
+    );
     const processed = {
       schema: processedSchema,
       version: schemaVersion,
@@ -5717,7 +5815,8 @@ var SchemaManager = class {
         filePath,
         versionPath,
         configuredPath,
-        params
+        params,
+        config2?.options
       ),
       processedJsonPath,
       processedTime
@@ -5782,8 +5881,8 @@ var SchemaManager = class {
       }
     }
   };
-  getLatestSchema = (path28) => this.processedSchemas[path28]?.at(0);
-  getSchemasForPath = (path28) => this.processedSchemas[path28];
+  getLatestSchema = (path30) => this.processedSchemas[path30]?.at(0);
+  getSchemasForPath = (path30) => this.processedSchemas[path30];
   getSchemaImports = () => Object.values(this.processedSchemas).flat().filter((s) => s.importKey);
   getUrlToFilePathMap = () => {
     const map = /* @__PURE__ */ new Map();
@@ -5803,14 +5902,15 @@ var SchemaManager = class {
     }
     return map;
   };
-  createSchemaPath = (inputPath, versionPath, apiPath, params) => {
+  createSchemaPath = (inputPath, versionPath, apiPath, params, config2) => {
     const suffix = paramsSuffix(params);
     const extension = suffix ? ".json" : path7.extname(inputPath);
+    const fileName = config2?.schemaDownload?.fileName ?? this.config.defaults?.apis?.schemaDownload?.fileName ?? "schema";
     return joinUrl(
       this.config.basePath,
       apiPath,
       versionPath,
-      `schema${suffix}${extension}`
+      `${fileName}${suffix}${extension}`
     );
   };
   validateSchema = async (schema2, filePath) => {
@@ -6148,6 +6248,7 @@ var viteConfigReloadPlugin = () => ({
 });
 
 // src/vite/plugin-api.ts
+var PROCESSED_STORE_SUBPATH = "node_modules/.zudoku/processed";
 var viteApiPlugin = async () => {
   const virtualModuleId4 = "virtual:zudoku-api-plugins";
   const resolvedVirtualModuleId4 = `\0${virtualModuleId4}`;
@@ -6159,7 +6260,7 @@ var viteApiPlugin = async () => {
   const buildProcessors = buildConfig?.processors ?? [];
   const tmpStoreDir = path11.posix.join(
     initialConfig.__meta.rootDir,
-    "node_modules/.zudoku/processed"
+    PROCESSED_STORE_SUBPATH
   );
   const processors = [...buildProcessors, ...zuploProcessors];
   const schemaManager = new SchemaManager({
@@ -6739,7 +6840,7 @@ init_ProtectedRoutesSchema();
 init_joinUrl();
 import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
 import path13 from "node:path";
-import { matchPath } from "react-router";
+init_url();
 var processMarkdownFile = async (filePath) => {
   const { content: markdownContent, data: frontmatter } = await readFrontmatter(filePath);
   let finalMarkdown = markdownContent;
@@ -6791,13 +6892,9 @@ var viteMarkdownExportPlugin = () => {
           config2.protectedRoutes
         );
         if (protectedRoutes) {
-          const isProtectedRoute = (routePath) => {
-            return Object.keys(protectedRoutes).some(
-              (route) => matchPath({ path: route, end: true }, routePath)
-            );
-          };
+          const patterns = Object.keys(protectedRoutes);
           for (const routePath of Object.keys(markdownFiles)) {
-            if (isProtectedRoute(routePath)) {
+            if (matchesAnyProtectedPattern(patterns, routePath)) {
               delete markdownFiles[routePath];
             }
           }
@@ -7476,6 +7573,155 @@ function vitePlugin() {
   ];
 }
 
+// src/vite/protected/registry.ts
+init_ProtectedRoutesSchema();
+init_joinUrl();
+init_url();
+import { matchPath as matchPath2 } from "react-router";
+var scopes = /* @__PURE__ */ new Map();
+var clearProtectedRegistry = () => scopes.clear();
+var registerProtectedScope = (moduleId, scope) => {
+  const list = scopes.get(moduleId);
+  if (list) list.push(scope);
+  else scopes.set(moduleId, [scope]);
+};
+var scopeMatchesPattern = (scope, pattern) => {
+  if (scope.type === "route") {
+    return matchesProtectedPattern(pattern, joinUrl(scope.path));
+  }
+  const root = joinUrl(scope.root);
+  if (!pattern.includes("*")) {
+    return matchesProtectedPattern(pattern, root);
+  }
+  return matchPath2({ path: pattern, end: false }, root) != null;
+};
+var getProtectedSourceMatcher = (config2) => {
+  const protectedRoutes = ProtectedRoutesSchema.parse(config2.protectedRoutes);
+  const patterns = protectedRoutes ? Object.keys(protectedRoutes) : [];
+  if (patterns.length === 0) {
+    return { match: () => false, enabled: false, patterns };
+  }
+  return {
+    enabled: true,
+    patterns,
+    match: (id) => {
+      const pathOnly = id.split("?")[0] ?? id;
+      const moduleScopes = scopes.get(pathOnly);
+      if (!moduleScopes) return false;
+      return moduleScopes.some(
+        (s) => patterns.some((p) => scopeMatchesPattern(s, p))
+      );
+    }
+  };
+};
+var findUnmatchedProtectedPatterns = (patterns) => patterns.filter(
+  (p) => ![...scopes.values()].some(
+    (scopeList) => scopeList.some((s) => scopeMatchesPattern(s, p))
+  )
+);
+
+// src/vite/protected/annotator.ts
+var walk = (node, visit9) => {
+  if (!node || typeof node !== "object") return;
+  if (typeof node.type === "string") visit9(node);
+  for (const key of Object.keys(node)) {
+    if (key === "loc" || key === "start" || key === "end" || key === "range") {
+      continue;
+    }
+    const val = node[key];
+    if (Array.isArray(val)) {
+      for (const v of val) walk(v, visit9);
+    } else if (val && typeof val === "object") {
+      walk(val, visit9);
+    }
+  }
+};
+var literalString = (node) => node?.type === "Literal" && typeof node.value === "string" ? node.value : void 0;
+var propKey = (prop) => prop.key?.type === "Identifier" ? prop.key.name : literalString(prop.key);
+var collectImportSpecs = (node) => {
+  const out = [];
+  walk(node, (n) => {
+    if (n.type === "ImportExpression") {
+      const spec = literalString(n.source);
+      if (spec) out.push(spec);
+    }
+  });
+  return out;
+};
+var matchPathObject = (node) => {
+  if (node.type !== "ObjectExpression") return;
+  let root;
+  const siblingValues = [];
+  for (const prop of node.properties ?? []) {
+    if (prop.type !== "Property") continue;
+    const name = propKey(prop);
+    const strValue = literalString(prop.value);
+    if (name === "path" && strValue) root = strValue;
+    else siblingValues.push(prop.value);
+  }
+  if (!root) return;
+  const specs = siblingValues.flatMap(collectImportSpecs);
+  if (specs.length === 0) return;
+  return { root, specs };
+};
+var matchRouteDict = (node) => {
+  if (node.type !== "ObjectExpression") return;
+  const props = node.properties ?? [];
+  if (props.length === 0) return;
+  const pairs = [];
+  for (const prop of props) {
+    if (prop.type !== "Property") return;
+    const key = literalString(prop.key);
+    if (!key?.startsWith("/") || key.includes(".")) return;
+    if (prop.value?.type !== "ArrowFunctionExpression" || prop.value.body?.type !== "ImportExpression") {
+      return;
+    }
+    const spec = literalString(prop.value.body.source);
+    if (!spec) return;
+    pairs.push({ root: key, spec });
+  }
+  return pairs;
+};
+var protectedAnnotatorPlugin = () => ({
+  name: "zudoku:protected-annotator",
+  buildStart() {
+    clearProtectedRegistry();
+  },
+  async transform(code, id) {
+    if (id.includes("/node_modules/")) return;
+    if (!code.includes("import(")) return;
+    let ast;
+    try {
+      ast = this.parse(code);
+    } catch (err) {
+      this.warn(
+        `protected-annotator: failed to parse ${id}: ${err instanceof Error ? err.message : String(err)}. Protected gating will NOT apply to this module.`
+      );
+      return;
+    }
+    const tasks = [];
+    walk(ast, (node) => {
+      const a = matchPathObject(node);
+      if (a) for (const spec of a.specs) tasks.push({ spec, root: a.root });
+      const b = matchRouteDict(node);
+      if (b) for (const { spec, root } of b) tasks.push({ spec, root });
+    });
+    for (const { spec, root } of tasks) {
+      const resolved = await this.resolve(spec, id);
+      if (!resolved || resolved.external) {
+        this.warn(
+          `Route-shaped import "${spec}" in ${id} did not resolve to a first-party module; protected gating will not apply.`
+        );
+        continue;
+      }
+      registerProtectedScope(resolved.id.split("?")[0] ?? resolved.id, {
+        type: "subtree",
+        root
+      });
+    }
+  }
+});
+
 // src/vite/config.ts
 var getAppClientEntryPath = () => path16.posix.join(getZudokuRootDir(), "src/app/entry.client.tsx");
 var getAppServerEntryPath = () => path16.posix.join(getZudokuRootDir(), "src/app/entry.server.tsx");
@@ -7487,11 +7733,15 @@ var defineEnvVars = (vars) => Object.fromEntries(
     [`import.meta.env.${v}`, JSON.stringify(process.env[v])]
   ])
 );
-async function getViteConfig(dir, configEnv) {
+async function getViteConfig(dir, configEnv, options = {}) {
   const { config: config2, publicEnv: publicEnv2, envPrefix: envPrefix2 } = await loadZudokuConfig(
     configEnv,
     dir
   );
+  const { match: isProtectedSource, enabled: hasProtectedSources } = getProtectedSourceMatcher(config2);
+  const shouldProtectChunks = hasProtectedSources && options.ssr === true;
+  const isProtectedChunk = (chunk) => chunk.facadeModuleId && isProtectedSource(chunk.facadeModuleId) || chunk.moduleIds.some(isProtectedSource);
+  const isWorker = options.adapter === "cloudflare";
   const cdnUrl = CdnUrlSchema.parse(config2.cdnUrl);
   const base = cdnUrl?.base ? joinUrl(cdnUrl.base, config2.basePath) : config2.basePath;
   if (cdnUrl && !hasLoggedCdnInfo) {
@@ -7517,6 +7767,10 @@ async function getViteConfig(dir, configEnv) {
     root: dir,
     base,
     appType: "custom",
+    // Cloudflare Workers: `webworker` makes Vite pick the browser platform
+    // for rolldown and avoids emitting `createRequire(import.meta.url)`,
+    // which is undefined in Workers. See vitejs/vite#21969 (fix in 8.0.4+).
+    ssr: isWorker ? { target: "webworker" } : void 0,
     configFile: false,
     clearScreen: false,
     logLevel: process.env.LOG_LEVEL ?? "info",
@@ -7574,13 +7828,19 @@ async function getViteConfig(dir, configEnv) {
     environments: {
       client: {
         build: {
+          manifest: true,
           rolldownOptions: {
-            input: "zudoku/app/entry.client.tsx"
+            input: "zudoku/app/entry.client.tsx",
+            output: shouldProtectChunks ? {
+              entryFileNames: (chunk) => isProtectedChunk(chunk) ? `${PROTECTED_CHUNK_DIR}/[name]-[hash].js` : "assets/[name]-[hash].js",
+              chunkFileNames: (chunk) => isProtectedChunk(chunk) ? `${PROTECTED_CHUNK_DIR}/[name]-[hash].js` : "assets/[name]-[hash].js"
+            } : void 0
           }
         }
       },
       ssr: {
-        resolve: {
+        // Build: bundle all for self-contained SSR output; dev uses minimal externals for speed.
+        resolve: configEnv.command === "build" ? { noExternal: true } : {
           noExternal: [/zudoku/, "@mdx-js/react"],
           external: ["@shikijs/themes", "@shikijs/langs"]
         },
@@ -7588,7 +7848,9 @@ async function getViteConfig(dir, configEnv) {
           outDir: path16.resolve(
             path16.join(dir, "dist", config2.basePath ?? "", "server")
           ),
+          copyPublicDir: false,
           rolldownOptions: {
+            logLevel: "warn",
             input: ["zudoku/app/entry.server.tsx", config2.__meta.configPath]
           }
         }
@@ -7596,6 +7858,9 @@ async function getViteConfig(dir, configEnv) {
     },
     experimental: {
       renderBuiltUrl(filename) {
+        if (filename.startsWith(`${PROTECTED_CHUNK_DIR}/`)) {
+          return joinUrl(config2.basePath, `/${filename}`);
+        }
         if (cdnUrl?.base && [".js", ".css"].includes(path16.extname(filename))) {
           return joinUrl(cdnUrl.base, filename);
         }
@@ -7620,7 +7885,7 @@ async function getViteConfig(dir, configEnv) {
       "/__z/entry.client.tsx",
       "**/pagefind.js"
     ],
-    plugins: [vitePlugin()],
+    plugins: [protectedAnnotatorPlugin(), vitePlugin()],
     future: {
       removeServerModuleGraph: "warn",
       removeSsrLoadModule: "warn",
@@ -7703,12 +7968,24 @@ ${cssLinks}
 `.trim();
 }
 
+// src/vite/manifest.ts
+import { writeFile as writeFile3 } from "node:fs/promises";
+import path17 from "node:path";
+var writeManifest = async (distDir, config2) => {
+  await writeFile3(
+    path17.join(distDir, MANIFEST_FILENAME),
+    `${JSON.stringify(buildManifest(config2), null, 2)}
+`,
+    "utf-8"
+  );
+};
+
 // src/vite/output.ts
 init_package_json();
 init_joinUrl();
 import assert from "node:assert";
-import { cp, mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import path17 from "node:path";
+import { cp, mkdir as mkdir3, writeFile as writeFile4 } from "node:fs/promises";
+import path18 from "node:path";
 var pkgJson = getZudokuPackageJson();
 function generateOutput({
   config: config2,
@@ -7765,10 +8042,10 @@ async function writeOutput(dir, {
   rewrites
 }) {
   const output = generateOutput({ config: config2, redirects, rewrites });
-  const outputDir = process.env.VERCEL ? path17.join(dir, ".vercel/output") : path17.join(dir, "dist/.output");
+  const outputDir = process.env.VERCEL ? path18.join(dir, ".vercel/output") : path18.join(dir, "dist/.output");
   await mkdir3(outputDir, { recursive: true });
-  const outputFile = path17.join(outputDir, "config.json");
-  await writeFile3(outputFile, JSON.stringify(output, null, 2), "utf-8");
+  const outputFile = path18.join(outputDir, "config.json");
+  await writeFile4(outputFile, JSON.stringify(output, null, 2), "utf-8");
   if (process.env.VERCEL) {
     console.log("Wrote Vercel output to", outputDir);
   }
@@ -7780,7 +8057,7 @@ init_file_exists();
 import { readFileSync as readFileSync2 } from "node:fs";
 import { readFile as readFile2, rm } from "node:fs/promises";
 import os from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 import { pathToFileURL } from "node:url";
 import { createIndex } from "pagefind";
 import colors7 from "picocolors";
@@ -7822,7 +8099,7 @@ function throttle(fn) {
 init_joinUrl();
 import { createWriteStream, existsSync } from "node:fs";
 import { mkdir as mkdir4 } from "node:fs/promises";
-import path18 from "node:path";
+import path19 from "node:path";
 import colors5 from "picocolors";
 import { SitemapStream } from "sitemap";
 async function generateSitemap({
@@ -7836,11 +8113,11 @@ async function generateSitemap({
     return;
   }
   const sitemap = new SitemapStream({ hostname: config2.siteUrl });
-  const outputDir = path18.resolve(baseOutputDir, config2.outDir ?? "");
+  const outputDir = path19.resolve(baseOutputDir, config2.outDir ?? "");
   if (!existsSync(outputDir)) {
     await mkdir4(outputDir, { recursive: true });
   }
-  const sitemapOutputPath = path18.join(outputDir, "sitemap.xml");
+  const sitemapOutputPath = path19.join(outputDir, "sitemap.xml");
   const writeStream = createWriteStream(sitemapOutputPath);
   sitemap.pipe(writeStream);
   let lastmod;
@@ -7870,14 +8147,14 @@ async function generateSitemap({
 
 // src/vite/prerender/utils.ts
 init_joinUrl();
-var resolveRoutePath = (path28) => {
-  const segments = path28.split("/");
+var resolveRoutePath = (path30) => {
+  const segments = path30.split("/");
   if (segments.some((s) => s.startsWith(":") && !s.endsWith("?"))) {
     return void 0;
   }
   return segments.filter((s) => !s.startsWith(":")).join("/") || void 0;
 };
-var isSkipped = (path28) => path28.includes("*") || /^\d+$/.test(path28);
+var isSkipped = (path30) => path30.includes("*") || /^\d+$/.test(path30);
 var resolveRoutes = (routes, parentPath = "") => routes.flatMap((route) => {
   if (route.path && isSkipped(route.path)) return [];
   const routePath = route.path ? resolveRoutePath(route.path) : void 0;
@@ -7926,12 +8203,12 @@ var prerender = async ({
   serverConfigFilename,
   writeRedirects = true
 }) => {
-  const distDir = path20.join(dir, "dist", basePath);
+  const distDir = path21.join(dir, "dist", basePath);
   const serverConfigPath = pathToFileURL(
-    path20.join(distDir, "server", serverConfigFilename)
+    path21.join(distDir, "server", serverConfigFilename)
   ).href;
   const entryServerPath = pathToFileURL(
-    path20.join(distDir, "server/entry.server.js")
+    path21.join(distDir, "server/entry.server.js")
   ).href;
   const rawConfig = await import(serverConfigPath).then(
     (m) => m.default
@@ -8043,7 +8320,7 @@ var prerender = async ({
     }
     if (isTTY()) writeLine("");
     const { outputPath } = await pagefindIndex.writeFiles({
-      outputPath: path20.join(distDir, "pagefind")
+      outputPath: path21.join(distDir, "pagefind")
     });
     if (outputPath) {
       const duration = (performance.now() - pagefindStart) / 1e3;
@@ -8067,7 +8344,7 @@ var prerender = async ({
     const { generateLlmsTxtFiles: generateLlmsTxtFiles2 } = await Promise.resolve().then(() => (init_llms(), llms_exports));
     const docsConfig = DocsConfigSchema2.parse(config2.docs);
     const llmsConfig = docsConfig.llms ?? {};
-    const markdownInfoPath = path20.join(
+    const markdownInfoPath = path21.join(
       dir,
       "node_modules/.zudoku/markdown-info.json"
     );
@@ -8092,7 +8369,7 @@ var prerender = async ({
       await Promise.all(
         markdownFileInfos.map((info) => {
           const outputPath = getMarkdownOutputPath(distDir, info.routePath);
-          if (!path20.resolve(outputPath).startsWith(path20.resolve(distDir))) {
+          if (!path21.resolve(outputPath).startsWith(path21.resolve(distDir))) {
             return;
           }
           return rm(outputPath).catch(() => {
@@ -8150,19 +8427,123 @@ var getContainerMemoryLimitMb = () => {
   return void 0;
 };
 
+// src/vite/protected/build.ts
+import { mkdir as mkdir5, readdir, readFile as readFile3, rename, rm as rm2 } from "node:fs/promises";
+import path22 from "node:path";
+init_joinUrl();
+var assertProtectedPatternsCovered = (config2) => {
+  const { patterns } = getProtectedSourceMatcher(config2);
+  const unmatched = findUnmatchedProtectedPatterns(patterns);
+  if (unmatched.length === 0) return;
+  throw new Error(
+    `[zudoku] protectedRoutes patterns with no matching content: ${unmatched.map((p) => `"${p}"`).join(", ")}.
+  Either the pattern is a typo, or the route uses an inline element / dynamic path that isn't code-split. Load the route via dynamic import so it gets its own chunk, otherwise its JS ships in the public bundle.`
+  );
+};
+var findProtectedLeaks = (output) => {
+  const isProtected = (fileName) => fileName.startsWith(`${PROTECTED_CHUNK_DIR}/`);
+  const chunks = output.filter((o) => o.type === "chunk");
+  const byFileName = new Map(chunks.map((c) => [c.fileName, c]));
+  const leaks = [];
+  for (const entry of chunks.filter(
+    (c) => c.isEntry && !isProtected(c.fileName)
+  )) {
+    const visited = /* @__PURE__ */ new Set();
+    const stack = [{ fileName: entry.fileName, path: [entry.fileName] }];
+    while (stack.length > 0) {
+      const { fileName, path: path30 } = stack.pop();
+      if (visited.has(fileName)) continue;
+      visited.add(fileName);
+      for (const imp of byFileName.get(fileName)?.imports ?? []) {
+        const next = [...path30, imp];
+        if (isProtected(imp)) {
+          leaks.push(next.join(" -> "));
+          continue;
+        }
+        stack.push({ fileName: imp, path: next });
+      }
+    }
+  }
+  return leaks;
+};
+var assertNoProtectedLeaks = (output) => {
+  const protectedEntries = output.filter((o) => o.type === "chunk").filter(
+    (c) => c.isEntry && c.fileName.startsWith(`${PROTECTED_CHUNK_DIR}/`)
+  ).map((c) => c.fileName);
+  if (protectedEntries.length > 0) {
+    throw new Error(
+      `Protected chunk(s) marked as entries:
+  ${protectedEntries.join("\n  ")}
+Entry chunks are loaded outside the gated import path. Move the entry to a public chunk that dynamically imports the protected one.`
+    );
+  }
+  const leaks = findProtectedLeaks(output);
+  if (leaks.length === 0) return;
+  throw new Error(
+    `Protected chunk(s) statically reachable from public entry:
+  ${leaks.join("\n  ")}
+This eagerly pulls gated content into the public bundle. Check that nothing in non-protected entry code statically imports the protected module.`
+  );
+};
+var moveProtectedChunks = async (clientOutDir, serverOutDir) => {
+  const srcDir = path22.join(clientOutDir, PROTECTED_CHUNK_DIR);
+  const files = await readdir(srcDir).catch((err) => {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  });
+  if (!files) return;
+  const destDir = path22.join(serverOutDir, PROTECTED_CHUNK_DIR);
+  await mkdir5(destDir, { recursive: true });
+  await Promise.all(
+    files.map(
+      (file) => rename(path22.join(srcDir, file), path22.join(destDir, file))
+    )
+  );
+  const leftover = await readdir(srcDir).catch(() => []);
+  if (leftover.length > 0) {
+    throw new Error(
+      `moveProtectedChunks left ${leftover.length} file(s) in ${srcDir}: ${leftover.join(", ")}.
+These would be served publicly. Aborting build.`
+    );
+  }
+  await rm2(srcDir, { recursive: true, force: true });
+};
+var assertCloudflareWranglerGatesProtected = async (dir, config2) => {
+  const { enabled } = getProtectedSourceMatcher(config2);
+  if (!enabled) return;
+  const protectedPrefix = `${joinUrl(config2.basePath, PROTECTED_CHUNK_DIR)}/`;
+  const candidates = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
+  for (const name of candidates) {
+    const file = await readFile3(path22.join(dir, name), "utf-8").catch(
+      () => void 0
+    );
+    if (file === void 0) continue;
+    if (file.includes("run_worker_first") && file.includes(protectedPrefix)) {
+      return;
+    }
+    throw new Error(
+      `[zudoku] ${name} must configure \`run_worker_first\` to include \`${protectedPrefix}*\` so the auth gate runs before the assets binding serves protected chunks. Without it, ${protectedPrefix}* is publicly readable. See https://developers.cloudflare.com/workers/static-assets/binding/#run_worker_first.`
+    );
+  }
+  throw new Error(
+    `[zudoku] No wrangler config found in ${dir} (looked for ${candidates.join(", ")}). Cloudflare adapter requires wrangler config with \`run_worker_first\` covering \`${protectedPrefix}*\`.`
+  );
+};
+
 // src/vite/build.ts
 var DIST_DIR = "dist";
 async function runBuild(options) {
   const { dir, ssr, adapter = "node" } = options;
-  const viteConfig = await getViteConfig(dir, {
-    mode: "production",
-    command: "build"
-  });
+  const viteConfig = await getViteConfig(
+    dir,
+    { mode: "production", command: "build" },
+    { adapter, ssr }
+  );
   const builder2 = await createBuilder(viteConfig);
   invariant(builder2.environments.client, "Client environment is missing");
   invariant(builder2.environments.ssr, "SSR environment is missing");
-  const distDir = path21.resolve(path21.join(dir, "dist"));
-  await rm2(distDir, { recursive: true, force: true });
+  const distDir = path23.resolve(path23.join(dir, "dist"));
+  await rm3(distDir, { recursive: true, force: true });
   const [clientResult, serverResult] = await Promise.all([
     builder2.build(builder2.environments.client),
     builder2.build(builder2.environments.ssr)
@@ -8201,10 +8582,23 @@ async function runBuild(options) {
       dir,
       adapter,
       serverOutDir,
-      html,
-      basePath: config2.basePath
+      html
     });
-    await rm2(path21.join(clientOutDir, "index.html"), { force: true });
+    assertProtectedPatternsCovered(config2);
+    assertNoProtectedLeaks(clientResult.output);
+    if (adapter !== "cloudflare") {
+      await moveProtectedChunks(clientOutDir, serverOutDir);
+    } else {
+      await assertCloudflareWranglerGatesProtected(dir, config2);
+    }
+    await writeFile6(
+      path23.join(distDir, "package.json"),
+      `${JSON.stringify({ type: "module" }, null, 2)}
+`,
+      "utf-8"
+    );
+    await writeManifest(distDir, config2);
+    await rm3(path23.join(clientOutDir, "index.html"), { force: true });
   } else {
     await runPrerender({
       dir,
@@ -8235,25 +8629,25 @@ var runPrerender = async (options) => {
       serverConfigFilename,
       writeRedirects: process.env.VERCEL === void 0
     });
-    const indexHtml = path21.join(clientOutDir, "index.html");
+    const indexHtml = path23.join(clientOutDir, "index.html");
     if (!workerResults.find((r) => r.outputPath === indexHtml)) {
-      await writeFile5(indexHtml, html, "utf-8");
+      await writeFile6(indexHtml, html, "utf-8");
     }
     const statusPages = workerResults.flatMap(
-      (r) => /^(400|404|500)\.html$/.test(path21.basename(r.outputPath)) ? r.outputPath : []
+      (r) => /^(400|404|500)\.html$/.test(path23.basename(r.outputPath)) ? r.outputPath : []
     );
     for (const statusPage of statusPages) {
-      await rename(
+      await rename2(
         statusPage,
-        path21.join(dir, DIST_DIR, path21.basename(statusPage))
+        path23.join(dir, DIST_DIR, path23.basename(statusPage))
       );
     }
-    await rm2(serverOutDir, { recursive: true, force: true });
+    await rm3(serverOutDir, { recursive: true, force: true });
     if (process.env.VERCEL) {
-      await mkdir5(path21.join(dir, ".vercel/output/static"), { recursive: true });
-      await rename(
-        path21.join(dir, DIST_DIR),
-        path21.join(dir, ".vercel/output/static")
+      await mkdir6(path23.join(dir, ".vercel/output/static"), { recursive: true });
+      await rename2(
+        path23.join(dir, DIST_DIR),
+        path23.join(dir, ".vercel/output/static")
       );
     }
     await writeOutput(dir, {
@@ -8263,8 +8657,8 @@ var runPrerender = async (options) => {
     });
     if (ZuploEnv.isZuplo && issuer) {
       const provider = config2.authentication?.type;
-      await writeFile5(
-        path21.join(dir, DIST_DIR, ".output/zuplo.json"),
+      await writeFile6(
+        path23.join(dir, DIST_DIR, ".output/zuplo.json"),
         JSON.stringify({ issuer, provider }, null, 2),
         "utf-8"
       );
@@ -8274,33 +8668,63 @@ var runPrerender = async (options) => {
     throw e;
   }
 };
+var findUserEntry = (dir) => {
+  for (const ext of ["ts", "tsx", "js", "mjs"]) {
+    const candidate = path23.join(dir, `zudoku.server.${ext}`);
+    if (existsSync2(candidate)) return candidate;
+  }
+};
 var bundleSSREntry = async (options) => {
-  const { dir, adapter, serverOutDir, html, basePath } = options;
-  const tempEntryPath = path21.join(dir, "__ssr-entry.ts");
+  const { dir, adapter, serverOutDir, html } = options;
   const packageRoot = getZudokuRootDir();
-  const templateContent = await readFile3(
-    path21.join(packageRoot, "src/vite/ssr-templates", `${adapter}.ts`),
-    "utf-8"
-  );
-  const entryContent = templateContent.replace('"__TEMPLATE__"', JSON.stringify(html)).replace(
-    '"__BASE_PATH__"',
-    basePath ? JSON.stringify(basePath) : "undefined"
-  );
-  await writeFile5(tempEntryPath, entryContent, "utf-8");
+  const userEntry = findUserEntry(dir);
+  let entryPoint = userEntry;
+  let tempEntryPath;
+  if (!entryPoint) {
+    tempEntryPath = path23.join(dir, "__ssr-entry.ts");
+    const templateContent = await readFile4(
+      path23.join(packageRoot, "src/vite/ssr-templates", `${adapter}.ts`),
+      "utf-8"
+    );
+    await writeFile6(tempEntryPath, templateContent, "utf-8");
+    entryPoint = tempEntryPath;
+  }
+  const frameworkPath = path23.join(serverOutDir, "entry.server.js");
   try {
     await esbuild({
-      entryPoints: [tempEntryPath],
+      entryPoints: [entryPoint],
       bundle: true,
-      platform: adapter === "node" ? "node" : "neutral",
+      platform: ["node", "lambda"].includes(adapter) ? "node" : "neutral",
       target: "es2022",
       format: "esm",
-      outfile: path21.join(serverOutDir, "entry.js"),
-      external: ["./entry.server.js", "./zudoku.config.js"],
-      nodePaths: [path21.join(packageRoot, "node_modules")],
-      banner: { js: "// Bundled SSR entry" }
+      outfile: path23.join(serverOutDir, "entry.js"),
+      external: ["./zudoku.config.js"],
+      nodePaths: [path23.join(packageRoot, "node_modules")],
+      banner: { js: "// Bundled SSR entry" },
+      define: {
+        __ZUDOKU_TEMPLATE__: JSON.stringify(html)
+      },
+      plugins: [
+        {
+          name: "zudoku-ssr-entry",
+          setup(build2) {
+            build2.onResolve({ filter: /^zudoku\/server$/ }, () => ({
+              path: frameworkPath
+            }));
+          }
+        }
+      ]
     });
+    await Promise.all([
+      rm3(frameworkPath, { force: true }),
+      rm3(`${frameworkPath}.map`, { force: true }),
+      rm3(path23.join(serverOutDir, "assets"), {
+        recursive: true,
+        force: true
+      })
+    ]);
   } finally {
-    await rm2(tempEntryPath, { force: true });
+    if (tempEntryPath) await rm3(tempEntryPath, { force: true });
   }
 };
 
@@ -8330,11 +8754,11 @@ function printWarningToConsole(message) {
 init_package_json();
 
 // src/cli/preview/handler.ts
-import path22 from "node:path";
+import path24 from "node:path";
 import { preview as vitePreview } from "vite";
 var DEFAULT_PREVIEW_PORT = 4e3;
 async function preview(argv) {
-  const dir = path22.resolve(process.cwd(), argv.dir);
+  const dir = path24.resolve(process.cwd(), argv.dir);
   const viteConfig = await getViteConfig(dir, {
     command: "serve",
     mode: "production",
@@ -8372,7 +8796,7 @@ async function build(argv) {
   printDiagnosticsToConsole(`Starting Zudoku build v${packageJson2.version}`);
   printDiagnosticsToConsole("");
   printDiagnosticsToConsole("");
-  const dir = path23.resolve(process.cwd(), argv.dir);
+  const dir = path25.resolve(process.cwd(), argv.dir);
   try {
     await runBuild({
       dir,
@@ -8513,8 +8937,8 @@ var build_default = {
     default: false
   }).option("adapter", {
     type: "string",
-    describe: "SSR adapter (node, cloudflare, vercel)",
-    choices: ["node", "cloudflare", "vercel"],
+    describe: "SSR adapter (node, cloudflare, vercel, lambda)",
+    choices: ["node", "cloudflare", "vercel", "lambda"],
     default: "node"
   }),
   handler: async (argv) => {
@@ -8526,14 +8950,14 @@ var build_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path26 from "node:path";
+import path28 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs3 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path25 from "node:path";
+import path27 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -8562,11 +8986,12 @@ async function findAvailablePort(startPort) {
 
 // src/vite/dev-server.ts
 init_loader();
+init_joinUrl();
 
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path24 from "node:path";
+import path26 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -8619,7 +9044,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path24.join(vite.config.publicDir, "pagefind");
+  const outputPath = path26.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -8639,9 +9064,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.#options;
     const [key, cert, ca] = await Promise.all([
-      fs3.readFile(path25.resolve(dir, config2.https.key)),
-      fs3.readFile(path25.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs3.readFile(path25.resolve(dir, config2.https.ca)) : void 0
+      fs3.readFile(path27.resolve(dir, config2.https.key)),
+      fs3.readFile(path27.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs3.readFile(path27.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -8667,7 +9092,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "zudoku:entry-client",
           configureServer(server2) {
-            const entryPath = path25.posix.join(
+            const entryPath = path27.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -8698,6 +9123,46 @@ var DevServer = class {
       next();
     });
     vite.middlewares.use(graphql.graphqlEndpoint, graphql);
+    const sessionEndpoint = joinUrl(config2.basePath, "/__z/auth/session");
+    vite.middlewares.use(sessionEndpoint, async (req, res) => {
+      if (req.method !== "POST" && req.method !== "DELETE") {
+        res.writeHead(405, { Allow: "POST, DELETE" });
+        res.end();
+        return;
+      }
+      const ssrEnvironment = vite.environments.ssr;
+      if (!isRunnableDevEnvironment2(ssrEnvironment)) {
+        res.writeHead(500);
+        res.end("SSR environment not available");
+        return;
+      }
+      const entryServer = await ssrEnvironment.runner.import(
+        getAppServerEntryPath()
+      );
+      const url = `${this.protocol}://${req.headers.host}${req.originalUrl ?? req.url}`;
+      const body = req.method === "POST" ? await new Promise((resolve) => {
+        let data = "";
+        req.on("data", (chunk) => data += chunk);
+        req.on("end", () => resolve(data));
+      }) : void 0;
+      const request = new Request(url, {
+        method: req.method,
+        headers: req.headers,
+        body
+      });
+      const app = entryServer.createServer({ template: "" });
+      const response = await app.fetch(request);
+      for (const [name, value] of response.headers) {
+        if (name.toLowerCase() === "set-cookie") continue;
+        res.setHeader(name, value);
+      }
+      for (const cookie of response.headers.getSetCookie()) {
+        res.appendHeader("Set-Cookie", cookie);
+      }
+      res.writeHead(response.status);
+      const text = await response.text();
+      res.end(text);
+    });
     vite.middlewares.use("/__z/pagefind-reindex", async (_req, res) => {
       res.writeHead(200, {
         "Content-Type": "text/event-stream",
@@ -8740,13 +9205,13 @@ var DevServer = class {
       `Server-side rendering ${this.#options.ssr ? "enabled" : "disabled"}`
     );
     if (config2.search?.type === "pagefind") {
-      const pagefindPath = path25.join(
+      const pagefindPath = path27.join(
         vite.config.publicDir,
         "pagefind/pagefind.js"
       );
       const exists = await fs3.stat(pagefindPath).catch(() => false);
       if (!exists) {
-        await fs3.mkdir(path25.dirname(pagefindPath), { recursive: true });
+        await fs3.mkdir(path27.dirname(pagefindPath), { recursive: true });
         await fs3.writeFile(pagefindPath, 'throw new Error("NOT_BUILT_YET");');
       }
     }
@@ -8788,14 +9253,15 @@ var DevServer = class {
               duplex: hasBody ? "half" : void 0
             }
           );
-          const response = await entryServer.handleRequest({
-            template,
-            request,
-            routes: entryServer.getRoutesByConfig(currentConfig),
-            basePath: currentConfig.basePath
+          const app = entryServer.createServer({ template });
+          const response = await app.fetch(request);
+          response.headers.forEach((value, key) => {
+            if (key.toLowerCase() !== "set-cookie") {
+              res.setHeader(key, value);
+            }
           });
-          for (const [key, value] of response.headers) {
-            res.appendHeader(key, value);
+          for (const cookie of response.headers.getSetCookie()) {
+            res.appendHeader("Set-Cookie", cookie);
           }
           res.writeHead(response.status);
           for await (const chunk of response.body ?? []) {
@@ -8844,7 +9310,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson2 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  const dir = path26.resolve(process.cwd(), argv.dir);
+  const dir = path28.resolve(process.cwd(), argv.dir);
   const server = new DevServer({
     dir,
     argPort: argv.port,
@@ -8949,8 +9415,8 @@ var previewCommand = {
 var preview_default = previewCommand;
 
 // src/cli/common/outdated.ts
-import { existsSync as existsSync2, mkdirSync } from "node:fs";
-import { readFile as readFile4, writeFile as writeFile6 } from "node:fs/promises";
+import { existsSync as existsSync3, mkdirSync } from "node:fs";
+import { readFile as readFile5, writeFile as writeFile7 } from "node:fs/promises";
 import { join } from "node:path";
 import colors10 from "picocolors";
 import { gt } from "semver";
@@ -9000,12 +9466,12 @@ function box(message, {
 
 // src/cli/common/xdg/lib.ts
 import { homedir } from "node:os";
-import path27 from "node:path";
+import path29 from "node:path";
 function defineDirectoryWithFallback(xdgName, fallback) {
   if (process.env[xdgName]) {
     return process.env[xdgName];
   } else {
-    return path27.join(homedir(), fallback);
+    return path29.join(homedir(), fallback);
   }
 }
 var XDG_CONFIG_HOME = defineDirectoryWithFallback(
@@ -9020,15 +9486,15 @@ var XDG_STATE_HOME = defineDirectoryWithFallback(
   "XDG_DATA_HOME",
   ".local/state"
 );
-var ZUDOKU_XDG_CONFIG_HOME = path27.join(
+var ZUDOKU_XDG_CONFIG_HOME = path29.join(
   XDG_CONFIG_HOME,
   CLI_XDG_FOLDER_NAME
 );
-var ZUDOKU_XDG_DATA_HOME = path27.join(
+var ZUDOKU_XDG_DATA_HOME = path29.join(
   XDG_DATA_HOME,
   CLI_XDG_FOLDER_NAME
 );
-var ZUDOKU_XDG_STATE_HOME = path27.join(
+var ZUDOKU_XDG_STATE_HOME = path29.join(
   XDG_STATE_HOME,
   CLI_XDG_FOLDER_NAME
 );
@@ -9070,14 +9536,14 @@ async function getLatestVersion() {
   return void 0;
 }
 async function getVersionCheckInfo() {
-  if (!existsSync2(ZUDOKU_XDG_STATE_HOME)) {
+  if (!existsSync3(ZUDOKU_XDG_STATE_HOME)) {
     mkdirSync(ZUDOKU_XDG_STATE_HOME, { recursive: true });
   }
   const versionCheckPath = join(ZUDOKU_XDG_STATE_HOME, VERSION_CHECK_FILE);
   let versionCheckInfo;
-  if (existsSync2(versionCheckPath)) {
+  if (existsSync3(versionCheckPath)) {
     try {
-      versionCheckInfo = await readFile4(versionCheckPath, "utf-8").then(
+      versionCheckInfo = await readFile5(versionCheckPath, "utf-8").then(
         JSON.parse
       );
     } catch {
@@ -9102,7 +9568,7 @@ async function getVersionCheckInfo() {
       lastCheck: Date.now(),
       latestVersion
     };
-    await writeFile6(
+    await writeFile7(
       versionCheckPath,
       JSON.stringify(versionCheckInfo),
       "utf-8"