zudoku 0.78.0 → 0.78.2

package/src/lib/components/context/ZudokuContext.ts

@@ -69,9 +69,10 @@ export const useCurrentNavigation = () => {
     }
   });
 
+  const { isAuthenticated } = useAuthState();
   const { data } = useSuspenseQuery({
     queryFn: () => getPluginNavigation(pathname),
-    queryKey: ["plugin-navigation", pathname],
+    queryKey: ["plugin-navigation", pathname, isAuthenticated],
   });
 
   let topNavItem = navItem;

package/src/lib/core/RouteGuard.tsx

@@ -1,12 +1,6 @@
 import { Helmet } from "@zudoku/react-helmet-async";
 import { use, useCallback, useEffect, useMemo } from "react";
-import {
-  matchPath,
-  Outlet,
-  useBlocker,
-  useLocation,
-  useNavigate,
-} from "react-router";
+import { Outlet, useBlocker, useLocation } from "react-router";
 import { Button } from "zudoku/ui/Button.js";
 import {
   Dialog,
@@ -22,11 +16,11 @@ import { RenderContext } from "../components/context/RenderContext.js";
 import { useZudoku } from "../components/context/ZudokuContext.js";
 import { Layout } from "../components/Layout.js";
 import { ZudokuError } from "../util/invariant.js";
-import { stripBasePath } from "../util/url.js";
+import { matchesProtectedPattern, stripBasePath } from "../util/url.js";
 
 export const SEARCH_PROTECTED_SECTION = "protected";
 
-type LoginDialogProps = {
+export type LoginDialogProps = {
   open: boolean;
   onCancel: () => void;
   onLogin: () => void;
@@ -34,7 +28,7 @@ type LoginDialogProps = {
   showRegister: boolean;
 };
 
-const LoginDialog = ({
+export const LoginDialog = ({
   open,
   onCancel,
   onLogin,
@@ -94,10 +88,38 @@ const ForbiddenPage = () => {
   );
 };
 
+// Inline sign-in prompt for initial page loads. Not a Dialog because those
+// portal to document.body and would leave SSR output empty.
+export const SignInRequiredPage = ({ redirectTo }: { redirectTo: string }) => {
+  const auth = useAuth();
+  return (
+    <Layout>
+      <div className="flex flex-col items-center justify-center min-h-[60vh] gap-4">
+        <h1 className="text-2xl font-bold">Sign in to continue</h1>
+        <p className="text-muted-foreground">
+          Please sign in to access this page.
+        </p>
+        <div className="flex gap-2">
+          <Button onClick={() => void auth.login({ redirectTo })}>
+            Sign in
+          </Button>
+          {auth.isAuthEnabled && !auth.disableSignUp && (
+            <Button
+              variant="outline"
+              onClick={() => void auth.signup({ redirectTo })}
+            >
+              Register
+            </Button>
+          )}
+        </div>
+      </div>
+    </Layout>
+  );
+};
+
 export const RouteGuard = () => {
   const auth = useAuth();
   const zudoku = useZudoku();
-  const navigate = useNavigate();
   const location = useLocation();
   const renderContext = use(RenderContext);
   const shouldBypass = renderContext.bypassProtection;
@@ -112,7 +134,7 @@ export const RouteGuard = () => {
     (pathname: string) => {
       if (!protectedRoutes) return;
       for (const [pattern, check] of Object.entries(protectedRoutes)) {
-        if (matchPath({ path: pattern, end: true }, pathname)) {
+        if (matchesProtectedPattern(pattern, pathname)) {
           return check;
         }
       }
@@ -122,8 +144,11 @@ export const RouteGuard = () => {
 
   const currentAuthCheck = getAuthCheck(location.pathname);
   const isProtectedRoute = currentAuthCheck !== undefined;
-  const rawResult = currentAuthCheck?.(authCheckContext) ?? true;
-  // Normalize: false is equivalent to UNAUTHORIZED
+  // Fail-closed: an unprotected route returns true; a protected route whose
+  // check returns undefined is treated as UNAUTHORIZED, not authorized.
+  const rawResult = isProtectedRoute
+    ? (currentAuthCheck(authCheckContext) ?? REASON_CODES.UNAUTHORIZED)
+    : true;
   const authResult =
     rawResult === false ? REASON_CODES.UNAUTHORIZED : rawResult;
   const isForbidden = authResult === REASON_CODES.FORBIDDEN;
@@ -139,7 +164,6 @@ export const RouteGuard = () => {
   });
   const isBlocked = blocker.state === "blocked";
 
-  // Proceed after successful login
   useEffect(() => {
     if (!auth.isAuthenticated || !isBlocked) return;
     const check = getAuthCheck(blocker.location.pathname);
@@ -160,13 +184,8 @@ export const RouteGuard = () => {
     getAuthCheck,
   ]);
 
-  if (isForbidden) {
-    return <ForbiddenPage />;
-  }
-
-  if (shouldBypass) {
-    return <BypassRoute isProtectedRoute={isProtectedRoute} />;
-  }
+  if (isForbidden) return <ForbiddenPage />;
+  if (shouldBypass) return <BypassRoute isProtectedRoute={isProtectedRoute} />;
 
   if (isProtectedRoute && !auth.isAuthEnabled) {
     throw new ZudokuError("Authentication is not enabled", {
@@ -176,12 +195,14 @@ export const RouteGuard = () => {
     });
   }
 
-  if (needsToSignIn && auth.isPending && typeof window !== "undefined") {
-    return null;
+  if (needsToSignIn) {
+    if (typeof window === "undefined") renderContext.status = 401;
+    if (auth.isPending) return null;
+    return (
+      <SignInRequiredPage redirectTo={location.pathname + location.search} />
+    );
   }
 
-  const showDialog = needsToSignIn || isBlocked;
-
   // Workaround: `blocker.location.pathname` includes basename, but `useLocation` does not.
   // Remove this when React Router fixes the issue. The canary test
   // `react-router-useblocker-basepath-bug.test.tsx` will fail when that happens.
@@ -192,10 +213,10 @@ export const RouteGuard = () => {
 
   return (
     <>
-      {!needsToSignIn && <Outlet />}
+      <Outlet />
       <LoginDialog
-        open={showDialog}
-        onCancel={needsToSignIn ? () => navigate(-1) : () => blocker.reset?.()}
+        open={isBlocked}
+        onCancel={() => blocker.reset?.()}
         onLogin={() => void auth.login({ redirectTo })}
         onRegister={() => void auth.signup({ redirectTo })}
         showRegister={!auth.disableSignUp}

package/src/lib/core/ZudokuContext.ts

@@ -20,10 +20,12 @@ import type {
 } from "../../config/validators/ZudokuConfig.js";
 import type { AuthenticationPlugin } from "../authentication/authentication.js";
 import { type AuthState, useAuthState } from "../authentication/state.js";
+import type { SSRAuthState } from "../components/context/RenderContext.js";
 import type { SlotType } from "../components/context/SlotProvider.js";
 import { joinUrl } from "../util/joinUrl.js";
 import type { MdxComponentsType } from "../util/MdxComponents.js";
 import { objectEntries } from "../util/objectEntries.js";
+import { matchesAnyProtectedPattern } from "../util/url.js";
 import {
   isApiIdentityPlugin,
   isAuthenticationPlugin,
@@ -158,13 +160,18 @@ export class ZudokuContext {
   public readonly protectedRoutes: ReturnType<typeof normalizeProtectedRoutes>;
   private readonly plugins: NonNullable<ZudokuContextOptions["plugins"]>;
   private readonly emitter = createNanoEvents<ZudokuEvents>();
+  // Per-request server auth. Zustand store is module-global so we can't
+  // mutate it per request.
+  readonly ssrAuth?: SSRAuthState;
   readonly initialize: Promise<void> | undefined;
 
   constructor(
     options: ZudokuContextOptions,
     queryClient: QueryClient,
     env: Record<string, string | undefined>,
+    ssrAuth?: SSRAuthState,
   ) {
+    this.ssrAuth = ssrAuth;
     this.queryClient = queryClient;
     this.env = env;
     this.options = options;
@@ -207,12 +214,15 @@ export class ZudokuContext {
       });
     });
 
-    useAuthState.subscribe((state, prevState) => {
-      this.emitEvent("auth", {
-        prev: prevState,
-        next: state,
+    // Client-only: Avoid subscribing in SSR to prevent memory leaks from persistent subscribers.
+    if (typeof window !== "undefined") {
+      useAuthState.subscribe((state, prevState) => {
+        this.emitEvent("auth", {
+          prev: prevState,
+          next: state,
+        });
       });
-    });
+    }
   }
 
   getApiIdentities = async () => {
@@ -239,7 +249,10 @@ export class ZudokuContext {
     return this.emitter.emit(event, ...data);
   };
 
-  getPluginNavigation = async (path: string) => {
+  // Skip plugins for unauthed users on protected paths. Plugins often load
+  // protected resources inside getNavigation; that work would leak.
+  getPluginNavigation = async (path: string): Promise<Navigation> => {
+    if (this.shouldSkipNavigationForProtected(path)) return [];
     const navigations = await Promise.all(
       this.plugins
         .filter(isNavigationPlugin)
@@ -249,6 +262,18 @@ export class ZudokuContext {
     return navigations.flatMap((nav) => nav ?? []);
   };
 
+  private shouldSkipNavigationForProtected(path: string): boolean {
+    const patterns = Object.keys(this.protectedRoutes ?? {});
+    if (patterns.length === 0) return false;
+    if (!matchesAnyProtectedPattern(patterns, path)) return false;
+    // Server: per-request ssrAuth. Client: live zustand state.
+    const isAuthed =
+      typeof window === "undefined"
+        ? !!this.ssrAuth?.profile
+        : this.getAuthState().isAuthenticated;
+    return !isAuthed;
+  }
+
   getProfileMenuItems = () => {
     const accountItems = this.plugins
       .filter((p) => isProfileMenuPlugin(p))
@@ -260,6 +285,14 @@ export class ZudokuContext {
   };
 
   signRequest = async (request: Request) => {
+    if (this.ssrAuth?.accessToken) {
+      request.headers.set(
+        "Authorization",
+        `Bearer ${this.ssrAuth.accessToken}`,
+      );
+      return request;
+    }
+
     if (!this.authentication) {
       throw new Error("No authentication provider configured");
     }

package/src/lib/errors/RouterError.tsx

@@ -1,10 +1,52 @@
-import { isRouteErrorResponse, useRouteError } from "react-router";
+import { isRouteErrorResponse, useLocation, useRouteError } from "react-router";
+import { useAuth } from "../authentication/hook.js";
+import { useZudoku } from "../components/context/ZudokuContext.js";
 import { NotFoundPage } from "../components/NotFoundPage.js";
+import { SignInRequiredPage } from "../core/RouteGuard.js";
 import { cn } from "../util/cn.js";
+import { matchesAnyProtectedPattern } from "../util/url.js";
 import { ErrorAlert } from "./ErrorAlert.js";
 
+// Chunk-load failure shape (what lazy() rejects with when protectChunks
+// serves a 401). Matches the three browser messages plus the webpack-style
+// ChunkLoadError name.
+const isChunkLoadError = (error: unknown): boolean =>
+  error instanceof Error &&
+  (error.name === "ChunkLoadError" ||
+    /Failed to fetch dynamically imported module|error loading dynamically imported module|Importing a module script failed/.test(
+      error.message,
+    ));
+
+// Safety net when a lazy() rejection trips errorElement instead of
+// RouteGuard (session expired mid-nav, etc.). Only fires for errors that
+// look like chunk-load failures or an explicit 401 route response so
+// genuine errors on protected routes still surface.
+const useSignInPromptIfProtectedUnauth = (error: unknown) => {
+  const location = useLocation();
+  const auth = useAuth();
+  const { protectedRoutes } = useZudoku();
+  if (!protectedRoutes || !auth.isAuthEnabled) return null;
+  if (auth.isAuthenticated || auth.isPending) return null;
+
+  const isAuthError =
+    (isRouteErrorResponse(error) && error.status === 401) ||
+    isChunkLoadError(error);
+
+  if (!isAuthError) return null;
+
+  const patterns = Object.keys(protectedRoutes);
+  if (!matchesAnyProtectedPattern(patterns, location.pathname)) return null;
+
+  return (
+    <SignInRequiredPage redirectTo={location.pathname + location.search} />
+  );
+};
+
 export function RouterError({ className }: { className?: string }) {
   const error = useRouteError();
+  const signInPrompt = useSignInPromptIfProtectedUnauth(error);
+
+  if (signInPrompt) return signInPrompt;
 
   if (isRouteErrorResponse(error) && error.status === 404) {
     return <NotFoundPage />;

package/src/lib/manifest.ts

@@ -0,0 +1,62 @@
+import type { ZudokuConfig } from "../config/config.js";
+import { ProtectedRoutesSchema } from "../config/validators/ProtectedRoutesSchema.js";
+import {
+  ACCESS_TOKEN_COOKIE,
+  AUTH_PROFILE_COOKIE,
+  REFRESH_TOKEN_COOKIE,
+} from "./authentication/cookies.js";
+import { joinUrl } from "./util/joinUrl.js";
+
+export const PROTECTED_CHUNK_DIR = "_protected";
+
+// Bump on schema-breaking changes; external tooling keys off this.
+export const MANIFEST_VERSION = 1;
+
+export const MANIFEST_FILENAME = "zudoku-manifest.json";
+
+export type ZudokuManifest = {
+  version: number;
+  basePath: string;
+  ssrEntry: string;
+  // URL prefixes without trailing slash; consumers append `/*` for globs.
+  static: { prefixes: string[] };
+  protected: {
+    chunkPrefix: string;
+    routePatterns: string[];
+  };
+  auth: {
+    sessionEndpoint: string;
+    cookies: {
+      access: string;
+      refresh: string;
+      profile: string;
+    };
+  };
+};
+
+export const buildManifest = (
+  config: Pick<ZudokuConfig, "basePath" | "protectedRoutes">,
+): ZudokuManifest => {
+  const protectedRoutes = ProtectedRoutesSchema.parse(config.protectedRoutes);
+  const routePatterns = protectedRoutes ? Object.keys(protectedRoutes) : [];
+  return {
+    version: MANIFEST_VERSION,
+    basePath: config.basePath ?? "/",
+    ssrEntry: "server/entry.js",
+    static: {
+      prefixes: [joinUrl(config.basePath, "assets")],
+    },
+    protected: {
+      chunkPrefix: joinUrl(config.basePath, PROTECTED_CHUNK_DIR),
+      routePatterns,
+    },
+    auth: {
+      sessionEndpoint: joinUrl(config.basePath, "/__z/auth/session"),
+      cookies: {
+        access: ACCESS_TOKEN_COOKIE,
+        refresh: REFRESH_TOKEN_COOKIE,
+        profile: AUTH_PROFILE_COOKIE,
+      },
+    },
+  };
+};

package/src/lib/oas/parser/dereference/index.ts

@@ -6,7 +6,8 @@ export type JSONSchema = JSONSchema4 | JSONSchema6;
 
 type CustomResolver = (ref: string) => Promise<JSONSchema | undefined>;
 
-const cache = new Map<JSONSchema, JSONSchema>();
+// WeakMap so cached schemas get GC'd once nothing else references them.
+const cache = new WeakMap<JSONSchema & object, JSONSchema>();
 
 // biome-ignore lint/suspicious/noExplicitAny: Allow any type
 const isIndexableObject = (obj: any): obj is Record<string, any> =>

package/src/lib/oas/parser/dereference/resolveRef.ts

@@ -1,6 +1,7 @@
 import type { JSONSchema } from "./index.js";
 
-const cache = new Map<JSONSchema, Map<string, unknown>>();
+// WeakMap so cached schemas get GC'd once nothing else references them.
+const cache = new WeakMap<JSONSchema & object, Map<string, unknown>>();
 
 /**
  * Resolves a $ref pointer in a schema and returns the referenced value.

package/src/lib/oas/parser/index.ts

@@ -53,7 +53,7 @@ const parseSchemaInput = async (
       let response: Response;
       try {
         response = await fetch(schemaInput, {
-          cache: "force-cache",
+          cache: typeof window !== "undefined" ? "force-cache" : undefined,
         });
       } catch (err) {
         throw new GraphQLError("Failed to fetch schema", {

package/src/lib/plugins/openapi/client/createServer.ts

@@ -2,7 +2,9 @@ import { useLogger } from "@envelop/core";
 import { createGraphQLServer } from "../../../oas/graphql/index.js";
 import type { OpenApiPluginOptions } from "../index.js";
 
-const map = new Map<string, number>();
+// Bounded so a query that never reaches -end doesn't accumulate (dev-only).
+const MAX_PENDING = 200;
+const pending = new Map<string, number>();
 
 export const createServer = (config: OpenApiPluginOptions) =>
   createGraphQLServer({
@@ -15,16 +17,23 @@ export const createServer = (config: OpenApiPluginOptions) =>
           if (import.meta.env.PROD) return;
 
           if (eventName.endsWith("-start")) {
-            map.set(`${eventName}-${args.operationName}`, performance.now());
+            if (pending.size >= MAX_PENDING) {
+              // Map iterates in insertion order, so the first key is oldest.
+              const oldest = pending.keys().next().value;
+              if (oldest) pending.delete(oldest);
+            }
+            const key = `${eventName}-${args.operationName}`;
+            pending.set(key, performance.now());
           } else if (eventName.endsWith("-end")) {
             const startEvent = eventName.replace("-end", "-start");
-            const start = map.get(`${startEvent}-${args.operationName}`);
+            const key = `${startEvent}-${args.operationName}`;
+            const start = pending.get(key);
             if (start) {
               // biome-ignore lint/suspicious/noConsole: Logging allowed here
               console.log(
                 `[zudoku:debug] ${args.operationName} query took ${performance.now() - start}ms`,
               );
-              map.delete(`${startEvent}-${args.operationName}`);
+              pending.delete(key);
             }
           }
         },

package/src/lib/plugins/search-pagefind/index.tsx

@@ -1,5 +1,4 @@
 import type { ZudokuConfig } from "../../../config/validators/ZudokuConfig.js";
-import { ClientOnly } from "../../components/ClientOnly.js";
 import type { ZudokuPlugin } from "../../core/plugins.js";
 import { PagefindSearch } from "./PagefindSearch.js";
 
@@ -13,9 +12,7 @@ export const pagefindSearchPlugin = (
 ): ZudokuPlugin => {
   return {
     renderSearch: ({ isOpen, onClose }) => (
-      <ClientOnly>
-        <PagefindSearch isOpen={isOpen} onClose={onClose} options={options} />
-      </ClientOnly>
+      <PagefindSearch isOpen={isOpen} onClose={onClose} options={options} />
     ),
   };
 };

package/src/lib/util/os.ts

@@ -1,4 +1,5 @@
 export function getOS(): "apple" | "linux" | "unix" | "windows" | undefined {
+  if (typeof navigator === "undefined") return;
   const notFound = -1;
   const userAgent = navigator.userAgent.toLowerCase();
   if (userAgent.indexOf("win") !== notFound) {

package/src/lib/util/url.ts

@@ -1,3 +1,16 @@
+import { matchPath } from "react-router";
+
+// `/admin` matches only `/admin`; use `/admin/*` for subtree coverage.
+export const matchesProtectedPattern = (
+  pattern: string,
+  path: string,
+): boolean => matchPath({ path: pattern, end: true }, path) != null;
+
+export const matchesAnyProtectedPattern = (
+  patterns: readonly string[],
+  path: string,
+): boolean => patterns.some((p) => matchesProtectedPattern(p, path));
+
 // Removes the basePath from a pathname if present
 // Returns the pathname unchanged if it's not under the basePath
 export const stripBasePath = (pathname: string, basePath = ""): string => {

package/src/vite/build.ts

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { build as esbuild } from "esbuild";
@@ -10,24 +11,34 @@ import invariant from "../lib/util/invariant.js";
 import { joinUrl } from "../lib/util/joinUrl.js";
 import { getViteConfig } from "./config.js";
 import { getBuildHtml } from "./html.js";
+import { writeManifest } from "./manifest.js";
 import { writeOutput } from "./output.js";
 import { prerender } from "./prerender/prerender.js";
+import {
+  assertCloudflareWranglerGatesProtected,
+  assertNoProtectedLeaks,
+  moveProtectedChunks,
+  assertProtectedPatternsCovered,
+} from "./protected/build.js";
 
 const DIST_DIR = "dist";
 
+export type SSRAdapter = "node" | "cloudflare" | "vercel" | "lambda";
+
 export type BuildOptions = {
   dir: string;
   ssr?: boolean;
-  adapter?: "node" | "cloudflare" | "vercel";
+  adapter?: SSRAdapter;
 };
 
 export async function runBuild(options: BuildOptions) {
   const { dir, ssr, adapter = "node" } = options;
 
-  const viteConfig = await getViteConfig(dir, {
-    mode: "production",
-    command: "build",
-  });
+  const viteConfig = await getViteConfig(
+    dir,
+    { mode: "production", command: "build" },
+    { adapter, ssr },
+  );
 
   const builder = await createBuilder(viteConfig);
 
@@ -67,6 +78,7 @@ export async function runBuild(options: BuildOptions) {
   const jsEntry = clientResult.output.find(
     (o) => "isEntry" in o && o.isEntry,
   )?.fileName;
+
   const cssEntries = clientResult.output
     .filter((o) => o.fileName.endsWith(".css"))
     .map((o) => o.fileName);
@@ -88,8 +100,25 @@ export async function runBuild(options: BuildOptions) {
       adapter,
       serverOutDir,
       html,
-      basePath: config.basePath,
     });
+    assertProtectedPatternsCovered(config);
+    assertNoProtectedLeaks(clientResult.output);
+    // On Cloudflare, protected chunks stay public (gate uses env.ASSETS.fetch).
+    // wrangler.toml must set run_worker_first for /_protected/*.
+    if (adapter !== "cloudflare") {
+      await moveProtectedChunks(clientOutDir, serverOutDir);
+    } else {
+      await assertCloudflareWranglerGatesProtected(dir, config);
+    }
+
+    // Mark the output as ESM so runtimes without a surrounding package.json
+    // (e.g. unzipped Lambda at /var/task) don't fall back to CommonJS.
+    await writeFile(
+      path.join(distDir, "package.json"),
+      `${JSON.stringify({ type: "module" }, null, 2)}\n`,
+      "utf-8",
+    );
+    await writeManifest(distDir, config);
     await rm(path.join(clientOutDir, "index.html"), { force: true });
   } else {
     // SSG: prerender and clean up server
@@ -190,45 +219,76 @@ const runPrerender = async (options: PrerenderOptions) => {
 
 type SSREntryOptions = {
   dir: string;
-  adapter: "node" | "cloudflare" | "vercel";
+  adapter: SSRAdapter;
   serverOutDir: string;
   html: string;
-  basePath?: string;
+};
+
+const findUserEntry = (dir: string) => {
+  for (const ext of ["ts", "tsx", "js", "mjs"]) {
+    const candidate = path.join(dir, `zudoku.server.${ext}`);
+    if (existsSync(candidate)) return candidate;
+  }
 };
 
 const bundleSSREntry = async (options: SSREntryOptions) => {
-  const { dir, adapter, serverOutDir, html, basePath } = options;
-  const tempEntryPath = path.join(dir, "__ssr-entry.ts");
+  const { dir, adapter, serverOutDir, html } = options;
 
   const packageRoot = getZudokuRootDir();
+  const userEntry = findUserEntry(dir);
 
-  const templateContent = await readFile(
-    path.join(packageRoot, "src/vite/ssr-templates", `${adapter}.ts`),
-    "utf-8",
-  );
+  let entryPoint = userEntry;
+  let tempEntryPath: string | undefined;
 
-  const entryContent = templateContent
-    .replace('"__TEMPLATE__"', JSON.stringify(html))
-    .replace(
-      '"__BASE_PATH__"',
-      basePath ? JSON.stringify(basePath) : "undefined",
+  if (!entryPoint) {
+    tempEntryPath = path.join(dir, "__ssr-entry.ts");
+    const templateContent = await readFile(
+      path.join(packageRoot, "src/vite/ssr-templates", `${adapter}.ts`),
+      "utf-8",
     );
+    await writeFile(tempEntryPath, templateContent, "utf-8");
+    entryPoint = tempEntryPath;
+  }
 
-  await writeFile(tempEntryPath, entryContent, "utf-8");
+  const frameworkPath = path.join(serverOutDir, "entry.server.js");
 
   try {
     await esbuild({
-      entryPoints: [tempEntryPath],
+      entryPoints: [entryPoint],
       bundle: true,
-      platform: adapter === "node" ? "node" : "neutral",
+      platform: ["node", "lambda"].includes(adapter) ? "node" : "neutral",
       target: "es2022",
       format: "esm",
       outfile: path.join(serverOutDir, "entry.js"),
-      external: ["./entry.server.js", "./zudoku.config.js"],
+      external: ["./zudoku.config.js"],
       nodePaths: [path.join(packageRoot, "node_modules")],
       banner: { js: "// Bundled SSR entry" },
+      define: {
+        __ZUDOKU_TEMPLATE__: JSON.stringify(html),
+      },
+      plugins: [
+        {
+          name: "zudoku-ssr-entry",
+          setup(build) {
+            // Point at the Vite-pre-built framework (virtual modules
+            // already resolved) so esbuild's `define` can reach into it.
+            build.onResolve({ filter: /^zudoku\/server$/ }, () => ({
+              path: frameworkPath,
+            }));
+          },
+        },
+      ],
     });
+    // Framework is inlined into entry.js; drop the standalone Vite SSR output.
+    await Promise.all([
+      rm(frameworkPath, { force: true }),
+      rm(`${frameworkPath}.map`, { force: true }),
+      rm(path.join(serverOutDir, "assets"), {
+        recursive: true,
+        force: true,
+      }),
+    ]);
   } finally {
-    await rm(tempEntryPath, { force: true });
+    if (tempEntryPath) await rm(tempEntryPath, { force: true });
   }
 };