zudoku 0.78.0 → 0.78.2

package/src/vite/config.ts

@@ -5,6 +5,7 @@ import {
   type ConfigEnv,
   type InlineConfig,
   type LogLevel,
+  type Rolldown,
   loadConfigFromFile,
   mergeConfig,
 } from "vite";
@@ -14,9 +15,13 @@ import { logger } from "../cli/common/logger.js";
 import { getZudokuRootDir } from "../cli/common/package-json.js";
 import { loadZudokuConfig } from "../config/loader.js";
 import { CdnUrlSchema } from "../config/validators/ZudokuConfig.js";
+import { PROTECTED_CHUNK_DIR } from "../lib/manifest.js";
 import { joinUrl } from "../lib/util/joinUrl.js";
+import type { SSRAdapter } from "./build.js";
 import { findPackageRoot } from "./package-root.js";
 import vitePlugin from "./plugin.js";
+import { protectedAnnotatorPlugin } from "./protected/annotator.js";
+import { getProtectedSourceMatcher } from "./protected/registry.js";
 import { getZuploSystemConfigurations } from "./zuplo.js";
 
 export type ZudokuConfigEnv = ConfigEnv & {
@@ -45,12 +50,23 @@ const defineEnvVars = (vars: string[]) =>
 export async function getViteConfig(
   dir: string,
   configEnv: ZudokuConfigEnv,
+  options: { adapter?: SSRAdapter; ssr?: boolean } = {},
 ): Promise<InlineConfig> {
   const { config, publicEnv, envPrefix } = await loadZudokuConfig(
     configEnv,
     dir,
   );
+  const { match: isProtectedSource, enabled: hasProtectedSources } =
+    getProtectedSourceMatcher(config);
+  const shouldProtectChunks = hasProtectedSources && options.ssr === true;
 
+  // Check facadeModuleId too: codeSplitting may move the body into a captured
+  // group, leaving a stub whose moduleIds no longer reference the protected source.
+  const isProtectedChunk = (chunk: Rolldown.PreRenderedChunk) =>
+    (chunk.facadeModuleId && isProtectedSource(chunk.facadeModuleId)) ||
+    chunk.moduleIds.some(isProtectedSource);
+
+  const isWorker = options.adapter === "cloudflare";
   const cdnUrl = CdnUrlSchema.parse(config.cdnUrl);
 
   const base = cdnUrl?.base
@@ -88,6 +104,10 @@ export async function getViteConfig(
     root: dir,
     base,
     appType: "custom",
+    // Cloudflare Workers: `webworker` makes Vite pick the browser platform
+    // for rolldown and avoids emitting `createRequire(import.meta.url)`,
+    // which is undefined in Workers. See vitejs/vite#21969 (fix in 8.0.4+).
+    ssr: isWorker ? { target: "webworker" } : undefined,
     configFile: false,
     clearScreen: false,
     logLevel: (process.env.LOG_LEVEL ?? "info") as LogLevel,
@@ -103,6 +123,7 @@ export async function getViteConfig(
       "process.env.ZUDOKU_VERSION": JSON.stringify(packageJson.version),
       "process.env.IS_ZUPLO": ZuploEnv.isZuplo,
       "import.meta.env.IS_ZUPLO": ZuploEnv.isZuplo,
+      "import.meta.env.ZUDOKU_HAS_SERVER": JSON.stringify(options.ssr === true),
       "import.meta.env.ZUPLO_PUBLIC_DEPLOYMENT_NAME":
         JSON.stringify(deploymentName),
       ...defineEnvVars([
@@ -146,21 +167,40 @@ export async function getViteConfig(
     environments: {
       client: {
         build: {
+          manifest: true,
           rolldownOptions: {
             input: "zudoku/app/entry.client.tsx",
+            output: shouldProtectChunks
+              ? {
+                  entryFileNames: (chunk) =>
+                    isProtectedChunk(chunk)
+                      ? `${PROTECTED_CHUNK_DIR}/[name]-[hash].js`
+                      : "assets/[name]-[hash].js",
+                  chunkFileNames: (chunk) =>
+                    isProtectedChunk(chunk)
+                      ? `${PROTECTED_CHUNK_DIR}/[name]-[hash].js`
+                      : "assets/[name]-[hash].js",
+                }
+              : undefined,
           },
         },
       },
       ssr: {
-        resolve: {
-          noExternal: [/zudoku/, "@mdx-js/react"],
-          external: ["@shikijs/themes", "@shikijs/langs"],
-        },
+        // Build: bundle all for self-contained SSR output; dev uses minimal externals for speed.
+        resolve:
+          configEnv.command === "build"
+            ? { noExternal: true }
+            : {
+                noExternal: [/zudoku/, "@mdx-js/react"],
+                external: ["@shikijs/themes", "@shikijs/langs"],
+              },
         build: {
           outDir: path.resolve(
             path.join(dir, "dist", config.basePath ?? "", "server"),
           ),
+          copyPublicDir: false,
           rolldownOptions: {
+            logLevel: "warn",
             input: ["zudoku/app/entry.server.tsx", config.__meta.configPath],
           },
         },
@@ -168,6 +208,12 @@ export async function getViteConfig(
     },
     experimental: {
       renderBuiltUrl(filename) {
+        // Protected chunks must resolve through the SSR origin so the auth
+        // gate runs; never prefix with a CDN.
+        if (filename.startsWith(`${PROTECTED_CHUNK_DIR}/`)) {
+          return joinUrl(config.basePath, `/${filename}`);
+        }
+
         if (cdnUrl?.base && [".js", ".css"].includes(path.extname(filename))) {
           return joinUrl(cdnUrl.base, filename);
         }
@@ -194,7 +240,7 @@ export async function getViteConfig(
       "/__z/entry.client.tsx",
       "**/pagefind.js",
     ],
-    plugins: [vitePlugin()],
+    plugins: [protectedAnnotatorPlugin(), vitePlugin()],
     future: {
       removeServerModuleGraph: "warn",
       removeSsrLoadModule: "warn",

package/src/vite/dev-server.ts

@@ -16,6 +16,7 @@ import { findAvailablePort } from "../cli/common/utils/ports.js";
 import type { LoadedConfig } from "../config/config.js";
 import { loadZudokuConfig } from "../config/loader.js";
 import { createGraphQLServer } from "../lib/oas/graphql/index.js";
+import { joinUrl } from "../lib/util/joinUrl.js";
 import {
   getAppClientEntryPath,
   getAppServerEntryPath,
@@ -131,6 +132,57 @@ export class DevServer {
 
     vite.middlewares.use(graphql.graphqlEndpoint, graphql);
 
+    // Auth session endpoint for cookie sync
+    const sessionEndpoint = joinUrl(config.basePath, "/__z/auth/session");
+    vite.middlewares.use(sessionEndpoint, async (req, res) => {
+      if (req.method !== "POST" && req.method !== "DELETE") {
+        res.writeHead(405, { Allow: "POST, DELETE" });
+        res.end();
+        return;
+      }
+
+      const ssrEnvironment = vite.environments.ssr;
+      if (!isRunnableDevEnvironment(ssrEnvironment)) {
+        res.writeHead(500);
+        res.end("SSR environment not available");
+        return;
+      }
+
+      const entryServer = await ssrEnvironment.runner.import<EntryServerImport>(
+        getAppServerEntryPath(),
+      );
+
+      const url = `${this.protocol}://${req.headers.host}${req.originalUrl ?? req.url}`;
+      const body =
+        req.method === "POST"
+          ? await new Promise<string>((resolve) => {
+              let data = "";
+              req.on("data", (chunk: Buffer) => (data += chunk));
+              req.on("end", () => resolve(data));
+            })
+          : undefined;
+
+      const request = new Request(url, {
+        method: req.method,
+        headers: req.headers as HeadersInit,
+        body,
+      });
+
+      const app = entryServer.createServer({ template: "" });
+      const response = await app.fetch(request);
+
+      for (const [name, value] of response.headers) {
+        if (name.toLowerCase() === "set-cookie") continue;
+        res.setHeader(name, value);
+      }
+      for (const cookie of response.headers.getSetCookie()) {
+        res.appendHeader("Set-Cookie", cookie);
+      }
+      res.writeHead(response.status);
+      const text = await response.text();
+      res.end(text);
+    });
+
     // Pagefind reindex endpoint (SSE)
     vite.middlewares.use("/__z/pagefind-reindex", async (_req, res) => {
       res.writeHead(200, {
@@ -238,15 +290,16 @@ export class DevServer {
             },
           );
 
-          const response = await entryServer.handleRequest({
-            template,
-            request,
-            routes: entryServer.getRoutesByConfig(currentConfig),
-            basePath: currentConfig.basePath,
-          });
+          const app = entryServer.createServer({ template });
+          const response = await app.fetch(request);
 
-          for (const [key, value] of response.headers) {
-            res.appendHeader(key, value);
+          response.headers.forEach((value, key) => {
+            if (key.toLowerCase() !== "set-cookie") {
+              res.setHeader(key, value);
+            }
+          });
+          for (const cookie of response.headers.getSetCookie()) {
+            res.appendHeader("Set-Cookie", cookie);
           }
           res.writeHead(response.status);
 

package/src/vite/manifest.ts

@@ -0,0 +1,15 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import type { ZudokuConfig } from "../config/config.js";
+import { buildManifest, MANIFEST_FILENAME } from "../lib/manifest.js";
+
+export const writeManifest = async (
+  distDir: string,
+  config: Pick<ZudokuConfig, "basePath" | "protectedRoutes">,
+) => {
+  await writeFile(
+    path.join(distDir, MANIFEST_FILENAME),
+    `${JSON.stringify(buildManifest(config), null, 2)}\n`,
+    "utf-8",
+  );
+};

package/src/vite/plugin-api.ts

@@ -20,6 +20,8 @@ import { SchemaManager } from "./api/SchemaManager.js";
 import { reload } from "./plugin-config-reload.js";
 import { invalidate as invalidateNavigation } from "./plugin-navigation.js";
 
+const PROCESSED_STORE_SUBPATH = "node_modules/.zudoku/processed";
+
 const viteApiPlugin = async (): Promise<Plugin> => {
   const virtualModuleId = "virtual:zudoku-api-plugins";
   const resolvedVirtualModuleId = `\0${virtualModuleId}`;
@@ -38,7 +40,7 @@ const viteApiPlugin = async (): Promise<Plugin> => {
 
   const tmpStoreDir = path.posix.join(
     initialConfig.__meta.rootDir,
-    "node_modules/.zudoku/processed",
+    PROCESSED_STORE_SUBPATH,
   );
 
   const processors = [...buildProcessors, ...zuploProcessors];

package/src/vite/plugin-markdown-export.ts

@@ -1,11 +1,11 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { matchPath } from "react-router";
 import type { Plugin } from "vite";
 import { getCurrentConfig } from "../config/loader.js";
 import { ProtectedRoutesSchema } from "../config/validators/ProtectedRoutesSchema.js";
 import { joinUrl } from "../lib/util/joinUrl.js";
 import { readFrontmatter } from "../lib/util/readFrontmatter.js";
+import { matchesAnyProtectedPattern } from "../lib/util/url.js";
 import {
   globMarkdownFiles,
   resolveCustomNavigationPaths,
@@ -107,15 +107,9 @@ const viteMarkdownExportPlugin = (): Plugin => {
           config.protectedRoutes,
         );
         if (protectedRoutes) {
-          const isProtectedRoute = (routePath: string): boolean => {
-            return Object.keys(protectedRoutes).some((route) =>
-              matchPath({ path: route, end: true }, routePath),
-            );
-          };
-
-          // Remove protected routes from the mapping
+          const patterns = Object.keys(protectedRoutes);
           for (const routePath of Object.keys(markdownFiles)) {
-            if (isProtectedRoute(routePath)) {
+            if (matchesAnyProtectedPattern(patterns, routePath)) {
               delete markdownFiles[routePath];
             }
           }

package/src/vite/prerender/worker.ts

@@ -1,11 +1,11 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import Piscina from "piscina";
-import { matchPath } from "react-router";
 import { ProtectedRoutesSchema } from "../../config/validators/ProtectedRoutesSchema.js";
 import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
 import { runPluginTransformConfig } from "../../lib/core/transform-config.js";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { matchesAnyProtectedPattern } from "../../lib/util/url.js";
 import type { WorkerResult } from "./prerender.js";
 
 type EntryServer = typeof import("../../app/entry.server.js");
@@ -42,9 +42,7 @@ const renderPage = async ({ urlPath }: WorkerData): Promise<WorkerResult> => {
 
   const protectedRoutes = ProtectedRoutesSchema.parse(config.protectedRoutes);
   const isProtectedRoute = protectedRoutes
-    ? Object.keys(protectedRoutes).some((route) =>
-        matchPath({ path: route, end: true }, urlPath),
-      )
+    ? matchesAnyProtectedPattern(Object.keys(protectedRoutes), urlPath)
     : false;
 
   // Get the main response

package/src/vite/protected/annotator.ts

@@ -0,0 +1,136 @@
+import type { Plugin } from "vite";
+import { clearProtectedRegistry, registerProtectedScope } from "./registry.js";
+
+// Minimal ESTree walker. Visits every node; skips position fields.
+// biome-ignore lint/suspicious/noExplicitAny: working against a loose ESTree shape
+type AstNode = any;
+
+const walk = (node: AstNode, visit: (n: AstNode) => void) => {
+  if (!node || typeof node !== "object") return;
+  if (typeof node.type === "string") visit(node);
+  for (const key of Object.keys(node)) {
+    if (key === "loc" || key === "start" || key === "end" || key === "range") {
+      continue;
+    }
+    const val = node[key];
+    if (Array.isArray(val)) {
+      for (const v of val) walk(v, visit);
+    } else if (val && typeof val === "object") {
+      walk(val, visit);
+    }
+  }
+};
+
+const literalString = (node: AstNode): string | undefined =>
+  node?.type === "Literal" && typeof node.value === "string"
+    ? node.value
+    : undefined;
+
+const propKey = (prop: AstNode): string | undefined =>
+  prop.key?.type === "Identifier" ? prop.key.name : literalString(prop.key);
+
+// All dynamic-import specifiers found anywhere inside a subtree.
+const collectImportSpecs = (node: AstNode): string[] => {
+  const out: string[] = [];
+  walk(node, (n) => {
+    if (n.type === "ImportExpression") {
+      const spec = literalString(n.source);
+      if (spec) out.push(spec);
+    }
+  });
+  return out;
+};
+
+// Shape A: `{path: "/X", ...}` with any nested dynamic imports. Covers
+// RR route objects and plugin-api's `openApiPlugin({path, schemaImports})`.
+export const matchPathObject = (
+  node: AstNode,
+): { root: string; specs: string[] } | undefined => {
+  if (node.type !== "ObjectExpression") return;
+  let root: string | undefined;
+  const siblingValues: AstNode[] = [];
+  for (const prop of node.properties ?? []) {
+    if (prop.type !== "Property") continue;
+    const name = propKey(prop);
+    const strValue = literalString(prop.value);
+    if (name === "path" && strValue) root = strValue;
+    else siblingValues.push(prop.value);
+  }
+  if (!root) return;
+  const specs = siblingValues.flatMap(collectImportSpecs);
+  if (specs.length === 0) return;
+  return { root, specs };
+};
+
+// Shape B: `{ "/foo": () => import(...), ... }`. Keys must be path-like
+// (leading `/`, no `.`) to avoid matching file-path dicts.
+export const matchRouteDict = (
+  node: AstNode,
+): Array<{ root: string; spec: string }> | undefined => {
+  if (node.type !== "ObjectExpression") return;
+  const props = node.properties ?? [];
+  if (props.length === 0) return;
+  const pairs: Array<{ root: string; spec: string }> = [];
+  for (const prop of props) {
+    if (prop.type !== "Property") return;
+    const key = literalString(prop.key);
+    if (!key?.startsWith("/") || key.includes(".")) return;
+    if (
+      prop.value?.type !== "ArrowFunctionExpression" ||
+      prop.value.body?.type !== "ImportExpression"
+    ) {
+      return;
+    }
+    const spec = literalString(prop.value.body.source);
+    if (!spec) return;
+    pairs.push({ root: key, spec });
+  }
+  return pairs;
+};
+
+// Auto-registers route-shaped dynamic imports. Covers plugin-docs,
+// plugin-api, and user custom pages without plugin-side changes.
+export const protectedAnnotatorPlugin = (): Plugin => ({
+  name: "zudoku:protected-annotator",
+  buildStart() {
+    clearProtectedRegistry();
+  },
+  async transform(code, id) {
+    if (id.includes("/node_modules/")) return;
+    if (!code.includes("import(")) return;
+
+    let ast: AstNode;
+    try {
+      ast = this.parse(code);
+    } catch (err) {
+      // Parse failure leaves this module unregistered, so any protected
+      // dynamic imports inside it would ship ungated. Warn loudly.
+      this.warn(
+        `protected-annotator: failed to parse ${id}: ${err instanceof Error ? err.message : String(err)}. Protected gating will NOT apply to this module.`,
+      );
+      return;
+    }
+
+    const tasks: Array<{ spec: string; root: string }> = [];
+    walk(ast, (node) => {
+      const a = matchPathObject(node);
+      if (a) for (const spec of a.specs) tasks.push({ spec, root: a.root });
+      const b = matchRouteDict(node);
+      if (b) for (const { spec, root } of b) tasks.push({ spec, root });
+    });
+
+    for (const { spec, root } of tasks) {
+      const resolved = await this.resolve(spec, id);
+      if (!resolved || resolved.external) {
+        this.warn(
+          `Route-shaped import "${spec}" in ${id} did not resolve to a first-party module; protected gating will not apply.`,
+        );
+        continue;
+      }
+      registerProtectedScope(resolved.id.split("?")[0] ?? resolved.id, {
+        type: "subtree",
+        root,
+      });
+    }
+  },
+});

package/src/vite/protected/build.ts

@@ -0,0 +1,151 @@
+import { mkdir, readdir, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import type { Rolldown } from "vite";
+import type { ConfigWithMeta } from "../../config/loader.js";
+import { PROTECTED_CHUNK_DIR } from "../../lib/manifest.js";
+import { joinUrl } from "../../lib/util/joinUrl.js";
+import {
+  findUnmatchedProtectedPatterns,
+  getProtectedSourceMatcher,
+} from "./registry.js";
+
+// Build-time helpers that enforce the protected-chunk invariant: gated content never lands in the publicly-served output.
+
+// Unmatched patterns mean a typo or a route served by an inline element / dynamic path (not chunk-isolated).
+// Without a registered scope the JS for that route ships in the public bundle even though RouteGuard blocks rendering.
+export const assertProtectedPatternsCovered = (config: ConfigWithMeta) => {
+  const { patterns } = getProtectedSourceMatcher(config);
+  const unmatched = findUnmatchedProtectedPatterns(patterns);
+  if (unmatched.length === 0) return;
+  throw new Error(
+    `[zudoku] protectedRoutes patterns with no matching content: ${unmatched
+      .map((p) => `"${p}"`)
+      .join(", ")}.\n` +
+      `  Either the pattern is a typo, or the route uses an inline element / dynamic path that isn't code-split. ` +
+      `Load the route via dynamic import so it gets its own chunk, otherwise its JS ships in the public bundle.`,
+  );
+};
+
+type BundleOutput = readonly (Rolldown.OutputChunk | Rolldown.OutputAsset)[];
+
+// Fails the build if a public entry chunk statically reaches a protected
+// chunk. Dynamic imports are expected (route-split lazy) and are skipped.
+export const findProtectedLeaks = (output: BundleOutput): string[] => {
+  const isProtected = (fileName: string) =>
+    fileName.startsWith(`${PROTECTED_CHUNK_DIR}/`);
+  const chunks = output.filter((o) => o.type === "chunk");
+  const byFileName = new Map(chunks.map((c) => [c.fileName, c]));
+
+  const leaks: string[] = [];
+  for (const entry of chunks.filter(
+    (c) => c.isEntry && !isProtected(c.fileName),
+  )) {
+    const visited = new Set<string>();
+    const stack = [{ fileName: entry.fileName, path: [entry.fileName] }];
+    while (stack.length > 0) {
+      // biome-ignore lint/style/noNonNullAssertion: Length check ensures this is not null
+      const { fileName, path } = stack.pop()!;
+      if (visited.has(fileName)) continue;
+      visited.add(fileName);
+      for (const imp of byFileName.get(fileName)?.imports ?? []) {
+        const next = [...path, imp];
+        if (isProtected(imp)) {
+          leaks.push(next.join(" -> "));
+          continue;
+        }
+        stack.push({ fileName: imp, path: next });
+      }
+    }
+  }
+  return leaks;
+};
+
+export const assertNoProtectedLeaks = (output: BundleOutput) => {
+  // A protected chunk that's also an entry would be loaded by the runtime
+  // independently of the static-import graph and bypass the gate.
+  const protectedEntries = output
+    .filter((o): o is Rolldown.OutputChunk => o.type === "chunk")
+    .filter(
+      (c) => c.isEntry && c.fileName.startsWith(`${PROTECTED_CHUNK_DIR}/`),
+    )
+    .map((c) => c.fileName);
+  if (protectedEntries.length > 0) {
+    throw new Error(
+      `Protected chunk(s) marked as entries:\n  ${protectedEntries.join("\n  ")}\n` +
+        `Entry chunks are loaded outside the gated import path. ` +
+        `Move the entry to a public chunk that dynamically imports the protected one.`,
+    );
+  }
+
+  const leaks = findProtectedLeaks(output);
+  if (leaks.length === 0) return;
+  throw new Error(
+    `Protected chunk(s) statically reachable from public entry:\n  ${leaks.join("\n  ")}\n` +
+      `This eagerly pulls gated content into the public bundle. ` +
+      `Check that nothing in non-protected entry code statically imports the protected module.`,
+  );
+};
+
+// Moves the protected chunk directory from the client output into the server bundle so static file serving can't reach it.
+export const moveProtectedChunks = async (
+  clientOutDir: string,
+  serverOutDir: string,
+) => {
+  const srcDir = path.join(clientOutDir, PROTECTED_CHUNK_DIR);
+  const files = await readdir(srcDir).catch((err) => {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  });
+  if (!files) return;
+  const destDir = path.join(serverOutDir, PROTECTED_CHUNK_DIR);
+  await mkdir(destDir, { recursive: true });
+  await Promise.all(
+    files.map((file) =>
+      rename(path.join(srcDir, file), path.join(destDir, file)),
+    ),
+  );
+  // Verify nothing was left behind. A partial rename would otherwise
+  // ship gated chunks publicly without erroring.
+  const leftover = await readdir(srcDir).catch(() => []);
+  if (leftover.length > 0) {
+    throw new Error(
+      `moveProtectedChunks left ${leftover.length} file(s) in ${srcDir}: ${leftover.join(", ")}.\n` +
+        `These would be served publicly. Aborting build.`,
+    );
+  }
+  await rm(srcDir, { recursive: true, force: true });
+};
+
+// Ensure protected chunks aren't publicly served under Cloudflare.
+// If `run_worker_first` is missing in wrangler config, protected assets are exposed.
+// Uses plain string matching; false positives may occur if `run_worker_first` is present but commented out.
+export const assertCloudflareWranglerGatesProtected = async (
+  dir: string,
+  config: ConfigWithMeta,
+) => {
+  const { enabled } = getProtectedSourceMatcher(config);
+  if (!enabled) return;
+
+  const protectedPrefix = `${joinUrl(config.basePath, PROTECTED_CHUNK_DIR)}/`;
+  const candidates = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
+  for (const name of candidates) {
+    const file = await readFile(path.join(dir, name), "utf-8").catch(
+      () => undefined,
+    );
+    if (file === undefined) continue;
+    if (file.includes("run_worker_first") && file.includes(protectedPrefix)) {
+      return;
+    }
+    throw new Error(
+      `[zudoku] ${name} must configure \`run_worker_first\` to include \`${protectedPrefix}*\` ` +
+        `so the auth gate runs before the assets binding serves protected chunks. ` +
+        `Without it, ${protectedPrefix}* is publicly readable. ` +
+        `See https://developers.cloudflare.com/workers/static-assets/binding/#run_worker_first.`,
+    );
+  }
+
+  throw new Error(
+    `[zudoku] No wrangler config found in ${dir} (looked for ${candidates.join(", ")}). ` +
+      `Cloudflare adapter requires wrangler config with \`run_worker_first\` covering \`${protectedPrefix}*\`.`,
+  );
+};

package/src/vite/protected/registry.ts

@@ -0,0 +1,82 @@
+import { matchPath } from "react-router";
+import type { ConfigWithMeta } from "../../config/loader.js";
+import { ProtectedRoutesSchema } from "../../config/validators/ProtectedRoutesSchema.js";
+import { joinUrl } from "../../lib/util/joinUrl.js";
+import { matchesProtectedPattern } from "../../lib/util/url.js";
+
+// Module routes contributed by auto-detection or registerProtectedScope.
+export type ModuleScope =
+  | { type: "route"; path: string }
+  | { type: "subtree"; root: string };
+
+const scopes = new Map<string, ModuleScope[]>();
+
+export const clearProtectedRegistry = () => scopes.clear();
+
+export const registerProtectedScope = (
+  moduleId: string,
+  scope: ModuleScope,
+) => {
+  const list = scopes.get(moduleId);
+  if (list) list.push(scope);
+  else scopes.set(moduleId, [scope]);
+};
+
+export const getProtectedScopes = (moduleId: string) => scopes.get(moduleId);
+
+export const protectedRegistryEntries = (): ReadonlyMap<
+  string,
+  readonly ModuleScope[]
+> => scopes;
+
+export type ProtectedSourceMatcher = (moduleId: string) => boolean;
+
+// Returns true if `pattern` matches `scope`, using react-router's matchPath:
+// "/admin" matches only the exact path; "/admin/*" matches /admin and all nested paths.
+export const scopeMatchesPattern = (
+  scope: ModuleScope,
+  pattern: string,
+): boolean => {
+  if (scope.type === "route") {
+    return matchesProtectedPattern(pattern, joinUrl(scope.path));
+  }
+  // Subtree scopes only match patterns with '*' (e.g. '/*') to require explicit descendant gating, like react-router.
+  const root = joinUrl(scope.root);
+  if (!pattern.includes("*")) {
+    return matchesProtectedPattern(pattern, root);
+  }
+  return matchPath({ path: pattern, end: false }, root) != null;
+};
+
+// Returns true if a module ID is gated by any configured protected pattern.
+// Populates registry automatically or via registerProtectedScope.
+export const getProtectedSourceMatcher = (
+  config: ConfigWithMeta,
+): { match: ProtectedSourceMatcher; enabled: boolean; patterns: string[] } => {
+  const protectedRoutes = ProtectedRoutesSchema.parse(config.protectedRoutes);
+  const patterns = protectedRoutes ? Object.keys(protectedRoutes) : [];
+  if (patterns.length === 0) {
+    return { match: () => false, enabled: false, patterns };
+  }
+  return {
+    enabled: true,
+    patterns,
+    match: (id) => {
+      const pathOnly = id.split("?")[0] ?? id;
+      const moduleScopes = scopes.get(pathOnly);
+      if (!moduleScopes) return false;
+      return moduleScopes.some((s) =>
+        patterns.some((p) => scopeMatchesPattern(s, p)),
+      );
+    },
+  };
+};
+
+// Finds patterns not matched by any registered module scope. Indicates typos or missing registerProtectedScope calls.
+export const findUnmatchedProtectedPatterns = (patterns: string[]): string[] =>
+  patterns.filter(
+    (p) =>
+      ![...scopes.values()].some((scopeList) =>
+        scopeList.some((s) => scopeMatchesPattern(s, p)),
+      ),
+  );