@tanstack/start-plugin-core 1.160.1 → 1.161.0

package/dist/esm/import-protection-plugin/plugin.js

@@ -0,0 +1,699 @@
+import * as path from "pathe";
+import { normalizePath } from "vite";
+import { resolveViteId } from "../utils.js";
+import { VITE_ENVIRONMENT_NAMES } from "../constants.js";
+import { formatViolation, ImportGraph, buildTrace } from "./trace.js";
+import { getDefaultImportProtectionRules, getMarkerSpecifiers } from "./defaults.js";
+import { findPostCompileUsagePos } from "./postCompileUsage.js";
+import { matchesAny, compileMatchers } from "./matchers.js";
+import { normalizeFilePath, dedupePatterns } from "./utils.js";
+import { collectMockExportNamesBySource } from "./rewriteDeniedImports.js";
+import { RESOLVED_MOCK_MODULE_ID, loadSilentMockModule, RESOLVED_MOCK_EDGE_PREFIX, loadMockEdgeModule, RESOLVED_MOCK_RUNTIME_PREFIX, loadMockRuntimeModule, RESOLVED_MARKER_PREFIX, loadMarkerModule, MOCK_MODULE_ID, MOCK_EDGE_PREFIX, MOCK_RUNTIME_PREFIX, MARKER_PREFIX, mockRuntimeModuleIdFromViolation, makeMockEdgeModuleId } from "./virtualModules.js";
+import { pickOriginalCodeFromSourcesContent, buildLineIndex, addTraceImportLocations, findPostCompileUsageLocation, findImportStatementLocationFromTransformed, buildCodeSnippet } from "./sourceLocation.js";
+function importProtectionPlugin(opts) {
+  const config = {
+    enabled: true,
+    root: "",
+    command: "build",
+    srcDirectory: "",
+    framework: opts.framework,
+    effectiveBehavior: "error",
+    mockAccess: "error",
+    logMode: "once",
+    maxTraceDepth: 20,
+    compiledRules: {
+      client: { specifiers: [], files: [] },
+      server: { specifiers: [], files: [] }
+    },
+    includeMatchers: [],
+    excludeMatchers: [],
+    ignoreImporterMatchers: [],
+    markerSpecifiers: { serverOnly: /* @__PURE__ */ new Set(), clientOnly: /* @__PURE__ */ new Set() },
+    envTypeMap: new Map(opts.environments.map((e) => [e.name, e.type])),
+    onViolation: void 0
+  };
+  const envStates = /* @__PURE__ */ new Map();
+  const shared = { fileMarkerKind: /* @__PURE__ */ new Map() };
+  function createImportLocCache(env) {
+    const cache = /* @__PURE__ */ new Map();
+    const originalSet = cache.set.bind(cache);
+    cache.set = function(key, value) {
+      originalSet(key, value);
+      const sepIdx = key.indexOf("::");
+      if (sepIdx !== -1) {
+        const file = key.slice(0, sepIdx);
+        let fileKeys = env.importLocByFile.get(file);
+        if (!fileKeys) {
+          fileKeys = /* @__PURE__ */ new Set();
+          env.importLocByFile.set(file, fileKeys);
+        }
+        fileKeys.add(key);
+      }
+      return this;
+    };
+    return cache;
+  }
+  function getMockEdgeExports(env, importerId, source) {
+    const importerFile = normalizeFilePath(importerId);
+    return env.mockExportsByImporter.get(importerFile)?.get(source) ?? [];
+  }
+  function getMarkerKindForFile(fileId) {
+    const file = normalizeFilePath(fileId);
+    return shared.fileMarkerKind.get(file);
+  }
+  function getTransformResultProvider(env) {
+    return {
+      getTransformResult(id) {
+        const fullKey = normalizePath(id);
+        const exact = env.transformResultCache.get(fullKey);
+        if (exact) return exact;
+        const strippedKey = normalizeFilePath(id);
+        return strippedKey !== fullKey ? env.transformResultCache.get(strippedKey) : void 0;
+      }
+    };
+  }
+  async function buildViolationInfo(provider, env, envName, envType, importer, normalizedImporter, source, overrides) {
+    const trace = buildTrace(
+      env.graph,
+      normalizedImporter,
+      config.maxTraceDepth
+    );
+    await addTraceImportLocations(provider, trace, env.importLocCache);
+    const loc = await findPostCompileUsageLocation(
+      provider,
+      importer,
+      source,
+      findPostCompileUsagePos
+    ) || await findImportStatementLocationFromTransformed(
+      provider,
+      importer,
+      source,
+      env.importLocCache
+    );
+    if (trace.length > 0) {
+      const last = trace[trace.length - 1];
+      if (!last.specifier) last.specifier = source;
+      if (loc && last.line == null) {
+        last.line = loc.line;
+        last.column = loc.column;
+      }
+    }
+    const snippet = loc ? buildCodeSnippet(provider, importer, loc) : void 0;
+    return {
+      env: envName,
+      envType,
+      behavior: config.effectiveBehavior,
+      specifier: source,
+      importer: normalizedImporter,
+      ...loc ? { importerLoc: loc } : {},
+      trace,
+      snippet,
+      ...overrides
+    };
+  }
+  async function maybeReportMarkerViolationFromResolvedImport(ctx, provider, env, envName, envType, importer, source, resolvedId, relativePath) {
+    const markerKind = getMarkerKindForFile(resolvedId);
+    const violates = envType === "client" && markerKind === "server" || envType === "server" && markerKind === "client";
+    if (!violates) return void 0;
+    const normalizedImporter = normalizeFilePath(importer);
+    const info = await buildViolationInfo(
+      provider,
+      env,
+      envName,
+      envType,
+      importer,
+      normalizedImporter,
+      source,
+      {
+        type: "marker",
+        resolved: normalizeFilePath(resolvedId),
+        message: markerKind === "server" ? `Module "${relativePath}" is marked server-only but is imported in the client environment` : `Module "${relativePath}" is marked client-only but is imported in the server environment`
+      }
+    );
+    return handleViolation.call(ctx, env, info);
+  }
+  function buildMockEdgeModuleId(env, importerId, source, runtimeId) {
+    const exports = getMockEdgeExports(env, importerId, source);
+    return makeMockEdgeModuleId(exports, source, runtimeId);
+  }
+  function getEnvType(envName) {
+    return config.envTypeMap.get(envName) ?? "server";
+  }
+  function getRulesForEnvironment(envName) {
+    const type = getEnvType(envName);
+    return type === "client" ? config.compiledRules.client : config.compiledRules.server;
+  }
+  const environmentNames = /* @__PURE__ */ new Set([
+    VITE_ENVIRONMENT_NAMES.client,
+    VITE_ENVIRONMENT_NAMES.server
+  ]);
+  if (opts.providerEnvName !== VITE_ENVIRONMENT_NAMES.server) {
+    environmentNames.add(opts.providerEnvName);
+  }
+  function getEnv(envName) {
+    let envState = envStates.get(envName);
+    if (!envState) {
+      const importLocByFile = /* @__PURE__ */ new Map();
+      envState = {
+        graph: new ImportGraph(),
+        deniedSources: /* @__PURE__ */ new Set(),
+        deniedEdges: /* @__PURE__ */ new Map(),
+        mockExportsByImporter: /* @__PURE__ */ new Map(),
+        resolveCache: /* @__PURE__ */ new Map(),
+        resolveCacheByFile: /* @__PURE__ */ new Map(),
+        importLocCache: /* @__PURE__ */ new Map(),
+        // placeholder, replaced below
+        importLocByFile,
+        seenViolations: /* @__PURE__ */ new Set(),
+        transformResultCache: /* @__PURE__ */ new Map(),
+        transformResultKeysByFile: /* @__PURE__ */ new Map()
+      };
+      envState.importLocCache = createImportLocCache(envState);
+      envStates.set(envName, envState);
+    }
+    return envState;
+  }
+  function shouldCheckImporter(importer) {
+    const relativePath = path.relative(config.root, importer);
+    if (config.excludeMatchers.length > 0 && matchesAny(relativePath, config.excludeMatchers)) {
+      return false;
+    }
+    if (config.ignoreImporterMatchers.length > 0 && matchesAny(relativePath, config.ignoreImporterMatchers)) {
+      return false;
+    }
+    if (config.includeMatchers.length > 0) {
+      return !!matchesAny(relativePath, config.includeMatchers);
+    }
+    if (config.srcDirectory) {
+      return importer.startsWith(config.srcDirectory);
+    }
+    return true;
+  }
+  function dedupeKey(type, importer, specifier, resolved) {
+    return `${type}:${importer}:${specifier}:${resolved ?? ""}`;
+  }
+  function hasSeen(env, key) {
+    if (config.logMode === "always") return false;
+    if (env.seenViolations.has(key)) return true;
+    env.seenViolations.add(key);
+    return false;
+  }
+  function getRelativePath(absolutePath) {
+    return normalizePath(path.relative(config.root, absolutePath));
+  }
+  return [
+    {
+      name: "tanstack-start-core:import-protection",
+      enforce: "pre",
+      applyToEnvironment(env) {
+        if (!config.enabled) return false;
+        return environmentNames.has(env.name);
+      },
+      configResolved(viteConfig) {
+        config.root = viteConfig.root;
+        config.command = viteConfig.command;
+        const { startConfig, resolvedStartConfig } = opts.getConfig();
+        config.srcDirectory = resolvedStartConfig.srcDirectory;
+        const userOpts = startConfig.importProtection;
+        if (userOpts?.enabled === false) {
+          config.enabled = false;
+          return;
+        }
+        config.enabled = true;
+        if (userOpts?.behavior) {
+          if (typeof userOpts.behavior === "string") {
+            config.effectiveBehavior = userOpts.behavior;
+          } else {
+            config.effectiveBehavior = viteConfig.command === "serve" ? userOpts.behavior.dev ?? "mock" : userOpts.behavior.build ?? "error";
+          }
+        } else {
+          config.effectiveBehavior = viteConfig.command === "serve" ? "mock" : "error";
+        }
+        config.logMode = userOpts?.log ?? "once";
+        config.mockAccess = userOpts?.mockAccess ?? "error";
+        config.maxTraceDepth = userOpts?.maxTraceDepth ?? 20;
+        config.onViolation = userOpts?.onViolation;
+        const defaults = getDefaultImportProtectionRules(opts.framework);
+        const clientSpecifiers = dedupePatterns([
+          ...defaults.client.specifiers,
+          ...userOpts?.client?.specifiers ?? []
+        ]);
+        const clientFiles = userOpts?.client?.files ? [...userOpts.client.files] : [...defaults.client.files];
+        const serverSpecifiers = userOpts?.server?.specifiers ? dedupePatterns([...userOpts.server.specifiers]) : dedupePatterns([...defaults.server.specifiers]);
+        const serverFiles = userOpts?.server?.files ? [...userOpts.server.files] : [...defaults.server.files];
+        config.compiledRules.client = {
+          specifiers: compileMatchers(clientSpecifiers),
+          files: compileMatchers(clientFiles)
+        };
+        config.compiledRules.server = {
+          specifiers: compileMatchers(serverSpecifiers),
+          files: compileMatchers(serverFiles)
+        };
+        if (userOpts?.include) {
+          config.includeMatchers = compileMatchers(userOpts.include);
+        }
+        if (userOpts?.exclude) {
+          config.excludeMatchers = compileMatchers(userOpts.exclude);
+        }
+        if (userOpts?.ignoreImporters) {
+          config.ignoreImporterMatchers = compileMatchers(
+            userOpts.ignoreImporters
+          );
+        }
+        const markers = getMarkerSpecifiers(opts.framework);
+        config.markerSpecifiers = {
+          serverOnly: new Set(markers.serverOnly),
+          clientOnly: new Set(markers.clientOnly)
+        };
+        for (const envDef of opts.environments) {
+          const envState = getEnv(envDef.name);
+          if (resolvedStartConfig.routerFilePath) {
+            envState.graph.addEntry(
+              normalizePath(resolvedStartConfig.routerFilePath)
+            );
+          }
+          if (resolvedStartConfig.startFilePath) {
+            envState.graph.addEntry(
+              normalizePath(resolvedStartConfig.startFilePath)
+            );
+          }
+        }
+      },
+      buildStart() {
+        if (!config.enabled) return;
+        for (const envState of envStates.values()) {
+          envState.resolveCache.clear();
+          envState.resolveCacheByFile.clear();
+          envState.importLocCache.clear();
+          envState.importLocByFile.clear();
+          envState.seenViolations.clear();
+          envState.transformResultCache.clear();
+          envState.transformResultKeysByFile.clear();
+          envState.graph.clear();
+          envState.deniedSources.clear();
+          envState.deniedEdges.clear();
+          envState.mockExportsByImporter.clear();
+        }
+        shared.fileMarkerKind.clear();
+        for (const envDef of opts.environments) {
+          const envState = getEnv(envDef.name);
+          const { resolvedStartConfig } = opts.getConfig();
+          if (resolvedStartConfig.routerFilePath) {
+            envState.graph.addEntry(
+              normalizePath(resolvedStartConfig.routerFilePath)
+            );
+          }
+          if (resolvedStartConfig.startFilePath) {
+            envState.graph.addEntry(
+              normalizePath(resolvedStartConfig.startFilePath)
+            );
+          }
+        }
+      },
+      hotUpdate(ctx) {
+        if (!config.enabled) return;
+        for (const mod of ctx.modules) {
+          if (mod.id) {
+            const id = mod.id;
+            const importerFile = normalizeFilePath(id);
+            shared.fileMarkerKind.delete(importerFile);
+            for (const envState of envStates.values()) {
+              const locKeys = envState.importLocByFile.get(importerFile);
+              if (locKeys) {
+                for (const key of locKeys) {
+                  envState.importLocCache.delete(key);
+                }
+                envState.importLocByFile.delete(importerFile);
+              }
+              const resolveKeys = envState.resolveCacheByFile.get(importerFile);
+              if (resolveKeys) {
+                for (const key of resolveKeys) {
+                  envState.resolveCache.delete(key);
+                }
+                envState.resolveCacheByFile.delete(importerFile);
+              }
+              envState.graph.invalidate(importerFile);
+              envState.deniedEdges.delete(importerFile);
+              envState.mockExportsByImporter.delete(importerFile);
+              const transformKeys = envState.transformResultKeysByFile.get(importerFile);
+              if (transformKeys) {
+                for (const key of transformKeys) {
+                  envState.transformResultCache.delete(key);
+                }
+                envState.transformResultKeysByFile.delete(importerFile);
+              } else {
+                envState.transformResultCache.delete(importerFile);
+              }
+            }
+          }
+        }
+      },
+      async resolveId(source, importer, _options) {
+        if (!config.enabled) return void 0;
+        const envName = this.environment.name;
+        const env = getEnv(envName);
+        const envType = getEnvType(envName);
+        const provider = getTransformResultProvider(env);
+        if (source === MOCK_MODULE_ID) {
+          return RESOLVED_MOCK_MODULE_ID;
+        }
+        if (source.startsWith(MOCK_EDGE_PREFIX)) {
+          return resolveViteId(source);
+        }
+        if (source.startsWith(MOCK_RUNTIME_PREFIX)) {
+          return resolveViteId(source);
+        }
+        if (source.startsWith(MARKER_PREFIX)) {
+          return resolveViteId(source);
+        }
+        if (!importer) {
+          env.graph.addEntry(source);
+          return void 0;
+        }
+        if (source.startsWith("\0") || source.startsWith("virtual:")) {
+          return void 0;
+        }
+        if (config.markerSpecifiers.serverOnly.has(source)) {
+          const resolvedImporter = normalizeFilePath(importer);
+          const existing = shared.fileMarkerKind.get(resolvedImporter);
+          if (existing && existing !== "server") {
+            this.error(
+              `[import-protection] File "${getRelativePath(resolvedImporter)}" has both server-only and client-only markers. This is not allowed.`
+            );
+          }
+          shared.fileMarkerKind.set(resolvedImporter, "server");
+          if (envType === "client") {
+            const info = await buildViolationInfo(
+              provider,
+              env,
+              envName,
+              envType,
+              importer,
+              resolvedImporter,
+              source,
+              {
+                type: "marker",
+                message: `Module "${getRelativePath(resolvedImporter)}" is marked server-only but is imported in the client environment`
+              }
+            );
+            handleViolation.call(this, env, info);
+          }
+          return resolveViteId(`${MARKER_PREFIX}server-only`);
+        }
+        if (config.markerSpecifiers.clientOnly.has(source)) {
+          const resolvedImporter = normalizeFilePath(importer);
+          const existing = shared.fileMarkerKind.get(resolvedImporter);
+          if (existing && existing !== "client") {
+            this.error(
+              `[import-protection] File "${getRelativePath(resolvedImporter)}" has both server-only and client-only markers. This is not allowed.`
+            );
+          }
+          shared.fileMarkerKind.set(resolvedImporter, "client");
+          if (envType === "server") {
+            const info = await buildViolationInfo(
+              provider,
+              env,
+              envName,
+              envType,
+              importer,
+              resolvedImporter,
+              source,
+              {
+                type: "marker",
+                message: `Module "${getRelativePath(resolvedImporter)}" is marked client-only but is imported in the server environment`
+              }
+            );
+            handleViolation.call(this, env, info);
+          }
+          return resolveViteId(`${MARKER_PREFIX}client-only`);
+        }
+        const normalizedImporter = normalizeFilePath(importer);
+        if (!shouldCheckImporter(normalizedImporter)) {
+          return void 0;
+        }
+        const matchers = getRulesForEnvironment(envName);
+        const specifierMatch = matchesAny(source, matchers.specifiers);
+        if (specifierMatch) {
+          env.graph.addEdge(source, normalizedImporter, source);
+          const info = await buildViolationInfo(
+            provider,
+            env,
+            envName,
+            envType,
+            importer,
+            normalizedImporter,
+            source,
+            {
+              type: "specifier",
+              pattern: specifierMatch.pattern,
+              message: `Import "${source}" is denied in the "${envName}" environment`
+            }
+          );
+          return handleViolation.call(this, env, info);
+        }
+        const cacheKey = `${normalizedImporter}:${source}`;
+        let resolved;
+        if (env.resolveCache.has(cacheKey)) {
+          resolved = env.resolveCache.get(cacheKey) || null;
+        } else {
+          const result = await this.resolve(source, importer, {
+            skipSelf: true
+          });
+          resolved = result ? normalizeFilePath(result.id) : null;
+          env.resolveCache.set(cacheKey, resolved);
+          let fileKeys = env.resolveCacheByFile.get(normalizedImporter);
+          if (!fileKeys) {
+            fileKeys = /* @__PURE__ */ new Set();
+            env.resolveCacheByFile.set(normalizedImporter, fileKeys);
+          }
+          fileKeys.add(cacheKey);
+        }
+        if (resolved) {
+          const relativePath = getRelativePath(resolved);
+          env.graph.addEdge(resolved, normalizedImporter, source);
+          const fileMatch = matchers.files.length > 0 ? matchesAny(relativePath, matchers.files) : void 0;
+          if (fileMatch) {
+            const info = await buildViolationInfo(
+              provider,
+              env,
+              envName,
+              envType,
+              importer,
+              normalizedImporter,
+              source,
+              {
+                type: "file",
+                pattern: fileMatch.pattern,
+                resolved,
+                message: `Import "${source}" (resolved to "${relativePath}") is denied in the "${envName}" environment`
+              }
+            );
+            return handleViolation.call(this, env, info);
+          }
+          const markerRes = await maybeReportMarkerViolationFromResolvedImport(
+            this,
+            provider,
+            env,
+            envName,
+            envType,
+            importer,
+            source,
+            resolved,
+            relativePath
+          );
+          if (markerRes !== void 0) {
+            return markerRes;
+          }
+        }
+        return void 0;
+      },
+      load: {
+        filter: {
+          id: new RegExp(
+            `(${RESOLVED_MOCK_MODULE_ID.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MARKER_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MOCK_EDGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MOCK_RUNTIME_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")})`
+          )
+        },
+        handler(id) {
+          if (!config.enabled) return void 0;
+          if (id === RESOLVED_MOCK_MODULE_ID) {
+            return loadSilentMockModule();
+          }
+          if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {
+            return loadMockEdgeModule(
+              id.slice(RESOLVED_MOCK_EDGE_PREFIX.length)
+            );
+          }
+          if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {
+            return loadMockRuntimeModule(
+              id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length)
+            );
+          }
+          if (id.startsWith(RESOLVED_MARKER_PREFIX)) {
+            return loadMarkerModule();
+          }
+          return void 0;
+        }
+      }
+    },
+    {
+      // This plugin runs WITHOUT `enforce` so it executes after all
+      // `enforce: 'pre'` transform hooks (including the Start compiler).
+      // It captures the transformed code + composed sourcemap for every module
+      // so that the `resolveId` hook (in the main plugin above) can look up
+      // the importer's transform result and map violation locations back to
+      // original source.
+      //
+      // Why not use `ctx.load()` in `resolveId`?
+      //   - Vite dev: `this.load()` returns a ModuleInfo proxy that throws on
+      //     `.code` access — code is not exposed.
+      //   - Rollup build: `ModuleInfo` has `.code` but NOT `.map`, so we
+      //     can't map generated positions back to original source.
+      //
+      // By caching in the transform hook we get both code and the composed
+      // sourcemap that chains all the way back to the original file.
+      //
+      // Performance: only files under `srcDirectory` are cached because only
+      // those can be importers in a violation.  Third-party code in
+      // node_modules is never checked.
+      name: "tanstack-start-core:import-protection-transform-cache",
+      applyToEnvironment(env) {
+        if (!config.enabled) return false;
+        return environmentNames.has(env.name);
+      },
+      transform: {
+        filter: {
+          id: {
+            include: [/\.[cm]?[tj]sx?($|\?)/]
+          }
+        },
+        handler(code, id) {
+          if (!config.enabled) return void 0;
+          const envName = this.environment.name;
+          const file = normalizeFilePath(id);
+          if (!shouldCheckImporter(file)) {
+            return void 0;
+          }
+          let map;
+          try {
+            map = this.getCombinedSourcemap();
+          } catch {
+            map = void 0;
+          }
+          let originalCode;
+          if (map?.sourcesContent) {
+            originalCode = pickOriginalCodeFromSourcesContent(
+              map,
+              file,
+              config.root
+            );
+          }
+          const lineIndex = buildLineIndex(code);
+          const cacheKey = normalizePath(id);
+          const envState = getEnv(envName);
+          envState.transformResultCache.set(cacheKey, {
+            code,
+            map,
+            originalCode,
+            lineIndex
+          });
+          let keySet = envState.transformResultKeysByFile.get(file);
+          if (!keySet) {
+            keySet = /* @__PURE__ */ new Set();
+            envState.transformResultKeysByFile.set(file, keySet);
+          }
+          keySet.add(cacheKey);
+          if (cacheKey !== file) {
+            envState.transformResultCache.set(file, {
+              code,
+              map,
+              originalCode,
+              lineIndex
+            });
+            keySet.add(file);
+          }
+          return void 0;
+        }
+      }
+    },
+    {
+      // Separate plugin so the transform can be enabled/disabled per-environment.
+      name: "tanstack-start-core:import-protection-mock-rewrite",
+      enforce: "pre",
+      // Only needed during dev. In build, we rely on Rollup's syntheticNamedExports.
+      apply: "serve",
+      applyToEnvironment(env) {
+        if (!config.enabled) return false;
+        if (config.effectiveBehavior !== "mock") return false;
+        return environmentNames.has(env.name);
+      },
+      transform: {
+        filter: {
+          id: {
+            include: [/\.[cm]?[tj]sx?($|\?)/]
+          }
+        },
+        handler(code, id) {
+          if (!config.enabled) return void 0;
+          const envName = this.environment.name;
+          const envState = envStates.get(envName);
+          if (!envState) return void 0;
+          try {
+            const importerFile = normalizeFilePath(id);
+            envState.mockExportsByImporter.set(
+              importerFile,
+              collectMockExportNamesBySource(code)
+            );
+          } catch {
+          }
+          return void 0;
+        }
+      }
+    }
+  ];
+  function handleViolation(env, info) {
+    const key = dedupeKey(
+      info.type,
+      info.importer,
+      info.specifier,
+      info.resolved
+    );
+    if (config.onViolation) {
+      const result = config.onViolation(info);
+      if (result === false) {
+        return void 0;
+      }
+    }
+    const seen = hasSeen(env, key);
+    if (config.effectiveBehavior === "error") {
+      if (!seen) this.error(formatViolation(info, config.root));
+      return void 0;
+    }
+    if (!seen) {
+      this.warn(formatViolation(info, config.root));
+    }
+    env.deniedSources.add(info.specifier);
+    let edgeSet = env.deniedEdges.get(info.importer);
+    if (!edgeSet) {
+      edgeSet = /* @__PURE__ */ new Set();
+      env.deniedEdges.set(info.importer, edgeSet);
+    }
+    edgeSet.add(info.specifier);
+    if (config.command === "serve") {
+      const runtimeId = mockRuntimeModuleIdFromViolation(
+        info,
+        config.mockAccess,
+        config.root
+      );
+      return resolveViteId(
+        buildMockEdgeModuleId(env, info.importer, info.specifier, runtimeId)
+      );
+    }
+    return { id: RESOLVED_MOCK_MODULE_ID, syntheticNamedExports: true };
+  }
+}
+export {
+  RESOLVED_MOCK_MODULE_ID,
+  dedupePatterns,
+  importProtectionPlugin
+};
+//# sourceMappingURL=plugin.js.map