@tanstack/start-plugin-core 1.160.2 → 1.161.0

package/src/import-protection-plugin/postCompileUsage.ts

@@ -0,0 +1,266 @@
+import * as t from '@babel/types'
+import { parseAst } from '@tanstack/router-utils'
+
+export type UsagePos = { line: number; column0: number }
+
+function collectPatternBindings(
+  node: t.Node | null | undefined,
+  out: Set<string>,
+): void {
+  if (!node) return
+  if (t.isIdentifier(node)) {
+    out.add(node.name)
+    return
+  }
+  if (t.isRestElement(node)) {
+    collectPatternBindings(node.argument, out)
+    return
+  }
+  if (t.isAssignmentPattern(node)) {
+    collectPatternBindings(node.left, out)
+    return
+  }
+  if (t.isObjectPattern(node)) {
+    for (const prop of node.properties) {
+      if (t.isRestElement(prop)) {
+        collectPatternBindings(prop.argument, out)
+      } else if (t.isObjectProperty(prop)) {
+        collectPatternBindings(prop.value as t.Node, out)
+      }
+    }
+    return
+  }
+  if (t.isArrayPattern(node)) {
+    for (const el of node.elements) {
+      collectPatternBindings(el, out)
+    }
+    return
+  }
+}
+
+function isBindingPosition(node: t.Node, parent: t.Node | null): boolean {
+  if (!parent) return false
+  if (t.isFunctionDeclaration(parent) && parent.id === node) return true
+  if (t.isFunctionExpression(parent) && parent.id === node) return true
+  if (t.isClassDeclaration(parent) && parent.id === node) return true
+  if (t.isClassExpression(parent) && parent.id === node) return true
+  if (t.isVariableDeclarator(parent) && parent.id === node) return true
+  if (t.isImportSpecifier(parent) && parent.local === node) return true
+  if (t.isImportDefaultSpecifier(parent) && parent.local === node) return true
+  if (t.isImportNamespaceSpecifier(parent) && parent.local === node) return true
+  if (
+    t.isObjectProperty(parent) &&
+    parent.key === node &&
+    !parent.computed &&
+    // In `{ foo }`, the identifier is also a value reference and must count as
+    // usage. Babel represents this as `shorthand: true`.
+    !parent.shorthand
+  )
+    return true
+  if (t.isObjectMethod(parent) && parent.key === node && !parent.computed)
+    return true
+  if (t.isExportSpecifier(parent) && parent.exported === node) return true
+  return false
+}
+
+function isPreferredUsage(node: t.Node, parent: t.Node | null): boolean {
+  if (!parent) return false
+  if (t.isCallExpression(parent) && parent.callee === node) return true
+  if (t.isNewExpression(parent) && parent.callee === node) return true
+  if (t.isMemberExpression(parent) && parent.object === node) return true
+  return false
+}
+
+function isScopeNode(node: t.Node): boolean {
+  return (
+    t.isProgram(node) ||
+    t.isFunctionDeclaration(node) ||
+    t.isFunctionExpression(node) ||
+    t.isArrowFunctionExpression(node) ||
+    t.isBlockStatement(node) ||
+    t.isCatchClause(node)
+  )
+}
+
+/** `var` hoists to the nearest function or program scope, not block scopes. */
+function isFunctionScopeNode(node: t.Node): boolean {
+  return (
+    t.isProgram(node) ||
+    t.isFunctionDeclaration(node) ||
+    t.isFunctionExpression(node) ||
+    t.isArrowFunctionExpression(node)
+  )
+}
+
+function collectScopeBindings(node: t.Node, out: Set<string>): void {
+  if (
+    t.isFunctionDeclaration(node) ||
+    t.isFunctionExpression(node) ||
+    t.isArrowFunctionExpression(node)
+  ) {
+    for (const p of node.params) {
+      collectPatternBindings(p, out)
+    }
+    return
+  }
+
+  if (t.isCatchClause(node)) {
+    collectPatternBindings(node.param, out)
+    return
+  }
+}
+
+/**
+ * Given transformed code, returns the first "meaningful" usage position for an
+ * import from `source` that survives compilation.
+ *
+ * The returned column is 0-based (Babel loc semantics).
+ */
+export function findPostCompileUsagePos(
+  code: string,
+  source: string,
+): UsagePos | undefined {
+  const ast = parseAst({ code })
+
+  // 1) Determine local names bound from this specifier
+  const imported = new Set<string>()
+  for (const node of ast.program.body) {
+    if (t.isImportDeclaration(node) && node.source.value === source) {
+      if (node.importKind === 'type') continue
+      for (const s of node.specifiers) {
+        if (t.isImportSpecifier(s) && s.importKind === 'type') continue
+        imported.add(s.local.name)
+      }
+    }
+  }
+  if (imported.size === 0) return undefined
+
+  let preferred: UsagePos | undefined
+  let anyUsage: UsagePos | undefined
+
+  // Scope stack (module scope at index 0).
+  // Each entry tracks bindings and whether it is a function/program scope
+  // (needed for `var` hoisting).
+  interface ScopeEntry {
+    bindings: Set<string>
+    isFnScope: boolean
+  }
+  const scopes: Array<ScopeEntry> = [{ bindings: new Set(), isFnScope: true }]
+
+  function isShadowed(name: string): boolean {
+    // Check inner scopes only
+    for (let i = scopes.length - 1; i >= 1; i--) {
+      if (scopes[i]!.bindings.has(name)) return true
+    }
+    return false
+  }
+
+  function record(node: t.Node, kind: 'preferred' | 'any') {
+    const loc = node.loc?.start
+    if (!loc) return
+    const pos: UsagePos = { line: loc.line, column0: loc.column }
+    if (kind === 'preferred') {
+      preferred ||= pos
+    } else {
+      anyUsage ||= pos
+    }
+  }
+
+  function pushScope(node: t.Node): void {
+    const bindings = new Set<string>()
+    collectScopeBindings(node, bindings)
+    scopes.push({ bindings, isFnScope: isFunctionScopeNode(node) })
+  }
+
+  function popScope(): void {
+    scopes.pop()
+  }
+
+  /** Find the nearest function/program scope entry in the stack. */
+  function nearestFnScope(): ScopeEntry {
+    for (let i = scopes.length - 1; i >= 0; i--) {
+      if (scopes[i]!.isFnScope) return scopes[i]!
+    }
+    // Should never happen (index 0 is always a function scope).
+    return scopes[0]!
+  }
+
+  // The walker accepts AST nodes, arrays (from node children like
+  // `body`, `params`, etc.), or null/undefined for optional children.
+  type Walkable =
+    | t.Node
+    | ReadonlyArray<t.Node | null | undefined>
+    | null
+    | undefined
+
+  function walk(node: Walkable, parent: t.Node | null) {
+    if (!node) return
+    if (preferred && anyUsage) return
+
+    if (Array.isArray(node)) {
+      for (const n of node) walk(n, parent)
+      return
+    }
+
+    // After the array check + early return, node is guaranteed to be t.Node.
+    // TypeScript doesn't narrow ReadonlyArray from the union, so we assert.
+    const astNode = node as t.Node
+
+    // Skip import declarations entirely
+    if (t.isImportDeclaration(astNode)) return
+
+    const enterScope = isScopeNode(astNode)
+    if (enterScope) {
+      pushScope(astNode)
+    }
+
+    // Add lexical bindings for variable declarations and class/function decls.
+    // Note: function/class *declaration* identifiers bind in the parent scope,
+    // so we register them before walking children.
+    if (t.isFunctionDeclaration(astNode) && astNode.id) {
+      scopes[scopes.length - 2]?.bindings.add(astNode.id.name)
+    }
+    if (t.isClassDeclaration(astNode) && astNode.id) {
+      scopes[scopes.length - 2]?.bindings.add(astNode.id.name)
+    }
+    if (t.isVariableDeclarator(astNode)) {
+      // `var` hoists to the nearest function/program scope, not block scope.
+      const isVar = t.isVariableDeclaration(parent) && parent.kind === 'var'
+      const target = isVar
+        ? nearestFnScope().bindings
+        : scopes[scopes.length - 1]!.bindings
+      collectPatternBindings(astNode.id, target)
+    }
+
+    if (t.isIdentifier(astNode) && imported.has(astNode.name)) {
+      if (!isBindingPosition(astNode, parent) && !isShadowed(astNode.name)) {
+        if (isPreferredUsage(astNode, parent)) {
+          record(astNode, 'preferred')
+        } else {
+          record(astNode, 'any')
+        }
+      }
+    }
+
+    // Iterate child properties of this AST node. We use a Record cast since
+    // Babel node types don't expose an index signature, but we need to walk
+    // all child properties generically.
+    const record_ = astNode as unknown as Record<string, unknown>
+    for (const key of Object.keys(record_)) {
+      const value = record_[key]
+      if (!value) continue
+      if (key === 'loc' || key === 'start' || key === 'end') continue
+      if (key === 'parent') continue
+      if (typeof value === 'string' || typeof value === 'number') continue
+      walk(value as Walkable, astNode)
+      if (preferred && anyUsage) break
+    }
+
+    if (enterScope) {
+      popScope()
+    }
+  }
+
+  walk(ast.program, null)
+  return preferred ?? anyUsage
+}

package/src/import-protection-plugin/rewriteDeniedImports.ts

@@ -0,0 +1,255 @@
+import * as t from '@babel/types'
+import { generateFromAst, parseAst } from '@tanstack/router-utils'
+
+import { MOCK_MODULE_ID } from './virtualModules'
+
+// ---------------------------------------------------------------------------
+// Export name collection (for dev mock-edge modules)
+// ---------------------------------------------------------------------------
+
+export function isValidExportName(name: string): boolean {
+  if (name === 'default') return false
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name)
+}
+
+/**
+ * Best-effort static analysis of an importer's source to determine which
+ * named exports are needed per specifier, to keep native ESM valid in dev.
+ */
+export function collectMockExportNamesBySource(
+  code: string,
+): Map<string, Array<string>> {
+  const ast = parseAst({ code })
+
+  const namesBySource = new Map<string, Set<string>>()
+  const add = (source: string, name: string) => {
+    if (!isValidExportName(name)) return
+    let set = namesBySource.get(source)
+    if (!set) {
+      set = new Set<string>()
+      namesBySource.set(source, set)
+    }
+    set.add(name)
+  }
+
+  for (const node of ast.program.body) {
+    if (t.isImportDeclaration(node)) {
+      if (node.importKind === 'type') continue
+      const source = node.source.value
+      for (const s of node.specifiers) {
+        if (!t.isImportSpecifier(s)) continue
+        if (s.importKind === 'type') continue
+        const importedName = t.isIdentifier(s.imported)
+          ? s.imported.name
+          : s.imported.value
+        // `import { default as x } from 'm'` only requires a default export.
+        if (importedName === 'default') continue
+        add(source, importedName)
+      }
+    }
+
+    if (t.isExportNamedDeclaration(node) && node.source?.value) {
+      if (node.exportKind === 'type') continue
+      const source = node.source.value
+      for (const s of node.specifiers) {
+        if (!t.isExportSpecifier(s)) continue
+        if (s.exportKind === 'type') continue
+        add(source, s.local.name)
+      }
+    }
+  }
+
+  const out = new Map<string, Array<string>>()
+  for (const [source, set] of namesBySource) {
+    out.set(source, Array.from(set).sort())
+  }
+  return out
+}
+
+// ---------------------------------------------------------------------------
+// AST-based import rewriting
+// ---------------------------------------------------------------------------
+
+/**
+ * Rewrite static imports/re-exports from denied sources using Babel AST transforms.
+ *
+ * Transforms:
+ *   import { a as b, c } from 'denied'
+ * Into:
+ *   import __tss_deny_0 from 'tanstack-start-import-protection:mock'
+ *   const b = __tss_deny_0.a
+ *   const c = __tss_deny_0.c
+ *
+ * Also handles:
+ *   import def from 'denied'        -> import def from mock
+ *   import * as ns from 'denied'    -> import ns from mock
+ *   export { x } from 'denied'      -> export const x = mock.x
+ *   export * from 'denied'          -> removed
+ *   export { x as y } from 'denied' -> export const y = mock.x
+ */
+export function rewriteDeniedImports(
+  code: string,
+  id: string,
+  deniedSources: Set<string>,
+  getMockModuleId: (source: string) => string = () => MOCK_MODULE_ID,
+): { code: string; map?: object | null } | undefined {
+  const ast = parseAst({ code })
+  let modified = false
+  let mockCounter = 0
+
+  // Walk program body in reverse so splice indices stay valid
+  for (let i = ast.program.body.length - 1; i >= 0; i--) {
+    const node = ast.program.body[i]!
+
+    // --- import declarations ---
+    if (t.isImportDeclaration(node)) {
+      // Skip type-only imports
+      if (node.importKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      const mockVar = `__tss_deny_${mockCounter++}`
+      const replacements: Array<t.Statement> = []
+
+      // import __tss_deny_N from '<mock>'
+      replacements.push(
+        t.importDeclaration(
+          [t.importDefaultSpecifier(t.identifier(mockVar))],
+          t.stringLiteral(getMockModuleId(node.source.value)),
+        ),
+      )
+
+      for (const specifier of node.specifiers) {
+        if (t.isImportDefaultSpecifier(specifier)) {
+          // import def from 'denied' -> const def = __tss_deny_N
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(specifier.local.name),
+                t.identifier(mockVar),
+              ),
+            ]),
+          )
+        } else if (t.isImportNamespaceSpecifier(specifier)) {
+          // import * as ns from 'denied' -> const ns = __tss_deny_N
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(specifier.local.name),
+                t.identifier(mockVar),
+              ),
+            ]),
+          )
+        } else if (t.isImportSpecifier(specifier)) {
+          // Skip type-only specifiers
+          if (specifier.importKind === 'type') continue
+          // import { a as b } from 'denied' -> const b = __tss_deny_N.a
+          const importedName = t.isIdentifier(specifier.imported)
+            ? specifier.imported.name
+            : specifier.imported.value
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(specifier.local.name),
+                t.memberExpression(
+                  t.identifier(mockVar),
+                  t.identifier(importedName),
+                ),
+              ),
+            ]),
+          )
+        }
+      }
+
+      ast.program.body.splice(i, 1, ...replacements)
+      modified = true
+      continue
+    }
+
+    // --- export { x } from 'denied' ---
+    if (t.isExportNamedDeclaration(node) && node.source) {
+      if (node.exportKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      const mockVar = `__tss_deny_${mockCounter++}`
+      const replacements: Array<t.Statement> = []
+
+      // import __tss_deny_N from '<mock>'
+      replacements.push(
+        t.importDeclaration(
+          [t.importDefaultSpecifier(t.identifier(mockVar))],
+          t.stringLiteral(getMockModuleId(node.source.value)),
+        ),
+      )
+
+      // For each re-exported specifier, create an exported const
+      const exportSpecifiers: Array<{
+        localName: string
+        exportedName: string
+      }> = []
+      for (const specifier of node.specifiers) {
+        if (t.isExportSpecifier(specifier)) {
+          if (specifier.exportKind === 'type') continue
+          const localName = specifier.local.name
+          const exportedName = t.isIdentifier(specifier.exported)
+            ? specifier.exported.name
+            : specifier.exported.value
+
+          const internalVar = `__tss_reexport_${localName}`
+          // const __tss_reexport_x = __tss_deny_N.x
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(internalVar),
+                t.memberExpression(
+                  t.identifier(mockVar),
+                  t.identifier(localName),
+                ),
+              ),
+            ]),
+          )
+          exportSpecifiers.push({ localName: internalVar, exportedName })
+        }
+      }
+
+      // export { __tss_reexport_x as x, ... }
+      if (exportSpecifiers.length > 0) {
+        replacements.push(
+          t.exportNamedDeclaration(
+            null,
+            exportSpecifiers.map((s) =>
+              t.exportSpecifier(
+                t.identifier(s.localName),
+                t.identifier(s.exportedName),
+              ),
+            ),
+          ),
+        )
+      }
+
+      ast.program.body.splice(i, 1, ...replacements)
+      modified = true
+      continue
+    }
+
+    // --- export * from 'denied' ---
+    if (t.isExportAllDeclaration(node)) {
+      if (node.exportKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      // Remove the star re-export entirely
+      ast.program.body.splice(i, 1)
+      modified = true
+      continue
+    }
+  }
+
+  if (!modified) return undefined
+
+  const result = generateFromAst(ast, {
+    sourceMaps: true,
+    sourceFileName: id,
+    filename: id,
+  })
+
+  return { code: result.code, map: result.map }
+}