@tanstack/start-plugin-core 1.161.3 → 1.162.0

package/dist/esm/import-protection-plugin/plugin.js

@@ -1,23 +1,102 @@
-import * as path from "pathe";
 import { normalizePath } from "vite";
 import { resolveViteId } from "../utils.js";
 import { VITE_ENVIRONMENT_NAMES } from "../constants.js";
 import { SERVER_FN_LOOKUP } from "../start-compiler-plugin/plugin.js";
-import { formatViolation, ImportGraph, buildTrace } from "./trace.js";
+import { ImportGraph, formatViolation, buildTrace } from "./trace.js";
 import { getDefaultImportProtectionRules, getMarkerSpecifiers } from "./defaults.js";
 import { findPostCompileUsagePos } from "./postCompileUsage.js";
 import { matchesAny, compileMatchers } from "./matchers.js";
-import { normalizeFilePath, dedupePatterns } from "./utils.js";
+import { escapeRegExp, normalizeFilePath, getOrCreate, clearNormalizeFilePathCache, dedupePatterns, extractImportSources, relativizePath } from "./utils.js";
 import { collectMockExportNamesBySource } from "./rewriteDeniedImports.js";
 import { RESOLVED_MOCK_MODULE_ID, loadSilentMockModule, RESOLVED_MOCK_EDGE_PREFIX, loadMockEdgeModule, RESOLVED_MOCK_RUNTIME_PREFIX, loadMockRuntimeModule, RESOLVED_MARKER_PREFIX, loadMarkerModule, MOCK_MODULE_ID, MOCK_EDGE_PREFIX, MOCK_RUNTIME_PREFIX, MARKER_PREFIX, mockRuntimeModuleIdFromViolation, makeMockEdgeModuleId } from "./virtualModules.js";
-import { pickOriginalCodeFromSourcesContent, buildLineIndex, addTraceImportLocations, findPostCompileUsageLocation, findImportStatementLocationFromTransformed, buildCodeSnippet } from "./sourceLocation.js";
+import { clearImportPatternCache, pickOriginalCodeFromSourcesContent, buildLineIndex, ImportLocCache, findPostCompileUsageLocation, findImportStatementLocationFromTransformed, buildCodeSnippet, addTraceImportLocations } from "./sourceLocation.js";
+const SERVER_FN_LOOKUP_QUERY = "?" + SERVER_FN_LOOKUP;
+const RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`);
+const RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`);
+const IMPORT_PROTECTION_DEBUG = process.env.TSR_IMPORT_PROTECTION_DEBUG === "1" || process.env.TSR_IMPORT_PROTECTION_DEBUG === "true";
+const IMPORT_PROTECTION_DEBUG_FILTER = process.env.TSR_IMPORT_PROTECTION_DEBUG_FILTER;
+function debugLog(...args) {
+  if (!IMPORT_PROTECTION_DEBUG) return;
+  console.warn("[import-protection:debug]", ...args);
+}
+function matchesDebugFilter(...values) {
+  if (!IMPORT_PROTECTION_DEBUG_FILTER) return true;
+  return values.some((v) => v.includes(IMPORT_PROTECTION_DEBUG_FILTER));
+}
 function importProtectionPlugin(opts) {
+  let devServer = null;
+  function buildTraceFromModuleGraph(envName, env, targetFile) {
+    if (!devServer) return null;
+    const environment = devServer.environments[envName];
+    if (!environment) return null;
+    const file = normalizeFilePath(targetFile);
+    const start = environment.moduleGraph.getModuleById(file);
+    if (!start) return null;
+    const nodeIds = /* @__PURE__ */ new Map();
+    function nodeId(n) {
+      let cached = nodeIds.get(n);
+      if (cached === void 0) {
+        cached = n.id ? normalizeFilePath(n.id) : n.url ? normalizeFilePath(n.url) : "";
+        nodeIds.set(n, cached);
+      }
+      return cached;
+    }
+    const queue = [start];
+    const visited = /* @__PURE__ */ new Set([start]);
+    const parent = /* @__PURE__ */ new Map();
+    let entryRoot = null;
+    let fallbackRoot = null;
+    let qi = 0;
+    while (qi < queue.length) {
+      const node = queue[qi++];
+      const id = nodeId(node);
+      if (id && env.graph.entries.has(id)) {
+        entryRoot = node;
+        break;
+      }
+      const importers = node.importers;
+      if (importers.size === 0) {
+        if (!fallbackRoot) fallbackRoot = node;
+        continue;
+      }
+      for (const imp of importers) {
+        if (visited.has(imp)) continue;
+        visited.add(imp);
+        parent.set(imp, node);
+        queue.push(imp);
+      }
+    }
+    const root = entryRoot ?? fallbackRoot;
+    if (!root) return null;
+    const chain = [];
+    let cur = root;
+    for (let i = 0; i < config.maxTraceDepth + 2 && cur; i++) {
+      chain.push(cur);
+      if (cur === start) break;
+      cur = parent.get(cur);
+    }
+    const steps = [];
+    for (let i = 0; i < chain.length; i++) {
+      const id = nodeId(chain[i]);
+      if (!id) continue;
+      let specifier;
+      if (i + 1 < chain.length) {
+        const nextId = nodeId(chain[i + 1]);
+        if (nextId) {
+          specifier = env.graph.reverseEdges.get(nextId)?.get(id);
+        }
+      }
+      steps.push(specifier ? { file: id, specifier } : { file: id });
+    }
+    return steps.length ? steps : null;
+  }
   const config = {
     enabled: true,
     root: "",
     command: "build",
     srcDirectory: "",
     framework: opts.framework,
+    entryFiles: [],
     effectiveBehavior: "error",
     mockAccess: "error",
     logMode: "once",
@@ -35,51 +114,34 @@ function importProtectionPlugin(opts) {
   };
   const envStates = /* @__PURE__ */ new Map();
   const shared = { fileMarkerKind: /* @__PURE__ */ new Map() };
-  function createImportLocCache(env) {
-    const cache = /* @__PURE__ */ new Map();
-    const originalSet = cache.set.bind(cache);
-    cache.set = function(key, value) {
-      originalSet(key, value);
-      const sepIdx = key.indexOf("::");
-      if (sepIdx !== -1) {
-        const file = key.slice(0, sepIdx);
-        let fileKeys = env.importLocByFile.get(file);
-        if (!fileKeys) {
-          fileKeys = /* @__PURE__ */ new Set();
-          env.importLocByFile.set(file, fileKeys);
-        }
-        fileKeys.add(key);
-      }
-      return this;
-    };
-    return cache;
-  }
-  function getMockEdgeExports(env, importerId, source) {
-    const importerFile = normalizeFilePath(importerId);
-    return env.mockExportsByImporter.get(importerFile)?.get(source) ?? [];
-  }
   function getMarkerKindForFile(fileId) {
     const file = normalizeFilePath(fileId);
     return shared.fileMarkerKind.get(file);
   }
-  function getTransformResultProvider(env) {
-    return {
-      getTransformResult(id) {
-        const fullKey = normalizePath(id);
-        const exact = env.transformResultCache.get(fullKey);
-        if (exact) return exact;
-        const strippedKey = normalizeFilePath(id);
-        return strippedKey !== fullKey ? env.transformResultCache.get(strippedKey) : void 0;
+  async function rebuildAndAnnotateTrace(provider, env, envName, normalizedImporter, specifier, importerLoc, traceOverride) {
+    let trace = traceOverride ?? buildTrace(env.graph, normalizedImporter, config.maxTraceDepth);
+    if (config.command === "serve") {
+      const mgTrace = buildTraceFromModuleGraph(
+        envName,
+        env,
+        normalizedImporter
+      );
+      if (mgTrace && mgTrace.length > trace.length) {
+        trace = mgTrace;
       }
-    };
-  }
-  async function buildViolationInfo(provider, env, envName, envType, importer, normalizedImporter, source, overrides) {
-    const trace = buildTrace(
-      env.graph,
-      normalizedImporter,
-      config.maxTraceDepth
-    );
+    }
     await addTraceImportLocations(provider, trace, env.importLocCache);
+    if (trace.length > 0) {
+      const last = trace[trace.length - 1];
+      if (!last.specifier) last.specifier = specifier;
+      if (importerLoc && last.line == null) {
+        last.line = importerLoc.line;
+        last.column = importerLoc.column;
+      }
+    }
+    return trace;
+  }
+  async function buildViolationInfo(provider, env, envName, envType, importer, normalizedImporter, source, overrides, traceOverride) {
     const loc = await findPostCompileUsageLocation(
       provider,
       importer,
@@ -91,14 +153,15 @@ function importProtectionPlugin(opts) {
       source,
       env.importLocCache
     );
-    if (trace.length > 0) {
-      const last = trace[trace.length - 1];
-      if (!last.specifier) last.specifier = source;
-      if (loc && last.line == null) {
-        last.line = loc.line;
-        last.column = loc.column;
-      }
-    }
+    const trace = await rebuildAndAnnotateTrace(
+      provider,
+      env,
+      envName,
+      normalizedImporter,
+      source,
+      loc,
+      traceOverride
+    );
     const snippet = loc ? buildCodeSnippet(provider, importer, loc) : void 0;
     return {
       env: envName,
@@ -112,12 +175,12 @@ function importProtectionPlugin(opts) {
       ...overrides
     };
   }
-  async function maybeReportMarkerViolationFromResolvedImport(ctx, provider, env, envName, envType, importer, source, resolvedId, relativePath, opts2) {
+  async function buildMarkerViolationFromResolvedImport(provider, env, envName, envType, importer, source, resolvedId, relativePath, traceOverride) {
     const markerKind = getMarkerKindForFile(resolvedId);
     const violates = envType === "client" && markerKind === "server" || envType === "server" && markerKind === "client";
     if (!violates) return void 0;
     const normalizedImporter = normalizeFilePath(importer);
-    const info = await buildViolationInfo(
+    return buildViolationInfo(
       provider,
       env,
       envName,
@@ -129,13 +192,9 @@ function importProtectionPlugin(opts) {
         type: "marker",
         resolved: normalizeFilePath(resolvedId),
         message: markerKind === "server" ? `Module "${relativePath}" is marked server-only but is imported in the client environment` : `Module "${relativePath}" is marked client-only but is imported in the server environment`
-      }
+      },
+      traceOverride
     );
-    return handleViolation.call(ctx, env, info, opts2);
-  }
-  function buildMockEdgeModuleId(env, importerId, source, runtimeId) {
-    const exports = getMockEdgeExports(env, importerId, source);
-    return makeMockEdgeModuleId(exports, source, runtimeId);
   }
   function getEnvType(envName) {
     return config.envTypeMap.get(envName) ?? "server";
@@ -154,7 +213,7 @@ function importProtectionPlugin(opts) {
   function getEnv(envName) {
     let envState = envStates.get(envName);
     if (!envState) {
-      const importLocByFile = /* @__PURE__ */ new Map();
+      const transformResultCache = /* @__PURE__ */ new Map();
       envState = {
         graph: new ImportGraph(),
         deniedSources: /* @__PURE__ */ new Set(),
@@ -162,33 +221,46 @@ function importProtectionPlugin(opts) {
         mockExportsByImporter: /* @__PURE__ */ new Map(),
         resolveCache: /* @__PURE__ */ new Map(),
         resolveCacheByFile: /* @__PURE__ */ new Map(),
-        importLocCache: /* @__PURE__ */ new Map(),
-        // placeholder, replaced below
-        importLocByFile,
+        importLocCache: new ImportLocCache(),
         seenViolations: /* @__PURE__ */ new Set(),
-        transformResultCache: /* @__PURE__ */ new Map(),
-        transformResultKeysByFile: /* @__PURE__ */ new Map()
+        transformResultCache,
+        transformResultKeysByFile: /* @__PURE__ */ new Map(),
+        transformResultProvider: {
+          getTransformResult(id) {
+            const fullKey = normalizePath(id);
+            const exact = transformResultCache.get(fullKey);
+            if (exact) return exact;
+            const strippedKey = normalizeFilePath(id);
+            return strippedKey !== fullKey ? transformResultCache.get(strippedKey) : void 0;
+          }
+        },
+        postTransformImports: /* @__PURE__ */ new Map(),
+        hasSeenEntry: false,
+        serverFnLookupModules: /* @__PURE__ */ new Set(),
+        pendingViolations: /* @__PURE__ */ new Map()
       };
-      envState.importLocCache = createImportLocCache(envState);
       envStates.set(envName, envState);
     }
     return envState;
   }
+  const shouldCheckImporterCache = /* @__PURE__ */ new Map();
   function shouldCheckImporter(importer) {
-    const relativePath = path.relative(config.root, importer);
+    let result = shouldCheckImporterCache.get(importer);
+    if (result !== void 0) return result;
+    const relativePath = relativizePath(importer, config.root);
     if (config.excludeMatchers.length > 0 && matchesAny(relativePath, config.excludeMatchers)) {
-      return false;
-    }
-    if (config.ignoreImporterMatchers.length > 0 && matchesAny(relativePath, config.ignoreImporterMatchers)) {
-      return false;
-    }
-    if (config.includeMatchers.length > 0) {
-      return !!matchesAny(relativePath, config.includeMatchers);
-    }
-    if (config.srcDirectory) {
-      return importer.startsWith(config.srcDirectory);
+      result = false;
+    } else if (config.ignoreImporterMatchers.length > 0 && matchesAny(relativePath, config.ignoreImporterMatchers)) {
+      result = false;
+    } else if (config.includeMatchers.length > 0) {
+      result = !!matchesAny(relativePath, config.includeMatchers);
+    } else if (config.srcDirectory) {
+      result = importer.startsWith(config.srcDirectory);
+    } else {
+      result = true;
     }
-    return true;
+    shouldCheckImporterCache.set(importer, result);
+    return result;
   }
   function dedupeKey(type, importer, specifier, resolved) {
     return `${type}:${importer}:${specifier}:${resolved ?? ""}`;
@@ -200,7 +272,182 @@ function importProtectionPlugin(opts) {
     return false;
   }
   function getRelativePath(absolutePath) {
-    return normalizePath(path.relative(config.root, absolutePath));
+    return relativizePath(normalizePath(absolutePath), config.root);
+  }
+  function registerEntries() {
+    const { resolvedStartConfig } = opts.getConfig();
+    for (const envDef of opts.environments) {
+      const envState = getEnv(envDef.name);
+      if (resolvedStartConfig.routerFilePath) {
+        envState.graph.addEntry(
+          normalizePath(resolvedStartConfig.routerFilePath)
+        );
+      }
+      if (resolvedStartConfig.startFilePath) {
+        envState.graph.addEntry(
+          normalizePath(resolvedStartConfig.startFilePath)
+        );
+      }
+    }
+  }
+  function checkPostTransformReachability(env, file) {
+    const visited = /* @__PURE__ */ new Set();
+    const queue = [file];
+    let hasUnknownEdge = false;
+    let qi = 0;
+    while (qi < queue.length) {
+      const current = queue[qi++];
+      if (visited.has(current)) continue;
+      visited.add(current);
+      if (env.graph.entries.has(current)) {
+        return "reachable";
+      }
+      const importers = env.graph.reverseEdges.get(current);
+      if (!importers) continue;
+      for (const [parent] of importers) {
+        if (visited.has(parent)) continue;
+        const keySet = env.transformResultKeysByFile.get(parent);
+        let anyVariantCached = false;
+        let edgeLive = false;
+        if (keySet) {
+          for (const k of keySet) {
+            const resolvedImports = env.postTransformImports.get(k);
+            if (resolvedImports) {
+              anyVariantCached = true;
+              if (resolvedImports.has(current)) {
+                edgeLive = true;
+                break;
+              }
+            }
+          }
+        }
+        if (!anyVariantCached) {
+          const resolvedImports = env.postTransformImports.get(parent);
+          if (resolvedImports) {
+            anyVariantCached = true;
+            if (resolvedImports.has(current)) {
+              edgeLive = true;
+            }
+          }
+        }
+        if (!anyVariantCached) {
+          const hasTransformResult = env.transformResultCache.has(parent) || (keySet ? keySet.size > 0 : false);
+          if (hasTransformResult) {
+            hasUnknownEdge = true;
+            continue;
+          }
+          queue.push(parent);
+          continue;
+        }
+        if (edgeLive) {
+          queue.push(parent);
+        }
+      }
+    }
+    return hasUnknownEdge ? "unknown" : "unreachable";
+  }
+  async function processPendingViolations(env, warnFn) {
+    if (env.pendingViolations.size === 0) return;
+    const toDelete = [];
+    for (const [file, violations] of env.pendingViolations) {
+      const status = env.hasSeenEntry ? checkPostTransformReachability(env, file) : "reachable";
+      if (status === "reachable") {
+        for (const pv of violations) {
+          const key = dedupeKey(
+            pv.info.type,
+            pv.info.importer,
+            pv.info.specifier,
+            pv.info.resolved
+          );
+          if (!hasSeen(env, key)) {
+            const freshTrace = await rebuildAndAnnotateTrace(
+              env.transformResultProvider,
+              env,
+              pv.info.env,
+              pv.info.importer,
+              pv.info.specifier,
+              pv.info.importerLoc
+            );
+            if (freshTrace.length > pv.info.trace.length) {
+              pv.info.trace = freshTrace;
+            }
+            if (config.onViolation) {
+              const result = config.onViolation(pv.info);
+              if (result === false) continue;
+            }
+            warnFn(formatViolation(pv.info, config.root));
+          }
+        }
+        toDelete.push(file);
+      } else if (status === "unreachable") {
+        toDelete.push(file);
+      }
+    }
+    for (const file of toDelete) {
+      env.pendingViolations.delete(file);
+    }
+  }
+  function deferViolation(env, importerFile, info, mockReturnValue) {
+    getOrCreate(env.pendingViolations, importerFile, () => []).push({
+      info,
+      mockReturnValue: typeof mockReturnValue === "string" ? mockReturnValue : mockReturnValue?.id ?? ""
+    });
+  }
+  function handleViolation(ctx, env, info, violationOpts) {
+    const key = dedupeKey(
+      info.type,
+      info.importer,
+      info.specifier,
+      info.resolved
+    );
+    if (!violationOpts?.silent) {
+      if (config.onViolation) {
+        const result = config.onViolation(info);
+        if (result === false) {
+          return void 0;
+        }
+      }
+      const seen = hasSeen(env, key);
+      if (config.effectiveBehavior === "error") {
+        if (!seen) ctx.error(formatViolation(info, config.root));
+        return void 0;
+      }
+      if (!seen) {
+        ctx.warn(formatViolation(info, config.root));
+      }
+    } else {
+      if (config.effectiveBehavior === "error") {
+        return void 0;
+      }
+    }
+    env.deniedSources.add(info.specifier);
+    getOrCreate(env.deniedEdges, info.importer, () => /* @__PURE__ */ new Set()).add(
+      info.specifier
+    );
+    if (config.command === "serve") {
+      const runtimeId = mockRuntimeModuleIdFromViolation(
+        info,
+        config.mockAccess,
+        config.root
+      );
+      const importerFile = normalizeFilePath(info.importer);
+      const exports = env.mockExportsByImporter.get(importerFile)?.get(info.specifier) ?? [];
+      return resolveViteId(
+        makeMockEdgeModuleId(exports, info.specifier, runtimeId)
+      );
+    }
+    return { id: RESOLVED_MOCK_MODULE_ID, syntheticNamedExports: true };
+  }
+  async function reportOrDeferViolation(ctx, env, importerFile, info, shouldDefer, isPreTransformResolve) {
+    if (shouldDefer) {
+      const result = handleViolation(ctx, env, info, { silent: true });
+      deferViolation(env, importerFile, info, result);
+      await processPendingViolations(env, ctx.warn.bind(ctx));
+      return result;
+    }
+    return handleViolation(ctx, env, info, {
+      silent: isPreTransformResolve
+    });
   }
   return [
     {
@@ -215,6 +462,10 @@ function importProtectionPlugin(opts) {
         config.command = viteConfig.command;
         const { startConfig, resolvedStartConfig } = opts.getConfig();
         config.srcDirectory = resolvedStartConfig.srcDirectory;
+        config.entryFiles = [
+          resolvedStartConfig.routerFilePath,
+          resolvedStartConfig.startFilePath
+        ].filter((f) => Boolean(f));
         const userOpts = startConfig.importProtection;
         if (userOpts?.enabled === false) {
           config.enabled = false;
@@ -233,8 +484,11 @@ function importProtectionPlugin(opts) {
         config.logMode = userOpts?.log ?? "once";
         config.mockAccess = userOpts?.mockAccess ?? "error";
         config.maxTraceDepth = userOpts?.maxTraceDepth ?? 20;
-        config.onViolation = userOpts?.onViolation;
-        const defaults = getDefaultImportProtectionRules(opts.framework);
+        if (userOpts?.onViolation) {
+          const fn = userOpts.onViolation;
+          config.onViolation = (info) => fn(info);
+        }
+        const defaults = getDefaultImportProtectionRules();
         const clientSpecifiers = dedupePatterns([
           ...defaults.client.specifiers,
           ...userOpts?.client?.specifiers ?? []
@@ -261,55 +515,37 @@ function importProtectionPlugin(opts) {
             userOpts.ignoreImporters
           );
         }
-        const markers = getMarkerSpecifiers(opts.framework);
+        const markers = getMarkerSpecifiers();
         config.markerSpecifiers = {
           serverOnly: new Set(markers.serverOnly),
           clientOnly: new Set(markers.clientOnly)
         };
-        for (const envDef of opts.environments) {
-          const envState = getEnv(envDef.name);
-          if (resolvedStartConfig.routerFilePath) {
-            envState.graph.addEntry(
-              normalizePath(resolvedStartConfig.routerFilePath)
-            );
-          }
-          if (resolvedStartConfig.startFilePath) {
-            envState.graph.addEntry(
-              normalizePath(resolvedStartConfig.startFilePath)
-            );
-          }
-        }
+      },
+      configureServer(server) {
+        devServer = server;
       },
       buildStart() {
         if (!config.enabled) return;
+        clearNormalizeFilePathCache();
+        clearImportPatternCache();
+        shouldCheckImporterCache.clear();
         for (const envState of envStates.values()) {
           envState.resolveCache.clear();
           envState.resolveCacheByFile.clear();
           envState.importLocCache.clear();
-          envState.importLocByFile.clear();
           envState.seenViolations.clear();
           envState.transformResultCache.clear();
           envState.transformResultKeysByFile.clear();
+          envState.postTransformImports.clear();
+          envState.hasSeenEntry = false;
+          envState.serverFnLookupModules.clear();
           envState.graph.clear();
           envState.deniedSources.clear();
           envState.deniedEdges.clear();
           envState.mockExportsByImporter.clear();
         }
         shared.fileMarkerKind.clear();
-        for (const envDef of opts.environments) {
-          const envState = getEnv(envDef.name);
-          const { resolvedStartConfig } = opts.getConfig();
-          if (resolvedStartConfig.routerFilePath) {
-            envState.graph.addEntry(
-              normalizePath(resolvedStartConfig.routerFilePath)
-            );
-          }
-          if (resolvedStartConfig.startFilePath) {
-            envState.graph.addEntry(
-              normalizePath(resolvedStartConfig.startFilePath)
-            );
-          }
-        }
+        registerEntries();
       },
       hotUpdate(ctx) {
         if (!config.enabled) return;
@@ -319,13 +555,7 @@ function importProtectionPlugin(opts) {
             const importerFile = normalizeFilePath(id);
             shared.fileMarkerKind.delete(importerFile);
             for (const envState of envStates.values()) {
-              const locKeys = envState.importLocByFile.get(importerFile);
-              if (locKeys) {
-                for (const key of locKeys) {
-                  envState.importLocCache.delete(key);
-                }
-                envState.importLocByFile.delete(importerFile);
-              }
+              envState.importLocCache.deleteByFile(importerFile);
               const resolveKeys = envState.resolveCacheByFile.get(importerFile);
               if (resolveKeys) {
                 for (const key of resolveKeys) {
@@ -336,25 +566,46 @@ function importProtectionPlugin(opts) {
               envState.graph.invalidate(importerFile);
               envState.deniedEdges.delete(importerFile);
               envState.mockExportsByImporter.delete(importerFile);
+              envState.serverFnLookupModules.delete(importerFile);
+              envState.pendingViolations.delete(importerFile);
               const transformKeys = envState.transformResultKeysByFile.get(importerFile);
               if (transformKeys) {
                 for (const key of transformKeys) {
                   envState.transformResultCache.delete(key);
+                  envState.postTransformImports.delete(key);
                 }
                 envState.transformResultKeysByFile.delete(importerFile);
               } else {
                 envState.transformResultCache.delete(importerFile);
+                envState.postTransformImports.delete(importerFile);
               }
             }
           }
         }
       },
       async resolveId(source, importer, _options) {
-        if (!config.enabled) return void 0;
         const envName = this.environment.name;
         const env = getEnv(envName);
         const envType = getEnvType(envName);
-        const provider = getTransformResultProvider(env);
+        const provider = env.transformResultProvider;
+        const isScanResolve = !!_options.scan;
+        if (IMPORT_PROTECTION_DEBUG) {
+          const importerPath = importer ? normalizeFilePath(importer) : "(entry)";
+          const isEntryResolve = !importer;
+          const filtered = IMPORT_PROTECTION_DEBUG_FILTER === "entry" ? isEntryResolve : matchesDebugFilter(source, importerPath);
+          if (filtered) {
+            debugLog("resolveId", {
+              env: envName,
+              envType,
+              source,
+              importer: importerPath,
+              isEntryResolve,
+              hasSeenEntry: env.hasSeenEntry,
+              command: config.command,
+              behavior: config.effectiveBehavior
+            });
+          }
+        }
         if (source === MOCK_MODULE_ID) {
           return RESOLVED_MOCK_MODULE_ID;
         }
@@ -369,71 +620,55 @@ function importProtectionPlugin(opts) {
         }
         if (!importer) {
           env.graph.addEntry(source);
+          env.hasSeenEntry = true;
           return void 0;
         }
         if (source.startsWith("\0") || source.startsWith("virtual:")) {
           return void 0;
         }
-        const isPreTransformResolve = importer.includes("?" + SERVER_FN_LOOKUP) || !!_options.scan;
-        if (config.markerSpecifiers.serverOnly.has(source)) {
-          const resolvedImporter = normalizeFilePath(importer);
-          const existing = shared.fileMarkerKind.get(resolvedImporter);
-          if (existing && existing !== "server") {
+        const normalizedImporter = normalizeFilePath(importer);
+        const isDirectLookup = importer.includes(SERVER_FN_LOOKUP_QUERY);
+        if (isDirectLookup) {
+          env.serverFnLookupModules.add(normalizedImporter);
+        }
+        const isPreTransformResolve = isDirectLookup || env.serverFnLookupModules.has(normalizedImporter) || isScanResolve;
+        const isDevMock = config.command === "serve" && config.effectiveBehavior === "mock";
+        const shouldDefer = isDevMock && !isPreTransformResolve;
+        const markerKind = config.markerSpecifiers.serverOnly.has(source) ? "server" : config.markerSpecifiers.clientOnly.has(source) ? "client" : void 0;
+        if (markerKind) {
+          const existing = shared.fileMarkerKind.get(normalizedImporter);
+          if (existing && existing !== markerKind) {
             this.error(
-              `[import-protection] File "${getRelativePath(resolvedImporter)}" has both server-only and client-only markers. This is not allowed.`
+              `[import-protection] File "${getRelativePath(normalizedImporter)}" has both server-only and client-only markers. This is not allowed.`
             );
           }
-          shared.fileMarkerKind.set(resolvedImporter, "server");
-          if (envType === "client") {
+          shared.fileMarkerKind.set(normalizedImporter, markerKind);
+          const violatesEnv = envType === "client" && markerKind === "server" || envType === "server" && markerKind === "client";
+          if (violatesEnv) {
             const info = await buildViolationInfo(
               provider,
               env,
               envName,
               envType,
               importer,
-              resolvedImporter,
+              normalizedImporter,
               source,
               {
                 type: "marker",
-                message: `Module "${getRelativePath(resolvedImporter)}" is marked server-only but is imported in the client environment`
+                message: markerKind === "server" ? `Module "${getRelativePath(normalizedImporter)}" is marked server-only but is imported in the client environment` : `Module "${getRelativePath(normalizedImporter)}" is marked client-only but is imported in the server environment`
               }
             );
-            handleViolation.call(this, env, info, {
-              silent: isPreTransformResolve
-            });
-          }
-          return resolveViteId(`${MARKER_PREFIX}server-only`);
-        }
-        if (config.markerSpecifiers.clientOnly.has(source)) {
-          const resolvedImporter = normalizeFilePath(importer);
-          const existing = shared.fileMarkerKind.get(resolvedImporter);
-          if (existing && existing !== "client") {
-            this.error(
-              `[import-protection] File "${getRelativePath(resolvedImporter)}" has both server-only and client-only markers. This is not allowed.`
-            );
-          }
-          shared.fileMarkerKind.set(resolvedImporter, "client");
-          if (envType === "server") {
-            const info = await buildViolationInfo(
-              provider,
+            await reportOrDeferViolation(
+              this,
               env,
-              envName,
-              envType,
-              importer,
-              resolvedImporter,
-              source,
-              {
-                type: "marker",
-                message: `Module "${getRelativePath(resolvedImporter)}" is marked client-only but is imported in the server environment`
-              }
+              normalizedImporter,
+              info,
+              shouldDefer,
+              isPreTransformResolve
             );
-            handleViolation.call(this, env, info, {
-              silent: isPreTransformResolve
-            });
           }
-          return resolveViteId(`${MARKER_PREFIX}client-only`);
+          return markerKind === "server" ? RESOLVED_MARKER_SERVER_ONLY : RESOLVED_MARKER_CLIENT_ONLY;
         }
-        const normalizedImporter = normalizeFilePath(importer);
         if (!shouldCheckImporter(normalizedImporter)) {
           return void 0;
         }
@@ -452,32 +687,39 @@ function importProtectionPlugin(opts) {
             {
               type: "specifier",
               pattern: specifierMatch.pattern,
-              message: `Import "${source}" is denied in the "${envName}" environment`
+              message: `Import "${source}" is denied in the ${envType} environment`
             }
           );
-          return handleViolation.call(this, env, info, {
-            silent: isPreTransformResolve
-          });
+          return reportOrDeferViolation(
+            this,
+            env,
+            normalizedImporter,
+            info,
+            shouldDefer,
+            isPreTransformResolve
+          );
         }
         const cacheKey = `${normalizedImporter}:${source}`;
         let resolved;
         if (env.resolveCache.has(cacheKey)) {
-          resolved = env.resolveCache.get(cacheKey) || null;
+          resolved = env.resolveCache.get(cacheKey) ?? null;
         } else {
           const result = await this.resolve(source, importer, {
             skipSelf: true
           });
           resolved = result ? normalizeFilePath(result.id) : null;
           env.resolveCache.set(cacheKey, resolved);
-          let fileKeys = env.resolveCacheByFile.get(normalizedImporter);
-          if (!fileKeys) {
-            fileKeys = /* @__PURE__ */ new Set();
-            env.resolveCacheByFile.set(normalizedImporter, fileKeys);
-          }
-          fileKeys.add(cacheKey);
+          getOrCreate(
+            env.resolveCacheByFile,
+            normalizedImporter,
+            () => /* @__PURE__ */ new Set()
+          ).add(cacheKey);
         }
         if (resolved) {
           const relativePath = getRelativePath(resolved);
+          if (isPreTransformResolve && !isScanResolve) {
+            env.serverFnLookupModules.add(resolved);
+          }
           env.graph.addEdge(resolved, normalizedImporter, source);
           const fileMatch = matchers.files.length > 0 ? matchesAny(relativePath, matchers.files) : void 0;
           if (fileMatch) {
@@ -493,15 +735,19 @@ function importProtectionPlugin(opts) {
                 type: "file",
                 pattern: fileMatch.pattern,
                 resolved,
-                message: `Import "${source}" (resolved to "${relativePath}") is denied in the "${envName}" environment`
+                message: `Import "${source}" (resolved to "${relativePath}") is denied in the ${envType} environment`
               }
             );
-            return handleViolation.call(this, env, info, {
-              silent: isPreTransformResolve
-            });
+            return reportOrDeferViolation(
+              this,
+              env,
+              normalizedImporter,
+              info,
+              shouldDefer,
+              isPreTransformResolve
+            );
           }
-          const markerRes = await maybeReportMarkerViolationFromResolvedImport(
-            this,
+          const markerInfo = await buildMarkerViolationFromResolvedImport(
             provider,
             env,
             envName,
@@ -509,11 +755,17 @@ function importProtectionPlugin(opts) {
             importer,
             source,
             resolved,
-            relativePath,
-            { silent: isPreTransformResolve }
+            relativePath
           );
-          if (markerRes !== void 0) {
-            return markerRes;
+          if (markerInfo) {
+            return reportOrDeferViolation(
+              this,
+              env,
+              normalizedImporter,
+              markerInfo,
+              shouldDefer,
+              isPreTransformResolve
+            );
           }
         }
         return void 0;
@@ -521,11 +773,23 @@ function importProtectionPlugin(opts) {
       load: {
         filter: {
           id: new RegExp(
-            `(${RESOLVED_MOCK_MODULE_ID.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MARKER_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MOCK_EDGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${RESOLVED_MOCK_RUNTIME_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")})`
+            [
+              RESOLVED_MOCK_MODULE_ID,
+              RESOLVED_MARKER_PREFIX,
+              RESOLVED_MOCK_EDGE_PREFIX,
+              RESOLVED_MOCK_RUNTIME_PREFIX
+            ].map(escapeRegExp).join("|")
           )
         },
         handler(id) {
-          if (!config.enabled) return void 0;
+          if (IMPORT_PROTECTION_DEBUG) {
+            if (matchesDebugFilter(id)) {
+              debugLog("load:handler", {
+                env: this.environment.name,
+                id: normalizePath(id)
+              });
+            }
+          }
           if (id === RESOLVED_MOCK_MODULE_ID) {
             return loadSilentMockModule();
           }
@@ -547,25 +811,9 @@ function importProtectionPlugin(opts) {
       }
     },
     {
-      // This plugin runs WITHOUT `enforce` so it executes after all
-      // `enforce: 'pre'` transform hooks (including the Start compiler).
-      // It captures the transformed code + composed sourcemap for every module
-      // so that the `resolveId` hook (in the main plugin above) can look up
-      // the importer's transform result and map violation locations back to
-      // original source.
-      //
-      // Why not use `ctx.load()` in `resolveId`?
-      //   - Vite dev: `this.load()` returns a ModuleInfo proxy that throws on
-      //     `.code` access — code is not exposed.
-      //   - Rollup build: `ModuleInfo` has `.code` but NOT `.map`, so we
-      //     can't map generated positions back to original source.
-      //
-      // By caching in the transform hook we get both code and the composed
-      // sourcemap that chains all the way back to the original file.
-      //
-      // Performance: only files under `srcDirectory` are cached because only
-      // those can be importers in a violation.  Third-party code in
-      // node_modules is never checked.
+      // Captures transformed code + composed sourcemap for location mapping.
+      // Runs after all `enforce: 'pre'` hooks (including the Start compiler).
+      // Only files under `srcDirectory` are cached.
       name: "tanstack-start-core:import-protection-transform-cache",
       applyToEnvironment(env) {
         if (!config.enabled) return false;
@@ -577,10 +825,18 @@ function importProtectionPlugin(opts) {
             include: [/\.[cm]?[tj]sx?($|\?)/]
           }
         },
-        handler(code, id) {
-          if (!config.enabled) return void 0;
+        async handler(code, id) {
           const envName = this.environment.name;
           const file = normalizeFilePath(id);
+          if (IMPORT_PROTECTION_DEBUG) {
+            if (matchesDebugFilter(file)) {
+              debugLog("transform-cache", {
+                env: envName,
+                id: normalizePath(id),
+                file
+              });
+            }
+          }
           if (!shouldCheckImporter(file)) {
             return void 0;
           }
@@ -601,17 +857,20 @@ function importProtectionPlugin(opts) {
           const lineIndex = buildLineIndex(code);
           const cacheKey = normalizePath(id);
           const envState = getEnv(envName);
+          if (id.includes(SERVER_FN_LOOKUP_QUERY)) {
+            envState.serverFnLookupModules.add(file);
+          }
           envState.transformResultCache.set(cacheKey, {
             code,
             map,
             originalCode,
             lineIndex
           });
-          let keySet = envState.transformResultKeysByFile.get(file);
-          if (!keySet) {
-            keySet = /* @__PURE__ */ new Set();
-            envState.transformResultKeysByFile.set(file, keySet);
-          }
+          const keySet = getOrCreate(
+            envState.transformResultKeysByFile,
+            file,
+            () => /* @__PURE__ */ new Set()
+          );
           keySet.add(cacheKey);
           if (cacheKey !== file) {
             envState.transformResultCache.set(file, {
@@ -622,6 +881,24 @@ function importProtectionPlugin(opts) {
             });
             keySet.add(file);
           }
+          const importSources = extractImportSources(code);
+          const resolvedChildren = /* @__PURE__ */ new Set();
+          for (const src of importSources) {
+            try {
+              const resolved = await this.resolve(src, id, { skipSelf: true });
+              if (resolved && !resolved.external) {
+                const resolvedPath = normalizeFilePath(resolved.id);
+                resolvedChildren.add(resolvedPath);
+                envState.graph.addEdge(resolvedPath, file, src);
+              }
+            } catch {
+            }
+          }
+          envState.postTransformImports.set(cacheKey, resolvedChildren);
+          if (cacheKey !== file) {
+            envState.postTransformImports.set(file, resolvedChildren);
+          }
+          await processPendingViolations(envState, this.warn.bind(this));
           return void 0;
         }
       }
@@ -644,7 +921,6 @@ function importProtectionPlugin(opts) {
           }
         },
         handler(code, id) {
-          if (!config.enabled) return void 0;
           const envName = this.environment.name;
           const envState = envStates.get(envName);
           if (!envState) return void 0;
@@ -661,56 +937,11 @@ function importProtectionPlugin(opts) {
       }
     }
   ];
-  function handleViolation(env, info, opts2) {
-    const key = dedupeKey(
-      info.type,
-      info.importer,
-      info.specifier,
-      info.resolved
-    );
-    if (!opts2?.silent) {
-      if (config.onViolation) {
-        const result = config.onViolation(info);
-        if (result === false) {
-          return void 0;
-        }
-      }
-      const seen = hasSeen(env, key);
-      if (config.effectiveBehavior === "error") {
-        if (!seen) this.error(formatViolation(info, config.root));
-        return void 0;
-      }
-      if (!seen) {
-        this.warn(formatViolation(info, config.root));
-      }
-    } else {
-      if (config.effectiveBehavior === "error") {
-        return void 0;
-      }
-    }
-    env.deniedSources.add(info.specifier);
-    let edgeSet = env.deniedEdges.get(info.importer);
-    if (!edgeSet) {
-      edgeSet = /* @__PURE__ */ new Set();
-      env.deniedEdges.set(info.importer, edgeSet);
-    }
-    edgeSet.add(info.specifier);
-    if (config.command === "serve") {
-      const runtimeId = mockRuntimeModuleIdFromViolation(
-        info,
-        config.mockAccess,
-        config.root
-      );
-      return resolveViteId(
-        buildMockEdgeModuleId(env, info.importer, info.specifier, runtimeId)
-      );
-    }
-    return { id: RESOLVED_MOCK_MODULE_ID, syntheticNamedExports: true };
-  }
 }
 export {
   RESOLVED_MOCK_MODULE_ID,
   dedupePatterns,
+  extractImportSources,
   importProtectionPlugin
 };
 //# sourceMappingURL=plugin.js.map