@tanstack/start-plugin-core 1.161.3 → 1.162.0

package/dist/esm/import-protection-plugin/virtualModules.js.map

@@ -1 +1 @@
-{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { normalizePath } from 'vite'\nimport * as path from 'pathe'\n\nimport { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport type { ViolationInfo } from './trace'\n\n// ---------------------------------------------------------------------------\n// Virtual module ID constants\n// ---------------------------------------------------------------------------\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nexport const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nexport const RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\n// Dev-only runtime-diagnostic mock modules (used only by the client rewrite pass)\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nexport const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nexport const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nexport const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\n// ---------------------------------------------------------------------------\n// Base64url helpers\n// ---------------------------------------------------------------------------\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\n// ---------------------------------------------------------------------------\n// Mock-runtime module helpers\n// ---------------------------------------------------------------------------\n\nexport type MockAccessMode = 'error' | 'warn' | 'off'\n\nfunction makeMockRuntimeModuleId(payload: {\n  env: string\n  importer: string\n  specifier: string\n  trace: Array<string>\n  mode: MockAccessMode\n}): string {\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nfunction stripTraceFormatting(\n  trace: Array<{ file: string; line?: number; column?: number }>,\n  root: string,\n): Array<string> {\n  // Keep this very small: runtime warning should show an actionable chain.\n  // Format: relativePath[:line:col]\n  const rel = (p: string) => {\n    if (p.startsWith(root)) return normalizePath(path.relative(root, p))\n    return p\n  }\n  return trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n}\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  // Only emit runtime diagnostics in dev and only on the client environment.\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n  return makeMockRuntimeModuleId({\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace: stripTraceFormatting(info.trace, root),\n    mode,\n  })\n}\n\n// ---------------------------------------------------------------------------\n// Mock-edge module ID builder\n// ---------------------------------------------------------------------------\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  source: string,\n  runtimeId: string,\n): string {\n  const payload = {\n    source,\n    exports,\n    runtimeId,\n  }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n// ---------------------------------------------------------------------------\n// Load handler helpers — virtual module source code generators\n// ---------------------------------------------------------------------------\n\nexport function loadSilentMockModule(): {\n  syntheticNamedExports: boolean\n  code: string\n} {\n  return {\n    // syntheticNamedExports tells Rollup to derive named exports\n    // from the default export. Combined with the Proxy-based mock,\n    // this allows `import { anything } from 'mock'` to work.\n    syntheticNamedExports: true,\n    code: `\nfunction createMock(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (typeof prop === 'symbol') return undefined;\n      // Thenable support: prevent await from hanging\n      if (prop === 'then') return (fn) => Promise.resolve(fn(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (fn) => { fn(); return Promise.resolve(proxy); };\n      // Memoize child proxies so mock.foo === mock.foo\n      if (!(prop in children)) {\n        children[prop] = createMock(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      return createMock(name + '()');\n    },\n    construct() {\n      return createMock('new ' + name);\n    },\n  });\n  return proxy;\n}\nconst mock = createMock('mock');\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names: Array<string> = Array.isArray(payload.exports)\n    ? payload.exports.filter(\n        (n): n is string => typeof n === 'string' && isValidExportName(n),\n      )\n    : []\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines = names.map((n) => `export const ${n} = mock.${n};`)\n  return {\n    code: `\n import mock from ${JSON.stringify(runtimeId)};\n   ${exportLines.join('\\n')}\n   export default mock;\n   `,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return {\n    code: `\nconst __meta = ${JSON.stringify(meta)};\nconst __mode = ${JSON.stringify(mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\nFix: Remove server-only imports from client code. Use createServerFn().handler(() => ...) to call server logic from the client via RPC, or move the import into a .server.ts file. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".';\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n\nfunction __createMock(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };\n\n      // Trigger a runtime diagnostic for primitive conversions.\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }\n\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = __createMock(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      __report('call', name + '()');\n      return __createMock(name + '()');\n    },\n    construct() {\n      __report('construct', 'new ' + name);\n      return __createMock('new ' + name);\n    },\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },\n  });\n\n  return proxy;\n}\n\nconst mock = __createMock('mock');\nexport default mock;\n`,\n  }\n}\n\nexport function loadMarkerModule(): { code: string } {\n  return { code: 'export {}' }\n}\n"],"names":[],"mappings":";;;;;AAYO,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,cAAc,cAAc;AAE5D,MAAM,mBAAmB;AACzB,MAAM,4BAA4B,cAAc,gBAAgB;AAGhE,MAAM,sBACX;AACK,MAAM,+BAA+B,cAAc,mBAAmB;AAEtE,MAAM,gBAAgB;AACtB,MAAM,yBAAyB,cAAc,aAAa;AAMjE,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQA,SAAS,wBAAwB,SAMtB;AACT,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEA,SAAS,qBACP,OACA,MACe;AAGf,QAAM,MAAM,CAAC,MAAc;AACzB,QAAI,EAAE,WAAW,IAAI,EAAG,QAAO,cAAc,KAAK,SAAS,MAAM,CAAC,CAAC;AACnE,WAAO;AAAA,EACT;AACA,SAAO,MAAM,IAAI,CAAC,MAAM;AACtB,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AACH;AAEO,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAE3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AACvD,SAAO,wBAAwB;AAAA,IAC7B,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB,OAAO,qBAAqB,KAAK,OAAO,IAAI;AAAA,IAC5C;AAAA,EAAA,CACD;AACH;AAMO,SAAS,qBACd,SACA,QACA,WACQ;AACR,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAMO,SAAS,uBAGd;AACA,SAAO;AAAA;AAAA;AAAA;AAAA,IAIL,uBAAuB;AAAA,IACvB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA;AAkCV;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAuB,MAAM,QAAQ,QAAQ,OAAO,IACtD,QAAQ,QAAQ;AAAA,IACd,CAAC,MAAmB,OAAO,MAAM,YAAY,kBAAkB,CAAC;AAAA,EAAA,IAElE,CAAA;AAEJ,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAAc,MAAM,IAAI,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,GAAG;AACrE,SAAO;AAAA,IACL,MAAM;AAAA,oBACU,KAAK,UAAU,SAAS,CAAC;AAAA,KACxC,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAI3B;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO;AAAA,IACL,MAAM;AAAA,iBACO,KAAK,UAAU,IAAI,CAAC;AAAA,iBACpB,KAAK,UAAU,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA;AAoFrC;AAEO,SAAS,mBAAqC;AACnD,SAAO,EAAE,MAAM,YAAA;AACjB;"}
+{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport { CLIENT_ENV_SUGGESTIONS } from './trace'\nimport { relativizePath } from './utils'\nimport type { ViolationInfo } from './trace'\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nexport const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nexport const RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nexport const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nexport const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nexport const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\ntype MockAccessMode = 'error' | 'warn' | 'off'\n\n/**\n * Compact runtime suggestion text for browser console, derived from\n * {@link CLIENT_ENV_SUGGESTIONS} so there's a single source of truth.\n */\nexport const RUNTIME_SUGGESTION_TEXT =\n  'Fix: ' +\n  CLIENT_ENV_SUGGESTIONS.join('. ') +\n  '. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".'\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n\n  const rel = (p: string) => relativizePath(p, root)\n  const trace = info.trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n\n  const payload = {\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace,\n    mode,\n  }\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  source: string,\n  runtimeId: string,\n): string {\n  const payload = { source, exports, runtimeId }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n/**\n * Generate a recursive Proxy-based mock module.\n *\n * When `diagnostics` is provided, the generated code includes a `__report`\n * function that logs runtime warnings/errors when the mock is actually used\n * (property access for primitive coercion, calls, construction, sets).\n *\n * When `diagnostics` is omitted, the mock is completely silent — suitable\n * for the shared `MOCK_MODULE_ID` that uses `syntheticNamedExports`.\n */\nfunction generateMockCode(diagnostics?: {\n  meta: {\n    env: string\n    importer: string\n    specifier: string\n    trace: Array<unknown>\n  }\n  mode: 'error' | 'warn' | 'off'\n}): string {\n  const fnName = diagnostics ? '__createMock' : 'createMock'\n  const hasDiag = !!diagnostics\n\n  const preamble = hasDiag\n    ? `const __meta = ${JSON.stringify(diagnostics.meta)};\nconst __mode = ${JSON.stringify(diagnostics.mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\n' + ${JSON.stringify(RUNTIME_SUGGESTION_TEXT)};\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n`\n    : ''\n\n  // Diagnostic-only traps for primitive coercion, set\n  const diagGetTraps = hasDiag\n    ? `\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }`\n    : ''\n\n  const applyBody = hasDiag\n    ? `__report('call', name + '()');\n      return ${fnName}(name + '()');`\n    : `return ${fnName}(name + '()');`\n\n  const constructBody = hasDiag\n    ? `__report('construct', 'new ' + name);\n      return ${fnName}('new ' + name);`\n    : `return ${fnName}('new ' + name);`\n\n  const setTrap = hasDiag\n    ? `\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },`\n    : ''\n\n  return `\n${preamble}function ${fnName}(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };${diagGetTraps}\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = ${fnName}(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      ${applyBody}\n    },\n    construct() {\n      ${constructBody}\n    },${setTrap}\n  });\n  return proxy;\n}\nconst mock = ${fnName}('mock');\nexport default mock;\n`\n}\n\nexport function loadSilentMockModule(): {\n  syntheticNamedExports: boolean\n  code: string\n} {\n  return { syntheticNamedExports: true, code: generateMockCode() }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names: Array<string> = Array.isArray(payload.exports)\n    ? payload.exports.filter(\n        (n): n is string =>\n          typeof n === 'string' && n.length > 0 && n !== 'default',\n      )\n    : []\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines: Array<string> = []\n  const stringExports: Array<{ alias: string; name: string }> = []\n\n  for (let i = 0; i < names.length; i++) {\n    const n = names[i]!\n    if (isValidExportName(n)) {\n      exportLines.push(`export const ${n} = mock.${n};`)\n    } else {\n      // ES2022 string-keyed export: use a temp var + re-export with string literal\n      const alias = `__tss_str_${i}`\n      exportLines.push(`const ${alias} = mock[${JSON.stringify(n)}];`)\n      stringExports.push({ alias, name: n })\n    }\n  }\n\n  if (stringExports.length > 0) {\n    const reexports = stringExports\n      .map((s) => `${s.alias} as ${JSON.stringify(s.name)}`)\n      .join(', ')\n    exportLines.push(`export { ${reexports} };`)\n  }\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return { code: generateMockCode({ meta, mode }) }\n}\n\nconst MARKER_MODULE_RESULT = { code: 'export {}' } as const\n\nexport function loadMarkerModule(): { code: string } {\n  return MARKER_MODULE_RESULT\n}\n"],"names":[],"mappings":";;;;;AAOO,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,cAAc,cAAc;AAE5D,MAAM,mBAAmB;AACzB,MAAM,4BAA4B,cAAc,gBAAgB;AAEhE,MAAM,sBACX;AACK,MAAM,+BAA+B,cAAc,mBAAmB;AAEtE,MAAM,gBAAgB;AACtB,MAAM,yBAAyB,cAAc,aAAa;AAEjE,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQO,MAAM,0BACX,UACA,uBAAuB,KAAK,IAAI,IAChC;AAEK,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AAEvD,QAAM,MAAM,CAAC,MAAc,eAAe,GAAG,IAAI;AACjD,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AAED,QAAM,UAAU;AAAA,IACd,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEO,SAAS,qBACd,SACA,QACA,WACQ;AACR,QAAM,UAAU,EAAE,QAAQ,SAAS,UAAA;AACnC,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAYA,SAAS,iBAAiB,aAQf;AACT,QAAM,SAAS,cAAc,iBAAiB;AAC9C,QAAM,UAAU,CAAC,CAAC;AAElB,QAAM,WAAW,UACb,kBAAkB,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,iBACvC,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAmBhC,KAAK,UAAU,uBAAuB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlD;AAGJ,QAAM,eAAe,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAaA;AAEJ,QAAM,YAAY,UACd;AAAA,eACS,MAAM,mBACf,UAAU,MAAM;AAEpB,QAAM,gBAAgB,UAClB;AAAA,eACS,MAAM,qBACf,UAAU,MAAM;AAEpB,QAAM,UAAU,UACZ;AAAA;AAAA;AAAA;AAAA,UAKA;AAEJ,SAAO;AAAA,EACP,QAAQ,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sFAW0D,YAAY;AAAA;AAAA;AAAA,2BAGvE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,QAKzB,SAAS;AAAA;AAAA;AAAA,QAGT,aAAa;AAAA,QACb,OAAO;AAAA;AAAA;AAAA;AAAA,eAIA,MAAM;AAAA;AAAA;AAGrB;AAEO,SAAS,uBAGd;AACA,SAAO,EAAE,uBAAuB,MAAM,MAAM,mBAAiB;AAC/D;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAuB,MAAM,QAAQ,QAAQ,OAAO,IACtD,QAAQ,QAAQ;AAAA,IACd,CAAC,MACC,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,MAAM;AAAA,EAAA,IAEnD,CAAA;AAEJ,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAA6B,CAAA;AACnC,QAAM,gBAAwD,CAAA;AAE9D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,kBAAkB,CAAC,GAAG;AACxB,kBAAY,KAAK,gBAAgB,CAAC,WAAW,CAAC,GAAG;AAAA,IACnD,OAAO;AAEL,YAAM,QAAQ,aAAa,CAAC;AAC5B,kBAAY,KAAK,SAAS,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,IAAI;AAC/D,oBAAc,KAAK,EAAE,OAAO,MAAM,GAAG;AAAA,IACvC;AAAA,EACF;AAEA,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,YAAY,cACf,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE,EACpD,KAAK,IAAI;AACZ,gBAAY,KAAK,YAAY,SAAS,KAAK;AAAA,EAC7C;AAEA,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO,EAAE,MAAM,iBAAiB,EAAE,MAAM,KAAA,CAAM,EAAA;AAChD;AAEA,MAAM,uBAAuB,EAAE,MAAM,YAAA;AAE9B,SAAS,mBAAqC;AACnD,SAAO;AACT;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanstack/start-plugin-core",
-  "version": "1.161.3",
+  "version": "1.162.0",
   "description": "Modern and scalable routing for React applications",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -60,18 +60,18 @@
     "vitefu": "^1.1.1",
     "xmlbuilder2": "^4.0.3",
     "zod": "^3.24.2",
-    "@tanstack/router-core": "1.161.3",
-    "@tanstack/router-plugin": "1.161.3",
-    "@tanstack/router-utils": "1.158.0",
-    "@tanstack/start-client-core": "1.161.3",
-    "@tanstack/router-generator": "1.161.3",
-    "@tanstack/start-server-core": "1.161.3"
+    "@tanstack/router-core": "1.161.4",
+    "@tanstack/router-generator": "1.161.4",
+    "@tanstack/router-utils": "1.161.4",
+    "@tanstack/router-plugin": "1.161.4",
+    "@tanstack/start-client-core": "1.161.4",
+    "@tanstack/start-server-core": "1.161.4"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.0.6",
     "@types/babel__core": "^7.20.5",
     "@types/picomatch": "^4.0.2",
-    "vite": "^7.3.1"
+    "vite": "*"
   },
   "peerDependencies": {
     "vite": ">=7.0.0"

package/src/import-protection-plugin/defaults.ts

@@ -1,4 +1,3 @@
-import type { CompileStartFrameworkOptions } from '../types'
 import type { ImportProtectionEnvRules } from '../schema'
 import type { Pattern } from './utils'
 
@@ -7,19 +6,15 @@ export interface DefaultImportProtectionRules {
   server: Required<ImportProtectionEnvRules>
 }
 
+const frameworks = ['react', 'solid', 'vue'] as const
+
 /**
- * Returns the default import protection rules for a given framework.
+ * Returns the default import protection rules.
+ *
+ * All three framework variants are always included so that, e.g., a React
+ * project also denies `@tanstack/solid-start/server` imports.
  */
-export function getDefaultImportProtectionRules(
-  _framework: CompileStartFrameworkOptions,
-): DefaultImportProtectionRules {
-  const frameworks: Array<CompileStartFrameworkOptions> = [
-    'react',
-    'solid',
-    'vue',
-  ]
-
-  // Deny client importing server-specific entrypoints
+export function getDefaultImportProtectionRules(): DefaultImportProtectionRules {
   const clientSpecifiers: Array<Pattern> = frameworks.map(
     (fw) => `@tanstack/${fw}-start/server`,
   )
@@ -39,16 +34,10 @@ export function getDefaultImportProtectionRules(
 /**
  * Marker module specifiers that restrict a file to a specific environment.
  */
-export function getMarkerSpecifiers(_framework: CompileStartFrameworkOptions): {
+export function getMarkerSpecifiers(): {
   serverOnly: Array<string>
   clientOnly: Array<string>
 } {
-  const frameworks: Array<CompileStartFrameworkOptions> = [
-    'react',
-    'solid',
-    'vue',
-  ]
-
   return {
     serverOnly: frameworks.map((fw) => `@tanstack/${fw}-start/server-only`),
     clientOnly: frameworks.map((fw) => `@tanstack/${fw}-start/client-only`),