@tanstack/start-plugin-core 1.161.4 → 1.162.1

package/src/import-protection-plugin/postCompileUsage.ts

@@ -1,120 +1,15 @@
+import babel from '@babel/core'
 import * as t from '@babel/types'
 import { parseAst } from '@tanstack/router-utils'
 
-export type UsagePos = { line: number; column0: number }
-
-function collectPatternBindings(
-  node: t.Node | null | undefined,
-  out: Set<string>,
-): void {
-  if (!node) return
-  if (t.isIdentifier(node)) {
-    out.add(node.name)
-    return
-  }
-  if (t.isRestElement(node)) {
-    collectPatternBindings(node.argument, out)
-    return
-  }
-  if (t.isAssignmentPattern(node)) {
-    collectPatternBindings(node.left, out)
-    return
-  }
-  if (t.isObjectPattern(node)) {
-    for (const prop of node.properties) {
-      if (t.isRestElement(prop)) {
-        collectPatternBindings(prop.argument, out)
-      } else if (t.isObjectProperty(prop)) {
-        collectPatternBindings(prop.value as t.Node, out)
-      }
-    }
-    return
-  }
-  if (t.isArrayPattern(node)) {
-    for (const el of node.elements) {
-      collectPatternBindings(el, out)
-    }
-    return
-  }
-}
-
-function isBindingPosition(node: t.Node, parent: t.Node | null): boolean {
-  if (!parent) return false
-  if (t.isFunctionDeclaration(parent) && parent.id === node) return true
-  if (t.isFunctionExpression(parent) && parent.id === node) return true
-  if (t.isClassDeclaration(parent) && parent.id === node) return true
-  if (t.isClassExpression(parent) && parent.id === node) return true
-  if (t.isVariableDeclarator(parent) && parent.id === node) return true
-  if (t.isImportSpecifier(parent) && parent.local === node) return true
-  if (t.isImportDefaultSpecifier(parent) && parent.local === node) return true
-  if (t.isImportNamespaceSpecifier(parent) && parent.local === node) return true
-  if (
-    t.isObjectProperty(parent) &&
-    parent.key === node &&
-    !parent.computed &&
-    // In `{ foo }`, the identifier is also a value reference and must count as
-    // usage. Babel represents this as `shorthand: true`.
-    !parent.shorthand
-  )
-    return true
-  if (t.isObjectMethod(parent) && parent.key === node && !parent.computed)
-    return true
-  if (t.isExportSpecifier(parent) && parent.exported === node) return true
-  return false
-}
-
-function isPreferredUsage(node: t.Node, parent: t.Node | null): boolean {
-  if (!parent) return false
-  if (t.isCallExpression(parent) && parent.callee === node) return true
-  if (t.isNewExpression(parent) && parent.callee === node) return true
-  if (t.isMemberExpression(parent) && parent.object === node) return true
-  return false
-}
-
-function isScopeNode(node: t.Node): boolean {
-  return (
-    t.isProgram(node) ||
-    t.isFunctionDeclaration(node) ||
-    t.isFunctionExpression(node) ||
-    t.isArrowFunctionExpression(node) ||
-    t.isBlockStatement(node) ||
-    t.isCatchClause(node)
-  )
-}
-
-/** `var` hoists to the nearest function or program scope, not block scopes. */
-function isFunctionScopeNode(node: t.Node): boolean {
-  return (
-    t.isProgram(node) ||
-    t.isFunctionDeclaration(node) ||
-    t.isFunctionExpression(node) ||
-    t.isArrowFunctionExpression(node)
-  )
-}
-
-function collectScopeBindings(node: t.Node, out: Set<string>): void {
-  if (
-    t.isFunctionDeclaration(node) ||
-    t.isFunctionExpression(node) ||
-    t.isArrowFunctionExpression(node)
-  ) {
-    for (const p of node.params) {
-      collectPatternBindings(p, out)
-    }
-    return
-  }
-
-  if (t.isCatchClause(node)) {
-    collectPatternBindings(node.param, out)
-    return
-  }
-}
+type UsagePos = { line: number; column0: number }
 
 /**
  * Given transformed code, returns the first "meaningful" usage position for an
  * import from `source` that survives compilation.
  *
- * The returned column is 0-based (Babel loc semantics).
+ * "Preferred" positions (call, new, member-access) take priority over bare
+ * identifier references. The returned column is 0-based (Babel loc semantics).
  */
 export function findPostCompileUsagePos(
   code: string,
@@ -122,7 +17,7 @@ export function findPostCompileUsagePos(
 ): UsagePos | undefined {
   const ast = parseAst({ code })
 
-  // 1) Determine local names bound from this specifier
+  // Collect local names bound from this specifier
   const imported = new Set<string>()
   for (const node of ast.program.body) {
     if (t.isImportDeclaration(node) && node.source.value === source) {
@@ -138,129 +33,62 @@ export function findPostCompileUsagePos(
   let preferred: UsagePos | undefined
   let anyUsage: UsagePos | undefined
 
-  // Scope stack (module scope at index 0).
-  // Each entry tracks bindings and whether it is a function/program scope
-  // (needed for `var` hoisting).
-  interface ScopeEntry {
-    bindings: Set<string>
-    isFnScope: boolean
-  }
-  const scopes: Array<ScopeEntry> = [{ bindings: new Set(), isFnScope: true }]
-
-  function isShadowed(name: string): boolean {
-    // Check inner scopes only
-    for (let i = scopes.length - 1; i >= 1; i--) {
-      if (scopes[i]!.bindings.has(name)) return true
-    }
-    return false
-  }
-
-  function record(node: t.Node, kind: 'preferred' | 'any') {
-    const loc = node.loc?.start
-    if (!loc) return
-    const pos: UsagePos = { line: loc.line, column0: loc.column }
-    if (kind === 'preferred') {
-      preferred ||= pos
-    } else {
-      anyUsage ||= pos
-    }
-  }
-
-  function pushScope(node: t.Node): void {
-    const bindings = new Set<string>()
-    collectScopeBindings(node, bindings)
-    scopes.push({ bindings, isFnScope: isFunctionScopeNode(node) })
-  }
-
-  function popScope(): void {
-    scopes.pop()
-  }
-
-  /** Find the nearest function/program scope entry in the stack. */
-  function nearestFnScope(): ScopeEntry {
-    for (let i = scopes.length - 1; i >= 0; i--) {
-      if (scopes[i]!.isFnScope) return scopes[i]!
-    }
-    // Should never happen (index 0 is always a function scope).
-    return scopes[0]!
-  }
-
-  // The walker accepts AST nodes, arrays (from node children like
-  // `body`, `params`, etc.), or null/undefined for optional children.
-  type Walkable =
-    | t.Node
-    | ReadonlyArray<t.Node | null | undefined>
-    | null
-    | undefined
-
-  function walk(node: Walkable, parent: t.Node | null) {
-    if (!node) return
-    if (preferred && anyUsage) return
-
-    if (Array.isArray(node)) {
-      for (const n of node) walk(n, parent)
-      return
-    }
-
-    // After the array check + early return, node is guaranteed to be t.Node.
-    // TypeScript doesn't narrow ReadonlyArray from the union, so we assert.
-    const astNode = node as t.Node
-
-    // Skip import declarations entirely
-    if (t.isImportDeclaration(astNode)) return
-
-    const enterScope = isScopeNode(astNode)
-    if (enterScope) {
-      pushScope(astNode)
-    }
-
-    // Add lexical bindings for variable declarations and class/function decls.
-    // Note: function/class *declaration* identifiers bind in the parent scope,
-    // so we register them before walking children.
-    if (t.isFunctionDeclaration(astNode) && astNode.id) {
-      scopes[scopes.length - 2]?.bindings.add(astNode.id.name)
-    }
-    if (t.isClassDeclaration(astNode) && astNode.id) {
-      scopes[scopes.length - 2]?.bindings.add(astNode.id.name)
-    }
-    if (t.isVariableDeclarator(astNode)) {
-      // `var` hoists to the nearest function/program scope, not block scope.
-      const isVar = t.isVariableDeclaration(parent) && parent.kind === 'var'
-      const target = isVar
-        ? nearestFnScope().bindings
-        : scopes[scopes.length - 1]!.bindings
-      collectPatternBindings(astNode.id, target)
-    }
+  // babel.traverse can throw on malformed scopes (e.g. duplicate bindings from
+  // import + const re-declaration) because parseAst doesn't attach a hub
+  try {
+    babel.traverse(ast, {
+      ImportDeclaration(path) {
+        path.skip()
+      },
+
+      Identifier(path: babel.NodePath<t.Identifier>) {
+        if (preferred && anyUsage) {
+          path.stop()
+          return
+        }
 
-    if (t.isIdentifier(astNode) && imported.has(astNode.name)) {
-      if (!isBindingPosition(astNode, parent) && !isShadowed(astNode.name)) {
-        if (isPreferredUsage(astNode, parent)) {
-          record(astNode, 'preferred')
+        const { node, parent, scope } = path
+        if (!imported.has(node.name)) return
+
+        // Skip binding positions (declarations, import specifiers, etc.)
+        if (path.isBindingIdentifier()) return
+
+        // Skip non-shorthand object property keys — they don't reference the import
+        if (
+          t.isObjectProperty(parent) &&
+          parent.key === node &&
+          !parent.computed &&
+          !parent.shorthand
+        )
+          return
+        if (t.isObjectMethod(parent) && parent.key === node && !parent.computed)
+          return
+        if (t.isExportSpecifier(parent) && parent.exported === node) return
+
+        // Skip if shadowed by a closer binding
+        const binding = scope.getBinding(node.name)
+        if (binding && binding.kind !== 'module') return
+
+        const loc = node.loc?.start
+        if (!loc) return
+        const pos: UsagePos = { line: loc.line, column0: loc.column }
+
+        const isPreferred =
+          (t.isCallExpression(parent) && parent.callee === node) ||
+          (t.isNewExpression(parent) && parent.callee === node) ||
+          (t.isMemberExpression(parent) && parent.object === node)
+
+        if (isPreferred) {
+          preferred ||= pos
         } else {
-          record(astNode, 'any')
+          anyUsage ||= pos
         }
-      }
-    }
-
-    // Iterate child properties of this AST node. We use a Record cast since
-    // Babel node types don't expose an index signature, but we need to walk
-    // all child properties generically.
-    const record_ = astNode as unknown as Record<string, unknown>
-    for (const key of Object.keys(record_)) {
-      const value = record_[key]
-      if (!value) continue
-      if (key === 'loc' || key === 'start' || key === 'end') continue
-      if (key === 'parent') continue
-      if (typeof value === 'string' || typeof value === 'number') continue
-      walk(value as Walkable, astNode)
-      if (preferred && anyUsage) break
-    }
-
-    if (enterScope) {
-      popScope()
-    }
+      },
+    })
+  } catch {
+    // Scope analysis failed — cannot determine usage positions reliably
+    return undefined
   }
 
-  walk(ast.program, null)
   return preferred ?? anyUsage
 }

package/src/import-protection-plugin/rewriteDeniedImports.ts

@@ -2,14 +2,36 @@ import * as t from '@babel/types'
 import { generateFromAst, parseAst } from '@tanstack/router-utils'
 
 import { MOCK_MODULE_ID } from './virtualModules'
-
-// ---------------------------------------------------------------------------
-// Export name collection (for dev mock-edge modules)
-// ---------------------------------------------------------------------------
+import { getOrCreate } from './utils'
 
 export function isValidExportName(name: string): boolean {
-  if (name === 'default') return false
-  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name)
+  if (name === 'default' || name.length === 0) return false
+  const first = name.charCodeAt(0)
+  // First char: A-Z (65-90), a-z (97-122), _ (95), $ (36)
+  if (
+    !(
+      (first >= 65 && first <= 90) ||
+      (first >= 97 && first <= 122) ||
+      first === 95 ||
+      first === 36
+    )
+  )
+    return false
+  for (let i = 1; i < name.length; i++) {
+    const ch = name.charCodeAt(i)
+    // Subsequent: A-Z, a-z, 0-9 (48-57), _, $
+    if (
+      !(
+        (ch >= 65 && ch <= 90) ||
+        (ch >= 97 && ch <= 122) ||
+        (ch >= 48 && ch <= 57) ||
+        ch === 95 ||
+        ch === 36
+      )
+    )
+      return false
+  }
+  return true
 }
 
 /**
@@ -23,13 +45,8 @@ export function collectMockExportNamesBySource(
 
   const namesBySource = new Map<string, Set<string>>()
   const add = (source: string, name: string) => {
-    if (!isValidExportName(name)) return
-    let set = namesBySource.get(source)
-    if (!set) {
-      set = new Set<string>()
-      namesBySource.set(source, set)
-    }
-    set.add(name)
+    if (name === 'default' || name.length === 0) return
+    getOrCreate(namesBySource, source, () => new Set<string>()).add(name)
   }
 
   for (const node of ast.program.body) {
@@ -66,10 +83,6 @@ export function collectMockExportNamesBySource(
   return out
 }
 
-// ---------------------------------------------------------------------------
-// AST-based import rewriting
-// ---------------------------------------------------------------------------
-
 /**
  * Rewrite static imports/re-exports from denied sources using Babel AST transforms.
  *
@@ -101,16 +114,13 @@ export function rewriteDeniedImports(
   for (let i = ast.program.body.length - 1; i >= 0; i--) {
     const node = ast.program.body[i]!
 
-    // --- import declarations ---
     if (t.isImportDeclaration(node)) {
-      // Skip type-only imports
       if (node.importKind === 'type') continue
       if (!deniedSources.has(node.source.value)) continue
 
       const mockVar = `__tss_deny_${mockCounter++}`
       const replacements: Array<t.Statement> = []
 
-      // import __tss_deny_N from '<mock>'
       replacements.push(
         t.importDeclaration(
           [t.importDefaultSpecifier(t.identifier(mockVar))],
@@ -119,18 +129,10 @@ export function rewriteDeniedImports(
       )
 
       for (const specifier of node.specifiers) {
-        if (t.isImportDefaultSpecifier(specifier)) {
-          // import def from 'denied' -> const def = __tss_deny_N
-          replacements.push(
-            t.variableDeclaration('const', [
-              t.variableDeclarator(
-                t.identifier(specifier.local.name),
-                t.identifier(mockVar),
-              ),
-            ]),
-          )
-        } else if (t.isImportNamespaceSpecifier(specifier)) {
-          // import * as ns from 'denied' -> const ns = __tss_deny_N
+        if (
+          t.isImportDefaultSpecifier(specifier) ||
+          t.isImportNamespaceSpecifier(specifier)
+        ) {
           replacements.push(
             t.variableDeclaration('const', [
               t.variableDeclarator(
@@ -140,9 +142,7 @@ export function rewriteDeniedImports(
             ]),
           )
         } else if (t.isImportSpecifier(specifier)) {
-          // Skip type-only specifiers
           if (specifier.importKind === 'type') continue
-          // import { a as b } from 'denied' -> const b = __tss_deny_N.a
           const importedName = t.isIdentifier(specifier.imported)
             ? specifier.imported.name
             : specifier.imported.value
@@ -165,7 +165,6 @@ export function rewriteDeniedImports(
       continue
     }
 
-    // --- export { x } from 'denied' ---
     if (t.isExportNamedDeclaration(node) && node.source) {
       if (node.exportKind === 'type') continue
       if (!deniedSources.has(node.source.value)) continue
@@ -173,15 +172,12 @@ export function rewriteDeniedImports(
       const mockVar = `__tss_deny_${mockCounter++}`
       const replacements: Array<t.Statement> = []
 
-      // import __tss_deny_N from '<mock>'
       replacements.push(
         t.importDeclaration(
           [t.importDefaultSpecifier(t.identifier(mockVar))],
           t.stringLiteral(getMockModuleId(node.source.value)),
         ),
       )
-
-      // For each re-exported specifier, create an exported const
       const exportSpecifiers: Array<{
         localName: string
         exportedName: string
@@ -195,7 +191,6 @@ export function rewriteDeniedImports(
             : specifier.exported.value
 
           const internalVar = `__tss_reexport_${localName}`
-          // const __tss_reexport_x = __tss_deny_N.x
           replacements.push(
             t.variableDeclaration('const', [
               t.variableDeclarator(
@@ -211,7 +206,6 @@ export function rewriteDeniedImports(
         }
       }
 
-      // export { __tss_reexport_x as x, ... }
       if (exportSpecifiers.length > 0) {
         replacements.push(
           t.exportNamedDeclaration(
@@ -231,12 +225,10 @@ export function rewriteDeniedImports(
       continue
     }
 
-    // --- export * from 'denied' ---
     if (t.isExportAllDeclaration(node)) {
       if (node.exportKind === 'type') continue
       if (!deniedSources.has(node.source.value)) continue
 
-      // Remove the star re-export entirely
       ast.program.body.splice(i, 1)
       modified = true
       continue