@tanstack/start-plugin-core 1.162.9 → 1.163.1

package/src/import-protection-plugin/plugin.ts

@@ -21,21 +21,13 @@ import {
 } from './utils'
 import { collectMockExportNamesBySource } from './rewriteDeniedImports'
 import {
-  MARKER_PREFIX,
-  MOCK_EDGE_PREFIX,
-  MOCK_MODULE_ID,
-  MOCK_RUNTIME_PREFIX,
-  RESOLVED_MARKER_PREFIX,
-  RESOLVED_MOCK_BUILD_PREFIX,
-  RESOLVED_MOCK_EDGE_PREFIX,
-  RESOLVED_MOCK_MODULE_ID,
-  RESOLVED_MOCK_RUNTIME_PREFIX,
-  loadMarkerModule,
-  loadMockEdgeModule,
-  loadMockRuntimeModule,
-  loadSilentMockModule,
+  MOCK_BUILD_PREFIX,
+  getResolvedVirtualModuleMatchers,
+  loadResolvedVirtualModule,
   makeMockEdgeModuleId,
   mockRuntimeModuleIdFromViolation,
+  resolveInternalVirtualModuleId,
+  resolvedMarkerVirtualModuleId,
 } from './virtualModules'
 import {
   ImportLocCache,
@@ -62,9 +54,6 @@ import type {
 import type { CompileStartFrameworkOptions, GetConfigFn } from '../types'
 
 const SERVER_FN_LOOKUP_QUERY = '?' + SERVER_FN_LOOKUP
-const RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)
-const RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)
-
 const IMPORT_PROTECTION_DEBUG =
   process.env.TSR_IMPORT_PROTECTION_DEBUG === '1' ||
   process.env.TSR_IMPORT_PROTECTION_DEBUG === 'true'
@@ -82,7 +71,6 @@ function matchesDebugFilter(...values: Array<string>): boolean {
   return values.some((v) => v.includes(IMPORT_PROTECTION_DEBUG_FILTER))
 }
 
-export { RESOLVED_MOCK_MODULE_ID } from './virtualModules'
 export { rewriteDeniedImports } from './rewriteDeniedImports'
 export { dedupePatterns, extractImportSources } from './utils'
 export type { Pattern } from './utils'
@@ -110,10 +98,12 @@ interface PluginConfig {
     client: {
       specifiers: Array<CompiledMatcher>
       files: Array<CompiledMatcher>
+      excludeFiles: Array<CompiledMatcher>
     }
     server: {
       specifiers: Array<CompiledMatcher>
       files: Array<CompiledMatcher>
+      excludeFiles: Array<CompiledMatcher>
     }
   }
   includeMatchers: Array<CompiledMatcher>
@@ -214,6 +204,16 @@ interface DeferredBuildViolation {
   info: ViolationInfo
   /** Unique mock module ID assigned to this violation. */
   mockModuleId: string
+
+  /**
+   * Module ID to check for tree-shaking survival in `generateBundle`.
+   *
+   * For most violations we check the unique mock module ID.
+   * For `marker` violations the import is a bare side-effect import that often
+   * gets optimized away regardless of whether the importer survives, so we
+   * instead check whether the importer module itself survived.
+   */
+  checkModuleId?: string
 }
 
 /**
@@ -350,8 +350,8 @@ export function importProtectionPlugin(
     logMode: 'once',
     maxTraceDepth: 20,
     compiledRules: {
-      client: { specifiers: [], files: [] },
-      server: { specifiers: [], files: [] },
+      client: { specifiers: [], files: [], excludeFiles: [] },
+      server: { specifiers: [], files: [], excludeFiles: [] },
     },
     includeMatchers: [],
     excludeMatchers: [],
@@ -540,6 +540,7 @@ export function importProtectionPlugin(
   function getRulesForEnvironment(envName: string): {
     specifiers: Array<CompiledMatcher>
     files: Array<CompiledMatcher>
+    excludeFiles: Array<CompiledMatcher>
   } {
     const type = getEnvType(envName)
     return type === 'client'
@@ -815,27 +816,18 @@ export function importProtectionPlugin(
     env: EnvState,
     importerFile: string,
     info: ViolationInfo,
-    mockReturnValue:
-      | { id: string; syntheticNamedExports: boolean }
-      | string
-      | undefined,
+    mockReturnValue: string | undefined,
   ): void {
     getOrCreate(env.pendingViolations, importerFile, () => []).push({
       info,
-      mockReturnValue:
-        typeof mockReturnValue === 'string'
-          ? mockReturnValue
-          : (mockReturnValue?.id ?? ''),
+      mockReturnValue: mockReturnValue ?? '',
     })
   }
 
   /** Counter for generating unique per-violation mock module IDs in build mode. */
   let buildViolationCounter = 0
 
-  type HandleViolationResult =
-    | { id: string; syntheticNamedExports: boolean }
-    | string
-    | undefined
+  type HandleViolationResult = string | undefined
 
   async function handleViolation(
     ctx: ViolationReporter,
@@ -906,8 +898,22 @@ export function importProtectionPlugin(
 
     // Build: unique per-violation mock IDs so generateBundle can check
     // which violations survived tree-shaking (both mock and error mode).
-    const mockId = `${RESOLVED_MOCK_BUILD_PREFIX}${buildViolationCounter++}`
-    return { id: mockId, syntheticNamedExports: true }
+    // We wrap the base mock in a mock-edge module that provides explicit
+    // named exports — Rolldown doesn't support Rollup's
+    // syntheticNamedExports, so without this named imports like
+    // `import { Foo } from "denied-pkg"` would fail with MISSING_EXPORT.
+    //
+    // Use the unresolved MOCK_BUILD_PREFIX (without \0) as the runtimeId
+    // so the mock-edge module's `import mock from "..."` goes through
+    // resolveId, which adds the \0 prefix. Using the resolved ID directly
+    // would cause Rollup/Vite to skip resolveId and fail to find the module.
+    const baseMockId = `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`
+    const importerFile = normalizeFilePath(info.importer)
+    const exports =
+      env.mockExportsByImporter.get(importerFile)?.get(info.specifier) ?? []
+    return resolveViteId(
+      makeMockEdgeModuleId(exports, info.specifier, baseMockId),
+    )
   }
 
   /**
@@ -937,9 +943,14 @@ export function importProtectionPlugin(
 
       if (config.command === 'build') {
         // Build mode: store for generateBundle tree-shaking check.
-        // The unique mock ID is inside `result`.
-        const mockId = typeof result === 'string' ? result : (result?.id ?? '')
-        env.deferredBuildViolations.push({ info, mockModuleId: mockId })
+        // The mock-edge module ID is returned as a plain string.
+        const mockId = result ?? ''
+        env.deferredBuildViolations.push({
+          info,
+          mockModuleId: mockId,
+          // For marker violations, check importer survival instead of mock.
+          checkModuleId: info.type === 'marker' ? info.importer : undefined,
+        })
       } else {
         // Dev mock: store for graph-reachability check.
         deferViolation(env, importerFile, info, result)
@@ -1021,20 +1032,28 @@ export function importProtectionPlugin(
         const clientFiles = userOpts?.client?.files
           ? [...userOpts.client.files]
           : [...defaults.client.files]
+        const clientExcludeFiles = userOpts?.client?.excludeFiles
+          ? [...userOpts.client.excludeFiles]
+          : [...defaults.client.excludeFiles]
         const serverSpecifiers = userOpts?.server?.specifiers
           ? dedupePatterns([...userOpts.server.specifiers])
           : dedupePatterns([...defaults.server.specifiers])
         const serverFiles = userOpts?.server?.files
           ? [...userOpts.server.files]
           : [...defaults.server.files]
+        const serverExcludeFiles = userOpts?.server?.excludeFiles
+          ? [...userOpts.server.excludeFiles]
+          : [...defaults.server.excludeFiles]
 
         config.compiledRules.client = {
           specifiers: compileMatchers(clientSpecifiers),
           files: compileMatchers(clientFiles),
+          excludeFiles: compileMatchers(clientExcludeFiles),
         }
         config.compiledRules.server = {
           specifiers: compileMatchers(serverSpecifiers),
           files: compileMatchers(serverFiles),
+          excludeFiles: compileMatchers(serverExcludeFiles),
         }
 
         // Include/exclude
@@ -1171,18 +1190,8 @@ export function importProtectionPlugin(
         }
 
         // Internal virtual modules
-        if (source === MOCK_MODULE_ID) {
-          return RESOLVED_MOCK_MODULE_ID
-        }
-        if (source.startsWith(MOCK_EDGE_PREFIX)) {
-          return resolveViteId(source)
-        }
-        if (source.startsWith(MOCK_RUNTIME_PREFIX)) {
-          return resolveViteId(source)
-        }
-        if (source.startsWith(MARKER_PREFIX)) {
-          return resolveViteId(source)
-        }
+        const internalVirtualId = resolveInternalVirtualModuleId(source)
+        if (internalVirtualId) return internalVirtualId
 
         if (!importer) {
           env.graph.addEntry(source)
@@ -1276,8 +1285,8 @@ export function importProtectionPlugin(
           }
 
           return markerKind === 'server'
-            ? RESOLVED_MARKER_SERVER_ONLY
-            : RESOLVED_MARKER_CLIENT_ONLY
+            ? resolvedMarkerVirtualModuleId('server')
+            : resolvedMarkerVirtualModuleId('client')
         }
 
         // Check if the importer is within our scope
@@ -1344,56 +1353,69 @@ export function importProtectionPlugin(
 
           env.graph.addEdge(resolved, normalizedImporter, source)
 
-          const fileMatch =
-            matchers.files.length > 0
-              ? matchesAny(relativePath, matchers.files)
-              : undefined
+          // Skip file-based and marker-based denial for resolved paths that
+          // match the per-environment `excludeFiles` patterns.  By default
+          // this includes `**/node_modules/**` so that third-party packages
+          // using `.client.` / `.server.` in their filenames (e.g. react-tweet
+          // exports `index.client.js`) are not treated as user-authored
+          // environment boundaries.  Users can override `excludeFiles` per
+          // environment to narrow or widen this exclusion.
+          const isExcludedFile =
+            matchers.excludeFiles.length > 0 &&
+            matchesAny(relativePath, matchers.excludeFiles)
+
+          if (!isExcludedFile) {
+            const fileMatch =
+              matchers.files.length > 0
+                ? matchesAny(relativePath, matchers.files)
+                : undefined
+
+            if (fileMatch) {
+              const info = await buildViolationInfo(
+                provider,
+                env,
+                envName,
+                envType,
+                importer,
+                normalizedImporter,
+                source,
+                {
+                  type: 'file',
+                  pattern: fileMatch.pattern,
+                  resolved,
+                  message: `Import "${source}" (resolved to "${relativePath}") is denied in the ${envType} environment`,
+                },
+              )
+              return reportOrDeferViolation(
+                this,
+                env,
+                normalizedImporter,
+                info,
+                shouldDefer,
+                isPreTransformResolve,
+              )
+            }
 
-          if (fileMatch) {
-            const info = await buildViolationInfo(
+            const markerInfo = await buildMarkerViolationFromResolvedImport(
               provider,
               env,
               envName,
               envType,
               importer,
-              normalizedImporter,
               source,
-              {
-                type: 'file',
-                pattern: fileMatch.pattern,
-                resolved,
-                message: `Import "${source}" (resolved to "${relativePath}") is denied in the ${envType} environment`,
-              },
-            )
-            return reportOrDeferViolation(
-              this,
-              env,
-              normalizedImporter,
-              info,
-              shouldDefer,
-              isPreTransformResolve,
-            )
-          }
-
-          const markerInfo = await buildMarkerViolationFromResolvedImport(
-            provider,
-            env,
-            envName,
-            envType,
-            importer,
-            source,
-            resolved,
-            relativePath,
-          )
-          if (markerInfo) {
-            return reportOrDeferViolation(
-              this,
-              env,
-              normalizedImporter,
-              markerInfo,
-              shouldDefer,
-              isPreTransformResolve,
+              resolved,
+              relativePath,
             )
+            if (markerInfo) {
+              return reportOrDeferViolation(
+                this,
+                env,
+                normalizedImporter,
+                markerInfo,
+                shouldDefer,
+                isPreTransformResolve,
+              )
+            }
           }
         }
 
@@ -1403,15 +1425,7 @@ export function importProtectionPlugin(
       load: {
         filter: {
           id: new RegExp(
-            [
-              RESOLVED_MOCK_MODULE_ID,
-              RESOLVED_MOCK_BUILD_PREFIX,
-              RESOLVED_MARKER_PREFIX,
-              RESOLVED_MOCK_EDGE_PREFIX,
-              RESOLVED_MOCK_RUNTIME_PREFIX,
-            ]
-              .map(escapeRegExp)
-              .join('|'),
+            getResolvedVirtualModuleMatchers().map(escapeRegExp).join('|'),
           ),
         },
         handler(id) {
@@ -1424,32 +1438,7 @@ export function importProtectionPlugin(
             }
           }
 
-          if (id === RESOLVED_MOCK_MODULE_ID) {
-            return loadSilentMockModule()
-          }
-
-          // Per-violation build mock modules — same silent mock code
-          if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {
-            return loadSilentMockModule()
-          }
-
-          if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {
-            return loadMockEdgeModule(
-              id.slice(RESOLVED_MOCK_EDGE_PREFIX.length),
-            )
-          }
-
-          if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {
-            return loadMockRuntimeModule(
-              id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length),
-            )
-          }
-
-          if (id.startsWith(RESOLVED_MARKER_PREFIX)) {
-            return loadMarkerModule()
-          }
-
-          return undefined
+          return loadResolvedVirtualModule(id)
         },
       },
 
@@ -1468,11 +1457,16 @@ export function importProtectionPlugin(
           }
         }
 
-        // Check each deferred violation: if its unique mock module survived
+        // Check each deferred violation: if its check module survived
         // in the bundle, the import was NOT tree-shaken — real leak.
         const realViolations: Array<ViolationInfo> = []
-        for (const { info, mockModuleId } of env.deferredBuildViolations) {
-          if (!survivingModules.has(mockModuleId)) continue
+        for (const {
+          info,
+          mockModuleId,
+          checkModuleId,
+        } of env.deferredBuildViolations) {
+          const checkId = checkModuleId ?? mockModuleId
+          if (!survivingModules.has(checkId)) continue
 
           if (config.onViolation) {
             const result = await config.onViolation(info)
@@ -1624,18 +1618,17 @@ export function importProtectionPlugin(
       name: 'tanstack-start-core:import-protection-mock-rewrite',
       enforce: 'pre',
 
-      // Only needed during dev. In build, we rely on Rollup's syntheticNamedExports.
-      apply: 'serve',
-
       applyToEnvironment(env) {
         if (!config.enabled) return false
-        // Only needed in mock mode — when not mocking, there is nothing to
-        // record.  applyToEnvironment runs after configResolved, so
-        // config.effectiveBehavior is already set.
-        if (config.effectiveBehavior !== 'mock') return false
-        // We record expected named exports per importer in all Start Vite
-        // environments during dev so mock-edge modules can provide explicit
-        // ESM named exports.
+        // We record expected named exports per importer so mock-edge modules
+        // can provide explicit ESM named exports.  This is needed in both dev
+        // and build: native ESM (dev) requires real named exports, and
+        // Rolldown (used in Vite 6+) doesn't support Rollup's
+        // syntheticNamedExports flag which was previously relied upon in build.
+        //
+        // In build+error mode we still emit mock modules for deferred
+        // violations (checked at generateBundle time), so we always need the
+        // export name data when import protection is active.
         return environmentNames.has(env.name)
       },
 

package/src/import-protection-plugin/virtualModules.ts

@@ -6,7 +6,7 @@ import { relativizePath } from './utils'
 import type { ViolationInfo } from './trace'
 
 export const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'
-export const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)
+const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)
 
 /**
  * Per-violation mock prefix used in build+error mode.
@@ -14,17 +14,63 @@ export const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)
  * survived tree-shaking in `generateBundle`.
  */
 export const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'
-export const RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)
+const RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)
 
 export const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'
-export const RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)
+const RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)
 
 export const MOCK_RUNTIME_PREFIX =
   'tanstack-start-import-protection:mock-runtime:'
-export const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)
+const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)
 
 export const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'
-export const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)
+const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)
+
+const RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)
+const RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)
+
+export function resolvedMarkerVirtualModuleId(
+  kind: 'server' | 'client',
+): string {
+  return kind === 'server'
+    ? RESOLVED_MARKER_SERVER_ONLY
+    : RESOLVED_MARKER_CLIENT_ONLY
+}
+
+/**
+ * Convenience list for plugin `load` filters/handlers.
+ *
+ * Vite/Rollup call `load(id)` with the *resolved* virtual id (prefixed by `\0`).
+ * `resolveId(source)` sees the *unresolved* id/prefix (without `\0`).
+ */
+export function getResolvedVirtualModuleMatchers(): ReadonlyArray<string> {
+  return RESOLVED_VIRTUAL_MODULE_MATCHERS
+}
+
+const RESOLVED_VIRTUAL_MODULE_MATCHERS = [
+  RESOLVED_MOCK_MODULE_ID,
+  RESOLVED_MOCK_BUILD_PREFIX,
+  RESOLVED_MOCK_EDGE_PREFIX,
+  RESOLVED_MOCK_RUNTIME_PREFIX,
+  RESOLVED_MARKER_PREFIX,
+] as const
+
+/**
+ * Resolve import-protection's internal virtual module IDs.
+ *
+ * `resolveId(source)` sees *unresolved* ids/prefixes (no `\0`).
+ * Returning a resolved id (with `\0`) ensures Vite/Rollup route it to `load`.
+ */
+export function resolveInternalVirtualModuleId(
+  source: string,
+): string | undefined {
+  if (source === MOCK_MODULE_ID) return RESOLVED_MOCK_MODULE_ID
+  if (source.startsWith(MOCK_EDGE_PREFIX)) return resolveViteId(source)
+  if (source.startsWith(MOCK_RUNTIME_PREFIX)) return resolveViteId(source)
+  if (source.startsWith(MOCK_BUILD_PREFIX)) return resolveViteId(source)
+  if (source.startsWith(MARKER_PREFIX)) return resolveViteId(source)
+  return undefined
+}
 
 function toBase64Url(input: string): string {
   return Buffer.from(input, 'utf8').toString('base64url')
@@ -87,7 +133,8 @@ export function makeMockEdgeModuleId(
  * (property access for primitive coercion, calls, construction, sets).
  *
  * When `diagnostics` is omitted, the mock is completely silent — suitable
- * for the shared `MOCK_MODULE_ID` that uses `syntheticNamedExports`.
+ * for base mock modules (e.g. `MOCK_MODULE_ID` or per-violation build mocks)
+ * that are consumed by mock-edge modules providing explicit named exports.
  */
 function generateMockCode(diagnostics?: {
   meta: {
@@ -170,7 +217,8 @@ function __report(action, accessPath) {
     : ''
 
   return `
-${preamble}function ${fnName}(name) {
+${preamble}/* @__NO_SIDE_EFFECTS__ */
+function ${fnName}(name) {
   const fn = function () {};
   fn.prototype.name = name;
   const children = Object.create(null);
@@ -197,16 +245,13 @@ ${preamble}function ${fnName}(name) {
   });
   return proxy;
 }
-const mock = ${fnName}('mock');
+const mock = /* @__PURE__ */ ${fnName}('mock');
 export default mock;
 `
 }
 
-export function loadSilentMockModule(): {
-  syntheticNamedExports: boolean
-  code: string
-} {
-  return { syntheticNamedExports: true, code: generateMockCode() }
+export function loadSilentMockModule(): { code: string } {
+  return { code: generateMockCode() }
 }
 
 export function loadMockEdgeModule(encodedPayload: string): { code: string } {
@@ -292,3 +337,30 @@ const MARKER_MODULE_RESULT = { code: 'export {}' } as const
 export function loadMarkerModule(): { code: string } {
   return MARKER_MODULE_RESULT
 }
+
+export function loadResolvedVirtualModule(
+  id: string,
+): { code: string } | undefined {
+  if (id === RESOLVED_MOCK_MODULE_ID) {
+    return loadSilentMockModule()
+  }
+
+  // Per-violation build mock modules — same silent mock code
+  if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {
+    return loadSilentMockModule()
+  }
+
+  if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {
+    return loadMockEdgeModule(id.slice(RESOLVED_MOCK_EDGE_PREFIX.length))
+  }
+
+  if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {
+    return loadMockRuntimeModule(id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length))
+  }
+
+  if (id.startsWith(RESOLVED_MARKER_PREFIX)) {
+    return loadMarkerModule()
+  }
+
+  return undefined
+}

package/src/schema.ts

@@ -16,6 +16,7 @@ const importProtectionBehaviorSchema = z.enum(['error', 'mock'])
 const importProtectionEnvRulesSchema = z.object({
   specifiers: z.array(patternSchema).optional(),
   files: z.array(patternSchema).optional(),
+  excludeFiles: z.array(patternSchema).optional(),
 })
 
 const importProtectionOptionsSchema = z