@tanstack/start-plugin-core 1.163.0 → 1.163.2

package/dist/esm/import-protection-plugin/virtualModules.js

@@ -13,6 +13,29 @@ const MOCK_RUNTIME_PREFIX = "tanstack-start-import-protection:mock-runtime:";
 const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX);
 const MARKER_PREFIX = "tanstack-start-import-protection:marker:";
 const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX);
+const RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`);
+const RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`);
+function resolvedMarkerVirtualModuleId(kind) {
+  return kind === "server" ? RESOLVED_MARKER_SERVER_ONLY : RESOLVED_MARKER_CLIENT_ONLY;
+}
+function getResolvedVirtualModuleMatchers() {
+  return RESOLVED_VIRTUAL_MODULE_MATCHERS;
+}
+const RESOLVED_VIRTUAL_MODULE_MATCHERS = [
+  RESOLVED_MOCK_MODULE_ID,
+  RESOLVED_MOCK_BUILD_PREFIX,
+  RESOLVED_MOCK_EDGE_PREFIX,
+  RESOLVED_MOCK_RUNTIME_PREFIX,
+  RESOLVED_MARKER_PREFIX
+];
+function resolveInternalVirtualModuleId(source) {
+  if (source === MOCK_MODULE_ID) return RESOLVED_MOCK_MODULE_ID;
+  if (source.startsWith(MOCK_EDGE_PREFIX)) return resolveViteId(source);
+  if (source.startsWith(MOCK_RUNTIME_PREFIX)) return resolveViteId(source);
+  if (source.startsWith(MOCK_BUILD_PREFIX)) return resolveViteId(source);
+  if (source.startsWith(MARKER_PREFIX)) return resolveViteId(source);
+  return void 0;
+}
 function toBase64Url(input) {
   return Buffer.from(input, "utf8").toString("base64url");
 }
@@ -98,7 +121,8 @@ function __report(action, accessPath) {
       return true;
     },` : "";
   return `
-${preamble}function ${fnName}(name) {
+${preamble}/* @__NO_SIDE_EFFECTS__ */
+function ${fnName}(name) {
   const fn = function () {};
   fn.prototype.name = name;
   const children = Object.create(null);
@@ -125,12 +149,12 @@ ${preamble}function ${fnName}(name) {
   });
   return proxy;
 }
-const mock = ${fnName}('mock');
+const mock = /* @__PURE__ */ ${fnName}('mock');
 export default mock;
 `;
 }
 function loadSilentMockModule() {
-  return { syntheticNamedExports: true, code: generateMockCode() };
+  return { code: generateMockCode() };
 }
 function loadMockEdgeModule(encodedPayload) {
   let payload;
@@ -186,23 +210,40 @@ const MARKER_MODULE_RESULT = { code: "export {}" };
 function loadMarkerModule() {
   return MARKER_MODULE_RESULT;
 }
+function loadResolvedVirtualModule(id) {
+  if (id === RESOLVED_MOCK_MODULE_ID) {
+    return loadSilentMockModule();
+  }
+  if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {
+    return loadSilentMockModule();
+  }
+  if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {
+    return loadMockEdgeModule(id.slice(RESOLVED_MOCK_EDGE_PREFIX.length));
+  }
+  if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {
+    return loadMockRuntimeModule(id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length));
+  }
+  if (id.startsWith(RESOLVED_MARKER_PREFIX)) {
+    return loadMarkerModule();
+  }
+  return void 0;
+}
 export {
   MARKER_PREFIX,
   MOCK_BUILD_PREFIX,
   MOCK_EDGE_PREFIX,
   MOCK_MODULE_ID,
   MOCK_RUNTIME_PREFIX,
-  RESOLVED_MARKER_PREFIX,
-  RESOLVED_MOCK_BUILD_PREFIX,
-  RESOLVED_MOCK_EDGE_PREFIX,
-  RESOLVED_MOCK_MODULE_ID,
-  RESOLVED_MOCK_RUNTIME_PREFIX,
   RUNTIME_SUGGESTION_TEXT,
+  getResolvedVirtualModuleMatchers,
   loadMarkerModule,
   loadMockEdgeModule,
   loadMockRuntimeModule,
+  loadResolvedVirtualModule,
   loadSilentMockModule,
   makeMockEdgeModuleId,
-  mockRuntimeModuleIdFromViolation
+  mockRuntimeModuleIdFromViolation,
+  resolveInternalVirtualModuleId,
+  resolvedMarkerVirtualModuleId
 };
 //# sourceMappingURL=virtualModules.js.map

package/dist/esm/import-protection-plugin/virtualModules.js.map

@@ -1 +1 @@
-{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport { CLIENT_ENV_SUGGESTIONS } from './trace'\nimport { relativizePath } from './utils'\nimport type { ViolationInfo } from './trace'\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nexport const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\n/**\n * Per-violation mock prefix used in build+error mode.\n * Each deferred violation gets a unique ID so we can check which ones\n * survived tree-shaking in `generateBundle`.\n */\nexport const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'\nexport const RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nexport const RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nexport const RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nexport const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nexport const RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\ntype MockAccessMode = 'error' | 'warn' | 'off'\n\n/**\n * Compact runtime suggestion text for browser console, derived from\n * {@link CLIENT_ENV_SUGGESTIONS} so there's a single source of truth.\n */\nexport const RUNTIME_SUGGESTION_TEXT =\n  'Fix: ' +\n  CLIENT_ENV_SUGGESTIONS.join('. ') +\n  '. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".'\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n\n  const rel = (p: string) => relativizePath(p, root)\n  const trace = info.trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n\n  const payload = {\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace,\n    mode,\n  }\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  source: string,\n  runtimeId: string,\n): string {\n  const payload = { source, exports, runtimeId }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n/**\n * Generate a recursive Proxy-based mock module.\n *\n * When `diagnostics` is provided, the generated code includes a `__report`\n * function that logs runtime warnings/errors when the mock is actually used\n * (property access for primitive coercion, calls, construction, sets).\n *\n * When `diagnostics` is omitted, the mock is completely silent — suitable\n * for the shared `MOCK_MODULE_ID` that uses `syntheticNamedExports`.\n */\nfunction generateMockCode(diagnostics?: {\n  meta: {\n    env: string\n    importer: string\n    specifier: string\n    trace: Array<unknown>\n  }\n  mode: 'error' | 'warn' | 'off'\n}): string {\n  const fnName = diagnostics ? '__createMock' : 'createMock'\n  const hasDiag = !!diagnostics\n\n  const preamble = hasDiag\n    ? `const __meta = ${JSON.stringify(diagnostics.meta)};\nconst __mode = ${JSON.stringify(diagnostics.mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\n' + ${JSON.stringify(RUNTIME_SUGGESTION_TEXT)};\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n`\n    : ''\n\n  // Diagnostic-only traps for primitive coercion, set\n  const diagGetTraps = hasDiag\n    ? `\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }`\n    : ''\n\n  const applyBody = hasDiag\n    ? `__report('call', name + '()');\n      return ${fnName}(name + '()');`\n    : `return ${fnName}(name + '()');`\n\n  const constructBody = hasDiag\n    ? `__report('construct', 'new ' + name);\n      return ${fnName}('new ' + name);`\n    : `return ${fnName}('new ' + name);`\n\n  const setTrap = hasDiag\n    ? `\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },`\n    : ''\n\n  return `\n${preamble}function ${fnName}(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };${diagGetTraps}\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = ${fnName}(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      ${applyBody}\n    },\n    construct() {\n      ${constructBody}\n    },${setTrap}\n  });\n  return proxy;\n}\nconst mock = ${fnName}('mock');\nexport default mock;\n`\n}\n\nexport function loadSilentMockModule(): {\n  syntheticNamedExports: boolean\n  code: string\n} {\n  return { syntheticNamedExports: true, code: generateMockCode() }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names: Array<string> = Array.isArray(payload.exports)\n    ? payload.exports.filter(\n        (n): n is string =>\n          typeof n === 'string' && n.length > 0 && n !== 'default',\n      )\n    : []\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines: Array<string> = []\n  const stringExports: Array<{ alias: string; name: string }> = []\n\n  for (let i = 0; i < names.length; i++) {\n    const n = names[i]!\n    if (isValidExportName(n)) {\n      exportLines.push(`export const ${n} = mock.${n};`)\n    } else {\n      // ES2022 string-keyed export: use a temp var + re-export with string literal\n      const alias = `__tss_str_${i}`\n      exportLines.push(`const ${alias} = mock[${JSON.stringify(n)}];`)\n      stringExports.push({ alias, name: n })\n    }\n  }\n\n  if (stringExports.length > 0) {\n    const reexports = stringExports\n      .map((s) => `${s.alias} as ${JSON.stringify(s.name)}`)\n      .join(', ')\n    exportLines.push(`export { ${reexports} };`)\n  }\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return { code: generateMockCode({ meta, mode }) }\n}\n\nconst MARKER_MODULE_RESULT = { code: 'export {}' } as const\n\nexport function loadMarkerModule(): { code: string } {\n  return MARKER_MODULE_RESULT\n}\n"],"names":[],"mappings":";;;;;AAOO,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,cAAc,cAAc;AAO5D,MAAM,oBAAoB;AAC1B,MAAM,6BAA6B,cAAc,iBAAiB;AAElE,MAAM,mBAAmB;AACzB,MAAM,4BAA4B,cAAc,gBAAgB;AAEhE,MAAM,sBACX;AACK,MAAM,+BAA+B,cAAc,mBAAmB;AAEtE,MAAM,gBAAgB;AACtB,MAAM,yBAAyB,cAAc,aAAa;AAEjE,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQO,MAAM,0BACX,UACA,uBAAuB,KAAK,IAAI,IAChC;AAEK,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AAEvD,QAAM,MAAM,CAAC,MAAc,eAAe,GAAG,IAAI;AACjD,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AAED,QAAM,UAAU;AAAA,IACd,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEO,SAAS,qBACd,SACA,QACA,WACQ;AACR,QAAM,UAAU,EAAE,QAAQ,SAAS,UAAA;AACnC,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAYA,SAAS,iBAAiB,aAQf;AACT,QAAM,SAAS,cAAc,iBAAiB;AAC9C,QAAM,UAAU,CAAC,CAAC;AAElB,QAAM,WAAW,UACb,kBAAkB,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,iBACvC,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAmBhC,KAAK,UAAU,uBAAuB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlD;AAGJ,QAAM,eAAe,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAaA;AAEJ,QAAM,YAAY,UACd;AAAA,eACS,MAAM,mBACf,UAAU,MAAM;AAEpB,QAAM,gBAAgB,UAClB;AAAA,eACS,MAAM,qBACf,UAAU,MAAM;AAEpB,QAAM,UAAU,UACZ;AAAA;AAAA;AAAA;AAAA,UAKA;AAEJ,SAAO;AAAA,EACP,QAAQ,YAAY,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sFAW0D,YAAY;AAAA;AAAA;AAAA,2BAGvE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,QAKzB,SAAS;AAAA;AAAA;AAAA,QAGT,aAAa;AAAA,QACb,OAAO;AAAA;AAAA;AAAA;AAAA,eAIA,MAAM;AAAA;AAAA;AAGrB;AAEO,SAAS,uBAGd;AACA,SAAO,EAAE,uBAAuB,MAAM,MAAM,mBAAiB;AAC/D;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAuB,MAAM,QAAQ,QAAQ,OAAO,IACtD,QAAQ,QAAQ;AAAA,IACd,CAAC,MACC,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,MAAM;AAAA,EAAA,IAEnD,CAAA;AAEJ,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAA6B,CAAA;AACnC,QAAM,gBAAwD,CAAA;AAE9D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,kBAAkB,CAAC,GAAG;AACxB,kBAAY,KAAK,gBAAgB,CAAC,WAAW,CAAC,GAAG;AAAA,IACnD,OAAO;AAEL,YAAM,QAAQ,aAAa,CAAC;AAC5B,kBAAY,KAAK,SAAS,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,IAAI;AAC/D,oBAAc,KAAK,EAAE,OAAO,MAAM,GAAG;AAAA,IACvC;AAAA,EACF;AAEA,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,YAAY,cACf,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE,EACpD,KAAK,IAAI;AACZ,gBAAY,KAAK,YAAY,SAAS,KAAK;AAAA,EAC7C;AAEA,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO,EAAE,MAAM,iBAAiB,EAAE,MAAM,KAAA,CAAM,EAAA;AAChD;AAEA,MAAM,uBAAuB,EAAE,MAAM,YAAA;AAE9B,SAAS,mBAAqC;AACnD,SAAO;AACT;"}
+{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport { CLIENT_ENV_SUGGESTIONS } from './trace'\nimport { relativizePath } from './utils'\nimport type { ViolationInfo } from './trace'\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nconst RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\n/**\n * Per-violation mock prefix used in build+error mode.\n * Each deferred violation gets a unique ID so we can check which ones\n * survived tree-shaking in `generateBundle`.\n */\nexport const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'\nconst RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nconst RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nconst RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nexport const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nconst RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\nconst RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)\nconst RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)\n\nexport function resolvedMarkerVirtualModuleId(\n  kind: 'server' | 'client',\n): string {\n  return kind === 'server'\n    ? RESOLVED_MARKER_SERVER_ONLY\n    : RESOLVED_MARKER_CLIENT_ONLY\n}\n\n/**\n * Convenience list for plugin `load` filters/handlers.\n *\n * Vite/Rollup call `load(id)` with the *resolved* virtual id (prefixed by `\\0`).\n * `resolveId(source)` sees the *unresolved* id/prefix (without `\\0`).\n */\nexport function getResolvedVirtualModuleMatchers(): ReadonlyArray<string> {\n  return RESOLVED_VIRTUAL_MODULE_MATCHERS\n}\n\nconst RESOLVED_VIRTUAL_MODULE_MATCHERS = [\n  RESOLVED_MOCK_MODULE_ID,\n  RESOLVED_MOCK_BUILD_PREFIX,\n  RESOLVED_MOCK_EDGE_PREFIX,\n  RESOLVED_MOCK_RUNTIME_PREFIX,\n  RESOLVED_MARKER_PREFIX,\n] as const\n\n/**\n * Resolve import-protection's internal virtual module IDs.\n *\n * `resolveId(source)` sees *unresolved* ids/prefixes (no `\\0`).\n * Returning a resolved id (with `\\0`) ensures Vite/Rollup route it to `load`.\n */\nexport function resolveInternalVirtualModuleId(\n  source: string,\n): string | undefined {\n  if (source === MOCK_MODULE_ID) return RESOLVED_MOCK_MODULE_ID\n  if (source.startsWith(MOCK_EDGE_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MOCK_RUNTIME_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MOCK_BUILD_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MARKER_PREFIX)) return resolveViteId(source)\n  return undefined\n}\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\ntype MockAccessMode = 'error' | 'warn' | 'off'\n\n/**\n * Compact runtime suggestion text for browser console, derived from\n * {@link CLIENT_ENV_SUGGESTIONS} so there's a single source of truth.\n */\nexport const RUNTIME_SUGGESTION_TEXT =\n  'Fix: ' +\n  CLIENT_ENV_SUGGESTIONS.join('. ') +\n  '. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".'\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n\n  const rel = (p: string) => relativizePath(p, root)\n  const trace = info.trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n\n  const payload = {\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace,\n    mode,\n  }\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  source: string,\n  runtimeId: string,\n): string {\n  const payload = { source, exports, runtimeId }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n/**\n * Generate a recursive Proxy-based mock module.\n *\n * When `diagnostics` is provided, the generated code includes a `__report`\n * function that logs runtime warnings/errors when the mock is actually used\n * (property access for primitive coercion, calls, construction, sets).\n *\n * When `diagnostics` is omitted, the mock is completely silent — suitable\n * for base mock modules (e.g. `MOCK_MODULE_ID` or per-violation build mocks)\n * that are consumed by mock-edge modules providing explicit named exports.\n */\nfunction generateMockCode(diagnostics?: {\n  meta: {\n    env: string\n    importer: string\n    specifier: string\n    trace: Array<unknown>\n  }\n  mode: 'error' | 'warn' | 'off'\n}): string {\n  const fnName = diagnostics ? '__createMock' : 'createMock'\n  const hasDiag = !!diagnostics\n\n  const preamble = hasDiag\n    ? `const __meta = ${JSON.stringify(diagnostics.meta)};\nconst __mode = ${JSON.stringify(diagnostics.mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\n' + ${JSON.stringify(RUNTIME_SUGGESTION_TEXT)};\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n`\n    : ''\n\n  // Diagnostic-only traps for primitive coercion, set\n  const diagGetTraps = hasDiag\n    ? `\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }`\n    : ''\n\n  const applyBody = hasDiag\n    ? `__report('call', name + '()');\n      return ${fnName}(name + '()');`\n    : `return ${fnName}(name + '()');`\n\n  const constructBody = hasDiag\n    ? `__report('construct', 'new ' + name);\n      return ${fnName}('new ' + name);`\n    : `return ${fnName}('new ' + name);`\n\n  const setTrap = hasDiag\n    ? `\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },`\n    : ''\n\n  return `\n${preamble}/* @__NO_SIDE_EFFECTS__ */\nfunction ${fnName}(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };${diagGetTraps}\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = ${fnName}(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      ${applyBody}\n    },\n    construct() {\n      ${constructBody}\n    },${setTrap}\n  });\n  return proxy;\n}\nconst mock = /* @__PURE__ */ ${fnName}('mock');\nexport default mock;\n`\n}\n\nexport function loadSilentMockModule(): { code: string } {\n  return { code: generateMockCode() }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names: Array<string> = Array.isArray(payload.exports)\n    ? payload.exports.filter(\n        (n): n is string =>\n          typeof n === 'string' && n.length > 0 && n !== 'default',\n      )\n    : []\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines: Array<string> = []\n  const stringExports: Array<{ alias: string; name: string }> = []\n\n  for (let i = 0; i < names.length; i++) {\n    const n = names[i]!\n    if (isValidExportName(n)) {\n      exportLines.push(`export const ${n} = mock.${n};`)\n    } else {\n      // ES2022 string-keyed export: use a temp var + re-export with string literal\n      const alias = `__tss_str_${i}`\n      exportLines.push(`const ${alias} = mock[${JSON.stringify(n)}];`)\n      stringExports.push({ alias, name: n })\n    }\n  }\n\n  if (stringExports.length > 0) {\n    const reexports = stringExports\n      .map((s) => `${s.alias} as ${JSON.stringify(s.name)}`)\n      .join(', ')\n    exportLines.push(`export { ${reexports} };`)\n  }\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return { code: generateMockCode({ meta, mode }) }\n}\n\nconst MARKER_MODULE_RESULT = { code: 'export {}' } as const\n\nexport function loadMarkerModule(): { code: string } {\n  return MARKER_MODULE_RESULT\n}\n\nexport function loadResolvedVirtualModule(\n  id: string,\n): { code: string } | undefined {\n  if (id === RESOLVED_MOCK_MODULE_ID) {\n    return loadSilentMockModule()\n  }\n\n  // Per-violation build mock modules — same silent mock code\n  if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {\n    return loadSilentMockModule()\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {\n    return loadMockEdgeModule(id.slice(RESOLVED_MOCK_EDGE_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {\n    return loadMockRuntimeModule(id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MARKER_PREFIX)) {\n    return loadMarkerModule()\n  }\n\n  return undefined\n}\n"],"names":[],"mappings":";;;;;AAOO,MAAM,iBAAiB;AAC9B,MAAM,0BAA0B,cAAc,cAAc;AAOrD,MAAM,oBAAoB;AACjC,MAAM,6BAA6B,cAAc,iBAAiB;AAE3D,MAAM,mBAAmB;AAChC,MAAM,4BAA4B,cAAc,gBAAgB;AAEzD,MAAM,sBACX;AACF,MAAM,+BAA+B,cAAc,mBAAmB;AAE/D,MAAM,gBAAgB;AAC7B,MAAM,yBAAyB,cAAc,aAAa;AAE1D,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAC/E,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAExE,SAAS,8BACd,MACQ;AACR,SAAO,SAAS,WACZ,8BACA;AACN;AAQO,SAAS,mCAA0D;AACxE,SAAO;AACT;AAEA,MAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,+BACd,QACoB;AACpB,MAAI,WAAW,eAAgB,QAAO;AACtC,MAAI,OAAO,WAAW,gBAAgB,EAAG,QAAO,cAAc,MAAM;AACpE,MAAI,OAAO,WAAW,mBAAmB,EAAG,QAAO,cAAc,MAAM;AACvE,MAAI,OAAO,WAAW,iBAAiB,EAAG,QAAO,cAAc,MAAM;AACrE,MAAI,OAAO,WAAW,aAAa,EAAG,QAAO,cAAc,MAAM;AACjE,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQO,MAAM,0BACX,UACA,uBAAuB,KAAK,IAAI,IAChC;AAEK,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AAEvD,QAAM,MAAM,CAAC,MAAc,eAAe,GAAG,IAAI;AACjD,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AAED,QAAM,UAAU;AAAA,IACd,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEO,SAAS,qBACd,SACA,QACA,WACQ;AACR,QAAM,UAAU,EAAE,QAAQ,SAAS,UAAA;AACnC,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAaA,SAAS,iBAAiB,aAQf;AACT,QAAM,SAAS,cAAc,iBAAiB;AAC9C,QAAM,UAAU,CAAC,CAAC;AAElB,QAAM,WAAW,UACb,kBAAkB,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,iBACvC,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAmBhC,KAAK,UAAU,uBAAuB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlD;AAGJ,QAAM,eAAe,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAaA;AAEJ,QAAM,YAAY,UACd;AAAA,eACS,MAAM,mBACf,UAAU,MAAM;AAEpB,QAAM,gBAAgB,UAClB;AAAA,eACS,MAAM,qBACf,UAAU,MAAM;AAEpB,QAAM,UAAU,UACZ;AAAA;AAAA;AAAA;AAAA,UAKA;AAEJ,SAAO;AAAA,EACP,QAAQ;AAAA,WACC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sFAWqE,YAAY;AAAA;AAAA;AAAA,2BAGvE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,QAKzB,SAAS;AAAA;AAAA;AAAA,QAGT,aAAa;AAAA,QACb,OAAO;AAAA;AAAA;AAAA;AAAA,+BAIgB,MAAM;AAAA;AAAA;AAGrC;AAEO,SAAS,uBAAyC;AACvD,SAAO,EAAE,MAAM,mBAAiB;AAClC;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAuB,MAAM,QAAQ,QAAQ,OAAO,IACtD,QAAQ,QAAQ;AAAA,IACd,CAAC,MACC,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,MAAM;AAAA,EAAA,IAEnD,CAAA;AAEJ,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAA6B,CAAA;AACnC,QAAM,gBAAwD,CAAA;AAE9D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,kBAAkB,CAAC,GAAG;AACxB,kBAAY,KAAK,gBAAgB,CAAC,WAAW,CAAC,GAAG;AAAA,IACnD,OAAO;AAEL,YAAM,QAAQ,aAAa,CAAC;AAC5B,kBAAY,KAAK,SAAS,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,IAAI;AAC/D,oBAAc,KAAK,EAAE,OAAO,MAAM,GAAG;AAAA,IACvC;AAAA,EACF;AAEA,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,YAAY,cACf,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE,EACpD,KAAK,IAAI;AACZ,gBAAY,KAAK,YAAY,SAAS,KAAK;AAAA,EAC7C;AAEA,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO,EAAE,MAAM,iBAAiB,EAAE,MAAM,KAAA,CAAM,EAAA;AAChD;AAEA,MAAM,uBAAuB,EAAE,MAAM,YAAA;AAE9B,SAAS,mBAAqC;AACnD,SAAO;AACT;AAEO,SAAS,0BACd,IAC8B;AAC9B,MAAI,OAAO,yBAAyB;AAClC,WAAO,qBAAA;AAAA,EACT;AAGA,MAAI,GAAG,WAAW,0BAA0B,GAAG;AAC7C,WAAO,qBAAA;AAAA,EACT;AAEA,MAAI,GAAG,WAAW,yBAAyB,GAAG;AAC5C,WAAO,mBAAmB,GAAG,MAAM,0BAA0B,MAAM,CAAC;AAAA,EACtE;AAEA,MAAI,GAAG,WAAW,4BAA4B,GAAG;AAC/C,WAAO,sBAAsB,GAAG,MAAM,6BAA6B,MAAM,CAAC;AAAA,EAC5E;AAEA,MAAI,GAAG,WAAW,sBAAsB,GAAG;AACzC,WAAO,iBAAA;AAAA,EACT;AAEA,SAAO;AACT;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanstack/start-plugin-core",
-  "version": "1.163.0",
+  "version": "1.163.2",
   "description": "Modern and scalable routing for React applications",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -60,12 +60,12 @@
     "vitefu": "^1.1.1",
     "xmlbuilder2": "^4.0.3",
     "zod": "^3.24.2",
-    "@tanstack/router-core": "1.162.9",
-    "@tanstack/router-generator": "1.162.9",
+    "@tanstack/router-core": "1.163.2",
+    "@tanstack/router-generator": "1.163.2",
+    "@tanstack/router-plugin": "1.163.2",
     "@tanstack/router-utils": "1.161.4",
-    "@tanstack/start-client-core": "1.162.9",
-    "@tanstack/router-plugin": "1.162.9",
-    "@tanstack/start-server-core": "1.162.9"
+    "@tanstack/start-client-core": "1.163.2",
+    "@tanstack/start-server-core": "1.163.2"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.0.6",

package/src/import-protection-plugin/INTERNALS.md

@@ -78,9 +78,9 @@ analysing a module's exports. These are tracked via `serverFnLookupModules` and
 ### Central functions
 
 - **`handleViolation()`**: Formats + reports (or silences) the violation. Returns
-  a mock module ID (or `{ id, syntheticNamedExports }` in build) so `resolveId`
-  can substitute the offending import. May also return `undefined` (suppressed by
-  `onViolation` or silent+error in dev) or throw via `ctx.error()` (dev+error).
+  a mock-edge module ID (string) so `resolveId` can substitute the offending
+  import. May also return `undefined` (suppressed by `onViolation` or
+  silent+error in dev) or throw via `ctx.error()` (dev+error).
 - **`reportOrDeferViolation()`**: Dispatch layer. Either defers (stores for later
   verification) or reports immediately, depending on `shouldDefer`.
 
@@ -138,8 +138,11 @@ In dev, each violation gets a **per-importer mock edge module** that:
 - Delegates to a **runtime mock module** that contains a recursive Proxy and
   optional runtime diagnostics (console warnings when mocked values are used).
 
-This differs from build mode, where `syntheticNamedExports: true` lets Rollup
-handle named export resolution from the silent mock.
+This differs from build mode, where each violation gets a **per-violation mock
+edge module** wrapping a unique base mock module
+(`\0tanstack-start-import-protection:mock:build:N`). The edge module re-exports
+the named exports the importer expects, just like in dev, ensuring compatibility
+with both Rollup and Rolldown (which doesn't support `syntheticNamedExports`).
 
 ## Build Mode Strategy
 
@@ -148,15 +151,19 @@ handle named export resolution from the silent mock.
 Both mock and error build modes follow the same pattern:
 
 1. **`resolveId`**: Call `handleViolation({ silent: true })`. Generate a
-   **unique per-violation mock module ID** (`\0tanstack-start-import-protection:mock:build:N`).
-   Store the violation + mock ID in `env.deferredBuildViolations`. Return the
-   mock ID so Rollup substitutes the offending import.
+   **unique per-violation mock-edge module** that wraps a base mock module
+   (`\0tanstack-start-import-protection:mock:build:N`) and provides explicit
+   named exports matching the importer's import bindings. Store the violation +
+   mock-edge ID in `env.deferredBuildViolations`. Return the mock-edge ID so the
+   bundler substitutes the offending import.
 
-2. **`load`**: Return a silent Proxy-based mock module (same code as
-   `RESOLVED_MOCK_MODULE_ID`) with `syntheticNamedExports: true`.
+2. **`load`**: For the base mock module, return a silent Proxy-based mock. For
+   the mock-edge module, return code that imports from the base mock and
+   re-exports the expected named bindings (e.g. `export const Foo = mock.Foo`).
 
-3. **Tree-shaking**: Rollup processes the bundle normally. If no binding from
-   the mock module is actually used at runtime, the mock module is eliminated.
+3. **Tree-shaking**: The bundler processes the bundle normally. If no binding from
+   the mock-edge module is actually used at runtime, both the edge and base
+   modules are eliminated.
 
 4. **`generateBundle`**: Inspect the output chunks. For each deferred violation,
    check whether its unique mock module ID appears in any chunk's `modules`.
@@ -171,15 +178,16 @@ Both mock and error build modes follow the same pattern:
 The original `RESOLVED_MOCK_MODULE_ID` is a single shared virtual module used
 for all mock-mode violations. If multiple violations are deferred, we need to
 know _which specific ones_ survived tree-shaking. A shared ID would tell us
-"something survived" but not which violation it corresponds to. The unique IDs
-(`...mock:build:0`, `...mock:build:1`, etc.) provide this granularity.
+"something survived" but not which violation it corresponds to. Each violation
+gets a unique mock-edge module (wrapping a unique base mock
+`...mock:build:0`, `...mock:build:1`, etc.) to provide this granularity.
 
 ### Why mocking doesn't affect tree-shaking
 
 From the consumer's perspective, the import bindings are identical whether they
-point to the real module or the mock. Rollup tree-shakes based on binding usage,
-not module content. If a binding from the barrel's re-export of `.server` is
-unused after the Start compiler strips server fn handlers, tree-shaking
+point to the real module or the mock. The bundler tree-shakes based on binding
+usage, not module content. If a binding from the barrel's re-export of `.server`
+is unused after the Start compiler strips server fn handlers, tree-shaking
 eliminates it regardless of whether it points to real DB code or a Proxy mock.
 
 ### Per-environment operation

package/src/import-protection-plugin/plugin.ts

@@ -21,21 +21,13 @@ import {
 } from './utils'
 import { collectMockExportNamesBySource } from './rewriteDeniedImports'
 import {
-  MARKER_PREFIX,
-  MOCK_EDGE_PREFIX,
-  MOCK_MODULE_ID,
-  MOCK_RUNTIME_PREFIX,
-  RESOLVED_MARKER_PREFIX,
-  RESOLVED_MOCK_BUILD_PREFIX,
-  RESOLVED_MOCK_EDGE_PREFIX,
-  RESOLVED_MOCK_MODULE_ID,
-  RESOLVED_MOCK_RUNTIME_PREFIX,
-  loadMarkerModule,
-  loadMockEdgeModule,
-  loadMockRuntimeModule,
-  loadSilentMockModule,
+  MOCK_BUILD_PREFIX,
+  getResolvedVirtualModuleMatchers,
+  loadResolvedVirtualModule,
   makeMockEdgeModuleId,
   mockRuntimeModuleIdFromViolation,
+  resolveInternalVirtualModuleId,
+  resolvedMarkerVirtualModuleId,
 } from './virtualModules'
 import {
   ImportLocCache,
@@ -62,9 +54,6 @@ import type {
 import type { CompileStartFrameworkOptions, GetConfigFn } from '../types'
 
 const SERVER_FN_LOOKUP_QUERY = '?' + SERVER_FN_LOOKUP
-const RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)
-const RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)
-
 const IMPORT_PROTECTION_DEBUG =
   process.env.TSR_IMPORT_PROTECTION_DEBUG === '1' ||
   process.env.TSR_IMPORT_PROTECTION_DEBUG === 'true'
@@ -82,7 +71,6 @@ function matchesDebugFilter(...values: Array<string>): boolean {
   return values.some((v) => v.includes(IMPORT_PROTECTION_DEBUG_FILTER))
 }
 
-export { RESOLVED_MOCK_MODULE_ID } from './virtualModules'
 export { rewriteDeniedImports } from './rewriteDeniedImports'
 export { dedupePatterns, extractImportSources } from './utils'
 export type { Pattern } from './utils'
@@ -216,6 +204,16 @@ interface DeferredBuildViolation {
   info: ViolationInfo
   /** Unique mock module ID assigned to this violation. */
   mockModuleId: string
+
+  /**
+   * Module ID to check for tree-shaking survival in `generateBundle`.
+   *
+   * For most violations we check the unique mock module ID.
+   * For `marker` violations the import is a bare side-effect import that often
+   * gets optimized away regardless of whether the importer survives, so we
+   * instead check whether the importer module itself survived.
+   */
+  checkModuleId?: string
 }
 
 /**
@@ -818,27 +816,18 @@ export function importProtectionPlugin(
     env: EnvState,
     importerFile: string,
     info: ViolationInfo,
-    mockReturnValue:
-      | { id: string; syntheticNamedExports: boolean }
-      | string
-      | undefined,
+    mockReturnValue: string | undefined,
   ): void {
     getOrCreate(env.pendingViolations, importerFile, () => []).push({
       info,
-      mockReturnValue:
-        typeof mockReturnValue === 'string'
-          ? mockReturnValue
-          : (mockReturnValue?.id ?? ''),
+      mockReturnValue: mockReturnValue ?? '',
     })
   }
 
   /** Counter for generating unique per-violation mock module IDs in build mode. */
   let buildViolationCounter = 0
 
-  type HandleViolationResult =
-    | { id: string; syntheticNamedExports: boolean }
-    | string
-    | undefined
+  type HandleViolationResult = string | undefined
 
   async function handleViolation(
     ctx: ViolationReporter,
@@ -909,8 +898,22 @@ export function importProtectionPlugin(
 
     // Build: unique per-violation mock IDs so generateBundle can check
     // which violations survived tree-shaking (both mock and error mode).
-    const mockId = `${RESOLVED_MOCK_BUILD_PREFIX}${buildViolationCounter++}`
-    return { id: mockId, syntheticNamedExports: true }
+    // We wrap the base mock in a mock-edge module that provides explicit
+    // named exports — Rolldown doesn't support Rollup's
+    // syntheticNamedExports, so without this named imports like
+    // `import { Foo } from "denied-pkg"` would fail with MISSING_EXPORT.
+    //
+    // Use the unresolved MOCK_BUILD_PREFIX (without \0) as the runtimeId
+    // so the mock-edge module's `import mock from "..."` goes through
+    // resolveId, which adds the \0 prefix. Using the resolved ID directly
+    // would cause Rollup/Vite to skip resolveId and fail to find the module.
+    const baseMockId = `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`
+    const importerFile = normalizeFilePath(info.importer)
+    const exports =
+      env.mockExportsByImporter.get(importerFile)?.get(info.specifier) ?? []
+    return resolveViteId(
+      makeMockEdgeModuleId(exports, info.specifier, baseMockId),
+    )
   }
 
   /**
@@ -940,9 +943,14 @@ export function importProtectionPlugin(
 
       if (config.command === 'build') {
         // Build mode: store for generateBundle tree-shaking check.
-        // The unique mock ID is inside `result`.
-        const mockId = typeof result === 'string' ? result : (result?.id ?? '')
-        env.deferredBuildViolations.push({ info, mockModuleId: mockId })
+        // The mock-edge module ID is returned as a plain string.
+        const mockId = result ?? ''
+        env.deferredBuildViolations.push({
+          info,
+          mockModuleId: mockId,
+          // For marker violations, check importer survival instead of mock.
+          checkModuleId: info.type === 'marker' ? info.importer : undefined,
+        })
       } else {
         // Dev mock: store for graph-reachability check.
         deferViolation(env, importerFile, info, result)
@@ -1182,18 +1190,8 @@ export function importProtectionPlugin(
         }
 
         // Internal virtual modules
-        if (source === MOCK_MODULE_ID) {
-          return RESOLVED_MOCK_MODULE_ID
-        }
-        if (source.startsWith(MOCK_EDGE_PREFIX)) {
-          return resolveViteId(source)
-        }
-        if (source.startsWith(MOCK_RUNTIME_PREFIX)) {
-          return resolveViteId(source)
-        }
-        if (source.startsWith(MARKER_PREFIX)) {
-          return resolveViteId(source)
-        }
+        const internalVirtualId = resolveInternalVirtualModuleId(source)
+        if (internalVirtualId) return internalVirtualId
 
         if (!importer) {
           env.graph.addEntry(source)
@@ -1287,8 +1285,8 @@ export function importProtectionPlugin(
           }
 
           return markerKind === 'server'
-            ? RESOLVED_MARKER_SERVER_ONLY
-            : RESOLVED_MARKER_CLIENT_ONLY
+            ? resolvedMarkerVirtualModuleId('server')
+            : resolvedMarkerVirtualModuleId('client')
         }
 
         // Check if the importer is within our scope
@@ -1427,15 +1425,7 @@ export function importProtectionPlugin(
       load: {
         filter: {
           id: new RegExp(
-            [
-              RESOLVED_MOCK_MODULE_ID,
-              RESOLVED_MOCK_BUILD_PREFIX,
-              RESOLVED_MARKER_PREFIX,
-              RESOLVED_MOCK_EDGE_PREFIX,
-              RESOLVED_MOCK_RUNTIME_PREFIX,
-            ]
-              .map(escapeRegExp)
-              .join('|'),
+            getResolvedVirtualModuleMatchers().map(escapeRegExp).join('|'),
           ),
         },
         handler(id) {
@@ -1448,32 +1438,7 @@ export function importProtectionPlugin(
             }
           }
 
-          if (id === RESOLVED_MOCK_MODULE_ID) {
-            return loadSilentMockModule()
-          }
-
-          // Per-violation build mock modules — same silent mock code
-          if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {
-            return loadSilentMockModule()
-          }
-
-          if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {
-            return loadMockEdgeModule(
-              id.slice(RESOLVED_MOCK_EDGE_PREFIX.length),
-            )
-          }
-
-          if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {
-            return loadMockRuntimeModule(
-              id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length),
-            )
-          }
-
-          if (id.startsWith(RESOLVED_MARKER_PREFIX)) {
-            return loadMarkerModule()
-          }
-
-          return undefined
+          return loadResolvedVirtualModule(id)
         },
       },
 
@@ -1492,11 +1457,16 @@ export function importProtectionPlugin(
           }
         }
 
-        // Check each deferred violation: if its unique mock module survived
+        // Check each deferred violation: if its check module survived
         // in the bundle, the import was NOT tree-shaken — real leak.
         const realViolations: Array<ViolationInfo> = []
-        for (const { info, mockModuleId } of env.deferredBuildViolations) {
-          if (!survivingModules.has(mockModuleId)) continue
+        for (const {
+          info,
+          mockModuleId,
+          checkModuleId,
+        } of env.deferredBuildViolations) {
+          const checkId = checkModuleId ?? mockModuleId
+          if (!survivingModules.has(checkId)) continue
 
           if (config.onViolation) {
             const result = await config.onViolation(info)
@@ -1648,18 +1618,17 @@ export function importProtectionPlugin(
       name: 'tanstack-start-core:import-protection-mock-rewrite',
       enforce: 'pre',
 
-      // Only needed during dev. In build, we rely on Rollup's syntheticNamedExports.
-      apply: 'serve',
-
       applyToEnvironment(env) {
         if (!config.enabled) return false
-        // Only needed in mock mode — when not mocking, there is nothing to
-        // record.  applyToEnvironment runs after configResolved, so
-        // config.effectiveBehavior is already set.
-        if (config.effectiveBehavior !== 'mock') return false
-        // We record expected named exports per importer in all Start Vite
-        // environments during dev so mock-edge modules can provide explicit
-        // ESM named exports.
+        // We record expected named exports per importer so mock-edge modules
+        // can provide explicit ESM named exports.  This is needed in both dev
+        // and build: native ESM (dev) requires real named exports, and
+        // Rolldown (used in Vite 6+) doesn't support Rollup's
+        // syntheticNamedExports flag which was previously relied upon in build.
+        //
+        // In build+error mode we still emit mock modules for deferred
+        // violations (checked at generateBundle time), so we always need the
+        // export name data when import protection is active.
         return environmentNames.has(env.name)
       },