@tanstack/start-plugin-core 1.163.3 → 1.163.5

package/dist/esm/import-protection-plugin/plugin.js

@@ -1,28 +1,41 @@
 import { normalizePath } from "vite";
 import { resolveViteId } from "../utils.js";
 import { VITE_ENVIRONMENT_NAMES } from "../constants.js";
-import { SERVER_FN_LOOKUP } from "../start-compiler-plugin/plugin.js";
 import { formatViolation, ImportGraph, buildTrace } from "./trace.js";
 import { getDefaultImportProtectionRules, getMarkerSpecifiers } from "./defaults.js";
-import { findPostCompileUsagePos } from "./postCompileUsage.js";
 import { matchesAny, compileMatchers } from "./matchers.js";
-import { escapeRegExp, normalizeFilePath, getOrCreate, clearNormalizeFilePathCache, dedupePatterns, extractImportSources, relativizePath } from "./utils.js";
-import { collectMockExportNamesBySource } from "./rewriteDeniedImports.js";
-import { loadResolvedVirtualModule, getResolvedVirtualModuleMatchers, resolveInternalVirtualModuleId, resolvedMarkerVirtualModuleId, mockRuntimeModuleIdFromViolation, makeMockEdgeModuleId, MOCK_BUILD_PREFIX } from "./virtualModules.js";
-import { clearImportPatternCache, pickOriginalCodeFromSourcesContent, buildLineIndex, ImportLocCache, findPostCompileUsageLocation, findImportStatementLocationFromTransformed, buildCodeSnippet, addTraceImportLocations } from "./sourceLocation.js";
-const SERVER_FN_LOOKUP_QUERY = "?" + SERVER_FN_LOOKUP;
-const IMPORT_PROTECTION_DEBUG = process.env.TSR_IMPORT_PROTECTION_DEBUG === "1" || process.env.TSR_IMPORT_PROTECTION_DEBUG === "true";
-const IMPORT_PROTECTION_DEBUG_FILTER = process.env.TSR_IMPORT_PROTECTION_DEBUG_FILTER;
-function debugLog(...args) {
-  if (!IMPORT_PROTECTION_DEBUG) return;
-  console.warn("[import-protection:debug]", ...args);
-}
-function matchesDebugFilter(...values) {
-  if (!IMPORT_PROTECTION_DEBUG_FILTER) return true;
-  return values.some((v) => v.includes(IMPORT_PROTECTION_DEBUG_FILTER));
-}
+import { normalizeFilePath, matchesDebugFilter, debugLog, escapeRegExp, getOrCreate, clearNormalizeFilePathCache, shouldDeferViolation, dedupePatterns, relativizePath, extractImportSources, canonicalizeResolvedId, isInsideDirectory, buildSourceCandidates, buildResolutionCandidates } from "./utils.js";
+import { collectNamedExports, rewriteDeniedImports, collectMockExportNamesBySource } from "./rewriteDeniedImports.js";
+import { loadResolvedVirtualModule, getResolvedVirtualModuleMatchers, resolveInternalVirtualModuleId, resolvedMarkerVirtualModuleId, generateSelfContainedMockModule, mockRuntimeModuleIdFromViolation, generateDevSelfDenialModule, MOCK_BUILD_PREFIX, makeMockEdgeModuleId } from "./virtualModules.js";
+import { ExtensionlessAbsoluteIdResolver } from "./extensionlessAbsoluteIdResolver.js";
+import { IMPORT_PROTECTION_DEBUG, SERVER_FN_LOOKUP_QUERY, VITE_BROWSER_VIRTUAL_PREFIX } from "./constants.js";
+import { pickOriginalCodeFromSourcesContent, buildLineIndex, ImportLocCache, buildCodeSnippet, findPostCompileUsageLocation, findImportStatementLocationFromTransformed, addTraceImportLocations } from "./sourceLocation.js";
 function importProtectionPlugin(opts) {
   let devServer = null;
+  const extensionlessIdResolver = new ExtensionlessAbsoluteIdResolver();
+  const resolveExtensionlessAbsoluteId = (id) => extensionlessIdResolver.resolve(id);
+  const importPatternCache = /* @__PURE__ */ new Map();
+  function findFirstImportSpecifierIndex(code, source) {
+    let patterns = importPatternCache.get(source);
+    if (!patterns) {
+      const escaped = escapeRegExp(source);
+      patterns = [
+        new RegExp(`\\bimport\\s+(['"])${escaped}\\1`),
+        new RegExp(`\\bfrom\\s+(['"])${escaped}\\1`),
+        new RegExp(`\\bimport\\s*\\(\\s*(['"])${escaped}\\1\\s*\\)`)
+      ];
+      importPatternCache.set(source, patterns);
+    }
+    let best = -1;
+    for (const re of patterns) {
+      const m = re.exec(code);
+      if (!m) continue;
+      const idx = m.index + m[0].indexOf(source);
+      if (idx === -1) continue;
+      if (best === -1 || idx < best) best = idx;
+    }
+    return best;
+  }
   function buildTraceFromModuleGraph(envName, env, targetFile) {
     if (!devServer) return null;
     const environment = devServer.environments[envName];
@@ -94,7 +107,6 @@ function importProtectionPlugin(opts) {
     command: "build",
     srcDirectory: "",
     framework: opts.framework,
-    entryFiles: [],
     effectiveBehavior: "error",
     mockAccess: "error",
     logMode: "once",
@@ -112,10 +124,6 @@ function importProtectionPlugin(opts) {
   };
   const envStates = /* @__PURE__ */ new Map();
   const shared = { fileMarkerKind: /* @__PURE__ */ new Map() };
-  function getMarkerKindForFile(fileId) {
-    const file = normalizeFilePath(fileId);
-    return shared.fileMarkerKind.get(file);
-  }
   async function rebuildAndAnnotateTrace(provider, env, envName, normalizedImporter, specifier, importerLoc, traceOverride) {
     let trace = traceOverride ?? buildTrace(env.graph, normalizedImporter, config.maxTraceDepth);
     if (config.command === "serve") {
@@ -128,7 +136,12 @@ function importProtectionPlugin(opts) {
         trace = mgTrace;
       }
     }
-    await addTraceImportLocations(provider, trace, env.importLocCache);
+    await addTraceImportLocations(
+      provider,
+      trace,
+      env.importLocCache,
+      findFirstImportSpecifierIndex
+    );
     if (trace.length > 0) {
       const last = trace[trace.length - 1];
       if (!last.specifier) last.specifier = specifier;
@@ -140,16 +153,16 @@ function importProtectionPlugin(opts) {
     return trace;
   }
   async function buildViolationInfo(provider, env, envName, envType, importer, normalizedImporter, source, overrides, traceOverride) {
-    const loc = await findPostCompileUsageLocation(
-      provider,
-      importer,
+    const sourceCandidates = buildSourceCandidates(
       source,
-      findPostCompileUsagePos
-    ) || await findImportStatementLocationFromTransformed(
+      "resolved" in overrides && typeof overrides.resolved === "string" ? overrides.resolved : void 0,
+      config.root
+    );
+    const loc = await resolveImporterLocation(
       provider,
+      env,
       importer,
-      source,
-      env.importLocCache
+      sourceCandidates
     );
     const trace = await rebuildAndAnnotateTrace(
       provider,
@@ -173,8 +186,22 @@ function importProtectionPlugin(opts) {
       ...overrides
     };
   }
+  async function resolveImporterLocation(provider, env, importer, sourceCandidates) {
+    for (const candidate of sourceCandidates) {
+      const loc = await findPostCompileUsageLocation(provider, importer, candidate) || await findImportStatementLocationFromTransformed(
+        provider,
+        importer,
+        candidate,
+        env.importLocCache,
+        findFirstImportSpecifierIndex
+      );
+      if (loc) return loc;
+    }
+    return void 0;
+  }
   async function buildMarkerViolationFromResolvedImport(provider, env, envName, envType, importer, source, resolvedId, relativePath, traceOverride) {
-    const markerKind = getMarkerKindForFile(resolvedId);
+    const normalizedResolvedId = normalizeFilePath(resolvedId);
+    const markerKind = shared.fileMarkerKind.get(normalizedResolvedId);
     const violates = envType === "client" && markerKind === "server" || envType === "server" && markerKind === "client";
     if (!violates) return void 0;
     const normalizedImporter = normalizeFilePath(importer);
@@ -188,8 +215,30 @@ function importProtectionPlugin(opts) {
       source,
       {
         type: "marker",
-        resolved: normalizeFilePath(resolvedId),
-        message: markerKind === "server" ? `Module "${relativePath}" is marked server-only but is imported in the client environment` : `Module "${relativePath}" is marked client-only but is imported in the server environment`
+        resolved: normalizedResolvedId,
+        message: buildMarkerViolationMessage(relativePath, markerKind)
+      },
+      traceOverride
+    );
+  }
+  function buildMarkerViolationMessage(relativePath, markerKind) {
+    return markerKind === "server" ? `Module "${relativePath}" is marked server-only but is imported in the client environment` : `Module "${relativePath}" is marked client-only but is imported in the server environment`;
+  }
+  async function buildFileViolationInfo(provider, env, envName, envType, importer, normalizedImporter, source, resolvedPath, pattern, traceOverride) {
+    const relativePath = getRelativePath(resolvedPath);
+    return buildViolationInfo(
+      provider,
+      env,
+      envName,
+      envType,
+      importer,
+      normalizedImporter,
+      source,
+      {
+        type: "file",
+        pattern,
+        resolved: resolvedPath,
+        message: `Import "${source}" (resolved to "${relativePath}") is denied in the ${envType} environment`
       },
       traceOverride
     );
@@ -201,6 +250,12 @@ function importProtectionPlugin(opts) {
     const type = getEnvType(envName);
     return type === "client" ? config.compiledRules.client : config.compiledRules.server;
   }
+  function checkFileDenial(relativePath, matchers) {
+    if (matchers.excludeFiles.length > 0 && matchesAny(relativePath, matchers.excludeFiles)) {
+      return void 0;
+    }
+    return matchers.files.length > 0 ? matchesAny(relativePath, matchers.files) : void 0;
+  }
   const environmentNames = /* @__PURE__ */ new Set([
     VITE_ENVIRONMENT_NAMES.client,
     VITE_ENVIRONMENT_NAMES.server
@@ -214,8 +269,6 @@ function importProtectionPlugin(opts) {
       const transformResultCache = /* @__PURE__ */ new Map();
       envState = {
         graph: new ImportGraph(),
-        deniedSources: /* @__PURE__ */ new Set(),
-        deniedEdges: /* @__PURE__ */ new Map(),
         mockExportsByImporter: /* @__PURE__ */ new Map(),
         resolveCache: /* @__PURE__ */ new Map(),
         resolveCacheByFile: /* @__PURE__ */ new Map(),
@@ -241,27 +294,137 @@ function importProtectionPlugin(opts) {
     }
     return envState;
   }
+  function findExportsInMap(exportMap, candidates) {
+    for (const candidate of candidates) {
+      const hit = exportMap.get(candidate);
+      if (hit && hit.length > 0) return hit;
+    }
+    return [];
+  }
+  function buildIdCandidates(id, extra) {
+    const set = new Set(buildResolutionCandidates(id));
+    if (extra) {
+      for (const c of buildResolutionCandidates(extra)) set.add(c);
+      set.add(resolveExtensionlessAbsoluteId(extra));
+    }
+    return Array.from(set);
+  }
+  async function resolveExportsForDeniedSpecifier(env, ctx, info, importerIdHint) {
+    const importerFile = normalizeFilePath(info.importer);
+    const specifierCandidates = buildIdCandidates(info.specifier, info.resolved);
+    let parsedBySource = env.mockExportsByImporter.get(importerFile);
+    if (!parsedBySource) {
+      const importerCode = env.transformResultProvider.getTransformResult(importerFile)?.code ?? (importerIdHint && ctx.getModuleInfo ? ctx.getModuleInfo(importerIdHint)?.code ?? void 0 : void 0);
+      if (typeof importerCode !== "string" || importerCode.length === 0)
+        return [];
+      try {
+        parsedBySource = collectMockExportNamesBySource(importerCode);
+        await recordMockExportsForImporter(
+          env,
+          importerFile,
+          parsedBySource,
+          async (src) => {
+            const cacheKey = `${importerFile}:${src}`;
+            if (env.resolveCache.has(cacheKey)) {
+              return env.resolveCache.get(cacheKey) ?? void 0;
+            }
+            if (!ctx.resolve) return void 0;
+            const resolved = await ctx.resolve(src, info.importer, {
+              skipSelf: true
+            });
+            if (!resolved || resolved.external) return void 0;
+            return resolved.id;
+          }
+        );
+        parsedBySource = env.mockExportsByImporter.get(importerFile) ?? parsedBySource;
+      } catch {
+        return [];
+      }
+    }
+    const direct = findExportsInMap(parsedBySource, specifierCandidates);
+    if (direct.length > 0) return direct;
+    const candidateSet = new Set(specifierCandidates);
+    for (const [sourceKey, names] of parsedBySource) {
+      if (!names.length) continue;
+      const resolvedId = await resolveSourceKey(
+        env,
+        ctx,
+        importerFile,
+        sourceKey,
+        info.importer
+      );
+      if (!resolvedId) continue;
+      const resolvedCandidates = buildIdCandidates(resolvedId);
+      resolvedCandidates.push(resolveExtensionlessAbsoluteId(resolvedId));
+      if (resolvedCandidates.some((v) => candidateSet.has(v))) {
+        return names;
+      }
+    }
+    return [];
+  }
+  async function resolveSourceKey(env, ctx, importerFile, sourceKey, importerId) {
+    const cacheKey = `${importerFile}:${sourceKey}`;
+    if (env.resolveCache.has(cacheKey)) {
+      return env.resolveCache.get(cacheKey) ?? void 0;
+    }
+    if (!ctx.resolve) return void 0;
+    try {
+      const resolved = await ctx.resolve(sourceKey, importerId, {
+        skipSelf: true
+      });
+      if (!resolved || resolved.external) return void 0;
+      return resolved.id;
+    } catch {
+      return void 0;
+    }
+  }
+  async function recordMockExportsForImporter(env, importerId, namesBySource, resolveSource) {
+    const importerFile = normalizeFilePath(importerId);
+    if (namesBySource.size === 0) return;
+    for (const [source, names] of namesBySource) {
+      try {
+        const resolvedId = await resolveSource(source);
+        if (!resolvedId) continue;
+        namesBySource.set(normalizeFilePath(resolvedId), names);
+        namesBySource.set(resolveExtensionlessAbsoluteId(resolvedId), names);
+      } catch {
+      }
+    }
+    const existing = env.mockExportsByImporter.get(importerFile);
+    if (!existing) {
+      env.mockExportsByImporter.set(importerFile, namesBySource);
+      return;
+    }
+    for (const [source, names] of namesBySource) {
+      const prev = existing.get(source);
+      if (!prev) {
+        existing.set(source, names);
+        continue;
+      }
+      const union = /* @__PURE__ */ new Set([...prev, ...names]);
+      existing.set(source, Array.from(union).sort());
+    }
+  }
   const shouldCheckImporterCache = /* @__PURE__ */ new Map();
   function shouldCheckImporter(importer) {
     let result = shouldCheckImporterCache.get(importer);
     if (result !== void 0) return result;
     const relativePath = relativizePath(importer, config.root);
-    if (config.excludeMatchers.length > 0 && matchesAny(relativePath, config.excludeMatchers)) {
-      result = false;
-    } else if (config.ignoreImporterMatchers.length > 0 && matchesAny(relativePath, config.ignoreImporterMatchers)) {
+    const excluded = config.excludeMatchers.length > 0 && matchesAny(relativePath, config.excludeMatchers) || config.ignoreImporterMatchers.length > 0 && matchesAny(relativePath, config.ignoreImporterMatchers);
+    if (excluded) {
       result = false;
     } else if (config.includeMatchers.length > 0) {
       result = !!matchesAny(relativePath, config.includeMatchers);
     } else if (config.srcDirectory) {
-      result = importer.startsWith(config.srcDirectory);
+      result = isInsideDirectory(importer, config.srcDirectory);
     } else {
       result = true;
     }
     shouldCheckImporterCache.set(importer, result);
     return result;
   }
-  function dedupeKey(type, importer, specifier, resolved) {
-    return `${type}:${importer}:${specifier}:${resolved ?? ""}`;
+  function dedupeKey(info) {
+    return `${info.type}:${info.importer}:${info.specifier}:${info.resolved ?? ""}`;
   }
   function hasSeen(env, key) {
     if (config.logMode === "always") return false;
@@ -272,6 +435,56 @@ function importProtectionPlugin(opts) {
   function getRelativePath(absolutePath) {
     return relativizePath(normalizePath(absolutePath), config.root);
   }
+  function clearEnvState(envState) {
+    envState.resolveCache.clear();
+    envState.resolveCacheByFile.clear();
+    envState.importLocCache.clear();
+    envState.seenViolations.clear();
+    envState.transformResultCache.clear();
+    envState.transformResultKeysByFile.clear();
+    envState.postTransformImports.clear();
+    envState.serverFnLookupModules.clear();
+    envState.pendingViolations.clear();
+    envState.deferredBuildViolations.length = 0;
+    envState.graph.clear();
+    envState.mockExportsByImporter.clear();
+  }
+  function invalidateFileFromEnv(envState, file) {
+    envState.importLocCache.deleteByFile(file);
+    const resolveKeys = envState.resolveCacheByFile.get(file);
+    if (resolveKeys) {
+      for (const key of resolveKeys) envState.resolveCache.delete(key);
+      envState.resolveCacheByFile.delete(file);
+    }
+    envState.graph.invalidate(file);
+    envState.mockExportsByImporter.delete(file);
+    envState.serverFnLookupModules.delete(file);
+    envState.pendingViolations.delete(file);
+    const transformKeys = envState.transformResultKeysByFile.get(file);
+    if (transformKeys) {
+      for (const key of transformKeys) {
+        envState.transformResultCache.delete(key);
+        envState.postTransformImports.delete(key);
+      }
+      envState.transformResultKeysByFile.delete(file);
+    } else {
+      envState.transformResultCache.delete(file);
+      envState.postTransformImports.delete(file);
+    }
+  }
+  function cacheTransformResult(envState, file, cacheKey, result) {
+    envState.transformResultCache.set(cacheKey, result);
+    const keySet = getOrCreate(
+      envState.transformResultKeysByFile,
+      file,
+      () => /* @__PURE__ */ new Set()
+    );
+    keySet.add(cacheKey);
+    if (cacheKey !== file) {
+      envState.transformResultCache.set(file, result);
+      keySet.add(file);
+    }
+  }
   function registerEntries() {
     const { resolvedStartConfig } = opts.getConfig();
     for (const envDef of opts.environments) {
@@ -288,6 +501,46 @@ function importProtectionPlugin(opts) {
       }
     }
   }
+  function getPostTransformImports(env, file) {
+    const keySet = env.transformResultKeysByFile.get(file);
+    let merged = null;
+    if (keySet) {
+      for (const k of keySet) {
+        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue;
+        const imports = env.postTransformImports.get(k);
+        if (imports) {
+          if (!merged) merged = new Set(imports);
+          else for (const v of imports) merged.add(v);
+        }
+      }
+    }
+    if (!merged) {
+      const imports = env.postTransformImports.get(file);
+      if (imports) merged = new Set(imports);
+    }
+    return merged;
+  }
+  function checkEdgeLiveness(env, parent, target) {
+    const keySet = env.transformResultKeysByFile.get(parent);
+    let anyVariantCached = false;
+    if (keySet) {
+      for (const k of keySet) {
+        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue;
+        const imports = env.postTransformImports.get(k);
+        if (imports) {
+          anyVariantCached = true;
+          if (imports.has(target)) return "live";
+        }
+      }
+    }
+    if (!anyVariantCached) {
+      const imports = env.postTransformImports.get(parent);
+      if (imports) return imports.has(target) ? "live" : "dead";
+      const hasTransformResult = env.transformResultCache.has(parent) || (keySet ? keySet.size > 0 : false);
+      return hasTransformResult ? "pending" : "no-data";
+    }
+    return "dead";
+  }
   function checkPostTransformReachability(env, file) {
     const visited = /* @__PURE__ */ new Set();
     const queue = [file];
@@ -304,147 +557,148 @@ function importProtectionPlugin(opts) {
       if (!importers) continue;
       for (const [parent] of importers) {
         if (visited.has(parent)) continue;
-        const keySet = env.transformResultKeysByFile.get(parent);
-        let anyVariantCached = false;
-        let edgeLive = false;
-        if (keySet) {
-          for (const k of keySet) {
-            if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue;
-            const resolvedImports = env.postTransformImports.get(k);
-            if (resolvedImports) {
-              anyVariantCached = true;
-              if (resolvedImports.has(current)) {
-                edgeLive = true;
-                break;
-              }
-            }
-          }
-        }
-        if (!anyVariantCached) {
-          const resolvedImports = env.postTransformImports.get(parent);
-          if (resolvedImports) {
-            anyVariantCached = true;
-            if (resolvedImports.has(current)) {
-              edgeLive = true;
-            }
-          }
-        }
-        if (!anyVariantCached) {
-          const hasTransformResult = env.transformResultCache.has(parent) || (keySet ? keySet.size > 0 : false);
-          if (hasTransformResult) {
-            hasUnknownEdge = true;
-            continue;
-          }
-          queue.push(parent);
-          continue;
-        }
-        if (edgeLive) {
+        const liveness = checkEdgeLiveness(env, parent, current);
+        if (liveness === "live" || liveness === "no-data") {
           queue.push(parent);
+        } else if (liveness === "pending") {
+          hasUnknownEdge = true;
         }
       }
     }
     return hasUnknownEdge ? "unknown" : "unreachable";
   }
+  function filterEdgeSurvival(env, file, violations) {
+    const postTransform = getPostTransformImports(env, file);
+    if (postTransform) {
+      const surviving = violations.filter(
+        (pv) => !pv.info.resolved || postTransform.has(pv.info.resolved)
+      );
+      if (surviving.length === 0) return "all-stripped";
+      env.pendingViolations.set(file, surviving);
+      return { active: surviving, edgeSurvivalApplied: true };
+    }
+    if (violations.some((pv) => pv.fromPreTransformResolve)) {
+      return "await-transform";
+    }
+    return { active: violations, edgeSurvivalApplied: false };
+  }
   async function processPendingViolations(env, warnFn) {
     if (env.pendingViolations.size === 0) return;
     const toDelete = [];
     for (const [file, violations] of env.pendingViolations) {
+      const filtered = filterEdgeSurvival(env, file, violations);
+      if (filtered === "all-stripped") {
+        toDelete.push(file);
+        continue;
+      }
+      if (filtered === "await-transform") continue;
+      const { active, edgeSurvivalApplied } = filtered;
       const status = env.graph.entries.size > 0 ? checkPostTransformReachability(env, file) : "unknown";
       if (status === "reachable") {
-        for (const pv of violations) {
-          const key = dedupeKey(
-            pv.info.type,
-            pv.info.importer,
-            pv.info.specifier,
-            pv.info.resolved
-          );
-          if (!hasSeen(env, key)) {
-            const freshTrace = await rebuildAndAnnotateTrace(
-              env.transformResultProvider,
-              env,
-              pv.info.env,
-              pv.info.importer,
-              pv.info.specifier,
-              pv.info.importerLoc
-            );
-            if (freshTrace.length > pv.info.trace.length) {
-              pv.info.trace = freshTrace;
-            }
-            if (config.onViolation) {
-              const result = await config.onViolation(pv.info);
-              if (result === false) continue;
-            }
-            warnFn(formatViolation(pv.info, config.root));
-          }
+        for (const pv of active) {
+          await emitPendingViolation(env, warnFn, pv);
         }
         toDelete.push(file);
       } else if (status === "unreachable") {
         toDelete.push(file);
+      } else if (config.command === "serve") {
+        let emittedAny = false;
+        for (const pv of active) {
+          if (pv.fromPreTransformResolve) continue;
+          const shouldEmit = edgeSurvivalApplied || pv.info.type === "file" && !!pv.info.resolved && isInsideDirectory(pv.info.resolved, config.srcDirectory);
+          if (shouldEmit) {
+            emittedAny = await emitPendingViolation(env, warnFn, pv) || emittedAny;
+          }
+        }
+        if (emittedAny) {
+          toDelete.push(file);
+        }
       }
     }
     for (const file of toDelete) {
       env.pendingViolations.delete(file);
     }
   }
-  function deferViolation(env, importerFile, info, mockReturnValue) {
+  async function emitPendingViolation(env, warnFn, pv) {
+    if (!pv.info.importerLoc) {
+      const sourceCandidates = buildSourceCandidates(
+        pv.info.specifier,
+        pv.info.resolved,
+        config.root
+      );
+      const loc = await resolveImporterLocation(
+        env.transformResultProvider,
+        env,
+        pv.info.importer,
+        sourceCandidates
+      );
+      if (loc) {
+        pv.info.importerLoc = loc;
+        pv.info.snippet = buildCodeSnippet(
+          env.transformResultProvider,
+          pv.info.importer,
+          loc
+        );
+      }
+    }
+    if (hasSeen(env, dedupeKey(pv.info))) {
+      return false;
+    }
+    const freshTrace = await rebuildAndAnnotateTrace(
+      env.transformResultProvider,
+      env,
+      pv.info.env,
+      pv.info.importer,
+      pv.info.specifier,
+      pv.info.importerLoc
+    );
+    if (freshTrace.length > pv.info.trace.length) {
+      pv.info.trace = freshTrace;
+    }
+    if (config.onViolation) {
+      const result = await config.onViolation(pv.info);
+      if (result === false) return false;
+    }
+    warnFn(formatViolation(pv.info, config.root));
+    return true;
+  }
+  function deferViolation(env, importerFile, info, isPreTransformResolve) {
     getOrCreate(env.pendingViolations, importerFile, () => []).push({
       info,
-      mockReturnValue: mockReturnValue ?? ""
+      fromPreTransformResolve: isPreTransformResolve
     });
   }
   let buildViolationCounter = 0;
-  async function handleViolation(ctx, env, info, violationOpts) {
-    const key = dedupeKey(
-      info.type,
-      info.importer,
-      info.specifier,
-      info.resolved
-    );
+  async function handleViolation(ctx, env, info, importerIdHint, violationOpts) {
     if (!violationOpts?.silent) {
       if (config.onViolation) {
         const result = await config.onViolation(info);
-        if (result === false) {
-          return void 0;
-        }
+        if (result === false) return void 0;
       }
       if (config.effectiveBehavior === "error") {
         return ctx.error(formatViolation(info, config.root));
       }
-      const seen = hasSeen(env, key);
-      if (!seen) {
+      if (!hasSeen(env, dedupeKey(info))) {
         ctx.warn(formatViolation(info, config.root));
       }
-    } else {
-      if (config.effectiveBehavior === "error" && config.command !== "build") {
-        return void 0;
-      }
+    } else if (config.effectiveBehavior === "error" && config.command !== "build") {
+      return void 0;
     }
-    env.deniedSources.add(info.specifier);
-    getOrCreate(env.deniedEdges, info.importer, () => /* @__PURE__ */ new Set()).add(
-      info.specifier
-    );
-    if (config.command === "serve") {
-      const runtimeId = mockRuntimeModuleIdFromViolation(
-        info,
-        config.mockAccess,
-        config.root
-      );
-      const importerFile2 = normalizeFilePath(info.importer);
-      const exports2 = env.mockExportsByImporter.get(importerFile2)?.get(info.specifier) ?? [];
-      return resolveViteId(
-        makeMockEdgeModuleId(exports2, info.specifier, runtimeId)
-      );
-    }
-    const baseMockId = `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`;
-    const importerFile = normalizeFilePath(info.importer);
-    const exports = env.mockExportsByImporter.get(importerFile)?.get(info.specifier) ?? [];
-    return resolveViteId(
-      makeMockEdgeModuleId(exports, info.specifier, baseMockId)
+    if (info.type === "file") return info.resolved;
+    const exports = await resolveExportsForDeniedSpecifier(
+      env,
+      ctx,
+      info,
+      importerIdHint
     );
+    const baseMockId = config.command === "serve" ? mockRuntimeModuleIdFromViolation(info, config.mockAccess, config.root) : `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`;
+    return resolveViteId(makeMockEdgeModuleId(exports, baseMockId));
   }
-  async function reportOrDeferViolation(ctx, env, importerFile, info, shouldDefer, isPreTransformResolve) {
+  async function reportOrDeferViolation(ctx, env, importerFile, importerIdHint, info, shouldDefer, isPreTransformResolve) {
     if (shouldDefer) {
-      const result = await handleViolation(ctx, env, info, { silent: true });
+      const result = await handleViolation(ctx, env, info, importerIdHint, {
+        silent: true
+      });
       if (config.command === "build") {
         const mockId = result ?? "";
         env.deferredBuildViolations.push({
@@ -454,12 +708,12 @@ function importProtectionPlugin(opts) {
           checkModuleId: info.type === "marker" ? info.importer : void 0
         });
       } else {
-        deferViolation(env, importerFile, info, result);
+        deferViolation(env, importerFile, info, isPreTransformResolve);
         await processPendingViolations(env, ctx.warn.bind(ctx));
       }
       return result;
     }
-    return await handleViolation(ctx, env, info, {
+    return handleViolation(ctx, env, info, importerIdHint, {
       silent: isPreTransformResolve
     });
   }
@@ -476,24 +730,17 @@ function importProtectionPlugin(opts) {
         config.command = viteConfig.command;
         const { startConfig, resolvedStartConfig } = opts.getConfig();
         config.srcDirectory = resolvedStartConfig.srcDirectory;
-        config.entryFiles = [
-          resolvedStartConfig.routerFilePath,
-          resolvedStartConfig.startFilePath
-        ].filter((f) => Boolean(f));
         const userOpts = startConfig.importProtection;
         if (userOpts?.enabled === false) {
           config.enabled = false;
           return;
         }
         config.enabled = true;
-        if (userOpts?.behavior) {
-          if (typeof userOpts.behavior === "string") {
-            config.effectiveBehavior = userOpts.behavior;
-          } else {
-            config.effectiveBehavior = viteConfig.command === "serve" ? userOpts.behavior.dev ?? "mock" : userOpts.behavior.build ?? "error";
-          }
+        const behavior = userOpts?.behavior;
+        if (typeof behavior === "string") {
+          config.effectiveBehavior = behavior;
         } else {
-          config.effectiveBehavior = viteConfig.command === "serve" ? "mock" : "error";
+          config.effectiveBehavior = viteConfig.command === "serve" ? behavior?.dev ?? "mock" : behavior?.build ?? "error";
         }
         config.logMode = userOpts?.log ?? "once";
         config.mockAccess = userOpts?.mockAccess ?? "error";
@@ -503,36 +750,38 @@ function importProtectionPlugin(opts) {
           config.onViolation = (info) => fn(info);
         }
         const defaults = getDefaultImportProtectionRules();
+        const pick = (user, fallback) => user ? [...user] : [...fallback];
         const clientSpecifiers = dedupePatterns([
           ...defaults.client.specifiers,
           ...userOpts?.client?.specifiers ?? []
         ]);
-        const clientFiles = userOpts?.client?.files ? [...userOpts.client.files] : [...defaults.client.files];
-        const clientExcludeFiles = userOpts?.client?.excludeFiles ? [...userOpts.client.excludeFiles] : [...defaults.client.excludeFiles];
-        const serverSpecifiers = userOpts?.server?.specifiers ? dedupePatterns([...userOpts.server.specifiers]) : dedupePatterns([...defaults.server.specifiers]);
-        const serverFiles = userOpts?.server?.files ? [...userOpts.server.files] : [...defaults.server.files];
-        const serverExcludeFiles = userOpts?.server?.excludeFiles ? [...userOpts.server.excludeFiles] : [...defaults.server.excludeFiles];
         config.compiledRules.client = {
           specifiers: compileMatchers(clientSpecifiers),
-          files: compileMatchers(clientFiles),
-          excludeFiles: compileMatchers(clientExcludeFiles)
+          files: compileMatchers(
+            pick(userOpts?.client?.files, defaults.client.files)
+          ),
+          excludeFiles: compileMatchers(
+            pick(userOpts?.client?.excludeFiles, defaults.client.excludeFiles)
+          )
         };
         config.compiledRules.server = {
-          specifiers: compileMatchers(serverSpecifiers),
-          files: compileMatchers(serverFiles),
-          excludeFiles: compileMatchers(serverExcludeFiles)
+          specifiers: compileMatchers(
+            dedupePatterns(
+              pick(userOpts?.server?.specifiers, defaults.server.specifiers)
+            )
+          ),
+          files: compileMatchers(
+            pick(userOpts?.server?.files, defaults.server.files)
+          ),
+          excludeFiles: compileMatchers(
+            pick(userOpts?.server?.excludeFiles, defaults.server.excludeFiles)
+          )
         };
-        if (userOpts?.include) {
-          config.includeMatchers = compileMatchers(userOpts.include);
-        }
-        if (userOpts?.exclude) {
-          config.excludeMatchers = compileMatchers(userOpts.exclude);
-        }
-        if (userOpts?.ignoreImporters) {
-          config.ignoreImporterMatchers = compileMatchers(
-            userOpts.ignoreImporters
-          );
-        }
+        config.includeMatchers = compileMatchers(userOpts?.include ?? []);
+        config.excludeMatchers = compileMatchers(userOpts?.exclude ?? []);
+        config.ignoreImporterMatchers = compileMatchers(
+          userOpts?.ignoreImporters ?? []
+        );
         const markers = getMarkerSpecifiers();
         config.markerSpecifiers = {
           serverOnly: new Set(markers.serverOnly),
@@ -545,23 +794,11 @@ function importProtectionPlugin(opts) {
       buildStart() {
         if (!config.enabled) return;
         clearNormalizeFilePathCache();
-        clearImportPatternCache();
+        extensionlessIdResolver.clear();
+        importPatternCache.clear();
         shouldCheckImporterCache.clear();
         for (const envState of envStates.values()) {
-          envState.resolveCache.clear();
-          envState.resolveCacheByFile.clear();
-          envState.importLocCache.clear();
-          envState.seenViolations.clear();
-          envState.transformResultCache.clear();
-          envState.transformResultKeysByFile.clear();
-          envState.postTransformImports.clear();
-          envState.serverFnLookupModules.clear();
-          envState.pendingViolations.clear();
-          envState.deferredBuildViolations.length = 0;
-          envState.graph.clear();
-          envState.deniedSources.clear();
-          envState.deniedEdges.clear();
-          envState.mockExportsByImporter.clear();
+          clearEnvState(envState);
         }
         shared.fileMarkerKind.clear();
         registerEntries();
@@ -572,32 +809,10 @@ function importProtectionPlugin(opts) {
           if (mod.id) {
             const id = mod.id;
             const importerFile = normalizeFilePath(id);
+            extensionlessIdResolver.invalidateByFile(importerFile);
             shared.fileMarkerKind.delete(importerFile);
             for (const envState of envStates.values()) {
-              envState.importLocCache.deleteByFile(importerFile);
-              const resolveKeys = envState.resolveCacheByFile.get(importerFile);
-              if (resolveKeys) {
-                for (const key of resolveKeys) {
-                  envState.resolveCache.delete(key);
-                }
-                envState.resolveCacheByFile.delete(importerFile);
-              }
-              envState.graph.invalidate(importerFile);
-              envState.deniedEdges.delete(importerFile);
-              envState.mockExportsByImporter.delete(importerFile);
-              envState.serverFnLookupModules.delete(importerFile);
-              envState.pendingViolations.delete(importerFile);
-              const transformKeys = envState.transformResultKeysByFile.get(importerFile);
-              if (transformKeys) {
-                for (const key of transformKeys) {
-                  envState.transformResultCache.delete(key);
-                  envState.postTransformImports.delete(key);
-                }
-                envState.transformResultKeysByFile.delete(importerFile);
-              } else {
-                envState.transformResultCache.delete(importerFile);
-                envState.postTransformImports.delete(importerFile);
-              }
+              invalidateFileFromEnv(envState, importerFile);
             }
           }
         }
@@ -611,7 +826,7 @@ function importProtectionPlugin(opts) {
         if (IMPORT_PROTECTION_DEBUG) {
           const importerPath = importer ? normalizeFilePath(importer) : "(entry)";
           const isEntryResolve = !importer;
-          const filtered = IMPORT_PROTECTION_DEBUG_FILTER === "entry" ? isEntryResolve : matchesDebugFilter(source, importerPath);
+          const filtered = process.env.TSR_IMPORT_PROTECTION_DEBUG_FILTER === "entry" ? isEntryResolve : matchesDebugFilter(source, importerPath);
           if (filtered) {
             debugLog("resolveId", {
               env: envName,
@@ -619,8 +834,7 @@ function importProtectionPlugin(opts) {
               source,
               importer: importerPath,
               isEntryResolve,
-              command: config.command,
-              behavior: config.effectiveBehavior
+              command: config.command
             });
           }
         }
@@ -642,7 +856,20 @@ function importProtectionPlugin(opts) {
         const isPreTransformResolve = isDirectLookup || env.serverFnLookupModules.has(normalizedImporter) || isScanResolve;
         const isDevMock = config.command === "serve" && config.effectiveBehavior === "mock";
         const isBuild = config.command === "build";
-        const shouldDefer = isDevMock && !isPreTransformResolve || isBuild;
+        const shouldDefer = shouldDeferViolation({ isBuild, isDevMock });
+        const resolveAgainstImporter = async () => {
+          const primary = await this.resolve(source, importer, {
+            skipSelf: true
+          });
+          if (primary) {
+            return canonicalizeResolvedId(
+              primary.id,
+              config.root,
+              resolveExtensionlessAbsoluteId
+            );
+          }
+          return null;
+        };
         const markerKind = config.markerSpecifiers.serverOnly.has(source) ? "server" : config.markerSpecifiers.clientOnly.has(source) ? "client" : void 0;
         if (markerKind) {
           const existing = shared.fileMarkerKind.get(normalizedImporter);
@@ -664,13 +891,17 @@ function importProtectionPlugin(opts) {
               source,
               {
                 type: "marker",
-                message: markerKind === "server" ? `Module "${getRelativePath(normalizedImporter)}" is marked server-only but is imported in the client environment` : `Module "${getRelativePath(normalizedImporter)}" is marked client-only but is imported in the server environment`
+                message: buildMarkerViolationMessage(
+                  getRelativePath(normalizedImporter),
+                  markerKind
+                )
               }
             );
             const markerResult = await reportOrDeferViolation(
               this,
               env,
               normalizedImporter,
+              importer,
               info,
               shouldDefer,
               isPreTransformResolve
@@ -679,6 +910,40 @@ function importProtectionPlugin(opts) {
               return markerResult;
             }
           }
+          const envRetroKey = `retro-marker:${normalizedImporter}`;
+          if (violatesEnv && !env.seenViolations.has(envRetroKey)) {
+            env.seenViolations.add(envRetroKey);
+            let retroDeferred = false;
+            const importersMap = env.graph.reverseEdges.get(normalizedImporter);
+            if (importersMap && importersMap.size > 0) {
+              for (const [importerFile, specifier] of importersMap) {
+                if (!specifier) continue;
+                if (!shouldCheckImporter(importerFile)) continue;
+                const markerInfo = await buildMarkerViolationFromResolvedImport(
+                  provider,
+                  env,
+                  envName,
+                  envType,
+                  importerFile,
+                  specifier,
+                  normalizedImporter,
+                  getRelativePath(normalizedImporter)
+                );
+                if (markerInfo) {
+                  deferViolation(
+                    env,
+                    importerFile,
+                    markerInfo,
+                    isPreTransformResolve
+                  );
+                  retroDeferred = true;
+                }
+              }
+            }
+            if (retroDeferred) {
+              await processPendingViolations(env, this.warn.bind(this));
+            }
+          }
           return markerKind === "server" ? resolvedMarkerVirtualModuleId("server") : resolvedMarkerVirtualModuleId("client");
         }
         if (!shouldCheckImporter(normalizedImporter)) {
@@ -687,7 +952,9 @@ function importProtectionPlugin(opts) {
         const matchers = getRulesForEnvironment(envName);
         const specifierMatch = matchesAny(source, matchers.specifiers);
         if (specifierMatch) {
-          env.graph.addEdge(source, normalizedImporter, source);
+          if (!isPreTransformResolve) {
+            env.graph.addEdge(source, normalizedImporter, source);
+          }
           const info = await buildViolationInfo(
             provider,
             env,
@@ -702,10 +969,18 @@ function importProtectionPlugin(opts) {
               message: `Import "${source}" is denied in the ${envType} environment`
             }
           );
+          if (shouldDefer && !info.resolved) {
+            try {
+              const resolvedForInfo = await resolveAgainstImporter();
+              if (resolvedForInfo) info.resolved = resolvedForInfo;
+            } catch {
+            }
+          }
           return reportOrDeferViolation(
             this,
             env,
             normalizedImporter,
+            importer,
             info,
             shouldDefer,
             isPreTransformResolve
@@ -716,28 +991,29 @@ function importProtectionPlugin(opts) {
         if (env.resolveCache.has(cacheKey)) {
           resolved = env.resolveCache.get(cacheKey) ?? null;
         } else {
-          const result = await this.resolve(source, importer, {
-            skipSelf: true
-          });
-          resolved = result ? normalizeFilePath(result.id) : null;
-          env.resolveCache.set(cacheKey, resolved);
-          getOrCreate(
-            env.resolveCacheByFile,
-            normalizedImporter,
-            () => /* @__PURE__ */ new Set()
-          ).add(cacheKey);
+          resolved = await resolveAgainstImporter();
+          if (resolved !== null) {
+            env.resolveCache.set(cacheKey, resolved);
+            getOrCreate(
+              env.resolveCacheByFile,
+              normalizedImporter,
+              () => /* @__PURE__ */ new Set()
+            ).add(cacheKey);
+          }
         }
         if (resolved) {
           const relativePath = getRelativePath(resolved);
           if (isPreTransformResolve && !isScanResolve) {
             env.serverFnLookupModules.add(resolved);
           }
-          env.graph.addEdge(resolved, normalizedImporter, source);
+          if (!isPreTransformResolve) {
+            env.graph.addEdge(resolved, normalizedImporter, source);
+          }
           const isExcludedFile = matchers.excludeFiles.length > 0 && matchesAny(relativePath, matchers.excludeFiles);
           if (!isExcludedFile) {
             const fileMatch = matchers.files.length > 0 ? matchesAny(relativePath, matchers.files) : void 0;
             if (fileMatch) {
-              const info = await buildViolationInfo(
+              const info = await buildFileViolationInfo(
                 provider,
                 env,
                 envName,
@@ -745,17 +1021,14 @@ function importProtectionPlugin(opts) {
                 importer,
                 normalizedImporter,
                 source,
-                {
-                  type: "file",
-                  pattern: fileMatch.pattern,
-                  resolved,
-                  message: `Import "${source}" (resolved to "${relativePath}") is denied in the ${envType} environment`
-                }
+                resolved,
+                fileMatch.pattern
               );
               return reportOrDeferViolation(
                 this,
                 env,
                 normalizedImporter,
+                importer,
                 info,
                 shouldDefer,
                 isPreTransformResolve
@@ -776,6 +1049,7 @@ function importProtectionPlugin(opts) {
                 this,
                 env,
                 normalizedImporter,
+                importer,
                 markerInfo,
                 shouldDefer,
                 isPreTransformResolve
@@ -807,22 +1081,70 @@ function importProtectionPlugin(opts) {
         const envName = this.environment.name;
         const env = envStates.get(envName);
         if (!env || env.deferredBuildViolations.length === 0) return;
+        const candidateCache = /* @__PURE__ */ new Map();
+        const toModuleIdCandidates = (id) => {
+          let cached = candidateCache.get(id);
+          if (cached) return cached;
+          const out = /* @__PURE__ */ new Set();
+          const normalized = normalizeFilePath(id);
+          out.add(id);
+          out.add(normalized);
+          out.add(relativizePath(normalized, config.root));
+          if (normalized.startsWith(VITE_BROWSER_VIRTUAL_PREFIX)) {
+            const internal = `\0${normalized.slice(VITE_BROWSER_VIRTUAL_PREFIX.length)}`;
+            out.add(internal);
+            out.add(relativizePath(normalizeFilePath(internal), config.root));
+          }
+          if (normalized.startsWith("\0")) {
+            const browser = `${VITE_BROWSER_VIRTUAL_PREFIX}${normalized.slice(1)}`;
+            out.add(browser);
+            out.add(relativizePath(normalizeFilePath(browser), config.root));
+          }
+          cached = Array.from(out);
+          candidateCache.set(id, cached);
+          return cached;
+        };
         const survivingModules = /* @__PURE__ */ new Set();
         for (const chunk of Object.values(bundle)) {
           if (chunk.type === "chunk") {
             for (const moduleId of Object.keys(chunk.modules)) {
-              survivingModules.add(moduleId);
+              for (const candidate of toModuleIdCandidates(moduleId)) {
+                survivingModules.add(candidate);
+              }
             }
           }
         }
+        const didModuleSurvive = (moduleId) => toModuleIdCandidates(moduleId).some(
+          (candidate) => survivingModules.has(candidate)
+        );
         const realViolations = [];
         for (const {
           info,
           mockModuleId,
           checkModuleId
         } of env.deferredBuildViolations) {
-          const checkId = checkModuleId ?? mockModuleId;
-          if (!survivingModules.has(checkId)) continue;
+          let survived;
+          if (checkModuleId != null) {
+            const importerVariantIds = /* @__PURE__ */ new Set([info.importer]);
+            const importerKeys = env.transformResultKeysByFile.get(
+              normalizeFilePath(info.importer)
+            );
+            if (importerKeys) {
+              for (const key of importerKeys) {
+                importerVariantIds.add(key);
+              }
+            }
+            survived = false;
+            for (const importerId of importerVariantIds) {
+              if (didModuleSurvive(importerId)) {
+                survived = true;
+                break;
+              }
+            }
+          } else {
+            survived = didModuleSurvive(mockModuleId);
+          }
+          if (!survived) continue;
           if (config.onViolation) {
             const result = await config.onViolation(info);
             if (result === false) continue;
@@ -835,12 +1157,7 @@ function importProtectionPlugin(opts) {
         } else {
           const seen = /* @__PURE__ */ new Set();
           for (const info of realViolations) {
-            const key = dedupeKey(
-              info.type,
-              info.importer,
-              info.specifier,
-              info.resolved
-            );
+            const key = dedupeKey(info);
             if (!seen.has(key)) {
               seen.add(key);
               this.warn(formatViolation(info, config.root));
@@ -867,6 +1184,9 @@ function importProtectionPlugin(opts) {
         async handler(code, id) {
           const envName = this.environment.name;
           const file = normalizeFilePath(id);
+          const envType = getEnvType(envName);
+          const matchers = getRulesForEnvironment(envName);
+          const isBuild = config.command === "build";
           if (IMPORT_PROTECTION_DEBUG) {
             if (matchesDebugFilter(file)) {
               debugLog("transform-cache", {
@@ -879,6 +1199,31 @@ function importProtectionPlugin(opts) {
           if (!shouldCheckImporter(file)) {
             return void 0;
           }
+          const selfFileMatch = checkFileDenial(getRelativePath(file), matchers);
+          if (selfFileMatch) {
+            let exportNames = [];
+            try {
+              exportNames = collectNamedExports(code);
+            } catch {
+            }
+            if (isBuild) {
+              return generateSelfContainedMockModule(exportNames);
+            }
+            const runtimeId = mockRuntimeModuleIdFromViolation(
+              {
+                env: envType,
+                behavior: config.effectiveBehavior === "error" ? "error" : "mock",
+                importer: file,
+                specifier: relativizePath(file, config.root),
+                pattern: selfFileMatch.pattern,
+                message: `File "${relativizePath(file, config.root)}" is denied in the ${envType} environment`,
+                trace: []
+              },
+              config.mockAccess,
+              config.root
+            );
+            return generateDevSelfDenialModule(exportNames, runtimeId);
+          }
           let map;
           try {
             map = this.getCombinedSourcemap();
@@ -896,77 +1241,119 @@ function importProtectionPlugin(opts) {
           const lineIndex = buildLineIndex(code);
           const cacheKey = normalizePath(id);
           const envState = getEnv(envName);
-          if (id.includes(SERVER_FN_LOOKUP_QUERY)) {
+          const isServerFnLookup = id.includes(SERVER_FN_LOOKUP_QUERY);
+          if (isServerFnLookup) {
             envState.serverFnLookupModules.add(file);
           }
-          envState.transformResultCache.set(cacheKey, {
+          const result = {
             code,
             map,
             originalCode,
             lineIndex
-          });
-          const keySet = getOrCreate(
-            envState.transformResultKeysByFile,
-            file,
-            () => /* @__PURE__ */ new Set()
-          );
-          keySet.add(cacheKey);
-          if (cacheKey !== file) {
-            envState.transformResultCache.set(file, {
-              code,
-              map,
-              originalCode,
-              lineIndex
-            });
-            keySet.add(file);
-          }
+          };
+          cacheTransformResult(envState, file, cacheKey, result);
+          if (isBuild) return void 0;
+          const isDevMock = config.effectiveBehavior === "mock";
           const importSources = extractImportSources(code);
           const resolvedChildren = /* @__PURE__ */ new Set();
+          const deniedSourceReplacements = /* @__PURE__ */ new Map();
           for (const src of importSources) {
             try {
               const resolved = await this.resolve(src, id, { skipSelf: true });
               if (resolved && !resolved.external) {
-                const resolvedPath = normalizeFilePath(resolved.id);
+                const resolvedPath = canonicalizeResolvedId(
+                  resolved.id,
+                  config.root,
+                  resolveExtensionlessAbsoluteId
+                );
                 resolvedChildren.add(resolvedPath);
+                if (resolved.id.includes("tanstack-start-import-protection:")) {
+                  let physicalPath;
+                  const pending = envState.pendingViolations.get(file);
+                  if (pending) {
+                    const match = pending.find(
+                      (pv) => pv.info.specifier === src && pv.info.resolved
+                    );
+                    if (match) physicalPath = match.info.resolved;
+                  }
+                  if (physicalPath && physicalPath !== resolvedPath) {
+                    resolvedChildren.add(physicalPath);
+                    envState.graph.addEdge(physicalPath, file, src);
+                  }
+                }
                 envState.graph.addEdge(resolvedPath, file, src);
+                if (isDevMock) {
+                  const relativePath = getRelativePath(resolvedPath);
+                  const fileMatch = checkFileDenial(relativePath, matchers);
+                  if (fileMatch) {
+                    const info = await buildFileViolationInfo(
+                      envState.transformResultProvider,
+                      envState,
+                      envName,
+                      envType,
+                      id,
+                      file,
+                      src,
+                      resolvedPath,
+                      fileMatch.pattern
+                    );
+                    const replacement = await reportOrDeferViolation(
+                      this,
+                      envState,
+                      file,
+                      id,
+                      info,
+                      isDevMock,
+                      isServerFnLookup
+                    );
+                    if (replacement) {
+                      deniedSourceReplacements.set(
+                        src,
+                        replacement.startsWith("\0") ? VITE_BROWSER_VIRTUAL_PREFIX + replacement.slice(1) : replacement
+                      );
+                    }
+                  }
+                }
               }
             } catch {
             }
           }
           envState.postTransformImports.set(cacheKey, resolvedChildren);
-          if (cacheKey !== file) {
+          if (cacheKey !== file && !isServerFnLookup) {
             envState.postTransformImports.set(file, resolvedChildren);
           }
           await processPendingViolations(envState, this.warn.bind(this));
-          return void 0;
-        }
-      }
-    },
-    {
-      // Separate plugin so the transform can be enabled/disabled per-environment.
-      name: "tanstack-start-core:import-protection-mock-rewrite",
-      enforce: "pre",
-      applyToEnvironment(env) {
-        if (!config.enabled) return false;
-        return environmentNames.has(env.name);
-      },
-      transform: {
-        filter: {
-          id: {
-            include: [/\.[cm]?[tj]sx?($|\?)/]
-          }
-        },
-        handler(code, id) {
-          const envName = this.environment.name;
-          const envState = envStates.get(envName);
-          if (!envState) return void 0;
-          try {
-            const importerFile = normalizeFilePath(id);
-            envState.mockExportsByImporter.set(
-              importerFile,
-              collectMockExportNamesBySource(code)
-            );
-          } catch {
+          if (deniedSourceReplacements.size > 0) {
+            try {
+              const rewritten = rewriteDeniedImports(
+                code,
+                id,
+                new Set(deniedSourceReplacements.keys()),
+                (source) => deniedSourceReplacements.get(source) ?? source
+              );
+              if (!rewritten) {
+                return void 0;
+              }
+              const normalizedMap = rewritten.map ? {
+                ...rewritten.map,
+                version: Number(rewritten.map.version),
+                sourcesContent: rewritten.map.sourcesContent?.map(
+                  (s) => s ?? ""
+                ) ?? []
+              } : {
+                version: 3,
+                file: id,
+                names: [],
+                sources: [id],
+                sourcesContent: [code],
+                mappings: ""
+              };
+              return {
+                code: rewritten.code,
+                map: normalizedMap
+              };
+            } catch {
+            }
           }
           return void 0;
         }
@@ -975,8 +1362,6 @@ function importProtectionPlugin(opts) {
   ];
 }
 export {
-  dedupePatterns,
-  extractImportSources,
   importProtectionPlugin
 };
 //# sourceMappingURL=plugin.js.map