@tanstack/start-plugin-core 1.163.3 → 1.163.5

package/dist/esm/import-protection-plugin/types.d.ts

@@ -0,0 +1,94 @@
+import { CompileStartFrameworkOptions, GetConfigFn } from '../types.js';
+import { ImportProtectionBehavior } from '../schema.js';
+import { CompiledMatcher } from './matchers.js';
+import { ImportGraph, ViolationInfo } from './trace.js';
+import { ImportLocCache, TransformResult, TransformResultProvider } from './sourceLocation.js';
+/** Compiled deny/exclude patterns for one environment (client or server). */
+export interface EnvRules {
+    specifiers: Array<CompiledMatcher>;
+    files: Array<CompiledMatcher>;
+    excludeFiles: Array<CompiledMatcher>;
+}
+export interface PluginConfig {
+    enabled: boolean;
+    root: string;
+    command: 'build' | 'serve';
+    srcDirectory: string;
+    framework: CompileStartFrameworkOptions;
+    effectiveBehavior: ImportProtectionBehavior;
+    mockAccess: 'error' | 'warn' | 'off';
+    logMode: 'once' | 'always';
+    maxTraceDepth: number;
+    compiledRules: {
+        client: EnvRules;
+        server: EnvRules;
+    };
+    includeMatchers: Array<CompiledMatcher>;
+    excludeMatchers: Array<CompiledMatcher>;
+    ignoreImporterMatchers: Array<CompiledMatcher>;
+    markerSpecifiers: {
+        serverOnly: Set<string>;
+        clientOnly: Set<string>;
+    };
+    envTypeMap: Map<string, 'client' | 'server'>;
+    onViolation?: (info: ViolationInfo) => boolean | void | Promise<boolean | void>;
+}
+export interface EnvState {
+    graph: ImportGraph;
+    mockExportsByImporter: Map<string, Map<string, Array<string>>>;
+    resolveCache: Map<string, string | null>;
+    resolveCacheByFile: Map<string, Set<string>>;
+    importLocCache: ImportLocCache;
+    seenViolations: Set<string>;
+    serverFnLookupModules: Set<string>;
+    transformResultCache: Map<string, TransformResult>;
+    transformResultKeysByFile: Map<string, Set<string>>;
+    transformResultProvider: TransformResultProvider;
+    postTransformImports: Map<string, Set<string>>;
+    pendingViolations: Map<string, Array<PendingViolation>>;
+    deferredBuildViolations: Array<DeferredBuildViolation>;
+}
+export interface PendingViolation {
+    info: ViolationInfo;
+    /** True when the violation originates from a pre-transform resolveId call
+     * (e.g. server-fn lookup).  These need edge-survival verification because
+     * the Start compiler may strip the import later. */
+    fromPreTransformResolve?: boolean;
+}
+export interface DeferredBuildViolation {
+    info: ViolationInfo;
+    mockModuleId: string;
+    checkModuleId?: string;
+}
+export interface SharedState {
+    fileMarkerKind: Map<string, 'server' | 'client'>;
+}
+export interface ImportProtectionPluginOptions {
+    getConfig: GetConfigFn;
+    framework: CompileStartFrameworkOptions;
+    environments: Array<{
+        name: string;
+        type: 'client' | 'server';
+    }>;
+    providerEnvName: string;
+}
+export type ModuleGraphNode = {
+    id?: string | null;
+    url?: string;
+    importers: Set<ModuleGraphNode>;
+};
+export type ViolationReporter = {
+    warn: (msg: string) => void;
+    error: (msg: string) => never;
+    resolve?: (source: string, importer?: string, options?: {
+        skipSelf?: boolean;
+        custom?: Record<string, unknown>;
+    }) => Promise<{
+        id: string;
+        external?: boolean | 'absolute';
+    } | null>;
+    getModuleInfo?: (id: string) => {
+        code?: string | null;
+    } | null;
+};
+export type HandleViolationResult = string | undefined;

package/dist/esm/import-protection-plugin/utils.d.ts

@@ -1,6 +1,7 @@
 export type Pattern = string | RegExp;
 export declare function dedupePatterns(patterns: Array<Pattern>): Array<Pattern>;
-export declare function stripViteQuery(id: string): string;
+/** Strip both `?query` and `#hash` from a module ID. */
+export declare function stripQueryAndHash(id: string): string;
 export declare function normalizeFilePath(id: string): string;
 /** Clear the memoization cache (call from buildStart to bound growth). */
 export declare function clearNormalizeFilePathCache(): void;
@@ -10,3 +11,34 @@ export declare function getOrCreate<TKey, TValue>(map: Map<TKey, TValue>, key: T
 /** Make a path relative to `root`, keeping non-rooted paths as-is. */
 export declare function relativizePath(p: string, root: string): string;
 export declare function extractImportSources(code: string): Array<string>;
+/** Log import-protection debug output when debug mode is enabled. */
+export declare function debugLog(...args: Array<unknown>): void;
+/** Check if any value matches the configured debug filter (if present). */
+export declare function matchesDebugFilter(...values: Array<string>): boolean;
+/** Strip `?query` (but not `#hash`) from a module ID. */
+export declare function stripQuery(id: string): string;
+export declare function withoutKnownExtension(id: string): string;
+/**
+ * Check whether `filePath` is contained inside `directory` using a
+ * boundary-safe comparison.  A naïve `filePath.startsWith(directory)`
+ * would incorrectly treat `/app/src2/foo.ts` as inside `/app/src`.
+ */
+export declare function isInsideDirectory(filePath: string, directory: string): boolean;
+/**
+ * Decide whether a violation should be deferred for later verification
+ * rather than reported immediately.
+ *
+ * Build mode: always defer — generateBundle checks tree-shaking.
+ * Dev mock mode: always defer — edge-survival verifies whether the Start
+ *   compiler strips the import (factory-safe pattern).  All violation
+ *   types and specifier formats are handled uniformly by the
+ *   edge-survival mechanism in processPendingViolations.
+ * Dev error mode: never defer — throw immediately (no mock fallback).
+ */
+export declare function shouldDeferViolation(opts: {
+    isBuild: boolean;
+    isDevMock: boolean;
+}): boolean;
+export declare function buildSourceCandidates(source: string, resolved: string | undefined, root: string): Set<string>;
+export declare function buildResolutionCandidates(id: string): Array<string>;
+export declare function canonicalizeResolvedId(id: string, root: string, resolveExtensionlessAbsoluteId: (value: string) => string): string;

package/dist/esm/import-protection-plugin/utils.js

@@ -1,4 +1,6 @@
+import { isAbsolute, resolve, relative, extname } from "node:path";
 import { normalizePath } from "vite";
+import { IMPORT_PROTECTION_DEBUG_FILTER, IMPORT_PROTECTION_DEBUG, KNOWN_SOURCE_EXTENSIONS } from "./constants.js";
 function dedupePatterns(patterns) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -10,7 +12,7 @@ function dedupePatterns(patterns) {
   }
   return out;
 }
-function stripViteQuery(id) {
+function stripQueryAndHash(id) {
   const q = id.indexOf("?");
   const h = id.indexOf("#");
   if (q === -1 && h === -1) return id;
@@ -22,7 +24,7 @@ const normalizeFilePathCache = /* @__PURE__ */ new Map();
 function normalizeFilePath(id) {
   let result = normalizeFilePathCache.get(id);
   if (result === void 0) {
-    result = normalizePath(stripViteQuery(id));
+    result = normalizePath(stripQueryAndHash(id));
     normalizeFilePathCache.set(id, result);
   }
   return result;
@@ -58,14 +60,78 @@ function extractImportSources(code) {
   }
   return sources;
 }
+function debugLog(...args) {
+  if (!IMPORT_PROTECTION_DEBUG) return;
+  console.warn("[import-protection:debug]", ...args);
+}
+function matchesDebugFilter(...values) {
+  const debugFilter = IMPORT_PROTECTION_DEBUG_FILTER;
+  if (!debugFilter) return true;
+  return values.some((v) => v.includes(debugFilter));
+}
+function stripQuery(id) {
+  const queryIndex = id.indexOf("?");
+  return queryIndex === -1 ? id : id.slice(0, queryIndex);
+}
+function withoutKnownExtension(id) {
+  const ext = extname(id);
+  return KNOWN_SOURCE_EXTENSIONS.has(ext) ? id.slice(0, -ext.length) : id;
+}
+function isInsideDirectory(filePath, directory) {
+  const rel = relative(resolve(directory), resolve(filePath));
+  return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function shouldDeferViolation(opts) {
+  return opts.isBuild || opts.isDevMock;
+}
+function buildSourceCandidates(source, resolved, root) {
+  const candidates = /* @__PURE__ */ new Set();
+  const push = (value) => {
+    if (!value) return;
+    candidates.add(value);
+    candidates.add(stripQuery(value));
+    candidates.add(withoutKnownExtension(stripQuery(value)));
+  };
+  push(source);
+  if (resolved) {
+    push(resolved);
+    const relativeResolved = relativizePath(resolved, root);
+    push(relativeResolved);
+    push(`./${relativeResolved}`);
+    push(`/${relativeResolved}`);
+  }
+  return candidates;
+}
+function buildResolutionCandidates(id) {
+  const normalized = normalizeFilePath(id);
+  const stripped = stripQuery(normalized);
+  return [.../* @__PURE__ */ new Set([id, normalized, stripped])];
+}
+function canonicalizeResolvedId(id, root, resolveExtensionlessAbsoluteId) {
+  const stripped = stripQuery(id);
+  let normalized = normalizeFilePath(stripped);
+  if (!isAbsolute(normalized) && !normalized.startsWith(".") && !normalized.startsWith("\0") && !/^[a-zA-Z]+:/.test(normalized)) {
+    normalized = normalizeFilePath(resolve(root, normalized));
+  }
+  return resolveExtensionlessAbsoluteId(normalized);
+}
 export {
+  buildResolutionCandidates,
+  buildSourceCandidates,
+  canonicalizeResolvedId,
   clearNormalizeFilePathCache,
+  debugLog,
   dedupePatterns,
   escapeRegExp,
   extractImportSources,
   getOrCreate,
+  isInsideDirectory,
+  matchesDebugFilter,
   normalizeFilePath,
   relativizePath,
-  stripViteQuery
+  shouldDeferViolation,
+  stripQuery,
+  stripQueryAndHash,
+  withoutKnownExtension
 };
 //# sourceMappingURL=utils.js.map

package/dist/esm/import-protection-plugin/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sources":["../../../src/import-protection-plugin/utils.ts"],"sourcesContent":["import { normalizePath } from 'vite'\n\nexport type Pattern = string | RegExp\n\nexport function dedupePatterns(patterns: Array<Pattern>): Array<Pattern> {\n  const out: Array<Pattern> = []\n  const seen = new Set<string>()\n  for (const p of patterns) {\n    const key = typeof p === 'string' ? `s:${p}` : `r:${p.toString()}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    out.push(p)\n  }\n  return out\n}\n\nexport function stripViteQuery(id: string): string {\n  const q = id.indexOf('?')\n  const h = id.indexOf('#')\n  if (q === -1 && h === -1) return id\n  if (q === -1) return id.slice(0, h)\n  if (h === -1) return id.slice(0, q)\n  return id.slice(0, Math.min(q, h))\n}\n\n/**\n * Strip Vite query parameters and normalize the path in one step.\n * Replaces the repeated `normalizePath(stripViteQuery(id))` pattern.\n *\n * Results are memoized because the same module IDs are processed many\n * times across resolveId, transform, and trace-building hooks.\n */\nconst normalizeFilePathCache = new Map<string, string>()\nexport function normalizeFilePath(id: string): string {\n  let result = normalizeFilePathCache.get(id)\n  if (result === undefined) {\n    result = normalizePath(stripViteQuery(id))\n    normalizeFilePathCache.set(id, result)\n  }\n  return result\n}\n\n/** Clear the memoization cache (call from buildStart to bound growth). */\nexport function clearNormalizeFilePathCache(): void {\n  normalizeFilePathCache.clear()\n}\n\n/**\n * Lightweight regex to extract all import/re-export source strings from\n * post-transform code.  Matches:\n *   - `from \"...\"` / `from '...'`   (static import/export)\n *   - `import(\"...\")` / `import('...')` (dynamic import)\n */\nconst importSourceRe =\n  /\\bfrom\\s+(?:\"([^\"]+)\"|'([^']+)')|import\\s*\\(\\s*(?:\"([^\"]+)\"|'([^']+)')\\s*\\)/g\n\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n\n/** Get a value from a Map, creating it with `factory` if absent. */\nexport function getOrCreate<TKey, TValue>(\n  map: Map<TKey, TValue>,\n  key: TKey,\n  factory: () => TValue,\n): TValue {\n  let value = map.get(key)\n  if (value === undefined) {\n    value = factory()\n    map.set(key, value)\n  }\n  return value\n}\n\n/** Make a path relative to `root`, keeping non-rooted paths as-is. */\nexport function relativizePath(p: string, root: string): string {\n  if (!p.startsWith(root)) return p\n  const ch = p.charCodeAt(root.length)\n  // Must be followed by a separator or end-of-string to be a true child\n  if (ch !== 47 && !Number.isNaN(ch)) return p\n  return ch === 47 ? p.slice(root.length + 1) : p.slice(root.length)\n}\n\nexport function extractImportSources(code: string): Array<string> {\n  const sources: Array<string> = []\n  let m: RegExpExecArray | null\n  importSourceRe.lastIndex = 0\n  while ((m = importSourceRe.exec(code)) !== null) {\n    const src = m[1] ?? m[2] ?? m[3] ?? m[4]\n    if (src) sources.push(src)\n  }\n  return sources\n}\n"],"names":[],"mappings":";AAIO,SAAS,eAAe,UAA0C;AACvE,QAAM,MAAsB,CAAA;AAC5B,QAAM,2BAAW,IAAA;AACjB,aAAW,KAAK,UAAU;AACxB,UAAM,MAAM,OAAO,MAAM,WAAW,KAAK,CAAC,KAAK,KAAK,EAAE,SAAA,CAAU;AAChE,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,QAAI,KAAK,CAAC;AAAA,EACZ;AACA,SAAO;AACT;AAEO,SAAS,eAAe,IAAoB;AACjD,QAAM,IAAI,GAAG,QAAQ,GAAG;AACxB,QAAM,IAAI,GAAG,QAAQ,GAAG;AACxB,MAAI,MAAM,MAAM,MAAM,GAAI,QAAO;AACjC,MAAI,MAAM,GAAI,QAAO,GAAG,MAAM,GAAG,CAAC;AAClC,MAAI,MAAM,GAAI,QAAO,GAAG,MAAM,GAAG,CAAC;AAClC,SAAO,GAAG,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;AACnC;AASA,MAAM,6CAA6B,IAAA;AAC5B,SAAS,kBAAkB,IAAoB;AACpD,MAAI,SAAS,uBAAuB,IAAI,EAAE;AAC1C,MAAI,WAAW,QAAW;AACxB,aAAS,cAAc,eAAe,EAAE,CAAC;AACzC,2BAAuB,IAAI,IAAI,MAAM;AAAA,EACvC;AACA,SAAO;AACT;AAGO,SAAS,8BAAoC;AAClD,yBAAuB,MAAA;AACzB;AAQA,MAAM,iBACJ;AAEK,SAAS,aAAa,GAAmB;AAC9C,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAGO,SAAS,YACd,KACA,KACA,SACQ;AACR,MAAI,QAAQ,IAAI,IAAI,GAAG;AACvB,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAA;AACR,QAAI,IAAI,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAGO,SAAS,eAAe,GAAW,MAAsB;AAC9D,MAAI,CAAC,EAAE,WAAW,IAAI,EAAG,QAAO;AAChC,QAAM,KAAK,EAAE,WAAW,KAAK,MAAM;AAEnC,MAAI,OAAO,MAAM,CAAC,OAAO,MAAM,EAAE,EAAG,QAAO;AAC3C,SAAO,OAAO,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;AACnE;AAEO,SAAS,qBAAqB,MAA6B;AAChE,QAAM,UAAyB,CAAA;AAC/B,MAAI;AACJ,iBAAe,YAAY;AAC3B,UAAQ,IAAI,eAAe,KAAK,IAAI,OAAO,MAAM;AAC/C,UAAM,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC;AACvC,QAAI,IAAK,SAAQ,KAAK,GAAG;AAAA,EAC3B;AACA,SAAO;AACT;"}
+{"version":3,"file":"utils.js","sources":["../../../src/import-protection-plugin/utils.ts"],"sourcesContent":["import {\n  extname,\n  isAbsolute,\n  relative,\n  resolve as resolvePath,\n} from 'node:path'\nimport { normalizePath } from 'vite'\n\nimport {\n  IMPORT_PROTECTION_DEBUG,\n  IMPORT_PROTECTION_DEBUG_FILTER,\n  KNOWN_SOURCE_EXTENSIONS,\n} from './constants'\n\nexport type Pattern = string | RegExp\n\nexport function dedupePatterns(patterns: Array<Pattern>): Array<Pattern> {\n  const out: Array<Pattern> = []\n  const seen = new Set<string>()\n  for (const p of patterns) {\n    const key = typeof p === 'string' ? `s:${p}` : `r:${p.toString()}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    out.push(p)\n  }\n  return out\n}\n\n/** Strip both `?query` and `#hash` from a module ID. */\nexport function stripQueryAndHash(id: string): string {\n  const q = id.indexOf('?')\n  const h = id.indexOf('#')\n  if (q === -1 && h === -1) return id\n  if (q === -1) return id.slice(0, h)\n  if (h === -1) return id.slice(0, q)\n  return id.slice(0, Math.min(q, h))\n}\n\n/**\n * Strip Vite query/hash parameters and normalize the path in one step.\n *\n * Results are memoized because the same module IDs are processed many\n * times across resolveId, transform, and trace-building hooks.\n */\nconst normalizeFilePathCache = new Map<string, string>()\nexport function normalizeFilePath(id: string): string {\n  let result = normalizeFilePathCache.get(id)\n  if (result === undefined) {\n    result = normalizePath(stripQueryAndHash(id))\n    normalizeFilePathCache.set(id, result)\n  }\n  return result\n}\n\n/** Clear the memoization cache (call from buildStart to bound growth). */\nexport function clearNormalizeFilePathCache(): void {\n  normalizeFilePathCache.clear()\n}\n\n/**\n * Lightweight regex to extract all import/re-export source strings from\n * post-transform code.  Matches:\n *   - `from \"...\"` / `from '...'`   (static import/export)\n *   - `import(\"...\")` / `import('...')` (dynamic import)\n */\nconst importSourceRe =\n  /\\bfrom\\s+(?:\"([^\"]+)\"|'([^']+)')|import\\s*\\(\\s*(?:\"([^\"]+)\"|'([^']+)')\\s*\\)/g\n\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n\n/** Get a value from a Map, creating it with `factory` if absent. */\nexport function getOrCreate<TKey, TValue>(\n  map: Map<TKey, TValue>,\n  key: TKey,\n  factory: () => TValue,\n): TValue {\n  let value = map.get(key)\n  if (value === undefined) {\n    value = factory()\n    map.set(key, value)\n  }\n  return value\n}\n\n/** Make a path relative to `root`, keeping non-rooted paths as-is. */\nexport function relativizePath(p: string, root: string): string {\n  if (!p.startsWith(root)) return p\n  const ch = p.charCodeAt(root.length)\n  // Must be followed by a separator or end-of-string to be a true child\n  if (ch !== 47 && !Number.isNaN(ch)) return p\n  return ch === 47 ? p.slice(root.length + 1) : p.slice(root.length)\n}\n\nexport function extractImportSources(code: string): Array<string> {\n  const sources: Array<string> = []\n  let m: RegExpExecArray | null\n  importSourceRe.lastIndex = 0\n  while ((m = importSourceRe.exec(code)) !== null) {\n    const src = m[1] ?? m[2] ?? m[3] ?? m[4]\n    if (src) sources.push(src)\n  }\n  return sources\n}\n\n/** Log import-protection debug output when debug mode is enabled. */\nexport function debugLog(...args: Array<unknown>): void {\n  if (!IMPORT_PROTECTION_DEBUG) return\n  console.warn('[import-protection:debug]', ...args)\n}\n\n/** Check if any value matches the configured debug filter (if present). */\nexport function matchesDebugFilter(...values: Array<string>): boolean {\n  const debugFilter = IMPORT_PROTECTION_DEBUG_FILTER\n  if (!debugFilter) return true\n  return values.some((v) => v.includes(debugFilter))\n}\n\n/** Strip `?query` (but not `#hash`) from a module ID. */\nexport function stripQuery(id: string): string {\n  const queryIndex = id.indexOf('?')\n  return queryIndex === -1 ? id : id.slice(0, queryIndex)\n}\n\nexport function withoutKnownExtension(id: string): string {\n  const ext = extname(id)\n  return KNOWN_SOURCE_EXTENSIONS.has(ext) ? id.slice(0, -ext.length) : id\n}\n\n/**\n * Check whether `filePath` is contained inside `directory` using a\n * boundary-safe comparison.  A naïve `filePath.startsWith(directory)`\n * would incorrectly treat `/app/src2/foo.ts` as inside `/app/src`.\n */\nexport function isInsideDirectory(\n  filePath: string,\n  directory: string,\n): boolean {\n  const rel = relative(resolvePath(directory), resolvePath(filePath))\n  return rel.length > 0 && !rel.startsWith('..') && !isAbsolute(rel)\n}\n\n/**\n * Decide whether a violation should be deferred for later verification\n * rather than reported immediately.\n *\n * Build mode: always defer — generateBundle checks tree-shaking.\n * Dev mock mode: always defer — edge-survival verifies whether the Start\n *   compiler strips the import (factory-safe pattern).  All violation\n *   types and specifier formats are handled uniformly by the\n *   edge-survival mechanism in processPendingViolations.\n * Dev error mode: never defer — throw immediately (no mock fallback).\n */\nexport function shouldDeferViolation(opts: {\n  isBuild: boolean\n  isDevMock: boolean\n}): boolean {\n  return opts.isBuild || opts.isDevMock\n}\n\nexport function buildSourceCandidates(\n  source: string,\n  resolved: string | undefined,\n  root: string,\n): Set<string> {\n  const candidates = new Set<string>()\n  const push = (value: string | undefined) => {\n    if (!value) return\n    candidates.add(value)\n    candidates.add(stripQuery(value))\n    candidates.add(withoutKnownExtension(stripQuery(value)))\n  }\n\n  push(source)\n  if (resolved) {\n    push(resolved)\n    const relativeResolved = relativizePath(resolved, root)\n    push(relativeResolved)\n    push(`./${relativeResolved}`)\n    push(`/${relativeResolved}`)\n  }\n\n  return candidates\n}\n\nexport function buildResolutionCandidates(id: string): Array<string> {\n  const normalized = normalizeFilePath(id)\n  const stripped = stripQuery(normalized)\n\n  return [...new Set([id, normalized, stripped])]\n}\n\nexport function canonicalizeResolvedId(\n  id: string,\n  root: string,\n  resolveExtensionlessAbsoluteId: (value: string) => string,\n): string {\n  const stripped = stripQuery(id)\n  let normalized = normalizeFilePath(stripped)\n\n  if (\n    !isAbsolute(normalized) &&\n    !normalized.startsWith('.') &&\n    !normalized.startsWith('\\0') &&\n    !/^[a-zA-Z]+:/.test(normalized)\n  ) {\n    normalized = normalizeFilePath(resolvePath(root, normalized))\n  }\n\n  return resolveExtensionlessAbsoluteId(normalized)\n}\n"],"names":["resolvePath"],"mappings":";;;AAgBO,SAAS,eAAe,UAA0C;AACvE,QAAM,MAAsB,CAAA;AAC5B,QAAM,2BAAW,IAAA;AACjB,aAAW,KAAK,UAAU;AACxB,UAAM,MAAM,OAAO,MAAM,WAAW,KAAK,CAAC,KAAK,KAAK,EAAE,SAAA,CAAU;AAChE,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,QAAI,KAAK,CAAC;AAAA,EACZ;AACA,SAAO;AACT;AAGO,SAAS,kBAAkB,IAAoB;AACpD,QAAM,IAAI,GAAG,QAAQ,GAAG;AACxB,QAAM,IAAI,GAAG,QAAQ,GAAG;AACxB,MAAI,MAAM,MAAM,MAAM,GAAI,QAAO;AACjC,MAAI,MAAM,GAAI,QAAO,GAAG,MAAM,GAAG,CAAC;AAClC,MAAI,MAAM,GAAI,QAAO,GAAG,MAAM,GAAG,CAAC;AAClC,SAAO,GAAG,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;AACnC;AAQA,MAAM,6CAA6B,IAAA;AAC5B,SAAS,kBAAkB,IAAoB;AACpD,MAAI,SAAS,uBAAuB,IAAI,EAAE;AAC1C,MAAI,WAAW,QAAW;AACxB,aAAS,cAAc,kBAAkB,EAAE,CAAC;AAC5C,2BAAuB,IAAI,IAAI,MAAM;AAAA,EACvC;AACA,SAAO;AACT;AAGO,SAAS,8BAAoC;AAClD,yBAAuB,MAAA;AACzB;AAQA,MAAM,iBACJ;AAEK,SAAS,aAAa,GAAmB;AAC9C,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAGO,SAAS,YACd,KACA,KACA,SACQ;AACR,MAAI,QAAQ,IAAI,IAAI,GAAG;AACvB,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAA;AACR,QAAI,IAAI,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAGO,SAAS,eAAe,GAAW,MAAsB;AAC9D,MAAI,CAAC,EAAE,WAAW,IAAI,EAAG,QAAO;AAChC,QAAM,KAAK,EAAE,WAAW,KAAK,MAAM;AAEnC,MAAI,OAAO,MAAM,CAAC,OAAO,MAAM,EAAE,EAAG,QAAO;AAC3C,SAAO,OAAO,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;AACnE;AAEO,SAAS,qBAAqB,MAA6B;AAChE,QAAM,UAAyB,CAAA;AAC/B,MAAI;AACJ,iBAAe,YAAY;AAC3B,UAAQ,IAAI,eAAe,KAAK,IAAI,OAAO,MAAM;AAC/C,UAAM,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC;AACvC,QAAI,IAAK,SAAQ,KAAK,GAAG;AAAA,EAC3B;AACA,SAAO;AACT;AAGO,SAAS,YAAY,MAA4B;AACtD,MAAI,CAAC,wBAAyB;AAC9B,UAAQ,KAAK,6BAA6B,GAAG,IAAI;AACnD;AAGO,SAAS,sBAAsB,QAAgC;AACpE,QAAM,cAAc;AACpB,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,WAAW,CAAC;AACnD;AAGO,SAAS,WAAW,IAAoB;AAC7C,QAAM,aAAa,GAAG,QAAQ,GAAG;AACjC,SAAO,eAAe,KAAK,KAAK,GAAG,MAAM,GAAG,UAAU;AACxD;AAEO,SAAS,sBAAsB,IAAoB;AACxD,QAAM,MAAM,QAAQ,EAAE;AACtB,SAAO,wBAAwB,IAAI,GAAG,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI;AACvE;AAOO,SAAS,kBACd,UACA,WACS;AACT,QAAM,MAAM,SAASA,QAAY,SAAS,GAAGA,QAAY,QAAQ,CAAC;AAClE,SAAO,IAAI,SAAS,KAAK,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AACnE;AAaO,SAAS,qBAAqB,MAGzB;AACV,SAAO,KAAK,WAAW,KAAK;AAC9B;AAEO,SAAS,sBACd,QACA,UACA,MACa;AACb,QAAM,iCAAiB,IAAA;AACvB,QAAM,OAAO,CAAC,UAA8B;AAC1C,QAAI,CAAC,MAAO;AACZ,eAAW,IAAI,KAAK;AACpB,eAAW,IAAI,WAAW,KAAK,CAAC;AAChC,eAAW,IAAI,sBAAsB,WAAW,KAAK,CAAC,CAAC;AAAA,EACzD;AAEA,OAAK,MAAM;AACX,MAAI,UAAU;AACZ,SAAK,QAAQ;AACb,UAAM,mBAAmB,eAAe,UAAU,IAAI;AACtD,SAAK,gBAAgB;AACrB,SAAK,KAAK,gBAAgB,EAAE;AAC5B,SAAK,IAAI,gBAAgB,EAAE;AAAA,EAC7B;AAEA,SAAO;AACT;AAEO,SAAS,0BAA0B,IAA2B;AACnE,QAAM,aAAa,kBAAkB,EAAE;AACvC,QAAM,WAAW,WAAW,UAAU;AAEtC,SAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,IAAI,YAAY,QAAQ,CAAC,CAAC;AAChD;AAEO,SAAS,uBACd,IACA,MACA,gCACQ;AACR,QAAM,WAAW,WAAW,EAAE;AAC9B,MAAI,aAAa,kBAAkB,QAAQ;AAE3C,MACE,CAAC,WAAW,UAAU,KACtB,CAAC,WAAW,WAAW,GAAG,KAC1B,CAAC,WAAW,WAAW,IAAI,KAC3B,CAAC,cAAc,KAAK,UAAU,GAC9B;AACA,iBAAa,kBAAkBA,QAAY,MAAM,UAAU,CAAC;AAAA,EAC9D;AAEA,SAAO,+BAA+B,UAAU;AAClD;"}

package/dist/esm/import-protection-plugin/virtualModules.d.ts

@@ -8,7 +8,6 @@ export declare const MOCK_MODULE_ID = "tanstack-start-import-protection:mock";
 export declare const MOCK_BUILD_PREFIX = "tanstack-start-import-protection:mock:build:";
 export declare const MOCK_EDGE_PREFIX = "tanstack-start-import-protection:mock-edge:";
 export declare const MOCK_RUNTIME_PREFIX = "tanstack-start-import-protection:mock-runtime:";
-export declare const MARKER_PREFIX = "tanstack-start-import-protection:marker:";
 export declare function resolvedMarkerVirtualModuleId(kind: 'server' | 'client'): string;
 /**
  * Convenience list for plugin `load` filters/handlers.
@@ -31,10 +30,39 @@ type MockAccessMode = 'error' | 'warn' | 'off';
  */
 export declare const RUNTIME_SUGGESTION_TEXT: string;
 export declare function mockRuntimeModuleIdFromViolation(info: ViolationInfo, mode: MockAccessMode, root: string): string;
-export declare function makeMockEdgeModuleId(exports: Array<string>, source: string, runtimeId: string): string;
+export declare function makeMockEdgeModuleId(exports: Array<string>, runtimeId: string): string;
 export declare function loadSilentMockModule(): {
     code: string;
 };
+/**
+ * Generate a self-contained mock module with explicit named exports.
+ *
+ * Used by the transform hook's "self-denial" check: when a denied file
+ * (e.g. `.server.ts` in the client environment) is transformed, its entire
+ * content is replaced with this mock module.  This avoids returning virtual
+ * module IDs from `resolveId`, which prevents cross-environment cache
+ * contamination from third-party resolver plugins.
+ *
+ * The generated code is side-effect-free and tree-shakeable.
+ */
+export declare function generateSelfContainedMockModule(exportNames: Array<string>): {
+    code: string;
+};
+/**
+ * Generate a dev-mode mock module for self-denial transforms.
+ *
+ * Similar to `loadMockEdgeModule` but takes export names and a runtime ID
+ * directly (instead of parsing them from a base64url-encoded payload).
+ * Used by the transform hook when a denied file (e.g. `.server.ts` in
+ * the client environment) is replaced in dev mode.
+ *
+ * The generated module imports mock-runtime for runtime diagnostics
+ * (error/warn on property access) and re-exports explicit named exports
+ * so that `import { foo } from './denied.server'` works.
+ */
+export declare function generateDevSelfDenialModule(exportNames: Array<string>, runtimeId: string): {
+    code: string;
+};
 export declare function loadMockEdgeModule(encodedPayload: string): {
     code: string;
 };

package/dist/esm/import-protection-plugin/virtualModules.js

@@ -2,6 +2,7 @@ import { resolveViteId } from "../utils.js";
 import { VITE_ENVIRONMENT_NAMES } from "../constants.js";
 import { isValidExportName } from "./rewriteDeniedImports.js";
 import { CLIENT_ENV_SUGGESTIONS } from "./trace.js";
+import { VITE_BROWSER_VIRTUAL_PREFIX } from "./constants.js";
 import { relativizePath } from "./utils.js";
 const MOCK_MODULE_ID = "tanstack-start-import-protection:mock";
 const RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID);
@@ -28,12 +29,29 @@ const RESOLVED_VIRTUAL_MODULE_MATCHERS = [
   RESOLVED_MOCK_RUNTIME_PREFIX,
   RESOLVED_MARKER_PREFIX
 ];
+const RESOLVE_PREFIX_PAIRS = [
+  [MOCK_EDGE_PREFIX, RESOLVED_MOCK_EDGE_PREFIX],
+  [MOCK_RUNTIME_PREFIX, RESOLVED_MOCK_RUNTIME_PREFIX],
+  [MOCK_BUILD_PREFIX, RESOLVED_MOCK_BUILD_PREFIX],
+  [MARKER_PREFIX, RESOLVED_MARKER_PREFIX]
+];
 function resolveInternalVirtualModuleId(source) {
-  if (source === MOCK_MODULE_ID) return RESOLVED_MOCK_MODULE_ID;
-  if (source.startsWith(MOCK_EDGE_PREFIX)) return resolveViteId(source);
-  if (source.startsWith(MOCK_RUNTIME_PREFIX)) return resolveViteId(source);
-  if (source.startsWith(MOCK_BUILD_PREFIX)) return resolveViteId(source);
-  if (source.startsWith(MARKER_PREFIX)) return resolveViteId(source);
+  if (source.startsWith(VITE_BROWSER_VIRTUAL_PREFIX)) {
+    return resolveInternalVirtualModuleId(
+      `\0${source.slice(VITE_BROWSER_VIRTUAL_PREFIX.length)}`
+    );
+  }
+  if (source === MOCK_MODULE_ID || source === RESOLVED_MOCK_MODULE_ID) {
+    return RESOLVED_MOCK_MODULE_ID;
+  }
+  for (const [unresolvedPrefix, resolvedPrefix] of RESOLVE_PREFIX_PAIRS) {
+    if (source.startsWith(unresolvedPrefix)) {
+      return resolveViteId(source);
+    }
+    if (source.startsWith(resolvedPrefix)) {
+      return source;
+    }
+  }
   return void 0;
 }
 function toBase64Url(input) {
@@ -61,8 +79,8 @@ function mockRuntimeModuleIdFromViolation(info, mode, root) {
   };
   return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`;
 }
-function makeMockEdgeModuleId(exports, source, runtimeId) {
-  const payload = { source, exports, runtimeId };
+function makeMockEdgeModuleId(exports, runtimeId) {
+  const payload = { exports, runtimeId };
   return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`;
 }
 function generateMockCode(diagnostics) {
@@ -156,33 +174,57 @@ export default mock;
 function loadSilentMockModule() {
   return { code: generateMockCode() };
 }
-function loadMockEdgeModule(encodedPayload) {
-  let payload;
-  try {
-    payload = JSON.parse(fromBase64Url(encodedPayload));
-  } catch {
-    payload = { exports: [] };
-  }
-  const names = Array.isArray(payload.exports) ? payload.exports.filter(
-    (n) => typeof n === "string" && n.length > 0 && n !== "default"
-  ) : [];
-  const runtimeId = typeof payload.runtimeId === "string" && payload.runtimeId.length > 0 ? payload.runtimeId : MOCK_MODULE_ID;
-  const exportLines = [];
+function filterExportNames(exports) {
+  return exports.filter((n) => n.length > 0 && n !== "default");
+}
+function generateExportLines(names) {
+  const lines = [];
   const stringExports = [];
   for (let i = 0; i < names.length; i++) {
     const n = names[i];
     if (isValidExportName(n)) {
-      exportLines.push(`export const ${n} = mock.${n};`);
+      lines.push(`export const ${n} = mock.${n};`);
     } else {
       const alias = `__tss_str_${i}`;
-      exportLines.push(`const ${alias} = mock[${JSON.stringify(n)}];`);
+      lines.push(`const ${alias} = mock[${JSON.stringify(n)}];`);
       stringExports.push({ alias, name: n });
     }
   }
   if (stringExports.length > 0) {
     const reexports = stringExports.map((s) => `${s.alias} as ${JSON.stringify(s.name)}`).join(", ");
-    exportLines.push(`export { ${reexports} };`);
+    lines.push(`export { ${reexports} };`);
+  }
+  return lines;
+}
+function generateSelfContainedMockModule(exportNames) {
+  const mockCode = generateMockCode();
+  const exportLines = generateExportLines(filterExportNames(exportNames));
+  return {
+    code: `${mockCode}
+${exportLines.join("\n")}
+`
+  };
+}
+function generateDevSelfDenialModule(exportNames, runtimeId) {
+  const names = filterExportNames(exportNames);
+  const exportLines = generateExportLines(names);
+  return {
+    code: `import mock from ${JSON.stringify(runtimeId)};
+${exportLines.join("\n")}
+export default mock;
+`
+  };
+}
+function loadMockEdgeModule(encodedPayload) {
+  let payload;
+  try {
+    payload = JSON.parse(fromBase64Url(encodedPayload));
+  } catch {
+    payload = { exports: [] };
   }
+  const names = filterExportNames(payload.exports ?? []);
+  const runtimeId = typeof payload.runtimeId === "string" && payload.runtimeId.length > 0 ? payload.runtimeId : MOCK_MODULE_ID;
+  const exportLines = generateExportLines(names);
   return {
     code: `import mock from ${JSON.stringify(runtimeId)};
 ${exportLines.join("\n")}
@@ -229,12 +271,13 @@ function loadResolvedVirtualModule(id) {
   return void 0;
 }
 export {
-  MARKER_PREFIX,
   MOCK_BUILD_PREFIX,
   MOCK_EDGE_PREFIX,
   MOCK_MODULE_ID,
   MOCK_RUNTIME_PREFIX,
   RUNTIME_SUGGESTION_TEXT,
+  generateDevSelfDenialModule,
+  generateSelfContainedMockModule,
   getResolvedVirtualModuleMatchers,
   loadMarkerModule,
   loadMockEdgeModule,

package/dist/esm/import-protection-plugin/virtualModules.js.map

@@ -1 +1 @@
-{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport { CLIENT_ENV_SUGGESTIONS } from './trace'\nimport { relativizePath } from './utils'\nimport type { ViolationInfo } from './trace'\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nconst RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\n/**\n * Per-violation mock prefix used in build+error mode.\n * Each deferred violation gets a unique ID so we can check which ones\n * survived tree-shaking in `generateBundle`.\n */\nexport const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'\nconst RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nconst RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nconst RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nexport const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nconst RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\nconst RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)\nconst RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)\n\nexport function resolvedMarkerVirtualModuleId(\n  kind: 'server' | 'client',\n): string {\n  return kind === 'server'\n    ? RESOLVED_MARKER_SERVER_ONLY\n    : RESOLVED_MARKER_CLIENT_ONLY\n}\n\n/**\n * Convenience list for plugin `load` filters/handlers.\n *\n * Vite/Rollup call `load(id)` with the *resolved* virtual id (prefixed by `\\0`).\n * `resolveId(source)` sees the *unresolved* id/prefix (without `\\0`).\n */\nexport function getResolvedVirtualModuleMatchers(): ReadonlyArray<string> {\n  return RESOLVED_VIRTUAL_MODULE_MATCHERS\n}\n\nconst RESOLVED_VIRTUAL_MODULE_MATCHERS = [\n  RESOLVED_MOCK_MODULE_ID,\n  RESOLVED_MOCK_BUILD_PREFIX,\n  RESOLVED_MOCK_EDGE_PREFIX,\n  RESOLVED_MOCK_RUNTIME_PREFIX,\n  RESOLVED_MARKER_PREFIX,\n] as const\n\n/**\n * Resolve import-protection's internal virtual module IDs.\n *\n * `resolveId(source)` sees *unresolved* ids/prefixes (no `\\0`).\n * Returning a resolved id (with `\\0`) ensures Vite/Rollup route it to `load`.\n */\nexport function resolveInternalVirtualModuleId(\n  source: string,\n): string | undefined {\n  if (source === MOCK_MODULE_ID) return RESOLVED_MOCK_MODULE_ID\n  if (source.startsWith(MOCK_EDGE_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MOCK_RUNTIME_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MOCK_BUILD_PREFIX)) return resolveViteId(source)\n  if (source.startsWith(MARKER_PREFIX)) return resolveViteId(source)\n  return undefined\n}\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\ntype MockAccessMode = 'error' | 'warn' | 'off'\n\n/**\n * Compact runtime suggestion text for browser console, derived from\n * {@link CLIENT_ENV_SUGGESTIONS} so there's a single source of truth.\n */\nexport const RUNTIME_SUGGESTION_TEXT =\n  'Fix: ' +\n  CLIENT_ENV_SUGGESTIONS.join('. ') +\n  '. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".'\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n\n  const rel = (p: string) => relativizePath(p, root)\n  const trace = info.trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n\n  const payload = {\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace,\n    mode,\n  }\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  source: string,\n  runtimeId: string,\n): string {\n  const payload = { source, exports, runtimeId }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n/**\n * Generate a recursive Proxy-based mock module.\n *\n * When `diagnostics` is provided, the generated code includes a `__report`\n * function that logs runtime warnings/errors when the mock is actually used\n * (property access for primitive coercion, calls, construction, sets).\n *\n * When `diagnostics` is omitted, the mock is completely silent — suitable\n * for base mock modules (e.g. `MOCK_MODULE_ID` or per-violation build mocks)\n * that are consumed by mock-edge modules providing explicit named exports.\n */\nfunction generateMockCode(diagnostics?: {\n  meta: {\n    env: string\n    importer: string\n    specifier: string\n    trace: Array<unknown>\n  }\n  mode: 'error' | 'warn' | 'off'\n}): string {\n  const fnName = diagnostics ? '__createMock' : 'createMock'\n  const hasDiag = !!diagnostics\n\n  const preamble = hasDiag\n    ? `const __meta = ${JSON.stringify(diagnostics.meta)};\nconst __mode = ${JSON.stringify(diagnostics.mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\n' + ${JSON.stringify(RUNTIME_SUGGESTION_TEXT)};\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n`\n    : ''\n\n  // Diagnostic-only traps for primitive coercion, set\n  const diagGetTraps = hasDiag\n    ? `\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }`\n    : ''\n\n  const applyBody = hasDiag\n    ? `__report('call', name + '()');\n      return ${fnName}(name + '()');`\n    : `return ${fnName}(name + '()');`\n\n  const constructBody = hasDiag\n    ? `__report('construct', 'new ' + name);\n      return ${fnName}('new ' + name);`\n    : `return ${fnName}('new ' + name);`\n\n  const setTrap = hasDiag\n    ? `\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },`\n    : ''\n\n  return `\n${preamble}/* @__NO_SIDE_EFFECTS__ */\nfunction ${fnName}(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };${diagGetTraps}\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = ${fnName}(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      ${applyBody}\n    },\n    construct() {\n      ${constructBody}\n    },${setTrap}\n  });\n  return proxy;\n}\nconst mock = /* @__PURE__ */ ${fnName}('mock');\nexport default mock;\n`\n}\n\nexport function loadSilentMockModule(): { code: string } {\n  return { code: generateMockCode() }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names: Array<string> = Array.isArray(payload.exports)\n    ? payload.exports.filter(\n        (n): n is string =>\n          typeof n === 'string' && n.length > 0 && n !== 'default',\n      )\n    : []\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines: Array<string> = []\n  const stringExports: Array<{ alias: string; name: string }> = []\n\n  for (let i = 0; i < names.length; i++) {\n    const n = names[i]!\n    if (isValidExportName(n)) {\n      exportLines.push(`export const ${n} = mock.${n};`)\n    } else {\n      // ES2022 string-keyed export: use a temp var + re-export with string literal\n      const alias = `__tss_str_${i}`\n      exportLines.push(`const ${alias} = mock[${JSON.stringify(n)}];`)\n      stringExports.push({ alias, name: n })\n    }\n  }\n\n  if (stringExports.length > 0) {\n    const reexports = stringExports\n      .map((s) => `${s.alias} as ${JSON.stringify(s.name)}`)\n      .join(', ')\n    exportLines.push(`export { ${reexports} };`)\n  }\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return { code: generateMockCode({ meta, mode }) }\n}\n\nconst MARKER_MODULE_RESULT = { code: 'export {}' } as const\n\nexport function loadMarkerModule(): { code: string } {\n  return MARKER_MODULE_RESULT\n}\n\nexport function loadResolvedVirtualModule(\n  id: string,\n): { code: string } | undefined {\n  if (id === RESOLVED_MOCK_MODULE_ID) {\n    return loadSilentMockModule()\n  }\n\n  // Per-violation build mock modules — same silent mock code\n  if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {\n    return loadSilentMockModule()\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {\n    return loadMockEdgeModule(id.slice(RESOLVED_MOCK_EDGE_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {\n    return loadMockRuntimeModule(id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MARKER_PREFIX)) {\n    return loadMarkerModule()\n  }\n\n  return undefined\n}\n"],"names":[],"mappings":";;;;;AAOO,MAAM,iBAAiB;AAC9B,MAAM,0BAA0B,cAAc,cAAc;AAOrD,MAAM,oBAAoB;AACjC,MAAM,6BAA6B,cAAc,iBAAiB;AAE3D,MAAM,mBAAmB;AAChC,MAAM,4BAA4B,cAAc,gBAAgB;AAEzD,MAAM,sBACX;AACF,MAAM,+BAA+B,cAAc,mBAAmB;AAE/D,MAAM,gBAAgB;AAC7B,MAAM,yBAAyB,cAAc,aAAa;AAE1D,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAC/E,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAExE,SAAS,8BACd,MACQ;AACR,SAAO,SAAS,WACZ,8BACA;AACN;AAQO,SAAS,mCAA0D;AACxE,SAAO;AACT;AAEA,MAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,+BACd,QACoB;AACpB,MAAI,WAAW,eAAgB,QAAO;AACtC,MAAI,OAAO,WAAW,gBAAgB,EAAG,QAAO,cAAc,MAAM;AACpE,MAAI,OAAO,WAAW,mBAAmB,EAAG,QAAO,cAAc,MAAM;AACvE,MAAI,OAAO,WAAW,iBAAiB,EAAG,QAAO,cAAc,MAAM;AACrE,MAAI,OAAO,WAAW,aAAa,EAAG,QAAO,cAAc,MAAM;AACjE,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQO,MAAM,0BACX,UACA,uBAAuB,KAAK,IAAI,IAChC;AAEK,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AAEvD,QAAM,MAAM,CAAC,MAAc,eAAe,GAAG,IAAI;AACjD,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AAED,QAAM,UAAU;AAAA,IACd,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEO,SAAS,qBACd,SACA,QACA,WACQ;AACR,QAAM,UAAU,EAAE,QAAQ,SAAS,UAAA;AACnC,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAaA,SAAS,iBAAiB,aAQf;AACT,QAAM,SAAS,cAAc,iBAAiB;AAC9C,QAAM,UAAU,CAAC,CAAC;AAElB,QAAM,WAAW,UACb,kBAAkB,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,iBACvC,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAmBhC,KAAK,UAAU,uBAAuB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlD;AAGJ,QAAM,eAAe,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAaA;AAEJ,QAAM,YAAY,UACd;AAAA,eACS,MAAM,mBACf,UAAU,MAAM;AAEpB,QAAM,gBAAgB,UAClB;AAAA,eACS,MAAM,qBACf,UAAU,MAAM;AAEpB,QAAM,UAAU,UACZ;AAAA;AAAA;AAAA;AAAA,UAKA;AAEJ,SAAO;AAAA,EACP,QAAQ;AAAA,WACC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sFAWqE,YAAY;AAAA;AAAA;AAAA,2BAGvE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,QAKzB,SAAS;AAAA;AAAA;AAAA,QAGT,aAAa;AAAA,QACb,OAAO;AAAA;AAAA;AAAA;AAAA,+BAIgB,MAAM;AAAA;AAAA;AAGrC;AAEO,SAAS,uBAAyC;AACvD,SAAO,EAAE,MAAM,mBAAiB;AAClC;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAuB,MAAM,QAAQ,QAAQ,OAAO,IACtD,QAAQ,QAAQ;AAAA,IACd,CAAC,MACC,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,MAAM;AAAA,EAAA,IAEnD,CAAA;AAEJ,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAA6B,CAAA;AACnC,QAAM,gBAAwD,CAAA;AAE9D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,kBAAkB,CAAC,GAAG;AACxB,kBAAY,KAAK,gBAAgB,CAAC,WAAW,CAAC,GAAG;AAAA,IACnD,OAAO;AAEL,YAAM,QAAQ,aAAa,CAAC;AAC5B,kBAAY,KAAK,SAAS,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,IAAI;AAC/D,oBAAc,KAAK,EAAE,OAAO,MAAM,GAAG;AAAA,IACvC;AAAA,EACF;AAEA,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,YAAY,cACf,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE,EACpD,KAAK,IAAI;AACZ,gBAAY,KAAK,YAAY,SAAS,KAAK;AAAA,EAC7C;AAEA,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO,EAAE,MAAM,iBAAiB,EAAE,MAAM,KAAA,CAAM,EAAA;AAChD;AAEA,MAAM,uBAAuB,EAAE,MAAM,YAAA;AAE9B,SAAS,mBAAqC;AACnD,SAAO;AACT;AAEO,SAAS,0BACd,IAC8B;AAC9B,MAAI,OAAO,yBAAyB;AAClC,WAAO,qBAAA;AAAA,EACT;AAGA,MAAI,GAAG,WAAW,0BAA0B,GAAG;AAC7C,WAAO,qBAAA;AAAA,EACT;AAEA,MAAI,GAAG,WAAW,yBAAyB,GAAG;AAC5C,WAAO,mBAAmB,GAAG,MAAM,0BAA0B,MAAM,CAAC;AAAA,EACtE;AAEA,MAAI,GAAG,WAAW,4BAA4B,GAAG;AAC/C,WAAO,sBAAsB,GAAG,MAAM,6BAA6B,MAAM,CAAC;AAAA,EAC5E;AAEA,MAAI,GAAG,WAAW,sBAAsB,GAAG;AACzC,WAAO,iBAAA;AAAA,EACT;AAEA,SAAO;AACT;"}
+{"version":3,"file":"virtualModules.js","sources":["../../../src/import-protection-plugin/virtualModules.ts"],"sourcesContent":["import { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { isValidExportName } from './rewriteDeniedImports'\nimport { CLIENT_ENV_SUGGESTIONS } from './trace'\nimport { VITE_BROWSER_VIRTUAL_PREFIX } from './constants'\nimport { relativizePath } from './utils'\nimport type { ViolationInfo } from './trace'\n\nexport const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'\nconst RESOLVED_MOCK_MODULE_ID = resolveViteId(MOCK_MODULE_ID)\n\n/**\n * Per-violation mock prefix used in build+error mode.\n * Each deferred violation gets a unique ID so we can check which ones\n * survived tree-shaking in `generateBundle`.\n */\nexport const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'\nconst RESOLVED_MOCK_BUILD_PREFIX = resolveViteId(MOCK_BUILD_PREFIX)\n\nexport const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'\nconst RESOLVED_MOCK_EDGE_PREFIX = resolveViteId(MOCK_EDGE_PREFIX)\n\nexport const MOCK_RUNTIME_PREFIX =\n  'tanstack-start-import-protection:mock-runtime:'\nconst RESOLVED_MOCK_RUNTIME_PREFIX = resolveViteId(MOCK_RUNTIME_PREFIX)\n\nconst MARKER_PREFIX = 'tanstack-start-import-protection:marker:'\nconst RESOLVED_MARKER_PREFIX = resolveViteId(MARKER_PREFIX)\n\nconst RESOLVED_MARKER_SERVER_ONLY = resolveViteId(`${MARKER_PREFIX}server-only`)\nconst RESOLVED_MARKER_CLIENT_ONLY = resolveViteId(`${MARKER_PREFIX}client-only`)\n\nexport function resolvedMarkerVirtualModuleId(\n  kind: 'server' | 'client',\n): string {\n  return kind === 'server'\n    ? RESOLVED_MARKER_SERVER_ONLY\n    : RESOLVED_MARKER_CLIENT_ONLY\n}\n\n/**\n * Convenience list for plugin `load` filters/handlers.\n *\n * Vite/Rollup call `load(id)` with the *resolved* virtual id (prefixed by `\\0`).\n * `resolveId(source)` sees the *unresolved* id/prefix (without `\\0`).\n */\nexport function getResolvedVirtualModuleMatchers(): ReadonlyArray<string> {\n  return RESOLVED_VIRTUAL_MODULE_MATCHERS\n}\n\nconst RESOLVED_VIRTUAL_MODULE_MATCHERS = [\n  RESOLVED_MOCK_MODULE_ID,\n  RESOLVED_MOCK_BUILD_PREFIX,\n  RESOLVED_MOCK_EDGE_PREFIX,\n  RESOLVED_MOCK_RUNTIME_PREFIX,\n  RESOLVED_MARKER_PREFIX,\n] as const\n\nconst RESOLVE_PREFIX_PAIRS = [\n  [MOCK_EDGE_PREFIX, RESOLVED_MOCK_EDGE_PREFIX],\n  [MOCK_RUNTIME_PREFIX, RESOLVED_MOCK_RUNTIME_PREFIX],\n  [MOCK_BUILD_PREFIX, RESOLVED_MOCK_BUILD_PREFIX],\n  [MARKER_PREFIX, RESOLVED_MARKER_PREFIX],\n] as const\n\n/**\n * Resolve import-protection's internal virtual module IDs.\n *\n * `resolveId(source)` sees *unresolved* ids/prefixes (no `\\0`).\n * Returning a resolved id (with `\\0`) ensures Vite/Rollup route it to `load`.\n */\nexport function resolveInternalVirtualModuleId(\n  source: string,\n): string | undefined {\n  if (source.startsWith(VITE_BROWSER_VIRTUAL_PREFIX)) {\n    return resolveInternalVirtualModuleId(\n      `\\0${source.slice(VITE_BROWSER_VIRTUAL_PREFIX.length)}`,\n    )\n  }\n\n  if (source === MOCK_MODULE_ID || source === RESOLVED_MOCK_MODULE_ID) {\n    return RESOLVED_MOCK_MODULE_ID\n  }\n\n  for (const [unresolvedPrefix, resolvedPrefix] of RESOLVE_PREFIX_PAIRS) {\n    if (source.startsWith(unresolvedPrefix)) {\n      return resolveViteId(source)\n    }\n\n    if (source.startsWith(resolvedPrefix)) {\n      return source\n    }\n  }\n\n  return undefined\n}\n\nfunction toBase64Url(input: string): string {\n  return Buffer.from(input, 'utf8').toString('base64url')\n}\n\nfunction fromBase64Url(input: string): string {\n  return Buffer.from(input, 'base64url').toString('utf8')\n}\n\ntype MockAccessMode = 'error' | 'warn' | 'off'\n\n/**\n * Compact runtime suggestion text for browser console, derived from\n * {@link CLIENT_ENV_SUGGESTIONS} so there's a single source of truth.\n */\nexport const RUNTIME_SUGGESTION_TEXT =\n  'Fix: ' +\n  CLIENT_ENV_SUGGESTIONS.join('. ') +\n  '. To disable these runtime diagnostics, set importProtection.mockAccess: \"off\".'\n\nexport function mockRuntimeModuleIdFromViolation(\n  info: ViolationInfo,\n  mode: MockAccessMode,\n  root: string,\n): string {\n  if (mode === 'off') return MOCK_MODULE_ID\n  if (info.env !== VITE_ENVIRONMENT_NAMES.client) return MOCK_MODULE_ID\n\n  const rel = (p: string) => relativizePath(p, root)\n  const trace = info.trace.map((s) => {\n    const file = rel(s.file)\n    if (s.line == null) return file\n    return `${file}:${s.line}:${s.column ?? 1}`\n  })\n\n  const payload = {\n    env: info.env,\n    importer: info.importer,\n    specifier: info.specifier,\n    trace,\n    mode,\n  }\n  return `${MOCK_RUNTIME_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\nexport function makeMockEdgeModuleId(\n  exports: Array<string>,\n  runtimeId: string,\n): string {\n  const payload = { exports, runtimeId }\n  return `${MOCK_EDGE_PREFIX}${toBase64Url(JSON.stringify(payload))}`\n}\n\n/**\n * Generate a recursive Proxy-based mock module.\n *\n * When `diagnostics` is provided, the generated code includes a `__report`\n * function that logs runtime warnings/errors when the mock is actually used\n * (property access for primitive coercion, calls, construction, sets).\n *\n * When `diagnostics` is omitted, the mock is completely silent — suitable\n * for base mock modules (e.g. `MOCK_MODULE_ID` or per-violation build mocks)\n * that are consumed by mock-edge modules providing explicit named exports.\n */\nfunction generateMockCode(diagnostics?: {\n  meta: {\n    env: string\n    importer: string\n    specifier: string\n    trace: Array<unknown>\n  }\n  mode: 'error' | 'warn' | 'off'\n}): string {\n  const fnName = diagnostics ? '__createMock' : 'createMock'\n  const hasDiag = !!diagnostics\n\n  const preamble = hasDiag\n    ? `const __meta = ${JSON.stringify(diagnostics.meta)};\nconst __mode = ${JSON.stringify(diagnostics.mode)};\n\nconst __seen = new Set();\nfunction __report(action, accessPath) {\n  if (__mode === 'off') return;\n  const key = action + ':' + accessPath;\n  if (__seen.has(key)) return;\n  __seen.add(key);\n\n  const traceLines = Array.isArray(__meta.trace) && __meta.trace.length\n    ? \"\\\\n\\\\nTrace:\\\\n\" + __meta.trace.map((t, i) => '  ' + (i + 1) + '. ' + String(t)).join('\\\\n')\n    : '';\n\n  const msg =\n    '[import-protection] Mocked import used in dev client\\\\n\\\\n' +\n    'Denied import: \"' + __meta.specifier + '\"\\\\n' +\n    'Importer: ' + __meta.importer + '\\\\n' +\n    'Access: ' + accessPath + ' (' + action + ')' +\n    traceLines +\n    '\\\\n\\\\n' + ${JSON.stringify(RUNTIME_SUGGESTION_TEXT)};\n\n  const err = new Error(msg);\n  if (__mode === 'warn') {\n    console.warn(err);\n  } else {\n    console.error(err);\n  }\n}\n`\n    : ''\n\n  // Diagnostic-only traps for primitive coercion, set\n  const diagGetTraps = hasDiag\n    ? `\n      if (prop === Symbol.toPrimitive) {\n        return () => {\n          __report('toPrimitive', name);\n          return '[import-protection mock]';\n        };\n      }\n      if (prop === 'toString' || prop === 'valueOf' || prop === 'toJSON') {\n        return () => {\n          __report(String(prop), name);\n          return '[import-protection mock]';\n        };\n      }`\n    : ''\n\n  const applyBody = hasDiag\n    ? `__report('call', name + '()');\n      return ${fnName}(name + '()');`\n    : `return ${fnName}(name + '()');`\n\n  const constructBody = hasDiag\n    ? `__report('construct', 'new ' + name);\n      return ${fnName}('new ' + name);`\n    : `return ${fnName}('new ' + name);`\n\n  const setTrap = hasDiag\n    ? `\n    set(_target, prop) {\n      __report('set', name + '.' + String(prop));\n      return true;\n    },`\n    : ''\n\n  return `\n${preamble}/* @__NO_SIDE_EFFECTS__ */\nfunction ${fnName}(name) {\n  const fn = function () {};\n  fn.prototype.name = name;\n  const children = Object.create(null);\n  const proxy = new Proxy(fn, {\n    get(_target, prop) {\n      if (prop === '__esModule') return true;\n      if (prop === 'default') return proxy;\n      if (prop === 'caller') return null;\n      if (prop === 'then') return (f) => Promise.resolve(f(proxy));\n      if (prop === 'catch') return () => Promise.resolve(proxy);\n      if (prop === 'finally') return (f) => { f(); return Promise.resolve(proxy); };${diagGetTraps}\n      if (typeof prop === 'symbol') return undefined;\n      if (!(prop in children)) {\n        children[prop] = ${fnName}(name + '.' + prop);\n      }\n      return children[prop];\n    },\n    apply() {\n      ${applyBody}\n    },\n    construct() {\n      ${constructBody}\n    },${setTrap}\n  });\n  return proxy;\n}\nconst mock = /* @__PURE__ */ ${fnName}('mock');\nexport default mock;\n`\n}\n\nexport function loadSilentMockModule(): { code: string } {\n  return { code: generateMockCode() }\n}\n\n/**\n * Filter export names to valid, non-default names.\n */\nfunction filterExportNames(exports: ReadonlyArray<string>): Array<string> {\n  return exports.filter((n) => n.length > 0 && n !== 'default')\n}\n\n/**\n * Generate ESM export lines that re-export named properties from `mock`.\n *\n * Produces `export const foo = mock.foo;` for valid identifiers and\n * string-keyed re-exports for non-identifier names.\n */\nfunction generateExportLines(names: ReadonlyArray<string>): Array<string> {\n  const lines: Array<string> = []\n  const stringExports: Array<{ alias: string; name: string }> = []\n\n  for (let i = 0; i < names.length; i++) {\n    const n = names[i]!\n    if (isValidExportName(n)) {\n      lines.push(`export const ${n} = mock.${n};`)\n    } else {\n      const alias = `__tss_str_${i}`\n      lines.push(`const ${alias} = mock[${JSON.stringify(n)}];`)\n      stringExports.push({ alias, name: n })\n    }\n  }\n\n  if (stringExports.length > 0) {\n    const reexports = stringExports\n      .map((s) => `${s.alias} as ${JSON.stringify(s.name)}`)\n      .join(', ')\n    lines.push(`export { ${reexports} };`)\n  }\n\n  return lines\n}\n\n/**\n * Generate a self-contained mock module with explicit named exports.\n *\n * Used by the transform hook's \"self-denial\" check: when a denied file\n * (e.g. `.server.ts` in the client environment) is transformed, its entire\n * content is replaced with this mock module.  This avoids returning virtual\n * module IDs from `resolveId`, which prevents cross-environment cache\n * contamination from third-party resolver plugins.\n *\n * The generated code is side-effect-free and tree-shakeable.\n */\nexport function generateSelfContainedMockModule(exportNames: Array<string>): {\n  code: string\n} {\n  const mockCode = generateMockCode()\n  const exportLines = generateExportLines(filterExportNames(exportNames))\n\n  return {\n    code: `${mockCode}\n${exportLines.join('\\n')}\n`,\n  }\n}\n\n/**\n * Generate a dev-mode mock module for self-denial transforms.\n *\n * Similar to `loadMockEdgeModule` but takes export names and a runtime ID\n * directly (instead of parsing them from a base64url-encoded payload).\n * Used by the transform hook when a denied file (e.g. `.server.ts` in\n * the client environment) is replaced in dev mode.\n *\n * The generated module imports mock-runtime for runtime diagnostics\n * (error/warn on property access) and re-exports explicit named exports\n * so that `import { foo } from './denied.server'` works.\n */\nexport function generateDevSelfDenialModule(\n  exportNames: Array<string>,\n  runtimeId: string,\n): { code: string } {\n  const names = filterExportNames(exportNames)\n  const exportLines = generateExportLines(names)\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockEdgeModule(encodedPayload: string): { code: string } {\n  let payload: { exports?: Array<string>; runtimeId?: string }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = { exports: [] }\n  }\n  const names = filterExportNames(payload.exports ?? [])\n\n  const runtimeId: string =\n    typeof payload.runtimeId === 'string' && payload.runtimeId.length > 0\n      ? payload.runtimeId\n      : MOCK_MODULE_ID\n\n  const exportLines = generateExportLines(names)\n\n  return {\n    code: `import mock from ${JSON.stringify(runtimeId)};\n${exportLines.join('\\n')}\nexport default mock;\n`,\n  }\n}\n\nexport function loadMockRuntimeModule(encodedPayload: string): {\n  code: string\n} {\n  let payload: {\n    mode?: string\n    env?: string\n    importer?: string\n    specifier?: string\n    trace?: Array<unknown>\n  }\n  try {\n    payload = JSON.parse(fromBase64Url(encodedPayload)) as typeof payload\n  } catch {\n    payload = {}\n  }\n\n  const mode: 'error' | 'warn' | 'off' =\n    payload.mode === 'warn' || payload.mode === 'off' ? payload.mode : 'error'\n\n  const meta = {\n    env: String(payload.env ?? ''),\n    importer: String(payload.importer ?? ''),\n    specifier: String(payload.specifier ?? ''),\n    trace: Array.isArray(payload.trace) ? payload.trace : [],\n  }\n\n  return { code: generateMockCode({ meta, mode }) }\n}\n\nconst MARKER_MODULE_RESULT = { code: 'export {}' } as const\n\nexport function loadMarkerModule(): { code: string } {\n  return MARKER_MODULE_RESULT\n}\n\nexport function loadResolvedVirtualModule(\n  id: string,\n): { code: string } | undefined {\n  if (id === RESOLVED_MOCK_MODULE_ID) {\n    return loadSilentMockModule()\n  }\n\n  // Per-violation build mock modules — same silent mock code\n  if (id.startsWith(RESOLVED_MOCK_BUILD_PREFIX)) {\n    return loadSilentMockModule()\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_EDGE_PREFIX)) {\n    return loadMockEdgeModule(id.slice(RESOLVED_MOCK_EDGE_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MOCK_RUNTIME_PREFIX)) {\n    return loadMockRuntimeModule(id.slice(RESOLVED_MOCK_RUNTIME_PREFIX.length))\n  }\n\n  if (id.startsWith(RESOLVED_MARKER_PREFIX)) {\n    return loadMarkerModule()\n  }\n\n  return undefined\n}\n"],"names":[],"mappings":";;;;;;AAQO,MAAM,iBAAiB;AAC9B,MAAM,0BAA0B,cAAc,cAAc;AAOrD,MAAM,oBAAoB;AACjC,MAAM,6BAA6B,cAAc,iBAAiB;AAE3D,MAAM,mBAAmB;AAChC,MAAM,4BAA4B,cAAc,gBAAgB;AAEzD,MAAM,sBACX;AACF,MAAM,+BAA+B,cAAc,mBAAmB;AAEtE,MAAM,gBAAgB;AACtB,MAAM,yBAAyB,cAAc,aAAa;AAE1D,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAC/E,MAAM,8BAA8B,cAAc,GAAG,aAAa,aAAa;AAExE,SAAS,8BACd,MACQ;AACR,SAAO,SAAS,WACZ,8BACA;AACN;AAQO,SAAS,mCAA0D;AACxE,SAAO;AACT;AAEA,MAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,uBAAuB;AAAA,EAC3B,CAAC,kBAAkB,yBAAyB;AAAA,EAC5C,CAAC,qBAAqB,4BAA4B;AAAA,EAClD,CAAC,mBAAmB,0BAA0B;AAAA,EAC9C,CAAC,eAAe,sBAAsB;AACxC;AAQO,SAAS,+BACd,QACoB;AACpB,MAAI,OAAO,WAAW,2BAA2B,GAAG;AAClD,WAAO;AAAA,MACL,KAAK,OAAO,MAAM,4BAA4B,MAAM,CAAC;AAAA,IAAA;AAAA,EAEzD;AAEA,MAAI,WAAW,kBAAkB,WAAW,yBAAyB;AACnE,WAAO;AAAA,EACT;AAEA,aAAW,CAAC,kBAAkB,cAAc,KAAK,sBAAsB;AACrE,QAAI,OAAO,WAAW,gBAAgB,GAAG;AACvC,aAAO,cAAc,MAAM;AAAA,IAC7B;AAEA,QAAI,OAAO,WAAW,cAAc,GAAG;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAQO,MAAM,0BACX,UACA,uBAAuB,KAAK,IAAI,IAChC;AAEK,SAAS,iCACd,MACA,MACA,MACQ;AACR,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,QAAQ,uBAAuB,OAAQ,QAAO;AAEvD,QAAM,MAAM,CAAC,MAAc,eAAe,GAAG,IAAI;AACjD,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;AAClC,UAAM,OAAO,IAAI,EAAE,IAAI;AACvB,QAAI,EAAE,QAAQ,KAAM,QAAO;AAC3B,WAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,EAC3C,CAAC;AAED,QAAM,UAAU;AAAA,IACd,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,GAAG,mBAAmB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACtE;AAEO,SAAS,qBACd,SACA,WACQ;AACR,QAAM,UAAU,EAAE,SAAS,UAAA;AAC3B,SAAO,GAAG,gBAAgB,GAAG,YAAY,KAAK,UAAU,OAAO,CAAC,CAAC;AACnE;AAaA,SAAS,iBAAiB,aAQf;AACT,QAAM,SAAS,cAAc,iBAAiB;AAC9C,QAAM,UAAU,CAAC,CAAC;AAElB,QAAM,WAAW,UACb,kBAAkB,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA,iBACvC,KAAK,UAAU,YAAY,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAmBhC,KAAK,UAAU,uBAAuB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlD;AAGJ,QAAM,eAAe,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAaA;AAEJ,QAAM,YAAY,UACd;AAAA,eACS,MAAM,mBACf,UAAU,MAAM;AAEpB,QAAM,gBAAgB,UAClB;AAAA,eACS,MAAM,qBACf,UAAU,MAAM;AAEpB,QAAM,UAAU,UACZ;AAAA;AAAA;AAAA;AAAA,UAKA;AAEJ,SAAO;AAAA,EACP,QAAQ;AAAA,WACC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sFAWqE,YAAY;AAAA;AAAA;AAAA,2BAGvE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,QAKzB,SAAS;AAAA;AAAA;AAAA,QAGT,aAAa;AAAA,QACb,OAAO;AAAA;AAAA;AAAA;AAAA,+BAIgB,MAAM;AAAA;AAAA;AAGrC;AAEO,SAAS,uBAAyC;AACvD,SAAO,EAAE,MAAM,mBAAiB;AAClC;AAKA,SAAS,kBAAkB,SAA+C;AACxE,SAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,SAAS;AAC9D;AAQA,SAAS,oBAAoB,OAA6C;AACxE,QAAM,QAAuB,CAAA;AAC7B,QAAM,gBAAwD,CAAA;AAE9D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,kBAAkB,CAAC,GAAG;AACxB,YAAM,KAAK,gBAAgB,CAAC,WAAW,CAAC,GAAG;AAAA,IAC7C,OAAO;AACL,YAAM,QAAQ,aAAa,CAAC;AAC5B,YAAM,KAAK,SAAS,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,IAAI;AACzD,oBAAc,KAAK,EAAE,OAAO,MAAM,GAAG;AAAA,IACvC;AAAA,EACF;AAEA,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,YAAY,cACf,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE,EACpD,KAAK,IAAI;AACZ,UAAM,KAAK,YAAY,SAAS,KAAK;AAAA,EACvC;AAEA,SAAO;AACT;AAaO,SAAS,gCAAgC,aAE9C;AACA,QAAM,WAAW,iBAAA;AACjB,QAAM,cAAc,oBAAoB,kBAAkB,WAAW,CAAC;AAEtE,SAAO;AAAA,IACL,MAAM,GAAG,QAAQ;AAAA,EACnB,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA,EAAA;AAGxB;AAcO,SAAS,4BACd,aACA,WACkB;AAClB,QAAM,QAAQ,kBAAkB,WAAW;AAC3C,QAAM,cAAc,oBAAoB,KAAK;AAE7C,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,mBAAmB,gBAA0C;AAC3E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,EAAE,SAAS,GAAC;AAAA,EACxB;AACA,QAAM,QAAQ,kBAAkB,QAAQ,WAAW,CAAA,CAAE;AAErD,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR;AAEN,QAAM,cAAc,oBAAoB,KAAK;AAE7C,SAAO;AAAA,IACL,MAAM,oBAAoB,KAAK,UAAU,SAAS,CAAC;AAAA,EACrD,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAAA;AAIxB;AAEO,SAAS,sBAAsB,gBAEpC;AACA,MAAI;AAOJ,MAAI;AACF,cAAU,KAAK,MAAM,cAAc,cAAc,CAAC;AAAA,EACpD,QAAQ;AACN,cAAU,CAAA;AAAA,EACZ;AAEA,QAAM,OACJ,QAAQ,SAAS,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AAErE,QAAM,OAAO;AAAA,IACX,KAAK,OAAO,QAAQ,OAAO,EAAE;AAAA,IAC7B,UAAU,OAAO,QAAQ,YAAY,EAAE;AAAA,IACvC,WAAW,OAAO,QAAQ,aAAa,EAAE;AAAA,IACzC,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAA;AAAA,EAAC;AAGzD,SAAO,EAAE,MAAM,iBAAiB,EAAE,MAAM,KAAA,CAAM,EAAA;AAChD;AAEA,MAAM,uBAAuB,EAAE,MAAM,YAAA;AAE9B,SAAS,mBAAqC;AACnD,SAAO;AACT;AAEO,SAAS,0BACd,IAC8B;AAC9B,MAAI,OAAO,yBAAyB;AAClC,WAAO,qBAAA;AAAA,EACT;AAGA,MAAI,GAAG,WAAW,0BAA0B,GAAG;AAC7C,WAAO,qBAAA;AAAA,EACT;AAEA,MAAI,GAAG,WAAW,yBAAyB,GAAG;AAC5C,WAAO,mBAAmB,GAAG,MAAM,0BAA0B,MAAM,CAAC;AAAA,EACtE;AAEA,MAAI,GAAG,WAAW,4BAA4B,GAAG;AAC/C,WAAO,sBAAsB,GAAG,MAAM,6BAA6B,MAAM,CAAC;AAAA,EAC5E;AAEA,MAAI,GAAG,WAAW,sBAAsB,GAAG;AACzC,WAAO,iBAAA;AAAA,EACT;AAEA,SAAO;AACT;"}

package/dist/esm/start-compiler-plugin/plugin.d.ts

@@ -1,7 +1,8 @@
+import { SERVER_FN_LOOKUP } from '../constants.js';
 import { CompileStartFrameworkOptions } from '../types.js';
 import { GenerateFunctionIdFnOptional } from './types.js';
 import { PluginOption } from 'vite';
-export declare const SERVER_FN_LOOKUP = "server-fn-module-lookup";
+export { SERVER_FN_LOOKUP };
 export interface StartCompilerPluginOptions {
     framework: CompileStartFrameworkOptions;
     environments: Array<{

package/dist/esm/start-compiler-plugin/plugin.js

@@ -1,7 +1,7 @@
 import assert from "node:assert";
 import { VIRTUAL_MODULES } from "@tanstack/start-server-core";
 import { resolve } from "pathe";
-import { VITE_ENVIRONMENT_NAMES, TRANSFORM_ID_REGEX } from "../constants.js";
+import { VITE_ENVIRONMENT_NAMES, SERVER_FN_LOOKUP, TRANSFORM_ID_REGEX } from "../constants.js";
 import { StartCompiler, LookupKindsPerEnv, detectKindsInCode, KindDetectionPatterns } from "./compiler.js";
 import { cleanId } from "./utils.js";
 function getTransformCodeFilterForEnv(env) {
@@ -62,7 +62,6 @@ const getLookupConfigurationsForEnv = (env, framework) => {
     ];
   }
 };
-const SERVER_FN_LOOKUP = "server-fn-module-lookup";
 function resolveViteId(id) {
   return `\0${id}`;
 }