@tanstack/start-plugin-core 1.166.11 → 1.166.13

package/dist/esm/import-protection-plugin/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sources":["../../../src/import-protection-plugin/plugin.ts"],"sourcesContent":["import { normalizePath } from 'vite'\n\nimport { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { ImportGraph, buildTrace, formatViolation } from './trace'\nimport {\n  getDefaultImportProtectionRules,\n  getMarkerSpecifiers,\n} from './defaults'\nimport { compileMatchers, matchesAny } from './matchers'\nimport {\n  buildResolutionCandidates,\n  buildSourceCandidates,\n  canonicalizeResolvedId,\n  clearNormalizeFilePathCache,\n  debugLog,\n  dedupePatterns,\n  escapeRegExp,\n  extractImportSources,\n  getOrCreate,\n  isInsideDirectory,\n  matchesDebugFilter,\n  normalizeFilePath,\n  relativizePath,\n  shouldDeferViolation,\n} from './utils'\nimport {\n  collectMockExportNamesBySource,\n  collectNamedExports,\n  rewriteDeniedImports,\n} from './rewriteDeniedImports'\nimport {\n  MOCK_BUILD_PREFIX,\n  generateDevSelfDenialModule,\n  generateSelfContainedMockModule,\n  getResolvedVirtualModuleMatchers,\n  loadResolvedVirtualModule,\n  makeMockEdgeModuleId,\n  mockRuntimeModuleIdFromViolation,\n  resolveInternalVirtualModuleId,\n  resolvedMarkerVirtualModuleId,\n} from './virtualModules'\nimport { ExtensionlessAbsoluteIdResolver } from './extensionlessAbsoluteIdResolver'\nimport {\n  IMPORT_PROTECTION_DEBUG,\n  SERVER_FN_LOOKUP_QUERY,\n  VITE_BROWSER_VIRTUAL_PREFIX,\n} from './constants'\nimport {\n  ImportLocCache,\n  addTraceImportLocations,\n  buildCodeSnippet,\n  buildLineIndex,\n  findImportStatementLocationFromTransformed,\n  findPostCompileUsageLocation,\n  pickOriginalCodeFromSourcesContent,\n} from './sourceLocation'\nimport type { PluginOption, ViteDevServer } from 'vite'\nimport type { CompiledMatcher } from './matchers'\nimport type { Loc, TraceStep, ViolationInfo } from './trace'\nimport type {\n  SourceMapLike,\n  TransformResult,\n  TransformResultProvider,\n} from './sourceLocation'\nimport type { ImportProtectionOptions } from '../schema'\nimport type {\n  EnvRules,\n  EnvState,\n  HandleViolationResult,\n  ImportProtectionPluginOptions,\n  ModuleGraphNode,\n  PendingViolation,\n  PluginConfig,\n  SharedState,\n  ViolationReporter,\n} from './types'\n\nexport type { ImportProtectionPluginOptions } from './types'\n\nexport function importProtectionPlugin(\n  opts: ImportProtectionPluginOptions,\n): PluginOption {\n  let devServer: ViteDevServer | null = null\n  const extensionlessIdResolver = new ExtensionlessAbsoluteIdResolver()\n  const resolveExtensionlessAbsoluteId = (id: string) =>\n    extensionlessIdResolver.resolve(id)\n\n  const importPatternCache = new Map<string, Array<RegExp>>()\n\n  function findFirstImportSpecifierIndex(code: string, source: string): number {\n    let patterns = importPatternCache.get(source)\n    if (!patterns) {\n      const escaped = escapeRegExp(source)\n      patterns = [\n        new RegExp(`\\\\bimport\\\\s+(['\"])${escaped}\\\\1`),\n        new RegExp(`\\\\bfrom\\\\s+(['\"])${escaped}\\\\1`),\n        new RegExp(`\\\\bimport\\\\s*\\\\(\\\\s*(['\"])${escaped}\\\\1\\\\s*\\\\)`),\n      ]\n      importPatternCache.set(source, patterns)\n    }\n\n    let best = -1\n    for (const re of patterns) {\n      const m = re.exec(code)\n      if (!m) continue\n      const idx = m.index + m[0].indexOf(source)\n      if (idx === -1) continue\n      if (best === -1 || idx < best) best = idx\n    }\n    return best\n  }\n\n  /**\n   * Build an import trace using Vite's per-environment module graph, which\n   * is authoritative even on warm starts when the plugin's own ImportGraph\n   * may be incomplete (Vite skips resolveId for cached modules).\n   */\n  function buildTraceFromModuleGraph(\n    envName: string,\n    env: EnvState,\n    targetFile: string,\n  ): Array<TraceStep> | null {\n    if (!devServer) return null\n    const environment = devServer.environments[envName]\n    if (!environment) return null\n\n    const file = normalizeFilePath(targetFile)\n    const start = environment.moduleGraph.getModuleById(file)\n    if (!start) return null\n\n    // Resolve a module graph node to its normalized file path once and\n    // cache the result so BFS + reconstruction don't recompute.\n    const nodeIds = new Map<ModuleGraphNode, string>()\n    function nodeId(n: ModuleGraphNode): string {\n      let cached = nodeIds.get(n)\n      if (cached === undefined) {\n        cached = n.id\n          ? normalizeFilePath(n.id)\n          : n.url\n            ? normalizeFilePath(n.url)\n            : ''\n        nodeIds.set(n, cached)\n      }\n      return cached\n    }\n\n    const queue: Array<ModuleGraphNode> = [start]\n    const visited = new Set<ModuleGraphNode>([start])\n    const parent = new Map<ModuleGraphNode, ModuleGraphNode>()\n\n    let entryRoot: ModuleGraphNode | null = null\n    let fallbackRoot: ModuleGraphNode | null = null\n    let qi = 0\n    while (qi < queue.length) {\n      const node = queue[qi++]!\n      const id = nodeId(node)\n\n      if (id && env.graph.entries.has(id)) {\n        entryRoot = node\n        break\n      }\n\n      const importers = node.importers\n      if (importers.size === 0) {\n        if (!fallbackRoot) fallbackRoot = node\n        continue\n      }\n\n      for (const imp of importers) {\n        if (visited.has(imp)) continue\n        visited.add(imp)\n        parent.set(imp, node)\n        queue.push(imp)\n      }\n    }\n\n    const root = entryRoot ?? fallbackRoot\n\n    if (!root) return null\n\n    // Reconstruct: root -> ... -> start\n    const chain: Array<ModuleGraphNode> = []\n    let cur: ModuleGraphNode | undefined = root\n    for (let i = 0; i < config.maxTraceDepth + 2 && cur; i++) {\n      chain.push(cur)\n      if (cur === start) break\n      cur = parent.get(cur)\n    }\n\n    const steps: Array<TraceStep> = []\n    for (let i = 0; i < chain.length; i++) {\n      const id = nodeId(chain[i]!)\n      if (!id) continue\n      let specifier: string | undefined\n      if (i + 1 < chain.length) {\n        const nextId = nodeId(chain[i + 1]!)\n        if (nextId) {\n          specifier = env.graph.reverseEdges.get(nextId)?.get(id)\n        }\n      }\n      steps.push(specifier ? { file: id, specifier } : { file: id })\n    }\n\n    return steps.length ? steps : null\n  }\n\n  const config: PluginConfig = {\n    enabled: true,\n    root: '',\n    command: 'build',\n    srcDirectory: '',\n    framework: opts.framework,\n    effectiveBehavior: 'error',\n    mockAccess: 'error',\n    logMode: 'once',\n    maxTraceDepth: 20,\n    compiledRules: {\n      client: { specifiers: [], files: [], excludeFiles: [] },\n      server: { specifiers: [], files: [], excludeFiles: [] },\n    },\n    includeMatchers: [],\n    excludeMatchers: [],\n    ignoreImporterMatchers: [],\n    markerSpecifiers: { serverOnly: new Set(), clientOnly: new Set() },\n    envTypeMap: new Map(opts.environments.map((e) => [e.name, e.type])),\n    onViolation: undefined,\n  }\n\n  const envStates = new Map<string, EnvState>()\n  const shared: SharedState = { fileMarkerKind: new Map() }\n\n  /**\n   * Build the best available trace for a module and enrich each step with\n   * line/column locations.  Tries the plugin's own ImportGraph first, then\n   * Vite's moduleGraph (authoritative on warm start), keeping whichever is\n   * longer.  Annotates the last step with the denied specifier + location.\n   *\n   * Shared by {@link buildViolationInfo} and {@link processPendingViolations}.\n   */\n  async function rebuildAndAnnotateTrace(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    normalizedImporter: string,\n    specifier: string,\n    importerLoc: Loc | undefined,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<Array<TraceStep>> {\n    let trace =\n      traceOverride ??\n      buildTrace(env.graph, normalizedImporter, config.maxTraceDepth)\n\n    if (config.command === 'serve') {\n      const mgTrace = buildTraceFromModuleGraph(\n        envName,\n        env,\n        normalizedImporter,\n      )\n      if (mgTrace && mgTrace.length > trace.length) {\n        trace = mgTrace\n      }\n    }\n    await addTraceImportLocations(\n      provider,\n      trace,\n      env.importLocCache,\n      findFirstImportSpecifierIndex,\n    )\n\n    if (trace.length > 0) {\n      const last = trace[trace.length - 1]!\n      if (!last.specifier) last.specifier = specifier\n      if (importerLoc && last.line == null) {\n        last.line = importerLoc.line\n        last.column = importerLoc.column\n      }\n    }\n\n    return trace\n  }\n\n  /**\n   * Build a complete {@link ViolationInfo} with trace, location, and snippet.\n   *\n   * This is the single path that all violation types go through: specifier,\n   * file, and marker.\n   */\n  async function buildViolationInfo(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    normalizedImporter: string,\n    source: string,\n    overrides: Omit<\n      ViolationInfo,\n      | 'env'\n      | 'envType'\n      | 'behavior'\n      | 'specifier'\n      | 'importer'\n      | 'trace'\n      | 'snippet'\n      | 'importerLoc'\n    >,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo> {\n    const sourceCandidates = buildSourceCandidates(\n      source,\n      'resolved' in overrides && typeof overrides.resolved === 'string'\n        ? overrides.resolved\n        : undefined,\n      config.root,\n    )\n\n    const loc = await resolveImporterLocation(\n      provider,\n      env,\n      importer,\n      sourceCandidates,\n    )\n\n    const trace = await rebuildAndAnnotateTrace(\n      provider,\n      env,\n      envName,\n      normalizedImporter,\n      source,\n      loc,\n      traceOverride,\n    )\n\n    const snippet = loc ? buildCodeSnippet(provider, importer, loc) : undefined\n\n    return {\n      env: envName,\n      envType,\n      behavior: config.effectiveBehavior,\n      specifier: source,\n      importer: normalizedImporter,\n      ...(loc ? { importerLoc: loc } : {}),\n      trace,\n      snippet,\n      ...overrides,\n    }\n  }\n\n  async function resolveImporterLocation(\n    provider: TransformResultProvider,\n    env: EnvState,\n    importer: string,\n    sourceCandidates: Iterable<string>,\n  ): Promise<Loc | undefined> {\n    for (const candidate of sourceCandidates) {\n      const loc =\n        (await findPostCompileUsageLocation(provider, importer, candidate)) ||\n        (await findImportStatementLocationFromTransformed(\n          provider,\n          importer,\n          candidate,\n          env.importLocCache,\n          findFirstImportSpecifierIndex,\n        ))\n      if (loc) return loc\n    }\n    return undefined\n  }\n\n  /**\n   * Check if a resolved import violates marker restrictions (e.g. importing\n   * a server-only module in the client env).  If so, build and return the\n   * {@link ViolationInfo} — the caller is responsible for reporting/deferring.\n   *\n   * Returns `undefined` when the resolved import has no marker conflict.\n   */\n  async function buildMarkerViolationFromResolvedImport(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    source: string,\n    resolvedId: string,\n    relativePath: string,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo | undefined> {\n    const normalizedResolvedId = normalizeFilePath(resolvedId)\n    const markerKind = shared.fileMarkerKind.get(normalizedResolvedId)\n    const violates =\n      (envType === 'client' && markerKind === 'server') ||\n      (envType === 'server' && markerKind === 'client')\n    if (!violates) return undefined\n\n    const normalizedImporter = normalizeFilePath(importer)\n\n    return buildViolationInfo(\n      provider,\n      env,\n      envName,\n      envType,\n      importer,\n      normalizedImporter,\n      source,\n      {\n        type: 'marker',\n        resolved: normalizedResolvedId,\n        message: buildMarkerViolationMessage(relativePath, markerKind),\n      },\n      traceOverride,\n    )\n  }\n\n  function buildMarkerViolationMessage(\n    relativePath: string,\n    markerKind: 'server' | 'client' | undefined,\n  ): string {\n    return markerKind === 'server'\n      ? `Module \"${relativePath}\" is marked server-only but is imported in the client environment`\n      : `Module \"${relativePath}\" is marked client-only but is imported in the server environment`\n  }\n\n  async function buildFileViolationInfo(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    normalizedImporter: string,\n    source: string,\n    resolvedPath: string,\n    pattern: string | RegExp,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo> {\n    const relativePath = getRelativePath(resolvedPath)\n\n    return buildViolationInfo(\n      provider,\n      env,\n      envName,\n      envType,\n      importer,\n      normalizedImporter,\n      source,\n      {\n        type: 'file',\n        pattern,\n        resolved: resolvedPath,\n        message: `Import \"${source}\" (resolved to \"${relativePath}\") is denied in the ${envType} environment`,\n      },\n      traceOverride,\n    )\n  }\n\n  function getEnvType(envName: string): 'client' | 'server' {\n    return config.envTypeMap.get(envName) ?? 'server'\n  }\n\n  function getRulesForEnvironment(envName: string): EnvRules {\n    const type = getEnvType(envName)\n    return type === 'client'\n      ? config.compiledRules.client\n      : config.compiledRules.server\n  }\n\n  /**\n   * Check if a relative path matches any denied file pattern for the given\n   * environment, respecting `excludeFiles`.  Returns the matching pattern\n   * or `undefined` if the file is not denied.\n   */\n  function checkFileDenial(\n    relativePath: string,\n    matchers: {\n      files: Array<CompiledMatcher>\n      excludeFiles: Array<CompiledMatcher>\n    },\n  ): CompiledMatcher | undefined {\n    if (\n      matchers.excludeFiles.length > 0 &&\n      matchesAny(relativePath, matchers.excludeFiles)\n    ) {\n      return undefined\n    }\n    return matchers.files.length > 0\n      ? matchesAny(relativePath, matchers.files)\n      : undefined\n  }\n\n  const environmentNames = new Set<string>([\n    VITE_ENVIRONMENT_NAMES.client,\n    VITE_ENVIRONMENT_NAMES.server,\n  ])\n  if (opts.providerEnvName !== VITE_ENVIRONMENT_NAMES.server) {\n    environmentNames.add(opts.providerEnvName)\n  }\n\n  /** Get (or lazily create) the per-env state for the given environment name. */\n  function getEnv(envName: string): EnvState {\n    let envState = envStates.get(envName)\n    if (!envState) {\n      const transformResultCache = new Map<string, TransformResult>()\n      envState = {\n        graph: new ImportGraph(),\n        mockExportsByImporter: new Map(),\n        resolveCache: new Map(),\n        resolveCacheByFile: new Map(),\n        importLocCache: new ImportLocCache(),\n        seenViolations: new Set(),\n        transformResultCache,\n        transformResultKeysByFile: new Map(),\n        transformResultProvider: {\n          getTransformResult(id: string) {\n            const fullKey = normalizePath(id)\n            const exact = transformResultCache.get(fullKey)\n            if (exact) return exact\n            const strippedKey = normalizeFilePath(id)\n            return strippedKey !== fullKey\n              ? transformResultCache.get(strippedKey)\n              : undefined\n          },\n        },\n        postTransformImports: new Map(),\n        serverFnLookupModules: new Set(),\n        pendingViolations: new Map(),\n        deferredBuildViolations: [],\n      }\n      envStates.set(envName, envState)\n    }\n    return envState\n  }\n\n  /**\n   * Search a parsed export-names map for an entry matching any of the\n   * specifier candidates.  Returns matching names or empty array.\n   */\n  function findExportsInMap(\n    exportMap: Map<string, Array<string>>,\n    candidates: Array<string>,\n  ): Array<string> {\n    for (const candidate of candidates) {\n      const hit = exportMap.get(candidate)\n      if (hit && hit.length > 0) return hit\n    }\n    return []\n  }\n\n  /**\n   * Build deduped resolution candidates for a module ID, including the\n   * extensionless absolute path when the ID looks like a file path.\n   */\n  function buildIdCandidates(id: string, extra?: string): Array<string> {\n    const set = new Set(buildResolutionCandidates(id))\n    if (extra) {\n      for (const c of buildResolutionCandidates(extra)) set.add(c)\n      set.add(resolveExtensionlessAbsoluteId(extra))\n    }\n    return Array.from(set)\n  }\n\n  /**\n   * Resolve which named exports the importer needs from a denied specifier,\n   * so mock-edge modules can provide explicit ESM named exports.\n   *\n   * Tries multiple strategies: cached export maps, AST parsing, and\n   * resolver-based comparison.\n   */\n  async function resolveExportsForDeniedSpecifier(\n    env: EnvState,\n    ctx: ViolationReporter,\n    info: ViolationInfo,\n    importerIdHint?: string,\n  ): Promise<Array<string>> {\n    const importerFile = normalizeFilePath(info.importer)\n    const specifierCandidates = buildIdCandidates(info.specifier, info.resolved)\n\n    // Only parse AST when a violation occurs (this function is only called\n    // while handling a violation). Cache per-importer to avoid repeated parses\n    // across multiple violations.\n    let parsedBySource = env.mockExportsByImporter.get(importerFile)\n    if (!parsedBySource) {\n      // Try transform-cache result first, then moduleInfo fallback.\n      const importerCode =\n        env.transformResultProvider.getTransformResult(importerFile)?.code ??\n        (importerIdHint && ctx.getModuleInfo\n          ? (ctx.getModuleInfo(importerIdHint)?.code ?? undefined)\n          : undefined)\n      if (typeof importerCode !== 'string' || importerCode.length === 0)\n        return []\n\n      try {\n        parsedBySource = collectMockExportNamesBySource(importerCode)\n\n        // Also index by resolved physical IDs so later lookups match.\n        await recordMockExportsForImporter(\n          env,\n          importerFile,\n          parsedBySource,\n          async (src) => {\n            const cacheKey = `${importerFile}:${src}`\n            if (env.resolveCache.has(cacheKey)) {\n              return env.resolveCache.get(cacheKey) ?? undefined\n            }\n            if (!ctx.resolve) return undefined\n            const resolved = await ctx.resolve(src, info.importer, {\n              skipSelf: true,\n            })\n            if (!resolved || resolved.external) return undefined\n            return resolved.id\n          },\n        )\n\n        // Keep the parsed-by-source map for direct lookups.\n        parsedBySource =\n          env.mockExportsByImporter.get(importerFile) ?? parsedBySource\n      } catch {\n        return []\n      }\n    }\n\n    // 1. Direct candidate match\n    const direct = findExportsInMap(parsedBySource, specifierCandidates)\n    if (direct.length > 0) return direct\n\n    // 2. Resolve each source key and compare candidates.\n    const candidateSet = new Set(specifierCandidates)\n    for (const [sourceKey, names] of parsedBySource) {\n      if (!names.length) continue\n\n      const resolvedId = await resolveSourceKey(\n        env,\n        ctx,\n        importerFile,\n        sourceKey,\n        info.importer,\n      )\n      if (!resolvedId) continue\n\n      const resolvedCandidates = buildIdCandidates(resolvedId)\n      resolvedCandidates.push(resolveExtensionlessAbsoluteId(resolvedId))\n      if (resolvedCandidates.some((v) => candidateSet.has(v))) {\n        return names\n      }\n    }\n\n    return []\n  }\n\n  /** Best-effort resolve a source key using the cache or ctx.resolve. */\n  async function resolveSourceKey(\n    env: EnvState,\n    ctx: ViolationReporter,\n    importerFile: string,\n    sourceKey: string,\n    importerId: string,\n  ): Promise<string | undefined> {\n    const cacheKey = `${importerFile}:${sourceKey}`\n    if (env.resolveCache.has(cacheKey)) {\n      return env.resolveCache.get(cacheKey) ?? undefined\n    }\n    if (!ctx.resolve) return undefined\n    try {\n      const resolved = await ctx.resolve(sourceKey, importerId, {\n        skipSelf: true,\n      })\n      if (!resolved || resolved.external) return undefined\n      return resolved.id\n    } catch {\n      return undefined\n    }\n  }\n\n  async function recordMockExportsForImporter(\n    env: EnvState,\n    importerId: string,\n    namesBySource: Map<string, Array<string>>,\n    resolveSource: (source: string) => Promise<string | undefined>,\n  ): Promise<void> {\n    const importerFile = normalizeFilePath(importerId)\n\n    if (namesBySource.size === 0) return\n\n    for (const [source, names] of namesBySource) {\n      try {\n        const resolvedId = await resolveSource(source)\n        if (!resolvedId) continue\n\n        namesBySource.set(normalizeFilePath(resolvedId), names)\n        namesBySource.set(resolveExtensionlessAbsoluteId(resolvedId), names)\n      } catch {\n        // Best-effort only\n      }\n    }\n\n    const existing = env.mockExportsByImporter.get(importerFile)\n    if (!existing) {\n      env.mockExportsByImporter.set(importerFile, namesBySource)\n      return\n    }\n\n    for (const [source, names] of namesBySource) {\n      const prev = existing.get(source)\n      if (!prev) {\n        existing.set(source, names)\n        continue\n      }\n\n      const union = new Set([...prev, ...names])\n      existing.set(source, Array.from(union).sort())\n    }\n  }\n\n  const shouldCheckImporterCache = new Map<string, boolean>()\n  function shouldCheckImporter(importer: string): boolean {\n    let result = shouldCheckImporterCache.get(importer)\n    if (result !== undefined) return result\n\n    const relativePath = relativizePath(importer, config.root)\n\n    // Excluded or ignored importers are never checked.\n    const excluded =\n      (config.excludeMatchers.length > 0 &&\n        matchesAny(relativePath, config.excludeMatchers)) ||\n      (config.ignoreImporterMatchers.length > 0 &&\n        matchesAny(relativePath, config.ignoreImporterMatchers))\n\n    if (excluded) {\n      result = false\n    } else if (config.includeMatchers.length > 0) {\n      result = !!matchesAny(relativePath, config.includeMatchers)\n    } else if (config.srcDirectory) {\n      result = isInsideDirectory(importer, config.srcDirectory)\n    } else {\n      result = true\n    }\n\n    shouldCheckImporterCache.set(importer, result)\n    return result\n  }\n\n  function dedupeKey(info: ViolationInfo): string {\n    return `${info.type}:${info.importer}:${info.specifier}:${info.resolved ?? ''}`\n  }\n\n  function hasSeen(env: EnvState, key: string): boolean {\n    if (config.logMode === 'always') return false\n    if (env.seenViolations.has(key)) return true\n    env.seenViolations.add(key)\n    return false\n  }\n\n  function getRelativePath(absolutePath: string): string {\n    return relativizePath(normalizePath(absolutePath), config.root)\n  }\n\n  /** Reset all caches on an EnvState (called from buildStart). */\n  function clearEnvState(envState: EnvState): void {\n    envState.resolveCache.clear()\n    envState.resolveCacheByFile.clear()\n    envState.importLocCache.clear()\n    envState.seenViolations.clear()\n    envState.transformResultCache.clear()\n    envState.transformResultKeysByFile.clear()\n    envState.postTransformImports.clear()\n    envState.serverFnLookupModules.clear()\n    envState.pendingViolations.clear()\n    envState.deferredBuildViolations.length = 0\n    envState.graph.clear()\n    envState.mockExportsByImporter.clear()\n  }\n\n  /** Invalidate all env-level caches that reference a specific file. */\n  function invalidateFileFromEnv(envState: EnvState, file: string): void {\n    envState.importLocCache.deleteByFile(file)\n\n    // Resolve cache (keyed \"importer:source\")\n    const resolveKeys = envState.resolveCacheByFile.get(file)\n    if (resolveKeys) {\n      for (const key of resolveKeys) envState.resolveCache.delete(key)\n      envState.resolveCacheByFile.delete(file)\n    }\n\n    envState.graph.invalidate(file)\n    envState.mockExportsByImporter.delete(file)\n    envState.serverFnLookupModules.delete(file)\n    envState.pendingViolations.delete(file)\n\n    // Transform result cache + post-transform imports\n    const transformKeys = envState.transformResultKeysByFile.get(file)\n    if (transformKeys) {\n      for (const key of transformKeys) {\n        envState.transformResultCache.delete(key)\n        envState.postTransformImports.delete(key)\n      }\n      envState.transformResultKeysByFile.delete(file)\n    } else {\n      envState.transformResultCache.delete(file)\n      envState.postTransformImports.delete(file)\n    }\n  }\n\n  /** Store a transform result under both the cacheKey and physical file path. */\n  function cacheTransformResult(\n    envState: EnvState,\n    file: string,\n    cacheKey: string,\n    result: TransformResult,\n  ): void {\n    envState.transformResultCache.set(cacheKey, result)\n    const keySet = getOrCreate(\n      envState.transformResultKeysByFile,\n      file,\n      () => new Set<string>(),\n    )\n    keySet.add(cacheKey)\n    if (cacheKey !== file) {\n      envState.transformResultCache.set(file, result)\n      keySet.add(file)\n    }\n  }\n\n  /** Register known Start entrypoints as trace roots for all environments. */\n  function registerEntries(): void {\n    const { resolvedStartConfig } = opts.getConfig()\n    for (const envDef of opts.environments) {\n      const envState = getEnv(envDef.name)\n      if (resolvedStartConfig.routerFilePath) {\n        envState.graph.addEntry(\n          normalizePath(resolvedStartConfig.routerFilePath),\n        )\n      }\n      if (resolvedStartConfig.startFilePath) {\n        envState.graph.addEntry(\n          normalizePath(resolvedStartConfig.startFilePath),\n        )\n      }\n    }\n  }\n\n  /**\n   * Get the merged set of post-transform imports for a file, checking all\n   * code-split variants.  Returns `null` if no post-transform data exists\n   * yet (transform hasn't run).\n   *\n   * Skips `SERVER_FN_LOOKUP` variants because they contain untransformed\n   * code — the Start compiler excludes them.\n   */\n  function getPostTransformImports(\n    env: EnvState,\n    file: string,\n  ): Set<string> | null {\n    const keySet = env.transformResultKeysByFile.get(file)\n    let merged: Set<string> | null = null\n\n    if (keySet) {\n      for (const k of keySet) {\n        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue\n        const imports = env.postTransformImports.get(k)\n        if (imports) {\n          if (!merged) merged = new Set(imports)\n          else for (const v of imports) merged.add(v)\n        }\n      }\n    }\n\n    // Fallback: direct file-path key\n    if (!merged) {\n      const imports = env.postTransformImports.get(file)\n      if (imports) merged = new Set(imports)\n    }\n\n    return merged\n  }\n\n  /**\n   * Check whether an import edge from `parent` to `target` survived\n   * post-transform compilation.\n   *\n   * Returns:\n   *   - `'live'`    — target appears in a non-lookup variant's post-transform imports\n   *   - `'dead'`    — post-transform data exists but target is absent (compiler stripped it)\n   *   - `'pending'` — transform ran but import data not yet posted\n   *   - `'no-data'` — transform never ran (warm-start cached module)\n   */\n  function checkEdgeLiveness(\n    env: EnvState,\n    parent: string,\n    target: string,\n  ): 'live' | 'dead' | 'pending' | 'no-data' {\n    const keySet = env.transformResultKeysByFile.get(parent)\n    let anyVariantCached = false\n\n    if (keySet) {\n      for (const k of keySet) {\n        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue\n        const imports = env.postTransformImports.get(k)\n        if (imports) {\n          anyVariantCached = true\n          if (imports.has(target)) return 'live'\n        }\n      }\n    }\n\n    if (!anyVariantCached) {\n      const imports = env.postTransformImports.get(parent)\n      if (imports) return imports.has(target) ? 'live' : 'dead'\n      const hasTransformResult =\n        env.transformResultCache.has(parent) ||\n        (keySet ? keySet.size > 0 : false)\n      return hasTransformResult ? 'pending' : 'no-data'\n    }\n\n    return 'dead'\n  }\n\n  function checkPostTransformReachability(\n    env: EnvState,\n    file: string,\n  ): 'reachable' | 'unreachable' | 'unknown' {\n    const visited = new Set<string>()\n    const queue: Array<string> = [file]\n    let hasUnknownEdge = false\n    let qi = 0\n\n    while (qi < queue.length) {\n      const current = queue[qi++]!\n      if (visited.has(current)) continue\n      visited.add(current)\n\n      if (env.graph.entries.has(current)) {\n        return 'reachable'\n      }\n\n      const importers = env.graph.reverseEdges.get(current)\n      if (!importers) continue\n\n      for (const [parent] of importers) {\n        if (visited.has(parent)) continue\n        const liveness = checkEdgeLiveness(env, parent, current)\n        if (liveness === 'live' || liveness === 'no-data') {\n          // Live edge or warm-start (no transform data) — follow it\n          queue.push(parent)\n        } else if (liveness === 'pending') {\n          hasUnknownEdge = true\n        }\n        // 'dead' — edge was stripped by compiler, skip\n      }\n    }\n\n    return hasUnknownEdge ? 'unknown' : 'unreachable'\n  }\n\n  /**\n   * Filter pending violations using edge-survival data.  Returns the subset\n   * of violations whose resolved import survived the Start compiler (or all\n   * violations when no post-transform data is available yet).\n   *\n   * Returns `undefined` when all violations were stripped or when we must wait\n   * for post-transform data before proceeding.\n   */\n  function filterEdgeSurvival(\n    env: EnvState,\n    file: string,\n    violations: Array<PendingViolation>,\n  ):\n    | { active: Array<PendingViolation>; edgeSurvivalApplied: boolean }\n    | 'all-stripped'\n    | 'await-transform' {\n    const postTransform = getPostTransformImports(env, file)\n\n    if (postTransform) {\n      const surviving = violations.filter(\n        (pv) => !pv.info.resolved || postTransform.has(pv.info.resolved),\n      )\n      if (surviving.length === 0) return 'all-stripped'\n      env.pendingViolations.set(file, surviving)\n      return { active: surviving, edgeSurvivalApplied: true }\n    }\n\n    // Pre-transform violations need edge-survival verification first.\n    if (violations.some((pv) => pv.fromPreTransformResolve)) {\n      return 'await-transform'\n    }\n\n    return { active: violations, edgeSurvivalApplied: false }\n  }\n\n  /**\n   * Process pending violations for the given environment.  Called from the\n   * transform-cache hook after each module transform is cached, because new\n   * transform data may allow us to confirm or discard pending violations.\n   *\n   * @param warnFn - `this.warn` from the transform hook context\n   */\n  async function processPendingViolations(\n    env: EnvState,\n    warnFn: (msg: string) => void,\n  ): Promise<void> {\n    if (env.pendingViolations.size === 0) return\n\n    const toDelete: Array<string> = []\n\n    for (const [file, violations] of env.pendingViolations) {\n      const filtered = filterEdgeSurvival(env, file, violations)\n\n      if (filtered === 'all-stripped') {\n        toDelete.push(file)\n        continue\n      }\n      if (filtered === 'await-transform') continue\n\n      const { active, edgeSurvivalApplied } = filtered\n\n      // Wait for entries before running reachability.  registerEntries()\n      // populates entries at buildStart; resolveId(!importer) may add more.\n      const status =\n        env.graph.entries.size > 0\n          ? checkPostTransformReachability(env, file)\n          : 'unknown'\n\n      if (status === 'reachable') {\n        for (const pv of active) {\n          await emitPendingViolation(env, warnFn, pv)\n        }\n        toDelete.push(file)\n      } else if (status === 'unreachable') {\n        toDelete.push(file)\n      } else if (config.command === 'serve') {\n        // 'unknown' reachability — some graph edges lack transform data.\n        // When edge-survival was applied, surviving violations are confirmed\n        // real.  Without it (warm start), emit conservatively.\n        let emittedAny = false\n        for (const pv of active) {\n          if (pv.fromPreTransformResolve) continue\n\n          const shouldEmit =\n            edgeSurvivalApplied ||\n            (pv.info.type === 'file' &&\n              !!pv.info.resolved &&\n              isInsideDirectory(pv.info.resolved, config.srcDirectory))\n\n          if (shouldEmit) {\n            emittedAny =\n              (await emitPendingViolation(env, warnFn, pv)) || emittedAny\n          }\n        }\n\n        if (emittedAny) {\n          toDelete.push(file)\n        }\n      }\n      // 'unknown' — keep pending for next transform-cache invocation.\n    }\n\n    for (const file of toDelete) {\n      env.pendingViolations.delete(file)\n    }\n  }\n\n  async function emitPendingViolation(\n    env: EnvState,\n    warnFn: (msg: string) => void,\n    pv: PendingViolation,\n  ): Promise<boolean> {\n    if (!pv.info.importerLoc) {\n      const sourceCandidates = buildSourceCandidates(\n        pv.info.specifier,\n        pv.info.resolved,\n        config.root,\n      )\n      const loc = await resolveImporterLocation(\n        env.transformResultProvider,\n        env,\n        pv.info.importer,\n        sourceCandidates,\n      )\n\n      if (loc) {\n        pv.info.importerLoc = loc\n        pv.info.snippet = buildCodeSnippet(\n          env.transformResultProvider,\n          pv.info.importer,\n          loc,\n        )\n      }\n    }\n\n    if (hasSeen(env, dedupeKey(pv.info))) {\n      return false\n    }\n\n    const freshTrace = await rebuildAndAnnotateTrace(\n      env.transformResultProvider,\n      env,\n      pv.info.env,\n      pv.info.importer,\n      pv.info.specifier,\n      pv.info.importerLoc,\n    )\n    if (freshTrace.length > pv.info.trace.length) {\n      pv.info.trace = freshTrace\n    }\n\n    if (config.onViolation) {\n      const result = await config.onViolation(pv.info)\n      if (result === false) return false\n    }\n\n    warnFn(formatViolation(pv.info, config.root))\n    return true\n  }\n\n  /**\n   * Record a violation as pending for later confirmation via graph\n   * reachability.  Called from `resolveId` when `shouldDefer` is true.\n   */\n  function deferViolation(\n    env: EnvState,\n    importerFile: string,\n    info: ViolationInfo,\n    isPreTransformResolve?: boolean,\n  ): void {\n    getOrCreate(env.pendingViolations, importerFile, () => []).push({\n      info,\n      fromPreTransformResolve: isPreTransformResolve,\n    })\n  }\n\n  /** Counter for generating unique per-violation mock module IDs in build mode. */\n  let buildViolationCounter = 0\n\n  async function handleViolation(\n    ctx: ViolationReporter,\n    env: EnvState,\n    info: ViolationInfo,\n    importerIdHint?: string,\n    violationOpts?: { silent?: boolean },\n  ): Promise<HandleViolationResult> {\n    if (!violationOpts?.silent) {\n      if (config.onViolation) {\n        const result = await config.onViolation(info)\n        if (result === false) return undefined\n      }\n\n      if (config.effectiveBehavior === 'error') {\n        // Dev+error: throw immediately.\n        // Always throw on error — do NOT deduplicate via hasSeen().\n        // Rollup may resolve the same specifier multiple times (e.g.\n        // commonjs--resolver's nested this.resolve() fires before\n        // getResolveStaticDependencyPromises). If we record the key\n        // on the first (nested) throw, the second (real) resolve\n        // silently returns undefined and the build succeeds — which\n        // is the bug this fixes.\n        //\n        // Build mode never reaches here — all build violations are\n        // deferred via shouldDefer and handled silently.\n        return ctx.error(formatViolation(info, config.root))\n      }\n\n      if (!hasSeen(env, dedupeKey(info))) {\n        ctx.warn(formatViolation(info, config.root))\n      }\n    } else if (\n      config.effectiveBehavior === 'error' &&\n      config.command !== 'build'\n    ) {\n      return undefined\n    }\n\n    // File violations: return resolved path — the self-denial transform\n    // will replace the file's content with a mock module.  This avoids\n    // virtual module IDs that could leak across environments via\n    // third-party resolver caches.\n    if (info.type === 'file') return info.resolved\n\n    // Non-file violations (specifier/marker): create mock-edge module.\n    // Dev mode uses a runtime diagnostics ID; build mode uses a unique\n    // per-violation ID so generateBundle can check tree-shaking survival.\n    const exports = await resolveExportsForDeniedSpecifier(\n      env,\n      ctx,\n      info,\n      importerIdHint,\n    )\n    const baseMockId =\n      config.command === 'serve'\n        ? mockRuntimeModuleIdFromViolation(info, config.mockAccess, config.root)\n        : `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`\n    return resolveViteId(makeMockEdgeModuleId(exports, baseMockId))\n  }\n\n  /**\n   * Unified violation dispatch: either defers or reports immediately.\n   *\n   * When `shouldDefer` is true (dev mock + build modes), calls\n   * `handleViolation` silently to obtain the mock module ID, then stores\n   * the violation for later verification:\n   *   - Dev mock mode: all violations are deferred to `pendingViolations`\n   *     for edge-survival and graph-reachability checking via\n   *     `processPendingViolations`.\n   *   - Build mode (mock + error): defers to `deferredBuildViolations` for\n   *     tree-shaking verification in `generateBundle`.\n   *\n   * Otherwise reports immediately (dev error mode).  Pre-transform\n   * resolves are silenced in error mode because they fire before the\n   * compiler runs and there is no deferred verification path.\n   *\n   * Returns the mock module ID / resolve result from `handleViolation`.\n   */\n  async function reportOrDeferViolation(\n    ctx: ViolationReporter,\n    env: EnvState,\n    importerFile: string,\n    importerIdHint: string | undefined,\n    info: ViolationInfo,\n    shouldDefer: boolean,\n    isPreTransformResolve: boolean,\n  ): Promise<HandleViolationResult> {\n    if (shouldDefer) {\n      const result = await handleViolation(ctx, env, info, importerIdHint, {\n        silent: true,\n      })\n\n      if (config.command === 'build') {\n        // Build mode: store for generateBundle tree-shaking check.\n        // The mock-edge module ID is returned as a plain string.\n        const mockId = result ?? ''\n        env.deferredBuildViolations.push({\n          info,\n          mockModuleId: mockId,\n          // For marker violations, check importer survival instead of mock.\n          checkModuleId: info.type === 'marker' ? info.importer : undefined,\n        })\n      } else {\n        // Dev mock: store for graph-reachability check.\n        deferViolation(env, importerFile, info, isPreTransformResolve)\n        await processPendingViolations(env, ctx.warn.bind(ctx))\n      }\n\n      return result\n    }\n\n    // Non-deferred path: dev error mode only.\n    // Pre-transform resolves are silenced because they fire before the\n    // compiler runs — imports inside `.server()` callbacks haven't been\n    // stripped yet and error mode has no deferred verification.\n    return handleViolation(ctx, env, info, importerIdHint, {\n      silent: isPreTransformResolve,\n    })\n  }\n\n  return [\n    {\n      name: 'tanstack-start-core:import-protection',\n      enforce: 'pre',\n\n      applyToEnvironment(env) {\n        if (!config.enabled) return false\n        // Start's environments are named `client` and `ssr` (not `server`), plus\n        // an optional serverFn provider environment (eg `rsc`) when configured.\n        return environmentNames.has(env.name)\n      },\n\n      configResolved(viteConfig) {\n        config.root = viteConfig.root\n        config.command = viteConfig.command\n\n        const { startConfig, resolvedStartConfig } = opts.getConfig()\n        config.srcDirectory = resolvedStartConfig.srcDirectory\n\n        const userOpts: ImportProtectionOptions | undefined =\n          startConfig.importProtection\n\n        if (userOpts?.enabled === false) {\n          config.enabled = false\n          return\n        }\n\n        config.enabled = true\n\n        const behavior = userOpts?.behavior\n        if (typeof behavior === 'string') {\n          config.effectiveBehavior = behavior\n        } else {\n          config.effectiveBehavior =\n            viteConfig.command === 'serve'\n              ? (behavior?.dev ?? 'mock')\n              : (behavior?.build ?? 'error')\n        }\n\n        config.logMode = userOpts?.log ?? 'once'\n        config.mockAccess = userOpts?.mockAccess ?? 'error'\n        config.maxTraceDepth = userOpts?.maxTraceDepth ?? 20\n        if (userOpts?.onViolation) {\n          const fn = userOpts.onViolation\n          config.onViolation = (info) => fn(info)\n        }\n\n        const defaults = getDefaultImportProtectionRules()\n        // Use user-provided patterns when available, otherwise defaults.\n        const pick = <T>(user: Array<T> | undefined, fallback: Array<T>) =>\n          user ? [...user] : [...fallback]\n\n        // Client specifier denies always include framework defaults even\n        // when the user provides a custom list.\n        const clientSpecifiers = dedupePatterns([\n          ...defaults.client.specifiers,\n          ...(userOpts?.client?.specifiers ?? []),\n        ])\n\n        config.compiledRules.client = {\n          specifiers: compileMatchers(clientSpecifiers),\n          files: compileMatchers(\n            pick(userOpts?.client?.files, defaults.client.files),\n          ),\n          excludeFiles: compileMatchers(\n            pick(userOpts?.client?.excludeFiles, defaults.client.excludeFiles),\n          ),\n        }\n        config.compiledRules.server = {\n          specifiers: compileMatchers(\n            dedupePatterns(\n              pick(userOpts?.server?.specifiers, defaults.server.specifiers),\n            ),\n          ),\n          files: compileMatchers(\n            pick(userOpts?.server?.files, defaults.server.files),\n          ),\n          excludeFiles: compileMatchers(\n            pick(userOpts?.server?.excludeFiles, defaults.server.excludeFiles),\n          ),\n        }\n\n        config.includeMatchers = compileMatchers(userOpts?.include ?? [])\n        config.excludeMatchers = compileMatchers(userOpts?.exclude ?? [])\n        config.ignoreImporterMatchers = compileMatchers(\n          userOpts?.ignoreImporters ?? [],\n        )\n\n        // Marker specifiers\n        const markers = getMarkerSpecifiers()\n        config.markerSpecifiers = {\n          serverOnly: new Set(markers.serverOnly),\n          clientOnly: new Set(markers.clientOnly),\n        }\n      },\n\n      configureServer(server) {\n        devServer = server\n      },\n\n      buildStart() {\n        if (!config.enabled) return\n        // Clear memoization caches that grow unboundedly across builds\n        clearNormalizeFilePathCache()\n        extensionlessIdResolver.clear()\n        importPatternCache.clear()\n        shouldCheckImporterCache.clear()\n\n        // Clear per-env caches\n        for (const envState of envStates.values()) {\n          clearEnvState(envState)\n        }\n\n        // Clear shared state\n        shared.fileMarkerKind.clear()\n\n        registerEntries()\n      },\n\n      hotUpdate(ctx) {\n        if (!config.enabled) return\n        // Invalidate caches for updated files\n        for (const mod of ctx.modules) {\n          if (mod.id) {\n            const id = mod.id\n            const importerFile = normalizeFilePath(id)\n\n            // Invalidate extensionless-resolution cache entries affected by this file.\n            extensionlessIdResolver.invalidateByFile(importerFile)\n            shared.fileMarkerKind.delete(importerFile)\n\n            // Invalidate per-env caches\n            for (const envState of envStates.values()) {\n              invalidateFileFromEnv(envState, importerFile)\n            }\n          }\n        }\n      },\n\n      async resolveId(source, importer, _options) {\n        const envName = this.environment.name\n        const env = getEnv(envName)\n        const envType = getEnvType(envName)\n        const provider = env.transformResultProvider\n        const isScanResolve = !!(_options as Record<string, unknown>).scan\n\n        if (IMPORT_PROTECTION_DEBUG) {\n          const importerPath = importer\n            ? normalizeFilePath(importer)\n            : '(entry)'\n          const isEntryResolve = !importer\n          const filtered =\n            process.env.TSR_IMPORT_PROTECTION_DEBUG_FILTER === 'entry'\n              ? isEntryResolve\n              : matchesDebugFilter(source, importerPath)\n          if (filtered) {\n            debugLog('resolveId', {\n              env: envName,\n              envType,\n              source,\n              importer: importerPath,\n              isEntryResolve,\n              command: config.command,\n            })\n          }\n        }\n\n        // Internal virtual modules (mock:build:N, mock-edge, mock-runtime, marker)\n        const internalVirtualId = resolveInternalVirtualModuleId(source)\n        if (internalVirtualId) return internalVirtualId\n\n        if (!importer) {\n          env.graph.addEntry(source)\n          // Flush pending violations now that an additional entry is known\n          // and reachability analysis may have new roots.\n          await processPendingViolations(env, this.warn.bind(this))\n          return undefined\n        }\n\n        if (source.startsWith('\\0') || source.startsWith('virtual:')) {\n          return undefined\n        }\n\n        const normalizedImporter = normalizeFilePath(importer)\n        const isDirectLookup = importer.includes(SERVER_FN_LOOKUP_QUERY)\n\n        if (isDirectLookup) {\n          env.serverFnLookupModules.add(normalizedImporter)\n        }\n\n        const isPreTransformResolve =\n          isDirectLookup ||\n          env.serverFnLookupModules.has(normalizedImporter) ||\n          isScanResolve\n\n        // Dev mock mode: defer all violations (including pre-transform\n        // resolves) until post-transform data is available, then\n        // confirm/discard via graph reachability.\n        // Build mode (both mock and error): defer violations until\n        // generateBundle so tree-shaking can eliminate false positives.\n        const isDevMock =\n          config.command === 'serve' && config.effectiveBehavior === 'mock'\n        const isBuild = config.command === 'build'\n        const shouldDefer = shouldDeferViolation({ isBuild, isDevMock })\n\n        const resolveAgainstImporter = async (): Promise<string | null> => {\n          const primary = await this.resolve(source, importer, {\n            skipSelf: true,\n          })\n          if (primary) {\n            return canonicalizeResolvedId(\n              primary.id,\n              config.root,\n              resolveExtensionlessAbsoluteId,\n            )\n          }\n\n          return null\n        }\n\n        // Check if this is a marker import\n        const markerKind = config.markerSpecifiers.serverOnly.has(source)\n          ? ('server' as const)\n          : config.markerSpecifiers.clientOnly.has(source)\n            ? ('client' as const)\n            : undefined\n\n        if (markerKind) {\n          const existing = shared.fileMarkerKind.get(normalizedImporter)\n          if (existing && existing !== markerKind) {\n            this.error(\n              `[import-protection] File \"${getRelativePath(normalizedImporter)}\" has both server-only and client-only markers. This is not allowed.`,\n            )\n          }\n          shared.fileMarkerKind.set(normalizedImporter, markerKind)\n\n          const violatesEnv =\n            (envType === 'client' && markerKind === 'server') ||\n            (envType === 'server' && markerKind === 'client')\n\n          if (violatesEnv) {\n            const info = await buildViolationInfo(\n              provider,\n              env,\n              envName,\n              envType,\n              importer,\n              normalizedImporter,\n              source,\n              {\n                type: 'marker',\n                message: buildMarkerViolationMessage(\n                  getRelativePath(normalizedImporter),\n                  markerKind,\n                ),\n              },\n            )\n            const markerResult = await reportOrDeferViolation(\n              this,\n              env,\n              normalizedImporter,\n              importer,\n              info,\n              shouldDefer,\n              isPreTransformResolve,\n            )\n\n            // In build mode, if the violation was deferred, return the unique\n            // build mock ID instead of the marker module. This lets\n            // generateBundle check whether the importer (and thus its marker\n            // import) survived tree-shaking. The mock is side-effect-free just\n            // like the marker module, and the bare import has no bindings, so\n            // replacing it is transparent.\n            if (isBuild && markerResult != null) {\n              return markerResult\n            }\n          }\n\n          // Retroactive marker violation detection: on cold starts, module\n          // A may import module B before B's marker is set (because B hasn't\n          // been processed yet).  When B's marker is set (here),\n          // retroactively check all known importers of B in the graph and\n          // create deferred marker violations for them.  Without this,\n          // cold-start ordering can miss marker violations that warm starts\n          // detect (warm starts see markers early from cached transforms).\n          //\n          // Uses lightweight `deferViolation` to avoid heavy side effects\n          // (mock module creation, export resolution).  Immediately calls\n          // `processPendingViolations` to flush the deferred violations,\n          // because the marker resolveId fires during Vite's import\n          // analysis (after our transform hook) — there may be no\n          // subsequent transform invocation to flush them.\n          //\n          // Guarded by `violatesEnv` (per-environment) plus a per-env\n          // seen-set.  The marker is shared across environments but each\n          // env's graph has its own edges; this ensures the check runs\n          // at most once per (env, module) pair.\n          const envRetroKey = `retro-marker:${normalizedImporter}`\n          if (violatesEnv && !env.seenViolations.has(envRetroKey)) {\n            env.seenViolations.add(envRetroKey)\n            let retroDeferred = false\n            const importersMap = env.graph.reverseEdges.get(normalizedImporter)\n            if (importersMap && importersMap.size > 0) {\n              for (const [importerFile, specifier] of importersMap) {\n                if (!specifier) continue\n                if (!shouldCheckImporter(importerFile)) continue\n                const markerInfo = await buildMarkerViolationFromResolvedImport(\n                  provider,\n                  env,\n                  envName,\n                  envType,\n                  importerFile,\n                  specifier,\n                  normalizedImporter,\n                  getRelativePath(normalizedImporter),\n                )\n                if (markerInfo) {\n                  deferViolation(\n                    env,\n                    importerFile,\n                    markerInfo,\n                    isPreTransformResolve,\n                  )\n                  retroDeferred = true\n                }\n              }\n            }\n            if (retroDeferred) {\n              await processPendingViolations(env, this.warn.bind(this))\n            }\n          }\n\n          return markerKind === 'server'\n            ? resolvedMarkerVirtualModuleId('server')\n            : resolvedMarkerVirtualModuleId('client')\n        }\n\n        // Check if the importer is within our scope\n        if (!shouldCheckImporter(normalizedImporter)) {\n          return undefined\n        }\n\n        const matchers = getRulesForEnvironment(envName)\n\n        // 1. Specifier-based denial\n        const specifierMatch = matchesAny(source, matchers.specifiers)\n        if (specifierMatch) {\n          if (!isPreTransformResolve) {\n            env.graph.addEdge(source, normalizedImporter, source)\n          }\n          const info = await buildViolationInfo(\n            provider,\n            env,\n            envName,\n            envType,\n            importer,\n            normalizedImporter,\n            source,\n            {\n              type: 'specifier',\n              pattern: specifierMatch.pattern,\n              message: `Import \"${source}\" is denied in the ${envType} environment`,\n            },\n          )\n\n          // Resolve the specifier so edge-survival can verify whether\n          // the import survives the Start compiler transform (e.g.\n          // factory-safe pattern strips imports inside .server() callbacks).\n          if (shouldDefer && !info.resolved) {\n            try {\n              const resolvedForInfo = await resolveAgainstImporter()\n              if (resolvedForInfo) info.resolved = resolvedForInfo\n            } catch {\n              // Non-fatal: edge-survival will skip unresolved specifiers\n            }\n          }\n\n          return reportOrDeferViolation(\n            this,\n            env,\n            normalizedImporter,\n            importer,\n            info,\n            shouldDefer,\n            isPreTransformResolve,\n          )\n        }\n\n        // 2. Resolve the import (cached)\n        const cacheKey = `${normalizedImporter}:${source}`\n        let resolved: string | null\n\n        if (env.resolveCache.has(cacheKey)) {\n          resolved = env.resolveCache.get(cacheKey) ?? null\n        } else {\n          resolved = await resolveAgainstImporter()\n\n          // Only cache successful resolves.  Null resolves can be\n          // order-dependent across importer variants (e.g. code-split\n          // `?tsr-split=...` ids) and may poison later lookups.\n          if (resolved !== null) {\n            env.resolveCache.set(cacheKey, resolved)\n            getOrCreate(\n              env.resolveCacheByFile,\n              normalizedImporter,\n              () => new Set(),\n            ).add(cacheKey)\n          }\n        }\n\n        if (resolved) {\n          const relativePath = getRelativePath(resolved)\n\n          // Propagate pre-transform status transitively\n          if (isPreTransformResolve && !isScanResolve) {\n            env.serverFnLookupModules.add(resolved)\n          }\n\n          if (!isPreTransformResolve) {\n            env.graph.addEdge(resolved, normalizedImporter, source)\n          }\n\n          // Skip file-based and marker-based denial for resolved paths that\n          // match the per-environment `excludeFiles` patterns.  By default\n          // this includes `**/node_modules/**` so that third-party packages\n          // using `.client.` / `.server.` in their filenames (e.g. react-tweet\n          // exports `index.client.js`) are not treated as user-authored\n          // environment boundaries.  Users can override `excludeFiles` per\n          // environment to narrow or widen this exclusion.\n          const isExcludedFile =\n            matchers.excludeFiles.length > 0 &&\n            matchesAny(relativePath, matchers.excludeFiles)\n\n          if (!isExcludedFile) {\n            const fileMatch =\n              matchers.files.length > 0\n                ? matchesAny(relativePath, matchers.files)\n                : undefined\n\n            if (fileMatch) {\n              const info = await buildFileViolationInfo(\n                provider,\n                env,\n                envName,\n                envType,\n                importer,\n                normalizedImporter,\n                source,\n                resolved,\n                fileMatch.pattern,\n              )\n              return reportOrDeferViolation(\n                this,\n                env,\n                normalizedImporter,\n                importer,\n                info,\n                shouldDefer,\n                isPreTransformResolve,\n              )\n            }\n\n            const markerInfo = await buildMarkerViolationFromResolvedImport(\n              provider,\n              env,\n              envName,\n              envType,\n              importer,\n              source,\n              resolved,\n              relativePath,\n            )\n            if (markerInfo) {\n              return reportOrDeferViolation(\n                this,\n                env,\n                normalizedImporter,\n                importer,\n                markerInfo,\n                shouldDefer,\n                isPreTransformResolve,\n              )\n            }\n          }\n        }\n\n        return undefined\n      },\n\n      load: {\n        filter: {\n          id: new RegExp(\n            getResolvedVirtualModuleMatchers().map(escapeRegExp).join('|'),\n          ),\n        },\n        handler(id) {\n          if (IMPORT_PROTECTION_DEBUG) {\n            if (matchesDebugFilter(id)) {\n              debugLog('load:handler', {\n                env: this.environment.name,\n                id: normalizePath(id),\n              })\n            }\n          }\n\n          return loadResolvedVirtualModule(id)\n        },\n      },\n\n      async generateBundle(_options, bundle) {\n        const envName = this.environment.name\n        const env = envStates.get(envName)\n        if (!env || env.deferredBuildViolations.length === 0) return\n\n        const candidateCache = new Map<string, Array<string>>()\n        const toModuleIdCandidates = (id: string): Array<string> => {\n          let cached = candidateCache.get(id)\n          if (cached) return cached\n\n          const out = new Set<string>()\n          const normalized = normalizeFilePath(id)\n          out.add(id)\n          out.add(normalized)\n          out.add(relativizePath(normalized, config.root))\n\n          if (normalized.startsWith(VITE_BROWSER_VIRTUAL_PREFIX)) {\n            const internal = `\\0${normalized.slice(VITE_BROWSER_VIRTUAL_PREFIX.length)}`\n            out.add(internal)\n            out.add(relativizePath(normalizeFilePath(internal), config.root))\n          }\n\n          if (normalized.startsWith('\\0')) {\n            const browser = `${VITE_BROWSER_VIRTUAL_PREFIX}${normalized.slice(1)}`\n            out.add(browser)\n            out.add(relativizePath(normalizeFilePath(browser), config.root))\n          }\n\n          cached = Array.from(out)\n          candidateCache.set(id, cached)\n          return cached\n        }\n\n        // Collect all module IDs that survived tree-shaking in this bundle.\n        const survivingModules = new Set<string>()\n        for (const chunk of Object.values(bundle)) {\n          if (chunk.type === 'chunk') {\n            for (const moduleId of Object.keys(chunk.modules)) {\n              for (const candidate of toModuleIdCandidates(moduleId)) {\n                survivingModules.add(candidate)\n              }\n            }\n          }\n        }\n\n        const didModuleSurvive = (moduleId: string): boolean =>\n          toModuleIdCandidates(moduleId).some((candidate) =>\n            survivingModules.has(candidate),\n          )\n\n        // Check each deferred violation: if its check module survived\n        // in the bundle, the import was NOT tree-shaken — real leak.\n        const realViolations: Array<ViolationInfo> = []\n        for (const {\n          info,\n          mockModuleId,\n          checkModuleId,\n        } of env.deferredBuildViolations) {\n          let survived: boolean\n          if (checkModuleId != null) {\n            // Marker violation: check if the importer survived\n            // (marker is about the file's directive, not a binding).\n            // Include transform-result keys (e.g. code-split variants)\n            // to cover all bundle representations of the importer.\n            const importerVariantIds = new Set<string>([info.importer])\n            const importerKeys = env.transformResultKeysByFile.get(\n              normalizeFilePath(info.importer),\n            )\n            if (importerKeys) {\n              for (const key of importerKeys) {\n                importerVariantIds.add(key)\n              }\n            }\n            survived = false\n            for (const importerId of importerVariantIds) {\n              if (didModuleSurvive(importerId)) {\n                survived = true\n                break\n              }\n            }\n          } else {\n            // File/specifier violation: check if the mock module survived.\n            survived = didModuleSurvive(mockModuleId)\n          }\n\n          if (!survived) continue\n\n          if (config.onViolation) {\n            const result = await config.onViolation(info)\n            if (result === false) continue\n          }\n\n          realViolations.push(info)\n        }\n\n        if (realViolations.length === 0) return\n\n        if (config.effectiveBehavior === 'error') {\n          // Error mode: fail the build on the first real violation.\n          this.error(formatViolation(realViolations[0]!, config.root))\n        } else {\n          // Mock mode: warn for each surviving violation.\n          const seen = new Set<string>()\n          for (const info of realViolations) {\n            const key = dedupeKey(info)\n            if (!seen.has(key)) {\n              seen.add(key)\n              this.warn(formatViolation(info, config.root))\n            }\n          }\n        }\n      },\n    },\n    {\n      // Captures transformed code + composed sourcemap for location mapping.\n      // Runs after all `enforce: 'pre'` hooks (including the Start compiler).\n      // Only files under `srcDirectory` are cached.\n      name: 'tanstack-start-core:import-protection-transform-cache',\n\n      applyToEnvironment(env) {\n        if (!config.enabled) return false\n        return environmentNames.has(env.name)\n      },\n\n      transform: {\n        filter: {\n          id: {\n            include: [/\\.[cm]?[tj]sx?($|\\?)/],\n          },\n        },\n        async handler(code, id) {\n          const envName = this.environment.name\n          const file = normalizeFilePath(id)\n          const envType = getEnvType(envName)\n          const matchers = getRulesForEnvironment(envName)\n          const isBuild = config.command === 'build'\n\n          if (IMPORT_PROTECTION_DEBUG) {\n            if (matchesDebugFilter(file)) {\n              debugLog('transform-cache', {\n                env: envName,\n                id: normalizePath(id),\n                file,\n              })\n            }\n          }\n\n          if (!shouldCheckImporter(file)) {\n            return undefined\n          }\n\n          // Self-denial: if this file is denied in the current environment\n          // (e.g. a `.server` file transformed in the client environment),\n          // replace its entire content with a mock module.\n          //\n          // This is the core mechanism for preventing cross-environment\n          // cache contamination: resolveId never returns virtual module\n          // IDs for file-based violations, so there is nothing for\n          // third-party resolver caches (e.g. vite-tsconfig-paths) to\n          // leak across environments.  Each environment's transform\n          // independently decides whether the file is denied.\n          //\n          // In dev mode, this also solves the cold-start problem where\n          // the importer's AST is unavailable for export resolution:\n          // the denied file's own source code is always available here,\n          // so we parse its exports directly.\n          const selfFileMatch = checkFileDenial(getRelativePath(file), matchers)\n          if (selfFileMatch) {\n            // Parse exports once — shared by build and dev paths.\n            // Falls back to empty list on non-standard syntax.\n            let exportNames: Array<string> = []\n            try {\n              exportNames = collectNamedExports(code)\n            } catch {\n              // Parsing may fail on non-standard syntax\n            }\n\n            if (isBuild) {\n              return generateSelfContainedMockModule(exportNames)\n            }\n\n            // Dev mode: generate a mock that imports mock-runtime for\n            // runtime diagnostics (error/warn on property access).\n            const runtimeId = mockRuntimeModuleIdFromViolation(\n              {\n                type: 'file',\n                env: envType,\n                envType,\n                behavior:\n                  config.effectiveBehavior === 'error' ? 'error' : 'mock',\n                importer: file,\n                specifier: relativizePath(file, config.root),\n                resolved: file,\n                pattern: selfFileMatch.pattern,\n                message: `File \"${relativizePath(file, config.root)}\" is denied in the ${envType} environment`,\n                trace: [],\n              },\n              config.mockAccess,\n              config.root,\n            )\n            return generateDevSelfDenialModule(exportNames, runtimeId)\n          }\n\n          // getCombinedSourcemap() returns the composed sourcemap\n          let map: SourceMapLike | undefined\n          try {\n            map = this.getCombinedSourcemap()\n          } catch {\n            map = undefined\n          }\n\n          let originalCode: string | undefined\n          if (map?.sourcesContent) {\n            originalCode = pickOriginalCodeFromSourcesContent(\n              map,\n              file,\n              config.root,\n            )\n          }\n\n          const lineIndex = buildLineIndex(code)\n          const cacheKey = normalizePath(id)\n\n          const envState = getEnv(envName)\n          const isServerFnLookup = id.includes(SERVER_FN_LOOKUP_QUERY)\n\n          // Propagate SERVER_FN_LOOKUP status before import-analysis\n          if (isServerFnLookup) {\n            envState.serverFnLookupModules.add(file)\n          }\n\n          const result: TransformResult = {\n            code,\n            map,\n            originalCode,\n            lineIndex,\n          }\n          cacheTransformResult(envState, file, cacheKey, result)\n\n          // Build mode: only self-denial (above) and transform caching are\n          // needed.  All violations are detected and deferred in resolveId;\n          // self-denial replaces denied file content; generateBundle checks\n          // tree-shaking survival.  The import resolution loop below is\n          // dev-mode only — it resolves imports for graph reachability,\n          // catches violations missed on warm starts (where Vite caches\n          // resolveId), and rewrites denied imports to mock modules.\n          if (isBuild) return undefined\n\n          // Dev mode: resolve imports, populate graph, detect violations,\n          // and rewrite denied imports.\n          const isDevMock = config.effectiveBehavior === 'mock'\n          const importSources = extractImportSources(code)\n          const resolvedChildren = new Set<string>()\n          const deniedSourceReplacements = new Map<string, string>()\n          for (const src of importSources) {\n            try {\n              const resolved = await this.resolve(src, id, { skipSelf: true })\n              if (resolved && !resolved.external) {\n                const resolvedPath = canonicalizeResolvedId(\n                  resolved.id,\n                  config.root,\n                  resolveExtensionlessAbsoluteId,\n                )\n\n                resolvedChildren.add(resolvedPath)\n\n                // When the resolved ID is a mock-module (from our\n                // resolveId returning a mock-edge ID), postTransformImports\n                // would only contain the mock ID.  Edge-survival needs the\n                // real physical path so pending violations can be matched.\n                //\n                // For relative specifiers we can compute the physical path\n                // directly.  For bare/alias specifiers, look up the real\n                // resolved path from the pending violations that were\n                // already stored by resolveId before this transform ran.\n                if (resolved.id.includes('tanstack-start-import-protection:')) {\n                  let physicalPath: string | undefined\n                  // Look up real resolved path from pending violations\n                  const pending = envState.pendingViolations.get(file)\n                  if (pending) {\n                    const match = pending.find(\n                      (pv) => pv.info.specifier === src && pv.info.resolved,\n                    )\n                    if (match) physicalPath = match.info.resolved\n                  }\n                  if (physicalPath && physicalPath !== resolvedPath) {\n                    resolvedChildren.add(physicalPath)\n                    envState.graph.addEdge(physicalPath, file, src)\n                  }\n                }\n\n                // Populate import graph edges for warm-start trace accuracy\n                envState.graph.addEdge(resolvedPath, file, src)\n\n                if (isDevMock) {\n                  const relativePath = getRelativePath(resolvedPath)\n                  const fileMatch = checkFileDenial(relativePath, matchers)\n\n                  if (fileMatch) {\n                    const info = await buildFileViolationInfo(\n                      envState.transformResultProvider,\n                      envState,\n                      envName,\n                      envType,\n                      id,\n                      file,\n                      src,\n                      resolvedPath,\n                      fileMatch.pattern,\n                    )\n\n                    const replacement = await reportOrDeferViolation(\n                      this,\n                      envState,\n                      file,\n                      id,\n                      info,\n                      isDevMock,\n                      isServerFnLookup,\n                    )\n\n                    if (replacement) {\n                      deniedSourceReplacements.set(\n                        src,\n                        replacement.startsWith('\\0')\n                          ? VITE_BROWSER_VIRTUAL_PREFIX + replacement.slice(1)\n                          : replacement,\n                      )\n                    }\n                  }\n                }\n              }\n            } catch {\n              // Non-fatal\n            }\n          }\n          envState.postTransformImports.set(cacheKey, resolvedChildren)\n          if (cacheKey !== file && !isServerFnLookup) {\n            envState.postTransformImports.set(file, resolvedChildren)\n          }\n\n          await processPendingViolations(envState, this.warn.bind(this))\n\n          if (deniedSourceReplacements.size > 0) {\n            try {\n              const rewritten = rewriteDeniedImports(\n                code,\n                id,\n                new Set(deniedSourceReplacements.keys()),\n                (source: string) =>\n                  deniedSourceReplacements.get(source) ?? source,\n              )\n\n              if (!rewritten) {\n                return undefined\n              }\n\n              const normalizedMap = rewritten.map\n                ? {\n                    ...rewritten.map,\n                    version: Number(rewritten.map.version),\n                    sourcesContent:\n                      rewritten.map.sourcesContent?.map(\n                        (s: string | null) => s ?? '',\n                      ) ?? [],\n                  }\n                : {\n                    version: 3,\n                    file: id,\n                    names: [],\n                    sources: [id],\n                    sourcesContent: [code],\n                    mappings: '',\n                  }\n\n              return {\n                code: rewritten.code,\n                map: normalizedMap,\n              }\n            } catch {\n              // Non-fatal: keep original code when rewrite fails.\n            }\n          }\n\n          return undefined\n        },\n      },\n    },\n  ] satisfies Array<PluginOption>\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAgFO,SAAS,uBACd,MACc;AACd,MAAI,YAAkC;AACtC,QAAM,0BAA0B,IAAI,gCAAA;AACpC,QAAM,iCAAiC,CAAC,OACtC,wBAAwB,QAAQ,EAAE;AAEpC,QAAM,yCAAyB,IAAA;AAE/B,WAAS,8BAA8B,MAAc,QAAwB;AAC3E,QAAI,WAAW,mBAAmB,IAAI,MAAM;AAC5C,QAAI,CAAC,UAAU;AACb,YAAM,UAAU,aAAa,MAAM;AACnC,iBAAW;AAAA,QACT,IAAI,OAAO,sBAAsB,OAAO,KAAK;AAAA,QAC7C,IAAI,OAAO,oBAAoB,OAAO,KAAK;AAAA,QAC3C,IAAI,OAAO,6BAA6B,OAAO,YAAY;AAAA,MAAA;AAE7D,yBAAmB,IAAI,QAAQ,QAAQ;AAAA,IACzC;AAEA,QAAI,OAAO;AACX,eAAW,MAAM,UAAU;AACzB,YAAM,IAAI,GAAG,KAAK,IAAI;AACtB,UAAI,CAAC,EAAG;AACR,YAAM,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,MAAM;AACzC,UAAI,QAAQ,GAAI;AAChB,UAAI,SAAS,MAAM,MAAM,KAAM,QAAO;AAAA,IACxC;AACA,WAAO;AAAA,EACT;AAOA,WAAS,0BACP,SACA,KACA,YACyB;AACzB,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,cAAc,UAAU,aAAa,OAAO;AAClD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,OAAO,kBAAkB,UAAU;AACzC,UAAM,QAAQ,YAAY,YAAY,cAAc,IAAI;AACxD,QAAI,CAAC,MAAO,QAAO;AAInB,UAAM,8BAAc,IAAA;AACpB,aAAS,OAAO,GAA4B;AAC1C,UAAI,SAAS,QAAQ,IAAI,CAAC;AAC1B,UAAI,WAAW,QAAW;AACxB,iBAAS,EAAE,KACP,kBAAkB,EAAE,EAAE,IACtB,EAAE,MACA,kBAAkB,EAAE,GAAG,IACvB;AACN,gBAAQ,IAAI,GAAG,MAAM;AAAA,MACvB;AACA,aAAO;AAAA,IACT;AAEA,UAAM,QAAgC,CAAC,KAAK;AAC5C,UAAM,UAAU,oBAAI,IAAqB,CAAC,KAAK,CAAC;AAChD,UAAM,6BAAa,IAAA;AAEnB,QAAI,YAAoC;AACxC,QAAI,eAAuC;AAC3C,QAAI,KAAK;AACT,WAAO,KAAK,MAAM,QAAQ;AACxB,YAAM,OAAO,MAAM,IAAI;AACvB,YAAM,KAAK,OAAO,IAAI;AAEtB,UAAI,MAAM,IAAI,MAAM,QAAQ,IAAI,EAAE,GAAG;AACnC,oBAAY;AACZ;AAAA,MACF;AAEA,YAAM,YAAY,KAAK;AACvB,UAAI,UAAU,SAAS,GAAG;AACxB,YAAI,CAAC,aAAc,gBAAe;AAClC;AAAA,MACF;AAEA,iBAAW,OAAO,WAAW;AAC3B,YAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,gBAAQ,IAAI,GAAG;AACf,eAAO,IAAI,KAAK,IAAI;AACpB,cAAM,KAAK,GAAG;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,aAAa;AAE1B,QAAI,CAAC,KAAM,QAAO;AAGlB,UAAM,QAAgC,CAAA;AACtC,QAAI,MAAmC;AACvC,aAAS,IAAI,GAAG,IAAI,OAAO,gBAAgB,KAAK,KAAK,KAAK;AACxD,YAAM,KAAK,GAAG;AACd,UAAI,QAAQ,MAAO;AACnB,YAAM,OAAO,IAAI,GAAG;AAAA,IACtB;AAEA,UAAM,QAA0B,CAAA;AAChC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAM,KAAK,OAAO,MAAM,CAAC,CAAE;AAC3B,UAAI,CAAC,GAAI;AACT,UAAI;AACJ,UAAI,IAAI,IAAI,MAAM,QAAQ;AACxB,cAAM,SAAS,OAAO,MAAM,IAAI,CAAC,CAAE;AACnC,YAAI,QAAQ;AACV,sBAAY,IAAI,MAAM,aAAa,IAAI,MAAM,GAAG,IAAI,EAAE;AAAA,QACxD;AAAA,MACF;AACA,YAAM,KAAK,YAAY,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,IAAI;AAAA,IAC/D;AAEA,WAAO,MAAM,SAAS,QAAQ;AAAA,EAChC;AAEA,QAAM,SAAuB;AAAA,IAC3B,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,mBAAmB;AAAA,IACnB,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,eAAe;AAAA,IACf,eAAe;AAAA,MACb,QAAQ,EAAE,YAAY,CAAA,GAAI,OAAO,CAAA,GAAI,cAAc,GAAC;AAAA,MACpD,QAAQ,EAAE,YAAY,CAAA,GAAI,OAAO,CAAA,GAAI,cAAc,CAAA,EAAC;AAAA,IAAE;AAAA,IAExD,iBAAiB,CAAA;AAAA,IACjB,iBAAiB,CAAA;AAAA,IACjB,wBAAwB,CAAA;AAAA,IACxB,kBAAkB,EAAE,YAAY,oBAAI,OAAO,YAAY,oBAAI,MAAI;AAAA,IAC/D,YAAY,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAAA,IAClE,aAAa;AAAA,EAAA;AAGf,QAAM,gCAAgB,IAAA;AACtB,QAAM,SAAsB,EAAE,gBAAgB,oBAAI,MAAI;AAUtD,iBAAe,wBACb,UACA,KACA,SACA,oBACA,WACA,aACA,eAC2B;AAC3B,QAAI,QACF,iBACA,WAAW,IAAI,OAAO,oBAAoB,OAAO,aAAa;AAEhE,QAAI,OAAO,YAAY,SAAS;AAC9B,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAEF,UAAI,WAAW,QAAQ,SAAS,MAAM,QAAQ;AAC5C,gBAAQ;AAAA,MACV;AAAA,IACF;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IAAA;AAGF,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,UAAI,CAAC,KAAK,UAAW,MAAK,YAAY;AACtC,UAAI,eAAe,KAAK,QAAQ,MAAM;AACpC,aAAK,OAAO,YAAY;AACxB,aAAK,SAAS,YAAY;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAQA,iBAAe,mBACb,UACA,KACA,SACA,SACA,UACA,oBACA,QACA,WAWA,eACwB;AACxB,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,cAAc,aAAa,OAAO,UAAU,aAAa,WACrD,UAAU,WACV;AAAA,MACJ,OAAO;AAAA,IAAA;AAGT,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAGF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAGF,UAAM,UAAU,MAAM,iBAAiB,UAAU,UAAU,GAAG,IAAI;AAElE,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,WAAW;AAAA,MACX,UAAU;AAAA,MACV,GAAI,MAAM,EAAE,aAAa,IAAA,IAAQ,CAAA;AAAA,MACjC;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IAAA;AAAA,EAEP;AAEA,iBAAe,wBACb,UACA,KACA,UACA,kBAC0B;AAC1B,eAAW,aAAa,kBAAkB;AACxC,YAAM,MACH,MAAM,6BAA6B,UAAU,UAAU,SAAS,KAChE,MAAM;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,MAAA;AAEJ,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,WAAO;AAAA,EACT;AASA,iBAAe,uCACb,UACA,KACA,SACA,SACA,UACA,QACA,YACA,cACA,eACoC;AACpC,UAAM,uBAAuB,kBAAkB,UAAU;AACzD,UAAM,aAAa,OAAO,eAAe,IAAI,oBAAoB;AACjE,UAAM,WACH,YAAY,YAAY,eAAe,YACvC,YAAY,YAAY,eAAe;AAC1C,QAAI,CAAC,SAAU,QAAO;AAEtB,UAAM,qBAAqB,kBAAkB,QAAQ;AAErD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,4BAA4B,cAAc,UAAU;AAAA,MAAA;AAAA,MAE/D;AAAA,IAAA;AAAA,EAEJ;AAEA,WAAS,4BACP,cACA,YACQ;AACR,WAAO,eAAe,WAClB,WAAW,YAAY,sEACvB,WAAW,YAAY;AAAA,EAC7B;AAEA,iBAAe,uBACb,UACA,KACA,SACA,SACA,UACA,oBACA,QACA,cACA,SACA,eACwB;AACxB,UAAM,eAAe,gBAAgB,YAAY;AAEjD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,UAAU;AAAA,QACV,SAAS,WAAW,MAAM,mBAAmB,YAAY,uBAAuB,OAAO;AAAA,MAAA;AAAA,MAEzF;AAAA,IAAA;AAAA,EAEJ;AAEA,WAAS,WAAW,SAAsC;AACxD,WAAO,OAAO,WAAW,IAAI,OAAO,KAAK;AAAA,EAC3C;AAEA,WAAS,uBAAuB,SAA2B;AACzD,UAAM,OAAO,WAAW,OAAO;AAC/B,WAAO,SAAS,WACZ,OAAO,cAAc,SACrB,OAAO,cAAc;AAAA,EAC3B;AAOA,WAAS,gBACP,cACA,UAI6B;AAC7B,QACE,SAAS,aAAa,SAAS,KAC/B,WAAW,cAAc,SAAS,YAAY,GAC9C;AACA,aAAO;AAAA,IACT;AACA,WAAO,SAAS,MAAM,SAAS,IAC3B,WAAW,cAAc,SAAS,KAAK,IACvC;AAAA,EACN;AAEA,QAAM,uCAAuB,IAAY;AAAA,IACvC,uBAAuB;AAAA,IACvB,uBAAuB;AAAA,EAAA,CACxB;AACD,MAAI,KAAK,oBAAoB,uBAAuB,QAAQ;AAC1D,qBAAiB,IAAI,KAAK,eAAe;AAAA,EAC3C;AAGA,WAAS,OAAO,SAA2B;AACzC,QAAI,WAAW,UAAU,IAAI,OAAO;AACpC,QAAI,CAAC,UAAU;AACb,YAAM,2CAA2B,IAAA;AACjC,iBAAW;AAAA,QACT,OAAO,IAAI,YAAA;AAAA,QACX,2CAA2B,IAAA;AAAA,QAC3B,kCAAkB,IAAA;AAAA,QAClB,wCAAwB,IAAA;AAAA,QACxB,gBAAgB,IAAI,eAAA;AAAA,QACpB,oCAAoB,IAAA;AAAA,QACpB;AAAA,QACA,+CAA+B,IAAA;AAAA,QAC/B,yBAAyB;AAAA,UACvB,mBAAmB,IAAY;AAC7B,kBAAM,UAAU,cAAc,EAAE;AAChC,kBAAM,QAAQ,qBAAqB,IAAI,OAAO;AAC9C,gBAAI,MAAO,QAAO;AAClB,kBAAM,cAAc,kBAAkB,EAAE;AACxC,mBAAO,gBAAgB,UACnB,qBAAqB,IAAI,WAAW,IACpC;AAAA,UACN;AAAA,QAAA;AAAA,QAEF,0CAA0B,IAAA;AAAA,QAC1B,2CAA2B,IAAA;AAAA,QAC3B,uCAAuB,IAAA;AAAA,QACvB,yBAAyB,CAAA;AAAA,MAAC;AAE5B,gBAAU,IAAI,SAAS,QAAQ;AAAA,IACjC;AACA,WAAO;AAAA,EACT;AAMA,WAAS,iBACP,WACA,YACe;AACf,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,UAAU,IAAI,SAAS;AACnC,UAAI,OAAO,IAAI,SAAS,EAAG,QAAO;AAAA,IACpC;AACA,WAAO,CAAA;AAAA,EACT;AAMA,WAAS,kBAAkB,IAAY,OAA+B;AACpE,UAAM,MAAM,IAAI,IAAI,0BAA0B,EAAE,CAAC;AACjD,QAAI,OAAO;AACT,iBAAW,KAAK,0BAA0B,KAAK,EAAG,KAAI,IAAI,CAAC;AAC3D,UAAI,IAAI,+BAA+B,KAAK,CAAC;AAAA,IAC/C;AACA,WAAO,MAAM,KAAK,GAAG;AAAA,EACvB;AASA,iBAAe,iCACb,KACA,KACA,MACA,gBACwB;AACxB,UAAM,eAAe,kBAAkB,KAAK,QAAQ;AACpD,UAAM,sBAAsB,kBAAkB,KAAK,WAAW,KAAK,QAAQ;AAK3E,QAAI,iBAAiB,IAAI,sBAAsB,IAAI,YAAY;AAC/D,QAAI,CAAC,gBAAgB;AAEnB,YAAM,eACJ,IAAI,wBAAwB,mBAAmB,YAAY,GAAG,SAC7D,kBAAkB,IAAI,gBAClB,IAAI,cAAc,cAAc,GAAG,QAAQ,SAC5C;AACN,UAAI,OAAO,iBAAiB,YAAY,aAAa,WAAW;AAC9D,eAAO,CAAA;AAET,UAAI;AACF,yBAAiB,+BAA+B,YAAY;AAG5D,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,QAAQ;AACb,kBAAM,WAAW,GAAG,YAAY,IAAI,GAAG;AACvC,gBAAI,IAAI,aAAa,IAAI,QAAQ,GAAG;AAClC,qBAAO,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,YAC3C;AACA,gBAAI,CAAC,IAAI,QAAS,QAAO;AACzB,kBAAM,WAAW,MAAM,IAAI,QAAQ,KAAK,KAAK,UAAU;AAAA,cACrD,UAAU;AAAA,YAAA,CACX;AACD,gBAAI,CAAC,YAAY,SAAS,SAAU,QAAO;AAC3C,mBAAO,SAAS;AAAA,UAClB;AAAA,QAAA;AAIF,yBACE,IAAI,sBAAsB,IAAI,YAAY,KAAK;AAAA,MACnD,QAAQ;AACN,eAAO,CAAA;AAAA,MACT;AAAA,IACF;AAGA,UAAM,SAAS,iBAAiB,gBAAgB,mBAAmB;AACnE,QAAI,OAAO,SAAS,EAAG,QAAO;AAG9B,UAAM,eAAe,IAAI,IAAI,mBAAmB;AAChD,eAAW,CAAC,WAAW,KAAK,KAAK,gBAAgB;AAC/C,UAAI,CAAC,MAAM,OAAQ;AAEnB,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,MAAA;AAEP,UAAI,CAAC,WAAY;AAEjB,YAAM,qBAAqB,kBAAkB,UAAU;AACvD,yBAAmB,KAAK,+BAA+B,UAAU,CAAC;AAClE,UAAI,mBAAmB,KAAK,CAAC,MAAM,aAAa,IAAI,CAAC,CAAC,GAAG;AACvD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO,CAAA;AAAA,EACT;AAGA,iBAAe,iBACb,KACA,KACA,cACA,WACA,YAC6B;AAC7B,UAAM,WAAW,GAAG,YAAY,IAAI,SAAS;AAC7C,QAAI,IAAI,aAAa,IAAI,QAAQ,GAAG;AAClC,aAAO,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC3C;AACA,QAAI,CAAC,IAAI,QAAS,QAAO;AACzB,QAAI;AACF,YAAM,WAAW,MAAM,IAAI,QAAQ,WAAW,YAAY;AAAA,QACxD,UAAU;AAAA,MAAA,CACX;AACD,UAAI,CAAC,YAAY,SAAS,SAAU,QAAO;AAC3C,aAAO,SAAS;AAAA,IAClB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,6BACb,KACA,YACA,eACA,eACe;AACf,UAAM,eAAe,kBAAkB,UAAU;AAEjD,QAAI,cAAc,SAAS,EAAG;AAE9B,eAAW,CAAC,QAAQ,KAAK,KAAK,eAAe;AAC3C,UAAI;AACF,cAAM,aAAa,MAAM,cAAc,MAAM;AAC7C,YAAI,CAAC,WAAY;AAEjB,sBAAc,IAAI,kBAAkB,UAAU,GAAG,KAAK;AACtD,sBAAc,IAAI,+BAA+B,UAAU,GAAG,KAAK;AAAA,MACrE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,sBAAsB,IAAI,YAAY;AAC3D,QAAI,CAAC,UAAU;AACb,UAAI,sBAAsB,IAAI,cAAc,aAAa;AACzD;AAAA,IACF;AAEA,eAAW,CAAC,QAAQ,KAAK,KAAK,eAAe;AAC3C,YAAM,OAAO,SAAS,IAAI,MAAM;AAChC,UAAI,CAAC,MAAM;AACT,iBAAS,IAAI,QAAQ,KAAK;AAC1B;AAAA,MACF;AAEA,YAAM,4BAAY,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AACzC,eAAS,IAAI,QAAQ,MAAM,KAAK,KAAK,EAAE,MAAM;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,+CAA+B,IAAA;AACrC,WAAS,oBAAoB,UAA2B;AACtD,QAAI,SAAS,yBAAyB,IAAI,QAAQ;AAClD,QAAI,WAAW,OAAW,QAAO;AAEjC,UAAM,eAAe,eAAe,UAAU,OAAO,IAAI;AAGzD,UAAM,WACH,OAAO,gBAAgB,SAAS,KAC/B,WAAW,cAAc,OAAO,eAAe,KAChD,OAAO,uBAAuB,SAAS,KACtC,WAAW,cAAc,OAAO,sBAAsB;AAE1D,QAAI,UAAU;AACZ,eAAS;AAAA,IACX,WAAW,OAAO,gBAAgB,SAAS,GAAG;AAC5C,eAAS,CAAC,CAAC,WAAW,cAAc,OAAO,eAAe;AAAA,IAC5D,WAAW,OAAO,cAAc;AAC9B,eAAS,kBAAkB,UAAU,OAAO,YAAY;AAAA,IAC1D,OAAO;AACL,eAAS;AAAA,IACX;AAEA,6BAAyB,IAAI,UAAU,MAAM;AAC7C,WAAO;AAAA,EACT;AAEA,WAAS,UAAU,MAA6B;AAC9C,WAAO,GAAG,KAAK,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,IAAI,KAAK,YAAY,EAAE;AAAA,EAC/E;AAEA,WAAS,QAAQ,KAAe,KAAsB;AACpD,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,QAAI,IAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACxC,QAAI,eAAe,IAAI,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,WAAS,gBAAgB,cAA8B;AACrD,WAAO,eAAe,cAAc,YAAY,GAAG,OAAO,IAAI;AAAA,EAChE;AAGA,WAAS,cAAc,UAA0B;AAC/C,aAAS,aAAa,MAAA;AACtB,aAAS,mBAAmB,MAAA;AAC5B,aAAS,eAAe,MAAA;AACxB,aAAS,eAAe,MAAA;AACxB,aAAS,qBAAqB,MAAA;AAC9B,aAAS,0BAA0B,MAAA;AACnC,aAAS,qBAAqB,MAAA;AAC9B,aAAS,sBAAsB,MAAA;AAC/B,aAAS,kBAAkB,MAAA;AAC3B,aAAS,wBAAwB,SAAS;AAC1C,aAAS,MAAM,MAAA;AACf,aAAS,sBAAsB,MAAA;AAAA,EACjC;AAGA,WAAS,sBAAsB,UAAoB,MAAoB;AACrE,aAAS,eAAe,aAAa,IAAI;AAGzC,UAAM,cAAc,SAAS,mBAAmB,IAAI,IAAI;AACxD,QAAI,aAAa;AACf,iBAAW,OAAO,YAAa,UAAS,aAAa,OAAO,GAAG;AAC/D,eAAS,mBAAmB,OAAO,IAAI;AAAA,IACzC;AAEA,aAAS,MAAM,WAAW,IAAI;AAC9B,aAAS,sBAAsB,OAAO,IAAI;AAC1C,aAAS,sBAAsB,OAAO,IAAI;AAC1C,aAAS,kBAAkB,OAAO,IAAI;AAGtC,UAAM,gBAAgB,SAAS,0BAA0B,IAAI,IAAI;AACjE,QAAI,eAAe;AACjB,iBAAW,OAAO,eAAe;AAC/B,iBAAS,qBAAqB,OAAO,GAAG;AACxC,iBAAS,qBAAqB,OAAO,GAAG;AAAA,MAC1C;AACA,eAAS,0BAA0B,OAAO,IAAI;AAAA,IAChD,OAAO;AACL,eAAS,qBAAqB,OAAO,IAAI;AACzC,eAAS,qBAAqB,OAAO,IAAI;AAAA,IAC3C;AAAA,EACF;AAGA,WAAS,qBACP,UACA,MACA,UACA,QACM;AACN,aAAS,qBAAqB,IAAI,UAAU,MAAM;AAClD,UAAM,SAAS;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA,0BAAU,IAAA;AAAA,IAAY;AAExB,WAAO,IAAI,QAAQ;AACnB,QAAI,aAAa,MAAM;AACrB,eAAS,qBAAqB,IAAI,MAAM,MAAM;AAC9C,aAAO,IAAI,IAAI;AAAA,IACjB;AAAA,EACF;AAGA,WAAS,kBAAwB;AAC/B,UAAM,EAAE,oBAAA,IAAwB,KAAK,UAAA;AACrC,eAAW,UAAU,KAAK,cAAc;AACtC,YAAM,WAAW,OAAO,OAAO,IAAI;AACnC,UAAI,oBAAoB,gBAAgB;AACtC,iBAAS,MAAM;AAAA,UACb,cAAc,oBAAoB,cAAc;AAAA,QAAA;AAAA,MAEpD;AACA,UAAI,oBAAoB,eAAe;AACrC,iBAAS,MAAM;AAAA,UACb,cAAc,oBAAoB,aAAa;AAAA,QAAA;AAAA,MAEnD;AAAA,IACF;AAAA,EACF;AAUA,WAAS,wBACP,KACA,MACoB;AACpB,UAAM,SAAS,IAAI,0BAA0B,IAAI,IAAI;AACrD,QAAI,SAA6B;AAEjC,QAAI,QAAQ;AACV,iBAAW,KAAK,QAAQ;AACtB,YAAI,EAAE,SAAS,sBAAsB,EAAG;AACxC,cAAM,UAAU,IAAI,qBAAqB,IAAI,CAAC;AAC9C,YAAI,SAAS;AACX,cAAI,CAAC,OAAQ,UAAS,IAAI,IAAI,OAAO;AAAA,cAChC,YAAW,KAAK,QAAS,QAAO,IAAI,CAAC;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAGA,QAAI,CAAC,QAAQ;AACX,YAAM,UAAU,IAAI,qBAAqB,IAAI,IAAI;AACjD,UAAI,QAAS,UAAS,IAAI,IAAI,OAAO;AAAA,IACvC;AAEA,WAAO;AAAA,EACT;AAYA,WAAS,kBACP,KACA,QACA,QACyC;AACzC,UAAM,SAAS,IAAI,0BAA0B,IAAI,MAAM;AACvD,QAAI,mBAAmB;AAEvB,QAAI,QAAQ;AACV,iBAAW,KAAK,QAAQ;AACtB,YAAI,EAAE,SAAS,sBAAsB,EAAG;AACxC,cAAM,UAAU,IAAI,qBAAqB,IAAI,CAAC;AAC9C,YAAI,SAAS;AACX,6BAAmB;AACnB,cAAI,QAAQ,IAAI,MAAM,EAAG,QAAO;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,YAAM,UAAU,IAAI,qBAAqB,IAAI,MAAM;AACnD,UAAI,QAAS,QAAO,QAAQ,IAAI,MAAM,IAAI,SAAS;AACnD,YAAM,qBACJ,IAAI,qBAAqB,IAAI,MAAM,MAClC,SAAS,OAAO,OAAO,IAAI;AAC9B,aAAO,qBAAqB,YAAY;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,+BACP,KACA,MACyC;AACzC,UAAM,8BAAc,IAAA;AACpB,UAAM,QAAuB,CAAC,IAAI;AAClC,QAAI,iBAAiB;AACrB,QAAI,KAAK;AAET,WAAO,KAAK,MAAM,QAAQ;AACxB,YAAM,UAAU,MAAM,IAAI;AAC1B,UAAI,QAAQ,IAAI,OAAO,EAAG;AAC1B,cAAQ,IAAI,OAAO;AAEnB,UAAI,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;AAClC,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,IAAI,MAAM,aAAa,IAAI,OAAO;AACpD,UAAI,CAAC,UAAW;AAEhB,iBAAW,CAAC,MAAM,KAAK,WAAW;AAChC,YAAI,QAAQ,IAAI,MAAM,EAAG;AACzB,cAAM,WAAW,kBAAkB,KAAK,QAAQ,OAAO;AACvD,YAAI,aAAa,UAAU,aAAa,WAAW;AAEjD,gBAAM,KAAK,MAAM;AAAA,QACnB,WAAW,aAAa,WAAW;AACjC,2BAAiB;AAAA,QACnB;AAAA,MAEF;AAAA,IACF;AAEA,WAAO,iBAAiB,YAAY;AAAA,EACtC;AAUA,WAAS,mBACP,KACA,MACA,YAIoB;AACpB,UAAM,gBAAgB,wBAAwB,KAAK,IAAI;AAEvD,QAAI,eAAe;AACjB,YAAM,YAAY,WAAW;AAAA,QAC3B,CAAC,OAAO,CAAC,GAAG,KAAK,YAAY,cAAc,IAAI,GAAG,KAAK,QAAQ;AAAA,MAAA;AAEjE,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,UAAI,kBAAkB,IAAI,MAAM,SAAS;AACzC,aAAO,EAAE,QAAQ,WAAW,qBAAqB,KAAA;AAAA,IACnD;AAGA,QAAI,WAAW,KAAK,CAAC,OAAO,GAAG,uBAAuB,GAAG;AACvD,aAAO;AAAA,IACT;AAEA,WAAO,EAAE,QAAQ,YAAY,qBAAqB,MAAA;AAAA,EACpD;AASA,iBAAe,yBACb,KACA,QACe;AACf,QAAI,IAAI,kBAAkB,SAAS,EAAG;AAEtC,UAAM,WAA0B,CAAA;AAEhC,eAAW,CAAC,MAAM,UAAU,KAAK,IAAI,mBAAmB;AACtD,YAAM,WAAW,mBAAmB,KAAK,MAAM,UAAU;AAEzD,UAAI,aAAa,gBAAgB;AAC/B,iBAAS,KAAK,IAAI;AAClB;AAAA,MACF;AACA,UAAI,aAAa,kBAAmB;AAEpC,YAAM,EAAE,QAAQ,oBAAA,IAAwB;AAIxC,YAAM,SACJ,IAAI,MAAM,QAAQ,OAAO,IACrB,+BAA+B,KAAK,IAAI,IACxC;AAEN,UAAI,WAAW,aAAa;AAC1B,mBAAW,MAAM,QAAQ;AACvB,gBAAM,qBAAqB,KAAK,QAAQ,EAAE;AAAA,QAC5C;AACA,iBAAS,KAAK,IAAI;AAAA,MACpB,WAAW,WAAW,eAAe;AACnC,iBAAS,KAAK,IAAI;AAAA,MACpB,WAAW,OAAO,YAAY,SAAS;AAIrC,YAAI,aAAa;AACjB,mBAAW,MAAM,QAAQ;AACvB,cAAI,GAAG,wBAAyB;AAEhC,gBAAM,aACJ,uBACC,GAAG,KAAK,SAAS,UAChB,CAAC,CAAC,GAAG,KAAK,YACV,kBAAkB,GAAG,KAAK,UAAU,OAAO,YAAY;AAE3D,cAAI,YAAY;AACd,yBACG,MAAM,qBAAqB,KAAK,QAAQ,EAAE,KAAM;AAAA,UACrD;AAAA,QACF;AAEA,YAAI,YAAY;AACd,mBAAS,KAAK,IAAI;AAAA,QACpB;AAAA,MACF;AAAA,IAEF;AAEA,eAAW,QAAQ,UAAU;AAC3B,UAAI,kBAAkB,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AAEA,iBAAe,qBACb,KACA,QACA,IACkB;AAClB,QAAI,CAAC,GAAG,KAAK,aAAa;AACxB,YAAM,mBAAmB;AAAA,QACvB,GAAG,KAAK;AAAA,QACR,GAAG,KAAK;AAAA,QACR,OAAO;AAAA,MAAA;AAET,YAAM,MAAM,MAAM;AAAA,QAChB,IAAI;AAAA,QACJ;AAAA,QACA,GAAG,KAAK;AAAA,QACR;AAAA,MAAA;AAGF,UAAI,KAAK;AACP,WAAG,KAAK,cAAc;AACtB,WAAG,KAAK,UAAU;AAAA,UAChB,IAAI;AAAA,UACJ,GAAG,KAAK;AAAA,UACR;AAAA,QAAA;AAAA,MAEJ;AAAA,IACF;AAEA,QAAI,QAAQ,KAAK,UAAU,GAAG,IAAI,CAAC,GAAG;AACpC,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB,IAAI;AAAA,MACJ;AAAA,MACA,GAAG,KAAK;AAAA,MACR,GAAG,KAAK;AAAA,MACR,GAAG,KAAK;AAAA,MACR,GAAG,KAAK;AAAA,IAAA;AAEV,QAAI,WAAW,SAAS,GAAG,KAAK,MAAM,QAAQ;AAC5C,SAAG,KAAK,QAAQ;AAAA,IAClB;AAEA,QAAI,OAAO,aAAa;AACtB,YAAM,SAAS,MAAM,OAAO,YAAY,GAAG,IAAI;AAC/C,UAAI,WAAW,MAAO,QAAO;AAAA,IAC/B;AAEA,WAAO,gBAAgB,GAAG,MAAM,OAAO,IAAI,CAAC;AAC5C,WAAO;AAAA,EACT;AAMA,WAAS,eACP,KACA,cACA,MACA,uBACM;AACN,gBAAY,IAAI,mBAAmB,cAAc,MAAM,CAAA,CAAE,EAAE,KAAK;AAAA,MAC9D;AAAA,MACA,yBAAyB;AAAA,IAAA,CAC1B;AAAA,EACH;AAGA,MAAI,wBAAwB;AAE5B,iBAAe,gBACb,KACA,KACA,MACA,gBACA,eACgC;AAChC,QAAI,CAAC,eAAe,QAAQ;AAC1B,UAAI,OAAO,aAAa;AACtB,cAAM,SAAS,MAAM,OAAO,YAAY,IAAI;AAC5C,YAAI,WAAW,MAAO,QAAO;AAAA,MAC/B;AAEA,UAAI,OAAO,sBAAsB,SAAS;AAYxC,eAAO,IAAI,MAAM,gBAAgB,MAAM,OAAO,IAAI,CAAC;AAAA,MACrD;AAEA,UAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,GAAG;AAClC,YAAI,KAAK,gBAAgB,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,WACE,OAAO,sBAAsB,WAC7B,OAAO,YAAY,SACnB;AACA,aAAO;AAAA,IACT;AAMA,QAAI,KAAK,SAAS,OAAQ,QAAO,KAAK;AAKtC,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAEF,UAAM,aACJ,OAAO,YAAY,UACf,iCAAiC,MAAM,OAAO,YAAY,OAAO,IAAI,IACrE,GAAG,iBAAiB,GAAG,uBAAuB;AACpD,WAAO,cAAc,qBAAqB,SAAS,UAAU,CAAC;AAAA,EAChE;AAoBA,iBAAe,uBACb,KACA,KACA,cACA,gBACA,MACA,aACA,uBACgC;AAChC,QAAI,aAAa;AACf,YAAM,SAAS,MAAM,gBAAgB,KAAK,KAAK,MAAM,gBAAgB;AAAA,QACnE,QAAQ;AAAA,MAAA,CACT;AAED,UAAI,OAAO,YAAY,SAAS;AAG9B,cAAM,SAAS,UAAU;AACzB,YAAI,wBAAwB,KAAK;AAAA,UAC/B;AAAA,UACA,cAAc;AAAA;AAAA,UAEd,eAAe,KAAK,SAAS,WAAW,KAAK,WAAW;AAAA,QAAA,CACzD;AAAA,MACH,OAAO;AAEL,uBAAe,KAAK,cAAc,MAAM,qBAAqB;AAC7D,cAAM,yBAAyB,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,MACxD;AAEA,aAAO;AAAA,IACT;AAMA,WAAO,gBAAgB,KAAK,KAAK,MAAM,gBAAgB;AAAA,MACrD,QAAQ;AAAA,IAAA,CACT;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MAET,mBAAmB,KAAK;AACtB,YAAI,CAAC,OAAO,QAAS,QAAO;AAG5B,eAAO,iBAAiB,IAAI,IAAI,IAAI;AAAA,MACtC;AAAA,MAEA,eAAe,YAAY;AACzB,eAAO,OAAO,WAAW;AACzB,eAAO,UAAU,WAAW;AAE5B,cAAM,EAAE,aAAa,wBAAwB,KAAK,UAAA;AAClD,eAAO,eAAe,oBAAoB;AAE1C,cAAM,WACJ,YAAY;AAEd,YAAI,UAAU,YAAY,OAAO;AAC/B,iBAAO,UAAU;AACjB;AAAA,QACF;AAEA,eAAO,UAAU;AAEjB,cAAM,WAAW,UAAU;AAC3B,YAAI,OAAO,aAAa,UAAU;AAChC,iBAAO,oBAAoB;AAAA,QAC7B,OAAO;AACL,iBAAO,oBACL,WAAW,YAAY,UAClB,UAAU,OAAO,SACjB,UAAU,SAAS;AAAA,QAC5B;AAEA,eAAO,UAAU,UAAU,OAAO;AAClC,eAAO,aAAa,UAAU,cAAc;AAC5C,eAAO,gBAAgB,UAAU,iBAAiB;AAClD,YAAI,UAAU,aAAa;AACzB,gBAAM,KAAK,SAAS;AACpB,iBAAO,cAAc,CAAC,SAAS,GAAG,IAAI;AAAA,QACxC;AAEA,cAAM,WAAW,gCAAA;AAEjB,cAAM,OAAO,CAAI,MAA4B,aAC3C,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,QAAQ;AAIjC,cAAM,mBAAmB,eAAe;AAAA,UACtC,GAAG,SAAS,OAAO;AAAA,UACnB,GAAI,UAAU,QAAQ,cAAc,CAAA;AAAA,QAAC,CACtC;AAED,eAAO,cAAc,SAAS;AAAA,UAC5B,YAAY,gBAAgB,gBAAgB;AAAA,UAC5C,OAAO;AAAA,YACL,KAAK,UAAU,QAAQ,OAAO,SAAS,OAAO,KAAK;AAAA,UAAA;AAAA,UAErD,cAAc;AAAA,YACZ,KAAK,UAAU,QAAQ,cAAc,SAAS,OAAO,YAAY;AAAA,UAAA;AAAA,QACnE;AAEF,eAAO,cAAc,SAAS;AAAA,UAC5B,YAAY;AAAA,YACV;AAAA,cACE,KAAK,UAAU,QAAQ,YAAY,SAAS,OAAO,UAAU;AAAA,YAAA;AAAA,UAC/D;AAAA,UAEF,OAAO;AAAA,YACL,KAAK,UAAU,QAAQ,OAAO,SAAS,OAAO,KAAK;AAAA,UAAA;AAAA,UAErD,cAAc;AAAA,YACZ,KAAK,UAAU,QAAQ,cAAc,SAAS,OAAO,YAAY;AAAA,UAAA;AAAA,QACnE;AAGF,eAAO,kBAAkB,gBAAgB,UAAU,WAAW,CAAA,CAAE;AAChE,eAAO,kBAAkB,gBAAgB,UAAU,WAAW,CAAA,CAAE;AAChE,eAAO,yBAAyB;AAAA,UAC9B,UAAU,mBAAmB,CAAA;AAAA,QAAC;AAIhC,cAAM,UAAU,oBAAA;AAChB,eAAO,mBAAmB;AAAA,UACxB,YAAY,IAAI,IAAI,QAAQ,UAAU;AAAA,UACtC,YAAY,IAAI,IAAI,QAAQ,UAAU;AAAA,QAAA;AAAA,MAE1C;AAAA,MAEA,gBAAgB,QAAQ;AACtB,oBAAY;AAAA,MACd;AAAA,MAEA,aAAa;AACX,YAAI,CAAC,OAAO,QAAS;AAErB,oCAAA;AACA,gCAAwB,MAAA;AACxB,2BAAmB,MAAA;AACnB,iCAAyB,MAAA;AAGzB,mBAAW,YAAY,UAAU,UAAU;AACzC,wBAAc,QAAQ;AAAA,QACxB;AAGA,eAAO,eAAe,MAAA;AAEtB,wBAAA;AAAA,MACF;AAAA,MAEA,UAAU,KAAK;AACb,YAAI,CAAC,OAAO,QAAS;AAErB,mBAAW,OAAO,IAAI,SAAS;AAC7B,cAAI,IAAI,IAAI;AACV,kBAAM,KAAK,IAAI;AACf,kBAAM,eAAe,kBAAkB,EAAE;AAGzC,oCAAwB,iBAAiB,YAAY;AACrD,mBAAO,eAAe,OAAO,YAAY;AAGzC,uBAAW,YAAY,UAAU,UAAU;AACzC,oCAAsB,UAAU,YAAY;AAAA,YAC9C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,MAAM,UAAU,QAAQ,UAAU,UAAU;AAC1C,cAAM,UAAU,KAAK,YAAY;AACjC,cAAM,MAAM,OAAO,OAAO;AAC1B,cAAM,UAAU,WAAW,OAAO;AAClC,cAAM,WAAW,IAAI;AACrB,cAAM,gBAAgB,CAAC,CAAE,SAAqC;AAE9D,YAAI,yBAAyB;AAC3B,gBAAM,eAAe,WACjB,kBAAkB,QAAQ,IAC1B;AACJ,gBAAM,iBAAiB,CAAC;AACxB,gBAAM,WACJ,QAAQ,IAAI,uCAAuC,UAC/C,iBACA,mBAAmB,QAAQ,YAAY;AAC7C,cAAI,UAAU;AACZ,qBAAS,aAAa;AAAA,cACpB,KAAK;AAAA,cACL;AAAA,cACA;AAAA,cACA,UAAU;AAAA,cACV;AAAA,cACA,SAAS,OAAO;AAAA,YAAA,CACjB;AAAA,UACH;AAAA,QACF;AAGA,cAAM,oBAAoB,+BAA+B,MAAM;AAC/D,YAAI,kBAAmB,QAAO;AAE9B,YAAI,CAAC,UAAU;AACb,cAAI,MAAM,SAAS,MAAM;AAGzB,gBAAM,yBAAyB,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;AACxD,iBAAO;AAAA,QACT;AAEA,YAAI,OAAO,WAAW,IAAI,KAAK,OAAO,WAAW,UAAU,GAAG;AAC5D,iBAAO;AAAA,QACT;AAEA,cAAM,qBAAqB,kBAAkB,QAAQ;AACrD,cAAM,iBAAiB,SAAS,SAAS,sBAAsB;AAE/D,YAAI,gBAAgB;AAClB,cAAI,sBAAsB,IAAI,kBAAkB;AAAA,QAClD;AAEA,cAAM,wBACJ,kBACA,IAAI,sBAAsB,IAAI,kBAAkB,KAChD;AAOF,cAAM,YACJ,OAAO,YAAY,WAAW,OAAO,sBAAsB;AAC7D,cAAM,UAAU,OAAO,YAAY;AACnC,cAAM,cAAc,qBAAqB,EAAE,SAAS,WAAW;AAE/D,cAAM,yBAAyB,YAAoC;AACjE,gBAAM,UAAU,MAAM,KAAK,QAAQ,QAAQ,UAAU;AAAA,YACnD,UAAU;AAAA,UAAA,CACX;AACD,cAAI,SAAS;AACX,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,OAAO;AAAA,cACP;AAAA,YAAA;AAAA,UAEJ;AAEA,iBAAO;AAAA,QACT;AAGA,cAAM,aAAa,OAAO,iBAAiB,WAAW,IAAI,MAAM,IAC3D,WACD,OAAO,iBAAiB,WAAW,IAAI,MAAM,IAC1C,WACD;AAEN,YAAI,YAAY;AACd,gBAAM,WAAW,OAAO,eAAe,IAAI,kBAAkB;AAC7D,cAAI,YAAY,aAAa,YAAY;AACvC,iBAAK;AAAA,cACH,6BAA6B,gBAAgB,kBAAkB,CAAC;AAAA,YAAA;AAAA,UAEpE;AACA,iBAAO,eAAe,IAAI,oBAAoB,UAAU;AAExD,gBAAM,cACH,YAAY,YAAY,eAAe,YACvC,YAAY,YAAY,eAAe;AAE1C,cAAI,aAAa;AACf,kBAAM,OAAO,MAAM;AAAA,cACjB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,gBACE,MAAM;AAAA,gBACN,SAAS;AAAA,kBACP,gBAAgB,kBAAkB;AAAA,kBAClC;AAAA,gBAAA;AAAA,cACF;AAAA,YACF;AAEF,kBAAM,eAAe,MAAM;AAAA,cACzB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YAAA;AASF,gBAAI,WAAW,gBAAgB,MAAM;AACnC,qBAAO;AAAA,YACT;AAAA,UACF;AAqBA,gBAAM,cAAc,gBAAgB,kBAAkB;AACtD,cAAI,eAAe,CAAC,IAAI,eAAe,IAAI,WAAW,GAAG;AACvD,gBAAI,eAAe,IAAI,WAAW;AAClC,gBAAI,gBAAgB;AACpB,kBAAM,eAAe,IAAI,MAAM,aAAa,IAAI,kBAAkB;AAClE,gBAAI,gBAAgB,aAAa,OAAO,GAAG;AACzC,yBAAW,CAAC,cAAc,SAAS,KAAK,cAAc;AACpD,oBAAI,CAAC,UAAW;AAChB,oBAAI,CAAC,oBAAoB,YAAY,EAAG;AACxC,sBAAM,aAAa,MAAM;AAAA,kBACvB;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA,gBAAgB,kBAAkB;AAAA,gBAAA;AAEpC,oBAAI,YAAY;AACd;AAAA,oBACE;AAAA,oBACA;AAAA,oBACA;AAAA,oBACA;AAAA,kBAAA;AAEF,kCAAgB;AAAA,gBAClB;AAAA,cACF;AAAA,YACF;AACA,gBAAI,eAAe;AACjB,oBAAM,yBAAyB,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;AAAA,YAC1D;AAAA,UACF;AAEA,iBAAO,eAAe,WAClB,8BAA8B,QAAQ,IACtC,8BAA8B,QAAQ;AAAA,QAC5C;AAGA,YAAI,CAAC,oBAAoB,kBAAkB,GAAG;AAC5C,iBAAO;AAAA,QACT;AAEA,cAAM,WAAW,uBAAuB,OAAO;AAG/C,cAAM,iBAAiB,WAAW,QAAQ,SAAS,UAAU;AAC7D,YAAI,gBAAgB;AAClB,cAAI,CAAC,uBAAuB;AAC1B,gBAAI,MAAM,QAAQ,QAAQ,oBAAoB,MAAM;AAAA,UACtD;AACA,gBAAM,OAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,cACE,MAAM;AAAA,cACN,SAAS,eAAe;AAAA,cACxB,SAAS,WAAW,MAAM,sBAAsB,OAAO;AAAA,YAAA;AAAA,UACzD;AAMF,cAAI,eAAe,CAAC,KAAK,UAAU;AACjC,gBAAI;AACF,oBAAM,kBAAkB,MAAM,uBAAA;AAC9B,kBAAI,sBAAsB,WAAW;AAAA,YACvC,QAAQ;AAAA,YAER;AAAA,UACF;AAEA,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UAAA;AAAA,QAEJ;AAGA,cAAM,WAAW,GAAG,kBAAkB,IAAI,MAAM;AAChD,YAAI;AAEJ,YAAI,IAAI,aAAa,IAAI,QAAQ,GAAG;AAClC,qBAAW,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,QAC/C,OAAO;AACL,qBAAW,MAAM,uBAAA;AAKjB,cAAI,aAAa,MAAM;AACrB,gBAAI,aAAa,IAAI,UAAU,QAAQ;AACvC;AAAA,cACE,IAAI;AAAA,cACJ;AAAA,cACA,0BAAU,IAAA;AAAA,YAAI,EACd,IAAI,QAAQ;AAAA,UAChB;AAAA,QACF;AAEA,YAAI,UAAU;AACZ,gBAAM,eAAe,gBAAgB,QAAQ;AAG7C,cAAI,yBAAyB,CAAC,eAAe;AAC3C,gBAAI,sBAAsB,IAAI,QAAQ;AAAA,UACxC;AAEA,cAAI,CAAC,uBAAuB;AAC1B,gBAAI,MAAM,QAAQ,UAAU,oBAAoB,MAAM;AAAA,UACxD;AASA,gBAAM,iBACJ,SAAS,aAAa,SAAS,KAC/B,WAAW,cAAc,SAAS,YAAY;AAEhD,cAAI,CAAC,gBAAgB;AACnB,kBAAM,YACJ,SAAS,MAAM,SAAS,IACpB,WAAW,cAAc,SAAS,KAAK,IACvC;AAEN,gBAAI,WAAW;AACb,oBAAM,OAAO,MAAM;AAAA,gBACjB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,UAAU;AAAA,cAAA;AAEZ,qBAAO;AAAA,gBACL;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA;AAAA,YAEJ;AAEA,kBAAM,aAAa,MAAM;AAAA,cACvB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YAAA;AAEF,gBAAI,YAAY;AACd,qBAAO;AAAA,gBACL;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA;AAAA,YAEJ;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM;AAAA,QACJ,QAAQ;AAAA,UACN,IAAI,IAAI;AAAA,YACN,mCAAmC,IAAI,YAAY,EAAE,KAAK,GAAG;AAAA,UAAA;AAAA,QAC/D;AAAA,QAEF,QAAQ,IAAI;AACV,cAAI,yBAAyB;AAC3B,gBAAI,mBAAmB,EAAE,GAAG;AAC1B,uBAAS,gBAAgB;AAAA,gBACvB,KAAK,KAAK,YAAY;AAAA,gBACtB,IAAI,cAAc,EAAE;AAAA,cAAA,CACrB;AAAA,YACH;AAAA,UACF;AAEA,iBAAO,0BAA0B,EAAE;AAAA,QACrC;AAAA,MAAA;AAAA,MAGF,MAAM,eAAe,UAAU,QAAQ;AACrC,cAAM,UAAU,KAAK,YAAY;AACjC,cAAM,MAAM,UAAU,IAAI,OAAO;AACjC,YAAI,CAAC,OAAO,IAAI,wBAAwB,WAAW,EAAG;AAEtD,cAAM,qCAAqB,IAAA;AAC3B,cAAM,uBAAuB,CAAC,OAA8B;AAC1D,cAAI,SAAS,eAAe,IAAI,EAAE;AAClC,cAAI,OAAQ,QAAO;AAEnB,gBAAM,0BAAU,IAAA;AAChB,gBAAM,aAAa,kBAAkB,EAAE;AACvC,cAAI,IAAI,EAAE;AACV,cAAI,IAAI,UAAU;AAClB,cAAI,IAAI,eAAe,YAAY,OAAO,IAAI,CAAC;AAE/C,cAAI,WAAW,WAAW,2BAA2B,GAAG;AACtD,kBAAM,WAAW,KAAK,WAAW,MAAM,4BAA4B,MAAM,CAAC;AAC1E,gBAAI,IAAI,QAAQ;AAChB,gBAAI,IAAI,eAAe,kBAAkB,QAAQ,GAAG,OAAO,IAAI,CAAC;AAAA,UAClE;AAEA,cAAI,WAAW,WAAW,IAAI,GAAG;AAC/B,kBAAM,UAAU,GAAG,2BAA2B,GAAG,WAAW,MAAM,CAAC,CAAC;AACpE,gBAAI,IAAI,OAAO;AACf,gBAAI,IAAI,eAAe,kBAAkB,OAAO,GAAG,OAAO,IAAI,CAAC;AAAA,UACjE;AAEA,mBAAS,MAAM,KAAK,GAAG;AACvB,yBAAe,IAAI,IAAI,MAAM;AAC7B,iBAAO;AAAA,QACT;AAGA,cAAM,uCAAuB,IAAA;AAC7B,mBAAW,SAAS,OAAO,OAAO,MAAM,GAAG;AACzC,cAAI,MAAM,SAAS,SAAS;AAC1B,uBAAW,YAAY,OAAO,KAAK,MAAM,OAAO,GAAG;AACjD,yBAAW,aAAa,qBAAqB,QAAQ,GAAG;AACtD,iCAAiB,IAAI,SAAS;AAAA,cAChC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,mBAAmB,CAAC,aACxB,qBAAqB,QAAQ,EAAE;AAAA,UAAK,CAAC,cACnC,iBAAiB,IAAI,SAAS;AAAA,QAAA;AAKlC,cAAM,iBAAuC,CAAA;AAC7C,mBAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QAAA,KACG,IAAI,yBAAyB;AAChC,cAAI;AACJ,cAAI,iBAAiB,MAAM;AAKzB,kBAAM,qBAAqB,oBAAI,IAAY,CAAC,KAAK,QAAQ,CAAC;AAC1D,kBAAM,eAAe,IAAI,0BAA0B;AAAA,cACjD,kBAAkB,KAAK,QAAQ;AAAA,YAAA;AAEjC,gBAAI,cAAc;AAChB,yBAAW,OAAO,cAAc;AAC9B,mCAAmB,IAAI,GAAG;AAAA,cAC5B;AAAA,YACF;AACA,uBAAW;AACX,uBAAW,cAAc,oBAAoB;AAC3C,kBAAI,iBAAiB,UAAU,GAAG;AAChC,2BAAW;AACX;AAAA,cACF;AAAA,YACF;AAAA,UACF,OAAO;AAEL,uBAAW,iBAAiB,YAAY;AAAA,UAC1C;AAEA,cAAI,CAAC,SAAU;AAEf,cAAI,OAAO,aAAa;AACtB,kBAAM,SAAS,MAAM,OAAO,YAAY,IAAI;AAC5C,gBAAI,WAAW,MAAO;AAAA,UACxB;AAEA,yBAAe,KAAK,IAAI;AAAA,QAC1B;AAEA,YAAI,eAAe,WAAW,EAAG;AAEjC,YAAI,OAAO,sBAAsB,SAAS;AAExC,eAAK,MAAM,gBAAgB,eAAe,CAAC,GAAI,OAAO,IAAI,CAAC;AAAA,QAC7D,OAAO;AAEL,gBAAM,2BAAW,IAAA;AACjB,qBAAW,QAAQ,gBAAgB;AACjC,kBAAM,MAAM,UAAU,IAAI;AAC1B,gBAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,mBAAK,IAAI,GAAG;AACZ,mBAAK,KAAK,gBAAgB,MAAM,OAAO,IAAI,CAAC;AAAA,YAC9C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IAAA;AAAA,IAEF;AAAA;AAAA;AAAA;AAAA,MAIE,MAAM;AAAA,MAEN,mBAAmB,KAAK;AACtB,YAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,eAAO,iBAAiB,IAAI,IAAI,IAAI;AAAA,MACtC;AAAA,MAEA,WAAW;AAAA,QACT,QAAQ;AAAA,UACN,IAAI;AAAA,YACF,SAAS,CAAC,sBAAsB;AAAA,UAAA;AAAA,QAClC;AAAA,QAEF,MAAM,QAAQ,MAAM,IAAI;AACtB,gBAAM,UAAU,KAAK,YAAY;AACjC,gBAAM,OAAO,kBAAkB,EAAE;AACjC,gBAAM,UAAU,WAAW,OAAO;AAClC,gBAAM,WAAW,uBAAuB,OAAO;AAC/C,gBAAM,UAAU,OAAO,YAAY;AAEnC,cAAI,yBAAyB;AAC3B,gBAAI,mBAAmB,IAAI,GAAG;AAC5B,uBAAS,mBAAmB;AAAA,gBAC1B,KAAK;AAAA,gBACL,IAAI,cAAc,EAAE;AAAA,gBACpB;AAAA,cAAA,CACD;AAAA,YACH;AAAA,UACF;AAEA,cAAI,CAAC,oBAAoB,IAAI,GAAG;AAC9B,mBAAO;AAAA,UACT;AAiBA,gBAAM,gBAAgB,gBAAgB,gBAAgB,IAAI,GAAG,QAAQ;AACrE,cAAI,eAAe;AAGjB,gBAAI,cAA6B,CAAA;AACjC,gBAAI;AACF,4BAAc,oBAAoB,IAAI;AAAA,YACxC,QAAQ;AAAA,YAER;AAEA,gBAAI,SAAS;AACX,qBAAO,gCAAgC,WAAW;AAAA,YACpD;AAIA,kBAAM,YAAY;AAAA,cAChB;AAAA,gBAEE,KAAK;AAAA,gBAEL,UACE,OAAO,sBAAsB,UAAU,UAAU;AAAA,gBACnD,UAAU;AAAA,gBACV,WAAW,eAAe,MAAM,OAAO,IAAI;AAAA,gBAE3C,SAAS,cAAc;AAAA,gBACvB,SAAS,SAAS,eAAe,MAAM,OAAO,IAAI,CAAC,sBAAsB,OAAO;AAAA,gBAChF,OAAO,CAAA;AAAA,cAAC;AAAA,cAEV,OAAO;AAAA,cACP,OAAO;AAAA,YAAA;AAET,mBAAO,4BAA4B,aAAa,SAAS;AAAA,UAC3D;AAGA,cAAI;AACJ,cAAI;AACF,kBAAM,KAAK,qBAAA;AAAA,UACb,QAAQ;AACN,kBAAM;AAAA,UACR;AAEA,cAAI;AACJ,cAAI,KAAK,gBAAgB;AACvB,2BAAe;AAAA,cACb;AAAA,cACA;AAAA,cACA,OAAO;AAAA,YAAA;AAAA,UAEX;AAEA,gBAAM,YAAY,eAAe,IAAI;AACrC,gBAAM,WAAW,cAAc,EAAE;AAEjC,gBAAM,WAAW,OAAO,OAAO;AAC/B,gBAAM,mBAAmB,GAAG,SAAS,sBAAsB;AAG3D,cAAI,kBAAkB;AACpB,qBAAS,sBAAsB,IAAI,IAAI;AAAA,UACzC;AAEA,gBAAM,SAA0B;AAAA,YAC9B;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UAAA;AAEF,+BAAqB,UAAU,MAAM,UAAU,MAAM;AASrD,cAAI,QAAS,QAAO;AAIpB,gBAAM,YAAY,OAAO,sBAAsB;AAC/C,gBAAM,gBAAgB,qBAAqB,IAAI;AAC/C,gBAAM,uCAAuB,IAAA;AAC7B,gBAAM,+CAA+B,IAAA;AACrC,qBAAW,OAAO,eAAe;AAC/B,gBAAI;AACF,oBAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI,EAAE,UAAU,MAAM;AAC/D,kBAAI,YAAY,CAAC,SAAS,UAAU;AAClC,sBAAM,eAAe;AAAA,kBACnB,SAAS;AAAA,kBACT,OAAO;AAAA,kBACP;AAAA,gBAAA;AAGF,iCAAiB,IAAI,YAAY;AAWjC,oBAAI,SAAS,GAAG,SAAS,mCAAmC,GAAG;AAC7D,sBAAI;AAEJ,wBAAM,UAAU,SAAS,kBAAkB,IAAI,IAAI;AACnD,sBAAI,SAAS;AACX,0BAAM,QAAQ,QAAQ;AAAA,sBACpB,CAAC,OAAO,GAAG,KAAK,cAAc,OAAO,GAAG,KAAK;AAAA,oBAAA;AAE/C,wBAAI,MAAO,gBAAe,MAAM,KAAK;AAAA,kBACvC;AACA,sBAAI,gBAAgB,iBAAiB,cAAc;AACjD,qCAAiB,IAAI,YAAY;AACjC,6BAAS,MAAM,QAAQ,cAAc,MAAM,GAAG;AAAA,kBAChD;AAAA,gBACF;AAGA,yBAAS,MAAM,QAAQ,cAAc,MAAM,GAAG;AAE9C,oBAAI,WAAW;AACb,wBAAM,eAAe,gBAAgB,YAAY;AACjD,wBAAM,YAAY,gBAAgB,cAAc,QAAQ;AAExD,sBAAI,WAAW;AACb,0BAAM,OAAO,MAAM;AAAA,sBACjB,SAAS;AAAA,sBACT;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA,UAAU;AAAA,oBAAA;AAGZ,0BAAM,cAAc,MAAM;AAAA,sBACxB;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,sBACA;AAAA,oBAAA;AAGF,wBAAI,aAAa;AACf,+CAAyB;AAAA,wBACvB;AAAA,wBACA,YAAY,WAAW,IAAI,IACvB,8BAA8B,YAAY,MAAM,CAAC,IACjD;AAAA,sBAAA;AAAA,oBAER;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF,QAAQ;AAAA,YAER;AAAA,UACF;AACA,mBAAS,qBAAqB,IAAI,UAAU,gBAAgB;AAC5D,cAAI,aAAa,QAAQ,CAAC,kBAAkB;AAC1C,qBAAS,qBAAqB,IAAI,MAAM,gBAAgB;AAAA,UAC1D;AAEA,gBAAM,yBAAyB,UAAU,KAAK,KAAK,KAAK,IAAI,CAAC;AAE7D,cAAI,yBAAyB,OAAO,GAAG;AACrC,gBAAI;AACF,oBAAM,YAAY;AAAA,gBAChB;AAAA,gBACA;AAAA,gBACA,IAAI,IAAI,yBAAyB,MAAM;AAAA,gBACvC,CAAC,WACC,yBAAyB,IAAI,MAAM,KAAK;AAAA,cAAA;AAG5C,kBAAI,CAAC,WAAW;AACd,uBAAO;AAAA,cACT;AAEA,oBAAM,gBAAgB,UAAU,MAC5B;AAAA,gBACE,GAAG,UAAU;AAAA,gBACb,SAAS,OAAO,UAAU,IAAI,OAAO;AAAA,gBACrC,gBACE,UAAU,IAAI,gBAAgB;AAAA,kBAC5B,CAAC,MAAqB,KAAK;AAAA,gBAAA,KACxB,CAAA;AAAA,cAAC,IAEV;AAAA,gBACE,SAAS;AAAA,gBACT,MAAM;AAAA,gBACN,OAAO,CAAA;AAAA,gBACP,SAAS,CAAC,EAAE;AAAA,gBACZ,gBAAgB,CAAC,IAAI;AAAA,gBACrB,UAAU;AAAA,cAAA;AAGhB,qBAAO;AAAA,gBACL,MAAM,UAAU;AAAA,gBAChB,KAAK;AAAA,cAAA;AAAA,YAET,QAAQ;AAAA,YAER;AAAA,UACF;AAEA,iBAAO;AAAA,QACT;AAAA,MAAA;AAAA,IACF;AAAA,EACF;AAEJ;"}
+{"version":3,"file":"plugin.js","names":[],"sources":["../../../src/import-protection-plugin/plugin.ts"],"sourcesContent":["import { normalizePath } from 'vite'\n\nimport { resolveViteId } from '../utils'\nimport { VITE_ENVIRONMENT_NAMES } from '../constants'\nimport { ImportGraph, buildTrace, formatViolation } from './trace'\nimport {\n  getDefaultImportProtectionRules,\n  getMarkerSpecifiers,\n} from './defaults'\nimport { compileMatchers, matchesAny } from './matchers'\nimport {\n  buildResolutionCandidates,\n  buildSourceCandidates,\n  canonicalizeResolvedId,\n  clearNormalizeFilePathCache,\n  debugLog,\n  dedupePatterns,\n  escapeRegExp,\n  extractImportSources,\n  getOrCreate,\n  isInsideDirectory,\n  matchesDebugFilter,\n  normalizeFilePath,\n  relativizePath,\n  shouldDeferViolation,\n} from './utils'\nimport {\n  collectMockExportNamesBySource,\n  collectNamedExports,\n  rewriteDeniedImports,\n} from './rewriteDeniedImports'\nimport {\n  MOCK_BUILD_PREFIX,\n  generateDevSelfDenialModule,\n  generateSelfContainedMockModule,\n  getResolvedVirtualModuleMatchers,\n  loadResolvedVirtualModule,\n  makeMockEdgeModuleId,\n  mockRuntimeModuleIdFromViolation,\n  resolveInternalVirtualModuleId,\n  resolvedMarkerVirtualModuleId,\n} from './virtualModules'\nimport { ExtensionlessAbsoluteIdResolver } from './extensionlessAbsoluteIdResolver'\nimport {\n  IMPORT_PROTECTION_DEBUG,\n  SERVER_FN_LOOKUP_QUERY,\n  VITE_BROWSER_VIRTUAL_PREFIX,\n} from './constants'\nimport {\n  ImportLocCache,\n  addTraceImportLocations,\n  buildCodeSnippet,\n  buildLineIndex,\n  findImportStatementLocationFromTransformed,\n  findPostCompileUsageLocation,\n  pickOriginalCodeFromSourcesContent,\n} from './sourceLocation'\nimport type { PluginOption, ViteDevServer } from 'vite'\nimport type { CompiledMatcher } from './matchers'\nimport type { Loc, TraceStep, ViolationInfo } from './trace'\nimport type {\n  SourceMapLike,\n  TransformResult,\n  TransformResultProvider,\n} from './sourceLocation'\nimport type { ImportProtectionOptions } from '../schema'\nimport type {\n  EnvRules,\n  EnvState,\n  HandleViolationResult,\n  ImportProtectionPluginOptions,\n  ModuleGraphNode,\n  PendingViolation,\n  PluginConfig,\n  SharedState,\n  ViolationReporter,\n} from './types'\n\nexport type { ImportProtectionPluginOptions } from './types'\n\nexport function importProtectionPlugin(\n  opts: ImportProtectionPluginOptions,\n): PluginOption {\n  let devServer: ViteDevServer | null = null\n  const extensionlessIdResolver = new ExtensionlessAbsoluteIdResolver()\n  const resolveExtensionlessAbsoluteId = (id: string) =>\n    extensionlessIdResolver.resolve(id)\n\n  const importPatternCache = new Map<string, Array<RegExp>>()\n\n  function findFirstImportSpecifierIndex(code: string, source: string): number {\n    let patterns = importPatternCache.get(source)\n    if (!patterns) {\n      const escaped = escapeRegExp(source)\n      patterns = [\n        new RegExp(`\\\\bimport\\\\s+(['\"])${escaped}\\\\1`),\n        new RegExp(`\\\\bfrom\\\\s+(['\"])${escaped}\\\\1`),\n        new RegExp(`\\\\bimport\\\\s*\\\\(\\\\s*(['\"])${escaped}\\\\1\\\\s*\\\\)`),\n      ]\n      importPatternCache.set(source, patterns)\n    }\n\n    let best = -1\n    for (const re of patterns) {\n      const m = re.exec(code)\n      if (!m) continue\n      const idx = m.index + m[0].indexOf(source)\n      if (idx === -1) continue\n      if (best === -1 || idx < best) best = idx\n    }\n    return best\n  }\n\n  /**\n   * Build an import trace using Vite's per-environment module graph, which\n   * is authoritative even on warm starts when the plugin's own ImportGraph\n   * may be incomplete (Vite skips resolveId for cached modules).\n   */\n  function buildTraceFromModuleGraph(\n    envName: string,\n    env: EnvState,\n    targetFile: string,\n  ): Array<TraceStep> | null {\n    if (!devServer) return null\n    const environment = devServer.environments[envName]\n    if (!environment) return null\n\n    const file = normalizeFilePath(targetFile)\n    const start = environment.moduleGraph.getModuleById(file)\n    if (!start) return null\n\n    // Resolve a module graph node to its normalized file path once and\n    // cache the result so BFS + reconstruction don't recompute.\n    const nodeIds = new Map<ModuleGraphNode, string>()\n    function nodeId(n: ModuleGraphNode): string {\n      let cached = nodeIds.get(n)\n      if (cached === undefined) {\n        cached = n.id\n          ? normalizeFilePath(n.id)\n          : n.url\n            ? normalizeFilePath(n.url)\n            : ''\n        nodeIds.set(n, cached)\n      }\n      return cached\n    }\n\n    const queue: Array<ModuleGraphNode> = [start]\n    const visited = new Set<ModuleGraphNode>([start])\n    const parent = new Map<ModuleGraphNode, ModuleGraphNode>()\n\n    let entryRoot: ModuleGraphNode | null = null\n    let fallbackRoot: ModuleGraphNode | null = null\n    let qi = 0\n    while (qi < queue.length) {\n      const node = queue[qi++]!\n      const id = nodeId(node)\n\n      if (id && env.graph.entries.has(id)) {\n        entryRoot = node\n        break\n      }\n\n      const importers = node.importers\n      if (importers.size === 0) {\n        if (!fallbackRoot) fallbackRoot = node\n        continue\n      }\n\n      for (const imp of importers) {\n        if (visited.has(imp)) continue\n        visited.add(imp)\n        parent.set(imp, node)\n        queue.push(imp)\n      }\n    }\n\n    const root = entryRoot ?? fallbackRoot\n\n    if (!root) return null\n\n    // Reconstruct: root -> ... -> start\n    const chain: Array<ModuleGraphNode> = []\n    let cur: ModuleGraphNode | undefined = root\n    for (let i = 0; i < config.maxTraceDepth + 2 && cur; i++) {\n      chain.push(cur)\n      if (cur === start) break\n      cur = parent.get(cur)\n    }\n\n    const steps: Array<TraceStep> = []\n    for (let i = 0; i < chain.length; i++) {\n      const id = nodeId(chain[i]!)\n      if (!id) continue\n      let specifier: string | undefined\n      if (i + 1 < chain.length) {\n        const nextId = nodeId(chain[i + 1]!)\n        if (nextId) {\n          specifier = env.graph.reverseEdges.get(nextId)?.get(id)\n        }\n      }\n      steps.push(specifier ? { file: id, specifier } : { file: id })\n    }\n\n    return steps.length ? steps : null\n  }\n\n  const config: PluginConfig = {\n    enabled: true,\n    root: '',\n    command: 'build',\n    srcDirectory: '',\n    framework: opts.framework,\n    effectiveBehavior: 'error',\n    mockAccess: 'error',\n    logMode: 'once',\n    maxTraceDepth: 20,\n    compiledRules: {\n      client: { specifiers: [], files: [], excludeFiles: [] },\n      server: { specifiers: [], files: [], excludeFiles: [] },\n    },\n    includeMatchers: [],\n    excludeMatchers: [],\n    ignoreImporterMatchers: [],\n    markerSpecifiers: { serverOnly: new Set(), clientOnly: new Set() },\n    envTypeMap: new Map(opts.environments.map((e) => [e.name, e.type])),\n    onViolation: undefined,\n  }\n\n  const envStates = new Map<string, EnvState>()\n  const shared: SharedState = { fileMarkerKind: new Map() }\n\n  /**\n   * Build the best available trace for a module and enrich each step with\n   * line/column locations.  Tries the plugin's own ImportGraph first, then\n   * Vite's moduleGraph (authoritative on warm start), keeping whichever is\n   * longer.  Annotates the last step with the denied specifier + location.\n   *\n   * Shared by {@link buildViolationInfo} and {@link processPendingViolations}.\n   */\n  async function rebuildAndAnnotateTrace(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    normalizedImporter: string,\n    specifier: string,\n    importerLoc: Loc | undefined,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<Array<TraceStep>> {\n    let trace =\n      traceOverride ??\n      buildTrace(env.graph, normalizedImporter, config.maxTraceDepth)\n\n    if (config.command === 'serve') {\n      const mgTrace = buildTraceFromModuleGraph(\n        envName,\n        env,\n        normalizedImporter,\n      )\n      if (mgTrace && mgTrace.length > trace.length) {\n        trace = mgTrace\n      }\n    }\n    await addTraceImportLocations(\n      provider,\n      trace,\n      env.importLocCache,\n      findFirstImportSpecifierIndex,\n    )\n\n    if (trace.length > 0) {\n      const last = trace[trace.length - 1]!\n      if (!last.specifier) last.specifier = specifier\n      if (importerLoc && last.line == null) {\n        last.line = importerLoc.line\n        last.column = importerLoc.column\n      }\n    }\n\n    return trace\n  }\n\n  /**\n   * Build a complete {@link ViolationInfo} with trace, location, and snippet.\n   *\n   * This is the single path that all violation types go through: specifier,\n   * file, and marker.\n   */\n  async function buildViolationInfo(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    normalizedImporter: string,\n    source: string,\n    overrides: Omit<\n      ViolationInfo,\n      | 'env'\n      | 'envType'\n      | 'behavior'\n      | 'specifier'\n      | 'importer'\n      | 'trace'\n      | 'snippet'\n      | 'importerLoc'\n    >,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo> {\n    const sourceCandidates = buildSourceCandidates(\n      source,\n      'resolved' in overrides && typeof overrides.resolved === 'string'\n        ? overrides.resolved\n        : undefined,\n      config.root,\n    )\n\n    const loc = await resolveImporterLocation(\n      provider,\n      env,\n      importer,\n      sourceCandidates,\n    )\n\n    const trace = await rebuildAndAnnotateTrace(\n      provider,\n      env,\n      envName,\n      normalizedImporter,\n      source,\n      loc,\n      traceOverride,\n    )\n\n    const snippet = loc ? buildCodeSnippet(provider, importer, loc) : undefined\n\n    return {\n      env: envName,\n      envType,\n      behavior: config.effectiveBehavior,\n      specifier: source,\n      importer: normalizedImporter,\n      ...(loc ? { importerLoc: loc } : {}),\n      trace,\n      snippet,\n      ...overrides,\n    }\n  }\n\n  async function resolveImporterLocation(\n    provider: TransformResultProvider,\n    env: EnvState,\n    importer: string,\n    sourceCandidates: Iterable<string>,\n  ): Promise<Loc | undefined> {\n    for (const candidate of sourceCandidates) {\n      const loc =\n        (await findPostCompileUsageLocation(provider, importer, candidate)) ||\n        (await findImportStatementLocationFromTransformed(\n          provider,\n          importer,\n          candidate,\n          env.importLocCache,\n          findFirstImportSpecifierIndex,\n        ))\n      if (loc) return loc\n    }\n    return undefined\n  }\n\n  /**\n   * Check if a resolved import violates marker restrictions (e.g. importing\n   * a server-only module in the client env).  If so, build and return the\n   * {@link ViolationInfo} — the caller is responsible for reporting/deferring.\n   *\n   * Returns `undefined` when the resolved import has no marker conflict.\n   */\n  async function buildMarkerViolationFromResolvedImport(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    source: string,\n    resolvedId: string,\n    relativePath: string,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo | undefined> {\n    const normalizedResolvedId = normalizeFilePath(resolvedId)\n    const markerKind = shared.fileMarkerKind.get(normalizedResolvedId)\n    const violates =\n      (envType === 'client' && markerKind === 'server') ||\n      (envType === 'server' && markerKind === 'client')\n    if (!violates) return undefined\n\n    const normalizedImporter = normalizeFilePath(importer)\n\n    return buildViolationInfo(\n      provider,\n      env,\n      envName,\n      envType,\n      importer,\n      normalizedImporter,\n      source,\n      {\n        type: 'marker',\n        resolved: normalizedResolvedId,\n        message: buildMarkerViolationMessage(relativePath, markerKind),\n      },\n      traceOverride,\n    )\n  }\n\n  function buildMarkerViolationMessage(\n    relativePath: string,\n    markerKind: 'server' | 'client' | undefined,\n  ): string {\n    return markerKind === 'server'\n      ? `Module \"${relativePath}\" is marked server-only but is imported in the client environment`\n      : `Module \"${relativePath}\" is marked client-only but is imported in the server environment`\n  }\n\n  async function buildFileViolationInfo(\n    provider: TransformResultProvider,\n    env: EnvState,\n    envName: string,\n    envType: 'client' | 'server',\n    importer: string,\n    normalizedImporter: string,\n    source: string,\n    resolvedPath: string,\n    pattern: string | RegExp,\n    traceOverride?: Array<TraceStep>,\n  ): Promise<ViolationInfo> {\n    const relativePath = getRelativePath(resolvedPath)\n\n    return buildViolationInfo(\n      provider,\n      env,\n      envName,\n      envType,\n      importer,\n      normalizedImporter,\n      source,\n      {\n        type: 'file',\n        pattern,\n        resolved: resolvedPath,\n        message: `Import \"${source}\" (resolved to \"${relativePath}\") is denied in the ${envType} environment`,\n      },\n      traceOverride,\n    )\n  }\n\n  function getEnvType(envName: string): 'client' | 'server' {\n    return config.envTypeMap.get(envName) ?? 'server'\n  }\n\n  function getRulesForEnvironment(envName: string): EnvRules {\n    const type = getEnvType(envName)\n    return type === 'client'\n      ? config.compiledRules.client\n      : config.compiledRules.server\n  }\n\n  /**\n   * Check if a relative path matches any denied file pattern for the given\n   * environment, respecting `excludeFiles`.  Returns the matching pattern\n   * or `undefined` if the file is not denied.\n   */\n  function checkFileDenial(\n    relativePath: string,\n    matchers: {\n      files: Array<CompiledMatcher>\n      excludeFiles: Array<CompiledMatcher>\n    },\n  ): CompiledMatcher | undefined {\n    if (\n      matchers.excludeFiles.length > 0 &&\n      matchesAny(relativePath, matchers.excludeFiles)\n    ) {\n      return undefined\n    }\n    return matchers.files.length > 0\n      ? matchesAny(relativePath, matchers.files)\n      : undefined\n  }\n\n  const environmentNames = new Set<string>([\n    VITE_ENVIRONMENT_NAMES.client,\n    VITE_ENVIRONMENT_NAMES.server,\n  ])\n  if (opts.providerEnvName !== VITE_ENVIRONMENT_NAMES.server) {\n    environmentNames.add(opts.providerEnvName)\n  }\n\n  /** Get (or lazily create) the per-env state for the given environment name. */\n  function getEnv(envName: string): EnvState {\n    let envState = envStates.get(envName)\n    if (!envState) {\n      const transformResultCache = new Map<string, TransformResult>()\n      envState = {\n        graph: new ImportGraph(),\n        mockExportsByImporter: new Map(),\n        resolveCache: new Map(),\n        resolveCacheByFile: new Map(),\n        importLocCache: new ImportLocCache(),\n        seenViolations: new Set(),\n        transformResultCache,\n        transformResultKeysByFile: new Map(),\n        transformResultProvider: {\n          getTransformResult(id: string) {\n            const fullKey = normalizePath(id)\n            const exact = transformResultCache.get(fullKey)\n            if (exact) return exact\n            const strippedKey = normalizeFilePath(id)\n            return strippedKey !== fullKey\n              ? transformResultCache.get(strippedKey)\n              : undefined\n          },\n        },\n        postTransformImports: new Map(),\n        serverFnLookupModules: new Set(),\n        pendingViolations: new Map(),\n        deferredBuildViolations: [],\n      }\n      envStates.set(envName, envState)\n    }\n    return envState\n  }\n\n  /**\n   * Search a parsed export-names map for an entry matching any of the\n   * specifier candidates.  Returns matching names or empty array.\n   */\n  function findExportsInMap(\n    exportMap: Map<string, Array<string>>,\n    candidates: Array<string>,\n  ): Array<string> {\n    for (const candidate of candidates) {\n      const hit = exportMap.get(candidate)\n      if (hit && hit.length > 0) return hit\n    }\n    return []\n  }\n\n  /**\n   * Build deduped resolution candidates for a module ID, including the\n   * extensionless absolute path when the ID looks like a file path.\n   */\n  function buildIdCandidates(id: string, extra?: string): Array<string> {\n    const set = new Set(buildResolutionCandidates(id))\n    if (extra) {\n      for (const c of buildResolutionCandidates(extra)) set.add(c)\n      set.add(resolveExtensionlessAbsoluteId(extra))\n    }\n    return Array.from(set)\n  }\n\n  /**\n   * Resolve which named exports the importer needs from a denied specifier,\n   * so mock-edge modules can provide explicit ESM named exports.\n   *\n   * Tries multiple strategies: cached export maps, AST parsing, and\n   * resolver-based comparison.\n   */\n  async function resolveExportsForDeniedSpecifier(\n    env: EnvState,\n    ctx: ViolationReporter,\n    info: ViolationInfo,\n    importerIdHint?: string,\n  ): Promise<Array<string>> {\n    const importerFile = normalizeFilePath(info.importer)\n    const specifierCandidates = buildIdCandidates(info.specifier, info.resolved)\n\n    // Only parse AST when a violation occurs (this function is only called\n    // while handling a violation). Cache per-importer to avoid repeated parses\n    // across multiple violations.\n    let parsedBySource = env.mockExportsByImporter.get(importerFile)\n    if (!parsedBySource) {\n      // Try transform-cache result first, then moduleInfo fallback.\n      const importerCode =\n        env.transformResultProvider.getTransformResult(importerFile)?.code ??\n        (importerIdHint && ctx.getModuleInfo\n          ? (ctx.getModuleInfo(importerIdHint)?.code ?? undefined)\n          : undefined)\n      if (typeof importerCode !== 'string' || importerCode.length === 0)\n        return []\n\n      try {\n        parsedBySource = collectMockExportNamesBySource(importerCode)\n\n        // Also index by resolved physical IDs so later lookups match.\n        await recordMockExportsForImporter(\n          env,\n          importerFile,\n          parsedBySource,\n          async (src) => {\n            const cacheKey = `${importerFile}:${src}`\n            if (env.resolveCache.has(cacheKey)) {\n              return env.resolveCache.get(cacheKey) ?? undefined\n            }\n            if (!ctx.resolve) return undefined\n            const resolved = await ctx.resolve(src, info.importer, {\n              skipSelf: true,\n            })\n            if (!resolved || resolved.external) return undefined\n            return resolved.id\n          },\n        )\n\n        // Keep the parsed-by-source map for direct lookups.\n        parsedBySource =\n          env.mockExportsByImporter.get(importerFile) ?? parsedBySource\n      } catch {\n        return []\n      }\n    }\n\n    // 1. Direct candidate match\n    const direct = findExportsInMap(parsedBySource, specifierCandidates)\n    if (direct.length > 0) return direct\n\n    // 2. Resolve each source key and compare candidates.\n    const candidateSet = new Set(specifierCandidates)\n    for (const [sourceKey, names] of parsedBySource) {\n      if (!names.length) continue\n\n      const resolvedId = await resolveSourceKey(\n        env,\n        ctx,\n        importerFile,\n        sourceKey,\n        info.importer,\n      )\n      if (!resolvedId) continue\n\n      const resolvedCandidates = buildIdCandidates(resolvedId)\n      resolvedCandidates.push(resolveExtensionlessAbsoluteId(resolvedId))\n      if (resolvedCandidates.some((v) => candidateSet.has(v))) {\n        return names\n      }\n    }\n\n    return []\n  }\n\n  /** Best-effort resolve a source key using the cache or ctx.resolve. */\n  async function resolveSourceKey(\n    env: EnvState,\n    ctx: ViolationReporter,\n    importerFile: string,\n    sourceKey: string,\n    importerId: string,\n  ): Promise<string | undefined> {\n    const cacheKey = `${importerFile}:${sourceKey}`\n    if (env.resolveCache.has(cacheKey)) {\n      return env.resolveCache.get(cacheKey) ?? undefined\n    }\n    if (!ctx.resolve) return undefined\n    try {\n      const resolved = await ctx.resolve(sourceKey, importerId, {\n        skipSelf: true,\n      })\n      if (!resolved || resolved.external) return undefined\n      return resolved.id\n    } catch {\n      return undefined\n    }\n  }\n\n  async function recordMockExportsForImporter(\n    env: EnvState,\n    importerId: string,\n    namesBySource: Map<string, Array<string>>,\n    resolveSource: (source: string) => Promise<string | undefined>,\n  ): Promise<void> {\n    const importerFile = normalizeFilePath(importerId)\n\n    if (namesBySource.size === 0) return\n\n    for (const [source, names] of namesBySource) {\n      try {\n        const resolvedId = await resolveSource(source)\n        if (!resolvedId) continue\n\n        namesBySource.set(normalizeFilePath(resolvedId), names)\n        namesBySource.set(resolveExtensionlessAbsoluteId(resolvedId), names)\n      } catch {\n        // Best-effort only\n      }\n    }\n\n    const existing = env.mockExportsByImporter.get(importerFile)\n    if (!existing) {\n      env.mockExportsByImporter.set(importerFile, namesBySource)\n      return\n    }\n\n    for (const [source, names] of namesBySource) {\n      const prev = existing.get(source)\n      if (!prev) {\n        existing.set(source, names)\n        continue\n      }\n\n      const union = new Set([...prev, ...names])\n      existing.set(source, Array.from(union).sort())\n    }\n  }\n\n  const shouldCheckImporterCache = new Map<string, boolean>()\n  function shouldCheckImporter(importer: string): boolean {\n    let result = shouldCheckImporterCache.get(importer)\n    if (result !== undefined) return result\n\n    const relativePath = relativizePath(importer, config.root)\n\n    // Excluded or ignored importers are never checked.\n    const excluded =\n      (config.excludeMatchers.length > 0 &&\n        matchesAny(relativePath, config.excludeMatchers)) ||\n      (config.ignoreImporterMatchers.length > 0 &&\n        matchesAny(relativePath, config.ignoreImporterMatchers))\n\n    if (excluded) {\n      result = false\n    } else if (config.includeMatchers.length > 0) {\n      result = !!matchesAny(relativePath, config.includeMatchers)\n    } else if (config.srcDirectory) {\n      result = isInsideDirectory(importer, config.srcDirectory)\n    } else {\n      result = true\n    }\n\n    shouldCheckImporterCache.set(importer, result)\n    return result\n  }\n\n  function dedupeKey(info: ViolationInfo): string {\n    return `${info.type}:${info.importer}:${info.specifier}:${info.resolved ?? ''}`\n  }\n\n  function hasSeen(env: EnvState, key: string): boolean {\n    if (config.logMode === 'always') return false\n    if (env.seenViolations.has(key)) return true\n    env.seenViolations.add(key)\n    return false\n  }\n\n  function getRelativePath(absolutePath: string): string {\n    return relativizePath(normalizePath(absolutePath), config.root)\n  }\n\n  /** Reset all caches on an EnvState (called from buildStart). */\n  function clearEnvState(envState: EnvState): void {\n    envState.resolveCache.clear()\n    envState.resolveCacheByFile.clear()\n    envState.importLocCache.clear()\n    envState.seenViolations.clear()\n    envState.transformResultCache.clear()\n    envState.transformResultKeysByFile.clear()\n    envState.postTransformImports.clear()\n    envState.serverFnLookupModules.clear()\n    envState.pendingViolations.clear()\n    envState.deferredBuildViolations.length = 0\n    envState.graph.clear()\n    envState.mockExportsByImporter.clear()\n  }\n\n  /** Invalidate all env-level caches that reference a specific file. */\n  function invalidateFileFromEnv(envState: EnvState, file: string): void {\n    envState.importLocCache.deleteByFile(file)\n\n    // Resolve cache (keyed \"importer:source\")\n    const resolveKeys = envState.resolveCacheByFile.get(file)\n    if (resolveKeys) {\n      for (const key of resolveKeys) envState.resolveCache.delete(key)\n      envState.resolveCacheByFile.delete(file)\n    }\n\n    envState.graph.invalidate(file)\n    envState.mockExportsByImporter.delete(file)\n    envState.serverFnLookupModules.delete(file)\n    envState.pendingViolations.delete(file)\n\n    // Transform result cache + post-transform imports\n    const transformKeys = envState.transformResultKeysByFile.get(file)\n    if (transformKeys) {\n      for (const key of transformKeys) {\n        envState.transformResultCache.delete(key)\n        envState.postTransformImports.delete(key)\n      }\n      envState.transformResultKeysByFile.delete(file)\n    } else {\n      envState.transformResultCache.delete(file)\n      envState.postTransformImports.delete(file)\n    }\n  }\n\n  /** Store a transform result under both the cacheKey and physical file path. */\n  function cacheTransformResult(\n    envState: EnvState,\n    file: string,\n    cacheKey: string,\n    result: TransformResult,\n  ): void {\n    envState.transformResultCache.set(cacheKey, result)\n    const keySet = getOrCreate(\n      envState.transformResultKeysByFile,\n      file,\n      () => new Set<string>(),\n    )\n    keySet.add(cacheKey)\n    if (cacheKey !== file) {\n      envState.transformResultCache.set(file, result)\n      keySet.add(file)\n    }\n  }\n\n  /** Register known Start entrypoints as trace roots for all environments. */\n  function registerEntries(): void {\n    const { resolvedStartConfig } = opts.getConfig()\n    for (const envDef of opts.environments) {\n      const envState = getEnv(envDef.name)\n      if (resolvedStartConfig.routerFilePath) {\n        envState.graph.addEntry(\n          normalizePath(resolvedStartConfig.routerFilePath),\n        )\n      }\n      if (resolvedStartConfig.startFilePath) {\n        envState.graph.addEntry(\n          normalizePath(resolvedStartConfig.startFilePath),\n        )\n      }\n    }\n  }\n\n  /**\n   * Get the merged set of post-transform imports for a file, checking all\n   * code-split variants.  Returns `null` if no post-transform data exists\n   * yet (transform hasn't run).\n   *\n   * Skips `SERVER_FN_LOOKUP` variants because they contain untransformed\n   * code — the Start compiler excludes them.\n   */\n  function getPostTransformImports(\n    env: EnvState,\n    file: string,\n  ): Set<string> | null {\n    const keySet = env.transformResultKeysByFile.get(file)\n    let merged: Set<string> | null = null\n\n    if (keySet) {\n      for (const k of keySet) {\n        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue\n        const imports = env.postTransformImports.get(k)\n        if (imports) {\n          if (!merged) merged = new Set(imports)\n          else for (const v of imports) merged.add(v)\n        }\n      }\n    }\n\n    // Fallback: direct file-path key\n    if (!merged) {\n      const imports = env.postTransformImports.get(file)\n      if (imports) merged = new Set(imports)\n    }\n\n    return merged\n  }\n\n  /**\n   * Check whether an import edge from `parent` to `target` survived\n   * post-transform compilation.\n   *\n   * Returns:\n   *   - `'live'`    — target appears in a non-lookup variant's post-transform imports\n   *   - `'dead'`    — post-transform data exists but target is absent (compiler stripped it)\n   *   - `'pending'` — transform ran but import data not yet posted\n   *   - `'no-data'` — transform never ran (warm-start cached module)\n   */\n  function checkEdgeLiveness(\n    env: EnvState,\n    parent: string,\n    target: string,\n  ): 'live' | 'dead' | 'pending' | 'no-data' {\n    const keySet = env.transformResultKeysByFile.get(parent)\n    let anyVariantCached = false\n\n    if (keySet) {\n      for (const k of keySet) {\n        if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue\n        const imports = env.postTransformImports.get(k)\n        if (imports) {\n          anyVariantCached = true\n          if (imports.has(target)) return 'live'\n        }\n      }\n    }\n\n    if (!anyVariantCached) {\n      const imports = env.postTransformImports.get(parent)\n      if (imports) return imports.has(target) ? 'live' : 'dead'\n      const hasTransformResult =\n        env.transformResultCache.has(parent) ||\n        (keySet ? keySet.size > 0 : false)\n      return hasTransformResult ? 'pending' : 'no-data'\n    }\n\n    return 'dead'\n  }\n\n  function checkPostTransformReachability(\n    env: EnvState,\n    file: string,\n  ): 'reachable' | 'unreachable' | 'unknown' {\n    const visited = new Set<string>()\n    const queue: Array<string> = [file]\n    let hasUnknownEdge = false\n    let qi = 0\n\n    while (qi < queue.length) {\n      const current = queue[qi++]!\n      if (visited.has(current)) continue\n      visited.add(current)\n\n      if (env.graph.entries.has(current)) {\n        return 'reachable'\n      }\n\n      const importers = env.graph.reverseEdges.get(current)\n      if (!importers) continue\n\n      for (const [parent] of importers) {\n        if (visited.has(parent)) continue\n        const liveness = checkEdgeLiveness(env, parent, current)\n        if (liveness === 'live' || liveness === 'no-data') {\n          // Live edge or warm-start (no transform data) — follow it\n          queue.push(parent)\n        } else if (liveness === 'pending') {\n          hasUnknownEdge = true\n        }\n        // 'dead' — edge was stripped by compiler, skip\n      }\n    }\n\n    return hasUnknownEdge ? 'unknown' : 'unreachable'\n  }\n\n  /**\n   * Filter pending violations using edge-survival data.  Returns the subset\n   * of violations whose resolved import survived the Start compiler (or all\n   * violations when no post-transform data is available yet).\n   *\n   * Returns `undefined` when all violations were stripped or when we must wait\n   * for post-transform data before proceeding.\n   */\n  function filterEdgeSurvival(\n    env: EnvState,\n    file: string,\n    violations: Array<PendingViolation>,\n  ):\n    | { active: Array<PendingViolation>; edgeSurvivalApplied: boolean }\n    | 'all-stripped'\n    | 'await-transform' {\n    const postTransform = getPostTransformImports(env, file)\n\n    if (postTransform) {\n      const surviving = violations.filter(\n        (pv) => !pv.info.resolved || postTransform.has(pv.info.resolved),\n      )\n      if (surviving.length === 0) return 'all-stripped'\n      env.pendingViolations.set(file, surviving)\n      return { active: surviving, edgeSurvivalApplied: true }\n    }\n\n    // Pre-transform violations need edge-survival verification first.\n    if (violations.some((pv) => pv.fromPreTransformResolve)) {\n      return 'await-transform'\n    }\n\n    return { active: violations, edgeSurvivalApplied: false }\n  }\n\n  /**\n   * Process pending violations for the given environment.  Called from the\n   * transform-cache hook after each module transform is cached, because new\n   * transform data may allow us to confirm or discard pending violations.\n   *\n   * @param warnFn - `this.warn` from the transform hook context\n   */\n  async function processPendingViolations(\n    env: EnvState,\n    warnFn: (msg: string) => void,\n  ): Promise<void> {\n    if (env.pendingViolations.size === 0) return\n\n    const toDelete: Array<string> = []\n\n    for (const [file, violations] of env.pendingViolations) {\n      const filtered = filterEdgeSurvival(env, file, violations)\n\n      if (filtered === 'all-stripped') {\n        toDelete.push(file)\n        continue\n      }\n      if (filtered === 'await-transform') continue\n\n      const { active, edgeSurvivalApplied } = filtered\n\n      // Wait for entries before running reachability.  registerEntries()\n      // populates entries at buildStart; resolveId(!importer) may add more.\n      const status =\n        env.graph.entries.size > 0\n          ? checkPostTransformReachability(env, file)\n          : 'unknown'\n\n      if (status === 'reachable') {\n        for (const pv of active) {\n          await emitPendingViolation(env, warnFn, pv)\n        }\n        toDelete.push(file)\n      } else if (status === 'unreachable') {\n        toDelete.push(file)\n      } else if (config.command === 'serve') {\n        // 'unknown' reachability — some graph edges lack transform data.\n        // When edge-survival was applied, surviving violations are confirmed\n        // real.  Without it (warm start), emit conservatively.\n        let emittedAny = false\n        for (const pv of active) {\n          if (pv.fromPreTransformResolve) continue\n\n          const shouldEmit =\n            edgeSurvivalApplied ||\n            (pv.info.type === 'file' &&\n              !!pv.info.resolved &&\n              isInsideDirectory(pv.info.resolved, config.srcDirectory))\n\n          if (shouldEmit) {\n            emittedAny =\n              (await emitPendingViolation(env, warnFn, pv)) || emittedAny\n          }\n        }\n\n        if (emittedAny) {\n          toDelete.push(file)\n        }\n      }\n      // 'unknown' — keep pending for next transform-cache invocation.\n    }\n\n    for (const file of toDelete) {\n      env.pendingViolations.delete(file)\n    }\n  }\n\n  async function emitPendingViolation(\n    env: EnvState,\n    warnFn: (msg: string) => void,\n    pv: PendingViolation,\n  ): Promise<boolean> {\n    if (!pv.info.importerLoc) {\n      const sourceCandidates = buildSourceCandidates(\n        pv.info.specifier,\n        pv.info.resolved,\n        config.root,\n      )\n      const loc = await resolveImporterLocation(\n        env.transformResultProvider,\n        env,\n        pv.info.importer,\n        sourceCandidates,\n      )\n\n      if (loc) {\n        pv.info.importerLoc = loc\n        pv.info.snippet = buildCodeSnippet(\n          env.transformResultProvider,\n          pv.info.importer,\n          loc,\n        )\n      }\n    }\n\n    if (hasSeen(env, dedupeKey(pv.info))) {\n      return false\n    }\n\n    const freshTrace = await rebuildAndAnnotateTrace(\n      env.transformResultProvider,\n      env,\n      pv.info.env,\n      pv.info.importer,\n      pv.info.specifier,\n      pv.info.importerLoc,\n    )\n    if (freshTrace.length > pv.info.trace.length) {\n      pv.info.trace = freshTrace\n    }\n\n    if (config.onViolation) {\n      const result = await config.onViolation(pv.info)\n      if (result === false) return false\n    }\n\n    warnFn(formatViolation(pv.info, config.root))\n    return true\n  }\n\n  /**\n   * Record a violation as pending for later confirmation via graph\n   * reachability.  Called from `resolveId` when `shouldDefer` is true.\n   */\n  function deferViolation(\n    env: EnvState,\n    importerFile: string,\n    info: ViolationInfo,\n    isPreTransformResolve?: boolean,\n  ): void {\n    getOrCreate(env.pendingViolations, importerFile, () => []).push({\n      info,\n      fromPreTransformResolve: isPreTransformResolve,\n    })\n  }\n\n  /** Counter for generating unique per-violation mock module IDs in build mode. */\n  let buildViolationCounter = 0\n\n  async function handleViolation(\n    ctx: ViolationReporter,\n    env: EnvState,\n    info: ViolationInfo,\n    importerIdHint?: string,\n    violationOpts?: { silent?: boolean },\n  ): Promise<HandleViolationResult> {\n    if (!violationOpts?.silent) {\n      if (config.onViolation) {\n        const result = await config.onViolation(info)\n        if (result === false) return undefined\n      }\n\n      if (config.effectiveBehavior === 'error') {\n        // Dev+error: throw immediately.\n        // Always throw on error — do NOT deduplicate via hasSeen().\n        // Rollup may resolve the same specifier multiple times (e.g.\n        // commonjs--resolver's nested this.resolve() fires before\n        // getResolveStaticDependencyPromises). If we record the key\n        // on the first (nested) throw, the second (real) resolve\n        // silently returns undefined and the build succeeds — which\n        // is the bug this fixes.\n        //\n        // Build mode never reaches here — all build violations are\n        // deferred via shouldDefer and handled silently.\n        return ctx.error(formatViolation(info, config.root))\n      }\n\n      if (!hasSeen(env, dedupeKey(info))) {\n        ctx.warn(formatViolation(info, config.root))\n      }\n    } else if (\n      config.effectiveBehavior === 'error' &&\n      config.command !== 'build'\n    ) {\n      return undefined\n    }\n\n    // File violations: return resolved path — the self-denial transform\n    // will replace the file's content with a mock module.  This avoids\n    // virtual module IDs that could leak across environments via\n    // third-party resolver caches.\n    if (info.type === 'file') return info.resolved\n\n    // Non-file violations (specifier/marker): create mock-edge module.\n    // Dev mode uses a runtime diagnostics ID; build mode uses a unique\n    // per-violation ID so generateBundle can check tree-shaking survival.\n    const exports = await resolveExportsForDeniedSpecifier(\n      env,\n      ctx,\n      info,\n      importerIdHint,\n    )\n    const baseMockId =\n      config.command === 'serve'\n        ? mockRuntimeModuleIdFromViolation(info, config.mockAccess, config.root)\n        : `${MOCK_BUILD_PREFIX}${buildViolationCounter++}`\n    return resolveViteId(makeMockEdgeModuleId(exports, baseMockId))\n  }\n\n  /**\n   * Unified violation dispatch: either defers or reports immediately.\n   *\n   * When `shouldDefer` is true (dev mock + build modes), calls\n   * `handleViolation` silently to obtain the mock module ID, then stores\n   * the violation for later verification:\n   *   - Dev mock mode: all violations are deferred to `pendingViolations`\n   *     for edge-survival and graph-reachability checking via\n   *     `processPendingViolations`.\n   *   - Build mode (mock + error): defers to `deferredBuildViolations` for\n   *     tree-shaking verification in `generateBundle`.\n   *\n   * Otherwise reports immediately (dev error mode).  Pre-transform\n   * resolves are silenced in error mode because they fire before the\n   * compiler runs and there is no deferred verification path.\n   *\n   * Returns the mock module ID / resolve result from `handleViolation`.\n   */\n  async function reportOrDeferViolation(\n    ctx: ViolationReporter,\n    env: EnvState,\n    importerFile: string,\n    importerIdHint: string | undefined,\n    info: ViolationInfo,\n    shouldDefer: boolean,\n    isPreTransformResolve: boolean,\n  ): Promise<HandleViolationResult> {\n    if (shouldDefer) {\n      const result = await handleViolation(ctx, env, info, importerIdHint, {\n        silent: true,\n      })\n\n      if (config.command === 'build') {\n        // Build mode: store for generateBundle tree-shaking check.\n        // The mock-edge module ID is returned as a plain string.\n        const mockId = result ?? ''\n        env.deferredBuildViolations.push({\n          info,\n          mockModuleId: mockId,\n          // For marker violations, check importer survival instead of mock.\n          checkModuleId: info.type === 'marker' ? info.importer : undefined,\n        })\n      } else {\n        // Dev mock: store for graph-reachability check.\n        deferViolation(env, importerFile, info, isPreTransformResolve)\n        await processPendingViolations(env, ctx.warn.bind(ctx))\n      }\n\n      return result\n    }\n\n    // Non-deferred path: dev error mode only.\n    // Pre-transform resolves are silenced because they fire before the\n    // compiler runs — imports inside `.server()` callbacks haven't been\n    // stripped yet and error mode has no deferred verification.\n    return handleViolation(ctx, env, info, importerIdHint, {\n      silent: isPreTransformResolve,\n    })\n  }\n\n  return [\n    {\n      name: 'tanstack-start-core:import-protection',\n      enforce: 'pre',\n\n      applyToEnvironment(env) {\n        if (!config.enabled) return false\n        // Start's environments are named `client` and `ssr` (not `server`), plus\n        // an optional serverFn provider environment (eg `rsc`) when configured.\n        return environmentNames.has(env.name)\n      },\n\n      configResolved(viteConfig) {\n        config.root = viteConfig.root\n        config.command = viteConfig.command\n\n        const { startConfig, resolvedStartConfig } = opts.getConfig()\n        config.srcDirectory = resolvedStartConfig.srcDirectory\n\n        const userOpts: ImportProtectionOptions | undefined =\n          startConfig.importProtection\n\n        if (userOpts?.enabled === false) {\n          config.enabled = false\n          return\n        }\n\n        config.enabled = true\n\n        const behavior = userOpts?.behavior\n        if (typeof behavior === 'string') {\n          config.effectiveBehavior = behavior\n        } else {\n          config.effectiveBehavior =\n            viteConfig.command === 'serve'\n              ? (behavior?.dev ?? 'mock')\n              : (behavior?.build ?? 'error')\n        }\n\n        config.logMode = userOpts?.log ?? 'once'\n        config.mockAccess = userOpts?.mockAccess ?? 'error'\n        config.maxTraceDepth = userOpts?.maxTraceDepth ?? 20\n        if (userOpts?.onViolation) {\n          const fn = userOpts.onViolation\n          config.onViolation = (info) => fn(info)\n        }\n\n        const defaults = getDefaultImportProtectionRules()\n        // Use user-provided patterns when available, otherwise defaults.\n        const pick = <T>(user: Array<T> | undefined, fallback: Array<T>) =>\n          user ? [...user] : [...fallback]\n\n        // Client specifier denies always include framework defaults even\n        // when the user provides a custom list.\n        const clientSpecifiers = dedupePatterns([\n          ...defaults.client.specifiers,\n          ...(userOpts?.client?.specifiers ?? []),\n        ])\n\n        config.compiledRules.client = {\n          specifiers: compileMatchers(clientSpecifiers),\n          files: compileMatchers(\n            pick(userOpts?.client?.files, defaults.client.files),\n          ),\n          excludeFiles: compileMatchers(\n            pick(userOpts?.client?.excludeFiles, defaults.client.excludeFiles),\n          ),\n        }\n        config.compiledRules.server = {\n          specifiers: compileMatchers(\n            dedupePatterns(\n              pick(userOpts?.server?.specifiers, defaults.server.specifiers),\n            ),\n          ),\n          files: compileMatchers(\n            pick(userOpts?.server?.files, defaults.server.files),\n          ),\n          excludeFiles: compileMatchers(\n            pick(userOpts?.server?.excludeFiles, defaults.server.excludeFiles),\n          ),\n        }\n\n        config.includeMatchers = compileMatchers(userOpts?.include ?? [])\n        config.excludeMatchers = compileMatchers(userOpts?.exclude ?? [])\n        config.ignoreImporterMatchers = compileMatchers(\n          userOpts?.ignoreImporters ?? [],\n        )\n\n        // Marker specifiers\n        const markers = getMarkerSpecifiers()\n        config.markerSpecifiers = {\n          serverOnly: new Set(markers.serverOnly),\n          clientOnly: new Set(markers.clientOnly),\n        }\n      },\n\n      configureServer(server) {\n        devServer = server\n      },\n\n      buildStart() {\n        if (!config.enabled) return\n        // Clear memoization caches that grow unboundedly across builds\n        clearNormalizeFilePathCache()\n        extensionlessIdResolver.clear()\n        importPatternCache.clear()\n        shouldCheckImporterCache.clear()\n\n        // Clear per-env caches\n        for (const envState of envStates.values()) {\n          clearEnvState(envState)\n        }\n\n        // Clear shared state\n        shared.fileMarkerKind.clear()\n\n        registerEntries()\n      },\n\n      hotUpdate(ctx) {\n        if (!config.enabled) return\n        // Invalidate caches for updated files\n        for (const mod of ctx.modules) {\n          if (mod.id) {\n            const id = mod.id\n            const importerFile = normalizeFilePath(id)\n\n            // Invalidate extensionless-resolution cache entries affected by this file.\n            extensionlessIdResolver.invalidateByFile(importerFile)\n            shared.fileMarkerKind.delete(importerFile)\n\n            // Invalidate per-env caches\n            for (const envState of envStates.values()) {\n              invalidateFileFromEnv(envState, importerFile)\n            }\n          }\n        }\n      },\n\n      async resolveId(source, importer, _options) {\n        const envName = this.environment.name\n        const env = getEnv(envName)\n        const envType = getEnvType(envName)\n        const provider = env.transformResultProvider\n        const isScanResolve = !!(_options as Record<string, unknown>).scan\n\n        if (IMPORT_PROTECTION_DEBUG) {\n          const importerPath = importer\n            ? normalizeFilePath(importer)\n            : '(entry)'\n          const isEntryResolve = !importer\n          const filtered =\n            process.env.TSR_IMPORT_PROTECTION_DEBUG_FILTER === 'entry'\n              ? isEntryResolve\n              : matchesDebugFilter(source, importerPath)\n          if (filtered) {\n            debugLog('resolveId', {\n              env: envName,\n              envType,\n              source,\n              importer: importerPath,\n              isEntryResolve,\n              command: config.command,\n            })\n          }\n        }\n\n        // Internal virtual modules (mock:build:N, mock-edge, mock-runtime, marker)\n        const internalVirtualId = resolveInternalVirtualModuleId(source)\n        if (internalVirtualId) return internalVirtualId\n\n        if (!importer) {\n          env.graph.addEntry(source)\n          // Flush pending violations now that an additional entry is known\n          // and reachability analysis may have new roots.\n          await processPendingViolations(env, this.warn.bind(this))\n          return undefined\n        }\n\n        if (source.startsWith('\\0') || source.startsWith('virtual:')) {\n          return undefined\n        }\n\n        const normalizedImporter = normalizeFilePath(importer)\n        const isDirectLookup = importer.includes(SERVER_FN_LOOKUP_QUERY)\n\n        if (isDirectLookup) {\n          env.serverFnLookupModules.add(normalizedImporter)\n        }\n\n        const isPreTransformResolve =\n          isDirectLookup ||\n          env.serverFnLookupModules.has(normalizedImporter) ||\n          isScanResolve\n\n        // Dev mock mode: defer all violations (including pre-transform\n        // resolves) until post-transform data is available, then\n        // confirm/discard via graph reachability.\n        // Build mode (both mock and error): defer violations until\n        // generateBundle so tree-shaking can eliminate false positives.\n        const isDevMock =\n          config.command === 'serve' && config.effectiveBehavior === 'mock'\n        const isBuild = config.command === 'build'\n        const shouldDefer = shouldDeferViolation({ isBuild, isDevMock })\n\n        const resolveAgainstImporter = async (): Promise<string | null> => {\n          const primary = await this.resolve(source, importer, {\n            skipSelf: true,\n          })\n          if (primary) {\n            return canonicalizeResolvedId(\n              primary.id,\n              config.root,\n              resolveExtensionlessAbsoluteId,\n            )\n          }\n\n          return null\n        }\n\n        // Check if this is a marker import\n        const markerKind = config.markerSpecifiers.serverOnly.has(source)\n          ? ('server' as const)\n          : config.markerSpecifiers.clientOnly.has(source)\n            ? ('client' as const)\n            : undefined\n\n        if (markerKind) {\n          const existing = shared.fileMarkerKind.get(normalizedImporter)\n          if (existing && existing !== markerKind) {\n            this.error(\n              `[import-protection] File \"${getRelativePath(normalizedImporter)}\" has both server-only and client-only markers. This is not allowed.`,\n            )\n          }\n          shared.fileMarkerKind.set(normalizedImporter, markerKind)\n\n          const violatesEnv =\n            (envType === 'client' && markerKind === 'server') ||\n            (envType === 'server' && markerKind === 'client')\n\n          if (violatesEnv) {\n            const info = await buildViolationInfo(\n              provider,\n              env,\n              envName,\n              envType,\n              importer,\n              normalizedImporter,\n              source,\n              {\n                type: 'marker',\n                message: buildMarkerViolationMessage(\n                  getRelativePath(normalizedImporter),\n                  markerKind,\n                ),\n              },\n            )\n            const markerResult = await reportOrDeferViolation(\n              this,\n              env,\n              normalizedImporter,\n              importer,\n              info,\n              shouldDefer,\n              isPreTransformResolve,\n            )\n\n            // In build mode, if the violation was deferred, return the unique\n            // build mock ID instead of the marker module. This lets\n            // generateBundle check whether the importer (and thus its marker\n            // import) survived tree-shaking. The mock is side-effect-free just\n            // like the marker module, and the bare import has no bindings, so\n            // replacing it is transparent.\n            if (isBuild && markerResult != null) {\n              return markerResult\n            }\n          }\n\n          // Retroactive marker violation detection: on cold starts, module\n          // A may import module B before B's marker is set (because B hasn't\n          // been processed yet).  When B's marker is set (here),\n          // retroactively check all known importers of B in the graph and\n          // create deferred marker violations for them.  Without this,\n          // cold-start ordering can miss marker violations that warm starts\n          // detect (warm starts see markers early from cached transforms).\n          //\n          // Uses lightweight `deferViolation` to avoid heavy side effects\n          // (mock module creation, export resolution).  Immediately calls\n          // `processPendingViolations` to flush the deferred violations,\n          // because the marker resolveId fires during Vite's import\n          // analysis (after our transform hook) — there may be no\n          // subsequent transform invocation to flush them.\n          //\n          // Guarded by `violatesEnv` (per-environment) plus a per-env\n          // seen-set.  The marker is shared across environments but each\n          // env's graph has its own edges; this ensures the check runs\n          // at most once per (env, module) pair.\n          const envRetroKey = `retro-marker:${normalizedImporter}`\n          if (violatesEnv && !env.seenViolations.has(envRetroKey)) {\n            env.seenViolations.add(envRetroKey)\n            let retroDeferred = false\n            const importersMap = env.graph.reverseEdges.get(normalizedImporter)\n            if (importersMap && importersMap.size > 0) {\n              for (const [importerFile, specifier] of importersMap) {\n                if (!specifier) continue\n                if (!shouldCheckImporter(importerFile)) continue\n                const markerInfo = await buildMarkerViolationFromResolvedImport(\n                  provider,\n                  env,\n                  envName,\n                  envType,\n                  importerFile,\n                  specifier,\n                  normalizedImporter,\n                  getRelativePath(normalizedImporter),\n                )\n                if (markerInfo) {\n                  deferViolation(\n                    env,\n                    importerFile,\n                    markerInfo,\n                    isPreTransformResolve,\n                  )\n                  retroDeferred = true\n                }\n              }\n            }\n            if (retroDeferred) {\n              await processPendingViolations(env, this.warn.bind(this))\n            }\n          }\n\n          return markerKind === 'server'\n            ? resolvedMarkerVirtualModuleId('server')\n            : resolvedMarkerVirtualModuleId('client')\n        }\n\n        // Check if the importer is within our scope\n        if (!shouldCheckImporter(normalizedImporter)) {\n          return undefined\n        }\n\n        const matchers = getRulesForEnvironment(envName)\n\n        // 1. Specifier-based denial\n        const specifierMatch = matchesAny(source, matchers.specifiers)\n        if (specifierMatch) {\n          if (!isPreTransformResolve) {\n            env.graph.addEdge(source, normalizedImporter, source)\n          }\n          const info = await buildViolationInfo(\n            provider,\n            env,\n            envName,\n            envType,\n            importer,\n            normalizedImporter,\n            source,\n            {\n              type: 'specifier',\n              pattern: specifierMatch.pattern,\n              message: `Import \"${source}\" is denied in the ${envType} environment`,\n            },\n          )\n\n          // Resolve the specifier so edge-survival can verify whether\n          // the import survives the Start compiler transform (e.g.\n          // factory-safe pattern strips imports inside .server() callbacks).\n          if (shouldDefer && !info.resolved) {\n            try {\n              const resolvedForInfo = await resolveAgainstImporter()\n              if (resolvedForInfo) info.resolved = resolvedForInfo\n            } catch {\n              // Non-fatal: edge-survival will skip unresolved specifiers\n            }\n          }\n\n          return reportOrDeferViolation(\n            this,\n            env,\n            normalizedImporter,\n            importer,\n            info,\n            shouldDefer,\n            isPreTransformResolve,\n          )\n        }\n\n        // 2. Resolve the import (cached)\n        const cacheKey = `${normalizedImporter}:${source}`\n        let resolved: string | null\n\n        if (env.resolveCache.has(cacheKey)) {\n          resolved = env.resolveCache.get(cacheKey) ?? null\n        } else {\n          resolved = await resolveAgainstImporter()\n\n          // Only cache successful resolves.  Null resolves can be\n          // order-dependent across importer variants (e.g. code-split\n          // `?tsr-split=...` ids) and may poison later lookups.\n          if (resolved !== null) {\n            env.resolveCache.set(cacheKey, resolved)\n            getOrCreate(\n              env.resolveCacheByFile,\n              normalizedImporter,\n              () => new Set(),\n            ).add(cacheKey)\n          }\n        }\n\n        if (resolved) {\n          const relativePath = getRelativePath(resolved)\n\n          // Propagate pre-transform status transitively\n          if (isPreTransformResolve && !isScanResolve) {\n            env.serverFnLookupModules.add(resolved)\n          }\n\n          if (!isPreTransformResolve) {\n            env.graph.addEdge(resolved, normalizedImporter, source)\n          }\n\n          // Skip file-based and marker-based denial for resolved paths that\n          // match the per-environment `excludeFiles` patterns.  By default\n          // this includes `**/node_modules/**` so that third-party packages\n          // using `.client.` / `.server.` in their filenames (e.g. react-tweet\n          // exports `index.client.js`) are not treated as user-authored\n          // environment boundaries.  Users can override `excludeFiles` per\n          // environment to narrow or widen this exclusion.\n          const isExcludedFile =\n            matchers.excludeFiles.length > 0 &&\n            matchesAny(relativePath, matchers.excludeFiles)\n\n          if (!isExcludedFile) {\n            const fileMatch =\n              matchers.files.length > 0\n                ? matchesAny(relativePath, matchers.files)\n                : undefined\n\n            if (fileMatch) {\n              const info = await buildFileViolationInfo(\n                provider,\n                env,\n                envName,\n                envType,\n                importer,\n                normalizedImporter,\n                source,\n                resolved,\n                fileMatch.pattern,\n              )\n              return reportOrDeferViolation(\n                this,\n                env,\n                normalizedImporter,\n                importer,\n                info,\n                shouldDefer,\n                isPreTransformResolve,\n              )\n            }\n\n            const markerInfo = await buildMarkerViolationFromResolvedImport(\n              provider,\n              env,\n              envName,\n              envType,\n              importer,\n              source,\n              resolved,\n              relativePath,\n            )\n            if (markerInfo) {\n              return reportOrDeferViolation(\n                this,\n                env,\n                normalizedImporter,\n                importer,\n                markerInfo,\n                shouldDefer,\n                isPreTransformResolve,\n              )\n            }\n          }\n        }\n\n        return undefined\n      },\n\n      load: {\n        filter: {\n          id: new RegExp(\n            getResolvedVirtualModuleMatchers().map(escapeRegExp).join('|'),\n          ),\n        },\n        handler(id) {\n          if (IMPORT_PROTECTION_DEBUG) {\n            if (matchesDebugFilter(id)) {\n              debugLog('load:handler', {\n                env: this.environment.name,\n                id: normalizePath(id),\n              })\n            }\n          }\n\n          return loadResolvedVirtualModule(id)\n        },\n      },\n\n      async generateBundle(_options, bundle) {\n        const envName = this.environment.name\n        const env = envStates.get(envName)\n        if (!env || env.deferredBuildViolations.length === 0) return\n\n        const candidateCache = new Map<string, Array<string>>()\n        const toModuleIdCandidates = (id: string): Array<string> => {\n          let cached = candidateCache.get(id)\n          if (cached) return cached\n\n          const out = new Set<string>()\n          const normalized = normalizeFilePath(id)\n          out.add(id)\n          out.add(normalized)\n          out.add(relativizePath(normalized, config.root))\n\n          if (normalized.startsWith(VITE_BROWSER_VIRTUAL_PREFIX)) {\n            const internal = `\\0${normalized.slice(VITE_BROWSER_VIRTUAL_PREFIX.length)}`\n            out.add(internal)\n            out.add(relativizePath(normalizeFilePath(internal), config.root))\n          }\n\n          if (normalized.startsWith('\\0')) {\n            const browser = `${VITE_BROWSER_VIRTUAL_PREFIX}${normalized.slice(1)}`\n            out.add(browser)\n            out.add(relativizePath(normalizeFilePath(browser), config.root))\n          }\n\n          cached = Array.from(out)\n          candidateCache.set(id, cached)\n          return cached\n        }\n\n        // Collect all module IDs that survived tree-shaking in this bundle.\n        const survivingModules = new Set<string>()\n        for (const chunk of Object.values(bundle)) {\n          if (chunk.type === 'chunk') {\n            for (const moduleId of Object.keys(chunk.modules)) {\n              for (const candidate of toModuleIdCandidates(moduleId)) {\n                survivingModules.add(candidate)\n              }\n            }\n          }\n        }\n\n        const didModuleSurvive = (moduleId: string): boolean =>\n          toModuleIdCandidates(moduleId).some((candidate) =>\n            survivingModules.has(candidate),\n          )\n\n        // Check each deferred violation: if its check module survived\n        // in the bundle, the import was NOT tree-shaken — real leak.\n        const realViolations: Array<ViolationInfo> = []\n        for (const {\n          info,\n          mockModuleId,\n          checkModuleId,\n        } of env.deferredBuildViolations) {\n          let survived: boolean\n          if (checkModuleId != null) {\n            // Marker violation: check if the importer survived\n            // (marker is about the file's directive, not a binding).\n            // Include transform-result keys (e.g. code-split variants)\n            // to cover all bundle representations of the importer.\n            const importerVariantIds = new Set<string>([info.importer])\n            const importerKeys = env.transformResultKeysByFile.get(\n              normalizeFilePath(info.importer),\n            )\n            if (importerKeys) {\n              for (const key of importerKeys) {\n                importerVariantIds.add(key)\n              }\n            }\n            survived = false\n            for (const importerId of importerVariantIds) {\n              if (didModuleSurvive(importerId)) {\n                survived = true\n                break\n              }\n            }\n          } else {\n            // File/specifier violation: check if the mock module survived.\n            survived = didModuleSurvive(mockModuleId)\n          }\n\n          if (!survived) continue\n\n          if (config.onViolation) {\n            const result = await config.onViolation(info)\n            if (result === false) continue\n          }\n\n          realViolations.push(info)\n        }\n\n        if (realViolations.length === 0) return\n\n        if (config.effectiveBehavior === 'error') {\n          // Error mode: fail the build on the first real violation.\n          this.error(formatViolation(realViolations[0]!, config.root))\n        } else {\n          // Mock mode: warn for each surviving violation.\n          const seen = new Set<string>()\n          for (const info of realViolations) {\n            const key = dedupeKey(info)\n            if (!seen.has(key)) {\n              seen.add(key)\n              this.warn(formatViolation(info, config.root))\n            }\n          }\n        }\n      },\n    },\n    {\n      // Captures transformed code + composed sourcemap for location mapping.\n      // Runs after all `enforce: 'pre'` hooks (including the Start compiler).\n      // Only files under `srcDirectory` are cached.\n      name: 'tanstack-start-core:import-protection-transform-cache',\n\n      applyToEnvironment(env) {\n        if (!config.enabled) return false\n        return environmentNames.has(env.name)\n      },\n\n      transform: {\n        filter: {\n          id: {\n            include: [/\\.[cm]?[tj]sx?($|\\?)/],\n          },\n        },\n        async handler(code, id) {\n          const envName = this.environment.name\n          const file = normalizeFilePath(id)\n          const envType = getEnvType(envName)\n          const matchers = getRulesForEnvironment(envName)\n          const isBuild = config.command === 'build'\n\n          if (IMPORT_PROTECTION_DEBUG) {\n            if (matchesDebugFilter(file)) {\n              debugLog('transform-cache', {\n                env: envName,\n                id: normalizePath(id),\n                file,\n              })\n            }\n          }\n\n          if (!shouldCheckImporter(file)) {\n            return undefined\n          }\n\n          // Self-denial: if this file is denied in the current environment\n          // (e.g. a `.server` file transformed in the client environment),\n          // replace its entire content with a mock module.\n          //\n          // This is the core mechanism for preventing cross-environment\n          // cache contamination: resolveId never returns virtual module\n          // IDs for file-based violations, so there is nothing for\n          // third-party resolver caches (e.g. vite-tsconfig-paths) to\n          // leak across environments.  Each environment's transform\n          // independently decides whether the file is denied.\n          //\n          // In dev mode, this also solves the cold-start problem where\n          // the importer's AST is unavailable for export resolution:\n          // the denied file's own source code is always available here,\n          // so we parse its exports directly.\n          const selfFileMatch = checkFileDenial(getRelativePath(file), matchers)\n          if (selfFileMatch) {\n            // Parse exports once — shared by build and dev paths.\n            // Falls back to empty list on non-standard syntax.\n            let exportNames: Array<string> = []\n            try {\n              exportNames = collectNamedExports(code)\n            } catch {\n              // Parsing may fail on non-standard syntax\n            }\n\n            if (isBuild) {\n              return generateSelfContainedMockModule(exportNames)\n            }\n\n            // Dev mode: generate a mock that imports mock-runtime for\n            // runtime diagnostics (error/warn on property access).\n            const runtimeId = mockRuntimeModuleIdFromViolation(\n              {\n                type: 'file',\n                env: envType,\n                envType,\n                behavior:\n                  config.effectiveBehavior === 'error' ? 'error' : 'mock',\n                importer: file,\n                specifier: relativizePath(file, config.root),\n                resolved: file,\n                pattern: selfFileMatch.pattern,\n                message: `File \"${relativizePath(file, config.root)}\" is denied in the ${envType} environment`,\n                trace: [],\n              },\n              config.mockAccess,\n              config.root,\n            )\n            return generateDevSelfDenialModule(exportNames, runtimeId)\n          }\n\n          // getCombinedSourcemap() returns the composed sourcemap\n          let map: SourceMapLike | undefined\n          try {\n            map = this.getCombinedSourcemap()\n          } catch {\n            map = undefined\n          }\n\n          let originalCode: string | undefined\n          if (map?.sourcesContent) {\n            originalCode = pickOriginalCodeFromSourcesContent(\n              map,\n              file,\n              config.root,\n            )\n          }\n\n          const lineIndex = buildLineIndex(code)\n          const cacheKey = normalizePath(id)\n\n          const envState = getEnv(envName)\n          const isServerFnLookup = id.includes(SERVER_FN_LOOKUP_QUERY)\n\n          // Propagate SERVER_FN_LOOKUP status before import-analysis\n          if (isServerFnLookup) {\n            envState.serverFnLookupModules.add(file)\n          }\n\n          const result: TransformResult = {\n            code,\n            map,\n            originalCode,\n            lineIndex,\n          }\n          cacheTransformResult(envState, file, cacheKey, result)\n\n          // Build mode: only self-denial (above) and transform caching are\n          // needed.  All violations are detected and deferred in resolveId;\n          // self-denial replaces denied file content; generateBundle checks\n          // tree-shaking survival.  The import resolution loop below is\n          // dev-mode only — it resolves imports for graph reachability,\n          // catches violations missed on warm starts (where Vite caches\n          // resolveId), and rewrites denied imports to mock modules.\n          if (isBuild) return undefined\n\n          // Dev mode: resolve imports, populate graph, detect violations,\n          // and rewrite denied imports.\n          const isDevMock = config.effectiveBehavior === 'mock'\n          const importSources = extractImportSources(code)\n          const resolvedChildren = new Set<string>()\n          const deniedSourceReplacements = new Map<string, string>()\n          for (const src of importSources) {\n            try {\n              const resolved = await this.resolve(src, id, { skipSelf: true })\n              if (resolved && !resolved.external) {\n                const resolvedPath = canonicalizeResolvedId(\n                  resolved.id,\n                  config.root,\n                  resolveExtensionlessAbsoluteId,\n                )\n\n                resolvedChildren.add(resolvedPath)\n\n                // When the resolved ID is a mock-module (from our\n                // resolveId returning a mock-edge ID), postTransformImports\n                // would only contain the mock ID.  Edge-survival needs the\n                // real physical path so pending violations can be matched.\n                //\n                // For relative specifiers we can compute the physical path\n                // directly.  For bare/alias specifiers, look up the real\n                // resolved path from the pending violations that were\n                // already stored by resolveId before this transform ran.\n                if (resolved.id.includes('tanstack-start-import-protection:')) {\n                  let physicalPath: string | undefined\n                  // Look up real resolved path from pending violations\n                  const pending = envState.pendingViolations.get(file)\n                  if (pending) {\n                    const match = pending.find(\n                      (pv) => pv.info.specifier === src && pv.info.resolved,\n                    )\n                    if (match) physicalPath = match.info.resolved\n                  }\n                  if (physicalPath && physicalPath !== resolvedPath) {\n                    resolvedChildren.add(physicalPath)\n                    envState.graph.addEdge(physicalPath, file, src)\n                  }\n                }\n\n                // Populate import graph edges for warm-start trace accuracy\n                envState.graph.addEdge(resolvedPath, file, src)\n\n                if (isDevMock) {\n                  const relativePath = getRelativePath(resolvedPath)\n                  const fileMatch = checkFileDenial(relativePath, matchers)\n\n                  if (fileMatch) {\n                    const info = await buildFileViolationInfo(\n                      envState.transformResultProvider,\n                      envState,\n                      envName,\n                      envType,\n                      id,\n                      file,\n                      src,\n                      resolvedPath,\n                      fileMatch.pattern,\n                    )\n\n                    const replacement = await reportOrDeferViolation(\n                      this,\n                      envState,\n                      file,\n                      id,\n                      info,\n                      isDevMock,\n                      isServerFnLookup,\n                    )\n\n                    if (replacement) {\n                      deniedSourceReplacements.set(\n                        src,\n                        replacement.startsWith('\\0')\n                          ? VITE_BROWSER_VIRTUAL_PREFIX + replacement.slice(1)\n                          : replacement,\n                      )\n                    }\n                  }\n                }\n              }\n            } catch {\n              // Non-fatal\n            }\n          }\n          envState.postTransformImports.set(cacheKey, resolvedChildren)\n          if (cacheKey !== file && !isServerFnLookup) {\n            envState.postTransformImports.set(file, resolvedChildren)\n          }\n\n          await processPendingViolations(envState, this.warn.bind(this))\n\n          if (deniedSourceReplacements.size > 0) {\n            try {\n              const rewritten = rewriteDeniedImports(\n                code,\n                id,\n                new Set(deniedSourceReplacements.keys()),\n                (source: string) =>\n                  deniedSourceReplacements.get(source) ?? source,\n              )\n\n              if (!rewritten) {\n                return undefined\n              }\n\n              const normalizedMap = rewritten.map\n                ? {\n                    ...rewritten.map,\n                    version: Number(rewritten.map.version),\n                    sourcesContent:\n                      rewritten.map.sourcesContent?.map(\n                        (s: string | null) => s ?? '',\n                      ) ?? [],\n                  }\n                : {\n                    version: 3,\n                    file: id,\n                    names: [],\n                    sources: [id],\n                    sourcesContent: [code],\n                    mappings: '',\n                  }\n\n              return {\n                code: rewritten.code,\n                map: normalizedMap,\n              }\n            } catch {\n              // Non-fatal: keep original code when rewrite fails.\n            }\n          }\n\n          return undefined\n        },\n      },\n    },\n  ] satisfies Array<PluginOption>\n}\n"],"mappings":";;;;;;;;;;;;;AAgFA,SAAgB,uBACd,MACc;CACd,IAAI,YAAkC;CACtC,MAAM,0BAA0B,IAAI,iCAAiC;CACrE,MAAM,kCAAkC,OACtC,wBAAwB,QAAQ,GAAG;CAErC,MAAM,qCAAqB,IAAI,KAA4B;CAE3D,SAAS,8BAA8B,MAAc,QAAwB;EAC3E,IAAI,WAAW,mBAAmB,IAAI,OAAO;AAC7C,MAAI,CAAC,UAAU;GACb,MAAM,UAAU,aAAa,OAAO;AACpC,cAAW;IACT,IAAI,OAAO,sBAAsB,QAAQ,KAAK;IAC9C,IAAI,OAAO,oBAAoB,QAAQ,KAAK;IAC5C,IAAI,OAAO,6BAA6B,QAAQ,YAAY;IAC7D;AACD,sBAAmB,IAAI,QAAQ,SAAS;;EAG1C,IAAI,OAAO;AACX,OAAK,MAAM,MAAM,UAAU;GACzB,MAAM,IAAI,GAAG,KAAK,KAAK;AACvB,OAAI,CAAC,EAAG;GACR,MAAM,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,OAAO;AAC1C,OAAI,QAAQ,GAAI;AAChB,OAAI,SAAS,MAAM,MAAM,KAAM,QAAO;;AAExC,SAAO;;;;;;;CAQT,SAAS,0BACP,SACA,KACA,YACyB;AACzB,MAAI,CAAC,UAAW,QAAO;EACvB,MAAM,cAAc,UAAU,aAAa;AAC3C,MAAI,CAAC,YAAa,QAAO;EAEzB,MAAM,OAAO,kBAAkB,WAAW;EAC1C,MAAM,QAAQ,YAAY,YAAY,cAAc,KAAK;AACzD,MAAI,CAAC,MAAO,QAAO;EAInB,MAAM,0BAAU,IAAI,KAA8B;EAClD,SAAS,OAAO,GAA4B;GAC1C,IAAI,SAAS,QAAQ,IAAI,EAAE;AAC3B,OAAI,WAAW,KAAA,GAAW;AACxB,aAAS,EAAE,KACP,kBAAkB,EAAE,GAAG,GACvB,EAAE,MACA,kBAAkB,EAAE,IAAI,GACxB;AACN,YAAQ,IAAI,GAAG,OAAO;;AAExB,UAAO;;EAGT,MAAM,QAAgC,CAAC,MAAM;EAC7C,MAAM,UAAU,IAAI,IAAqB,CAAC,MAAM,CAAC;EACjD,MAAM,yBAAS,IAAI,KAAuC;EAE1D,IAAI,YAAoC;EACxC,IAAI,eAAuC;EAC3C,IAAI,KAAK;AACT,SAAO,KAAK,MAAM,QAAQ;GACxB,MAAM,OAAO,MAAM;GACnB,MAAM,KAAK,OAAO,KAAK;AAEvB,OAAI,MAAM,IAAI,MAAM,QAAQ,IAAI,GAAG,EAAE;AACnC,gBAAY;AACZ;;GAGF,MAAM,YAAY,KAAK;AACvB,OAAI,UAAU,SAAS,GAAG;AACxB,QAAI,CAAC,aAAc,gBAAe;AAClC;;AAGF,QAAK,MAAM,OAAO,WAAW;AAC3B,QAAI,QAAQ,IAAI,IAAI,CAAE;AACtB,YAAQ,IAAI,IAAI;AAChB,WAAO,IAAI,KAAK,KAAK;AACrB,UAAM,KAAK,IAAI;;;EAInB,MAAM,OAAO,aAAa;AAE1B,MAAI,CAAC,KAAM,QAAO;EAGlB,MAAM,QAAgC,EAAE;EACxC,IAAI,MAAmC;AACvC,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,gBAAgB,KAAK,KAAK,KAAK;AACxD,SAAM,KAAK,IAAI;AACf,OAAI,QAAQ,MAAO;AACnB,SAAM,OAAO,IAAI,IAAI;;EAGvB,MAAM,QAA0B,EAAE;AAClC,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,MAAM,KAAK,OAAO,MAAM,GAAI;AAC5B,OAAI,CAAC,GAAI;GACT,IAAI;AACJ,OAAI,IAAI,IAAI,MAAM,QAAQ;IACxB,MAAM,SAAS,OAAO,MAAM,IAAI,GAAI;AACpC,QAAI,OACF,aAAY,IAAI,MAAM,aAAa,IAAI,OAAO,EAAE,IAAI,GAAG;;AAG3D,SAAM,KAAK,YAAY;IAAE,MAAM;IAAI;IAAW,GAAG,EAAE,MAAM,IAAI,CAAC;;AAGhE,SAAO,MAAM,SAAS,QAAQ;;CAGhC,MAAM,SAAuB;EAC3B,SAAS;EACT,MAAM;EACN,SAAS;EACT,cAAc;EACd,WAAW,KAAK;EAChB,mBAAmB;EACnB,YAAY;EACZ,SAAS;EACT,eAAe;EACf,eAAe;GACb,QAAQ;IAAE,YAAY,EAAE;IAAE,OAAO,EAAE;IAAE,cAAc,EAAE;IAAE;GACvD,QAAQ;IAAE,YAAY,EAAE;IAAE,OAAO,EAAE;IAAE,cAAc,EAAE;IAAE;GACxD;EACD,iBAAiB,EAAE;EACnB,iBAAiB,EAAE;EACnB,wBAAwB,EAAE;EAC1B,kBAAkB;GAAE,4BAAY,IAAI,KAAK;GAAE,4BAAY,IAAI,KAAK;GAAE;EAClE,YAAY,IAAI,IAAI,KAAK,aAAa,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;EACnE,aAAa,KAAA;EACd;CAED,MAAM,4BAAY,IAAI,KAAuB;CAC7C,MAAM,SAAsB,EAAE,gCAAgB,IAAI,KAAK,EAAE;;;;;;;;;CAUzD,eAAe,wBACb,UACA,KACA,SACA,oBACA,WACA,aACA,eAC2B;EAC3B,IAAI,QACF,iBACA,WAAW,IAAI,OAAO,oBAAoB,OAAO,cAAc;AAEjE,MAAI,OAAO,YAAY,SAAS;GAC9B,MAAM,UAAU,0BACd,SACA,KACA,mBACD;AACD,OAAI,WAAW,QAAQ,SAAS,MAAM,OACpC,SAAQ;;AAGZ,QAAM,wBACJ,UACA,OACA,IAAI,gBACJ,8BACD;AAED,MAAI,MAAM,SAAS,GAAG;GACpB,MAAM,OAAO,MAAM,MAAM,SAAS;AAClC,OAAI,CAAC,KAAK,UAAW,MAAK,YAAY;AACtC,OAAI,eAAe,KAAK,QAAQ,MAAM;AACpC,SAAK,OAAO,YAAY;AACxB,SAAK,SAAS,YAAY;;;AAI9B,SAAO;;;;;;;;CAST,eAAe,mBACb,UACA,KACA,SACA,SACA,UACA,oBACA,QACA,WAWA,eACwB;EASxB,MAAM,MAAM,MAAM,wBAChB,UACA,KACA,UAXuB,sBACvB,QACA,cAAc,aAAa,OAAO,UAAU,aAAa,WACrD,UAAU,WACV,KAAA,GACJ,OAAO,KACR,CAOA;EAED,MAAM,QAAQ,MAAM,wBAClB,UACA,KACA,SACA,oBACA,QACA,KACA,cACD;EAED,MAAM,UAAU,MAAM,iBAAiB,UAAU,UAAU,IAAI,GAAG,KAAA;AAElE,SAAO;GACL,KAAK;GACL;GACA,UAAU,OAAO;GACjB,WAAW;GACX,UAAU;GACV,GAAI,MAAM,EAAE,aAAa,KAAK,GAAG,EAAE;GACnC;GACA;GACA,GAAG;GACJ;;CAGH,eAAe,wBACb,UACA,KACA,UACA,kBAC0B;AAC1B,OAAK,MAAM,aAAa,kBAAkB;GACxC,MAAM,MACH,MAAM,6BAA6B,UAAU,UAAU,UAAU,IACjE,MAAM,2CACL,UACA,UACA,WACA,IAAI,gBACJ,8BACD;AACH,OAAI,IAAK,QAAO;;;;;;;;;;CAYpB,eAAe,uCACb,UACA,KACA,SACA,SACA,UACA,QACA,YACA,cACA,eACoC;EACpC,MAAM,uBAAuB,kBAAkB,WAAW;EAC1D,MAAM,aAAa,OAAO,eAAe,IAAI,qBAAqB;AAIlE,MAAI,EAFD,YAAY,YAAY,eAAe,YACvC,YAAY,YAAY,eAAe,UAC3B,QAAO,KAAA;AAItB,SAAO,mBACL,UACA,KACA,SACA,SACA,UAPyB,kBAAkB,SAAS,EASpD,QACA;GACE,MAAM;GACN,UAAU;GACV,SAAS,4BAA4B,cAAc,WAAW;GAC/D,EACD,cACD;;CAGH,SAAS,4BACP,cACA,YACQ;AACR,SAAO,eAAe,WAClB,WAAW,aAAa,qEACxB,WAAW,aAAa;;CAG9B,eAAe,uBACb,UACA,KACA,SACA,SACA,UACA,oBACA,QACA,cACA,SACA,eACwB;AAGxB,SAAO,mBACL,UACA,KACA,SACA,SACA,UACA,oBACA,QACA;GACE,MAAM;GACN;GACA,UAAU;GACV,SAAS,WAAW,OAAO,kBAdV,gBAAgB,aAAa,CAcY,sBAAsB,QAAQ;GACzF,EACD,cACD;;CAGH,SAAS,WAAW,SAAsC;AACxD,SAAO,OAAO,WAAW,IAAI,QAAQ,IAAI;;CAG3C,SAAS,uBAAuB,SAA2B;AAEzD,SADa,WAAW,QAAQ,KAChB,WACZ,OAAO,cAAc,SACrB,OAAO,cAAc;;;;;;;CAQ3B,SAAS,gBACP,cACA,UAI6B;AAC7B,MACE,SAAS,aAAa,SAAS,KAC/B,WAAW,cAAc,SAAS,aAAa,CAE/C;AAEF,SAAO,SAAS,MAAM,SAAS,IAC3B,WAAW,cAAc,SAAS,MAAM,GACxC,KAAA;;CAGN,MAAM,mBAAmB,IAAI,IAAY,CACvC,uBAAuB,QACvB,uBAAuB,OACxB,CAAC;AACF,KAAI,KAAK,oBAAoB,uBAAuB,OAClD,kBAAiB,IAAI,KAAK,gBAAgB;;CAI5C,SAAS,OAAO,SAA2B;EACzC,IAAI,WAAW,UAAU,IAAI,QAAQ;AACrC,MAAI,CAAC,UAAU;GACb,MAAM,uCAAuB,IAAI,KAA8B;AAC/D,cAAW;IACT,OAAO,IAAI,aAAa;IACxB,uCAAuB,IAAI,KAAK;IAChC,8BAAc,IAAI,KAAK;IACvB,oCAAoB,IAAI,KAAK;IAC7B,gBAAgB,IAAI,gBAAgB;IACpC,gCAAgB,IAAI,KAAK;IACzB;IACA,2CAA2B,IAAI,KAAK;IACpC,yBAAyB,EACvB,mBAAmB,IAAY;KAC7B,MAAM,UAAU,cAAc,GAAG;KACjC,MAAM,QAAQ,qBAAqB,IAAI,QAAQ;AAC/C,SAAI,MAAO,QAAO;KAClB,MAAM,cAAc,kBAAkB,GAAG;AACzC,YAAO,gBAAgB,UACnB,qBAAqB,IAAI,YAAY,GACrC,KAAA;OAEP;IACD,sCAAsB,IAAI,KAAK;IAC/B,uCAAuB,IAAI,KAAK;IAChC,mCAAmB,IAAI,KAAK;IAC5B,yBAAyB,EAAE;IAC5B;AACD,aAAU,IAAI,SAAS,SAAS;;AAElC,SAAO;;;;;;CAOT,SAAS,iBACP,WACA,YACe;AACf,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,MAAM,UAAU,IAAI,UAAU;AACpC,OAAI,OAAO,IAAI,SAAS,EAAG,QAAO;;AAEpC,SAAO,EAAE;;;;;;CAOX,SAAS,kBAAkB,IAAY,OAA+B;EACpE,MAAM,MAAM,IAAI,IAAI,0BAA0B,GAAG,CAAC;AAClD,MAAI,OAAO;AACT,QAAK,MAAM,KAAK,0BAA0B,MAAM,CAAE,KAAI,IAAI,EAAE;AAC5D,OAAI,IAAI,+BAA+B,MAAM,CAAC;;AAEhD,SAAO,MAAM,KAAK,IAAI;;;;;;;;;CAUxB,eAAe,iCACb,KACA,KACA,MACA,gBACwB;EACxB,MAAM,eAAe,kBAAkB,KAAK,SAAS;EACrD,MAAM,sBAAsB,kBAAkB,KAAK,WAAW,KAAK,SAAS;EAK5E,IAAI,iBAAiB,IAAI,sBAAsB,IAAI,aAAa;AAChE,MAAI,CAAC,gBAAgB;GAEnB,MAAM,eACJ,IAAI,wBAAwB,mBAAmB,aAAa,EAAE,SAC7D,kBAAkB,IAAI,gBAClB,IAAI,cAAc,eAAe,EAAE,QAAQ,KAAA,IAC5C,KAAA;AACN,OAAI,OAAO,iBAAiB,YAAY,aAAa,WAAW,EAC9D,QAAO,EAAE;AAEX,OAAI;AACF,qBAAiB,+BAA+B,aAAa;AAG7D,UAAM,6BACJ,KACA,cACA,gBACA,OAAO,QAAQ;KACb,MAAM,WAAW,GAAG,aAAa,GAAG;AACpC,SAAI,IAAI,aAAa,IAAI,SAAS,CAChC,QAAO,IAAI,aAAa,IAAI,SAAS,IAAI,KAAA;AAE3C,SAAI,CAAC,IAAI,QAAS,QAAO,KAAA;KACzB,MAAM,WAAW,MAAM,IAAI,QAAQ,KAAK,KAAK,UAAU,EACrD,UAAU,MACX,CAAC;AACF,SAAI,CAAC,YAAY,SAAS,SAAU,QAAO,KAAA;AAC3C,YAAO,SAAS;MAEnB;AAGD,qBACE,IAAI,sBAAsB,IAAI,aAAa,IAAI;WAC3C;AACN,WAAO,EAAE;;;EAKb,MAAM,SAAS,iBAAiB,gBAAgB,oBAAoB;AACpE,MAAI,OAAO,SAAS,EAAG,QAAO;EAG9B,MAAM,eAAe,IAAI,IAAI,oBAAoB;AACjD,OAAK,MAAM,CAAC,WAAW,UAAU,gBAAgB;AAC/C,OAAI,CAAC,MAAM,OAAQ;GAEnB,MAAM,aAAa,MAAM,iBACvB,KACA,KACA,cACA,WACA,KAAK,SACN;AACD,OAAI,CAAC,WAAY;GAEjB,MAAM,qBAAqB,kBAAkB,WAAW;AACxD,sBAAmB,KAAK,+BAA+B,WAAW,CAAC;AACnE,OAAI,mBAAmB,MAAM,MAAM,aAAa,IAAI,EAAE,CAAC,CACrD,QAAO;;AAIX,SAAO,EAAE;;;CAIX,eAAe,iBACb,KACA,KACA,cACA,WACA,YAC6B;EAC7B,MAAM,WAAW,GAAG,aAAa,GAAG;AACpC,MAAI,IAAI,aAAa,IAAI,SAAS,CAChC,QAAO,IAAI,aAAa,IAAI,SAAS,IAAI,KAAA;AAE3C,MAAI,CAAC,IAAI,QAAS,QAAO,KAAA;AACzB,MAAI;GACF,MAAM,WAAW,MAAM,IAAI,QAAQ,WAAW,YAAY,EACxD,UAAU,MACX,CAAC;AACF,OAAI,CAAC,YAAY,SAAS,SAAU,QAAO,KAAA;AAC3C,UAAO,SAAS;UACV;AACN;;;CAIJ,eAAe,6BACb,KACA,YACA,eACA,eACe;EACf,MAAM,eAAe,kBAAkB,WAAW;AAElD,MAAI,cAAc,SAAS,EAAG;AAE9B,OAAK,MAAM,CAAC,QAAQ,UAAU,cAC5B,KAAI;GACF,MAAM,aAAa,MAAM,cAAc,OAAO;AAC9C,OAAI,CAAC,WAAY;AAEjB,iBAAc,IAAI,kBAAkB,WAAW,EAAE,MAAM;AACvD,iBAAc,IAAI,+BAA+B,WAAW,EAAE,MAAM;UAC9D;EAKV,MAAM,WAAW,IAAI,sBAAsB,IAAI,aAAa;AAC5D,MAAI,CAAC,UAAU;AACb,OAAI,sBAAsB,IAAI,cAAc,cAAc;AAC1D;;AAGF,OAAK,MAAM,CAAC,QAAQ,UAAU,eAAe;GAC3C,MAAM,OAAO,SAAS,IAAI,OAAO;AACjC,OAAI,CAAC,MAAM;AACT,aAAS,IAAI,QAAQ,MAAM;AAC3B;;GAGF,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;AAC1C,YAAS,IAAI,QAAQ,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;;;CAIlD,MAAM,2CAA2B,IAAI,KAAsB;CAC3D,SAAS,oBAAoB,UAA2B;EACtD,IAAI,SAAS,yBAAyB,IAAI,SAAS;AACnD,MAAI,WAAW,KAAA,EAAW,QAAO;EAEjC,MAAM,eAAe,eAAe,UAAU,OAAO,KAAK;AAS1D,MALG,OAAO,gBAAgB,SAAS,KAC/B,WAAW,cAAc,OAAO,gBAAgB,IACjD,OAAO,uBAAuB,SAAS,KACtC,WAAW,cAAc,OAAO,uBAAuB,CAGzD,UAAS;WACA,OAAO,gBAAgB,SAAS,EACzC,UAAS,CAAC,CAAC,WAAW,cAAc,OAAO,gBAAgB;WAClD,OAAO,aAChB,UAAS,kBAAkB,UAAU,OAAO,aAAa;MAEzD,UAAS;AAGX,2BAAyB,IAAI,UAAU,OAAO;AAC9C,SAAO;;CAGT,SAAS,UAAU,MAA6B;AAC9C,SAAO,GAAG,KAAK,KAAK,GAAG,KAAK,SAAS,GAAG,KAAK,UAAU,GAAG,KAAK,YAAY;;CAG7E,SAAS,QAAQ,KAAe,KAAsB;AACpD,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,IAAI,eAAe,IAAI,IAAI,CAAE,QAAO;AACxC,MAAI,eAAe,IAAI,IAAI;AAC3B,SAAO;;CAGT,SAAS,gBAAgB,cAA8B;AACrD,SAAO,eAAe,cAAc,aAAa,EAAE,OAAO,KAAK;;;CAIjE,SAAS,cAAc,UAA0B;AAC/C,WAAS,aAAa,OAAO;AAC7B,WAAS,mBAAmB,OAAO;AACnC,WAAS,eAAe,OAAO;AAC/B,WAAS,eAAe,OAAO;AAC/B,WAAS,qBAAqB,OAAO;AACrC,WAAS,0BAA0B,OAAO;AAC1C,WAAS,qBAAqB,OAAO;AACrC,WAAS,sBAAsB,OAAO;AACtC,WAAS,kBAAkB,OAAO;AAClC,WAAS,wBAAwB,SAAS;AAC1C,WAAS,MAAM,OAAO;AACtB,WAAS,sBAAsB,OAAO;;;CAIxC,SAAS,sBAAsB,UAAoB,MAAoB;AACrE,WAAS,eAAe,aAAa,KAAK;EAG1C,MAAM,cAAc,SAAS,mBAAmB,IAAI,KAAK;AACzD,MAAI,aAAa;AACf,QAAK,MAAM,OAAO,YAAa,UAAS,aAAa,OAAO,IAAI;AAChE,YAAS,mBAAmB,OAAO,KAAK;;AAG1C,WAAS,MAAM,WAAW,KAAK;AAC/B,WAAS,sBAAsB,OAAO,KAAK;AAC3C,WAAS,sBAAsB,OAAO,KAAK;AAC3C,WAAS,kBAAkB,OAAO,KAAK;EAGvC,MAAM,gBAAgB,SAAS,0BAA0B,IAAI,KAAK;AAClE,MAAI,eAAe;AACjB,QAAK,MAAM,OAAO,eAAe;AAC/B,aAAS,qBAAqB,OAAO,IAAI;AACzC,aAAS,qBAAqB,OAAO,IAAI;;AAE3C,YAAS,0BAA0B,OAAO,KAAK;SAC1C;AACL,YAAS,qBAAqB,OAAO,KAAK;AAC1C,YAAS,qBAAqB,OAAO,KAAK;;;;CAK9C,SAAS,qBACP,UACA,MACA,UACA,QACM;AACN,WAAS,qBAAqB,IAAI,UAAU,OAAO;EACnD,MAAM,SAAS,YACb,SAAS,2BACT,4BACM,IAAI,KAAa,CACxB;AACD,SAAO,IAAI,SAAS;AACpB,MAAI,aAAa,MAAM;AACrB,YAAS,qBAAqB,IAAI,MAAM,OAAO;AAC/C,UAAO,IAAI,KAAK;;;;CAKpB,SAAS,kBAAwB;EAC/B,MAAM,EAAE,wBAAwB,KAAK,WAAW;AAChD,OAAK,MAAM,UAAU,KAAK,cAAc;GACtC,MAAM,WAAW,OAAO,OAAO,KAAK;AACpC,OAAI,oBAAoB,eACtB,UAAS,MAAM,SACb,cAAc,oBAAoB,eAAe,CAClD;AAEH,OAAI,oBAAoB,cACtB,UAAS,MAAM,SACb,cAAc,oBAAoB,cAAc,CACjD;;;;;;;;;;;CAaP,SAAS,wBACP,KACA,MACoB;EACpB,MAAM,SAAS,IAAI,0BAA0B,IAAI,KAAK;EACtD,IAAI,SAA6B;AAEjC,MAAI,OACF,MAAK,MAAM,KAAK,QAAQ;AACtB,OAAI,EAAE,SAAS,uBAAuB,CAAE;GACxC,MAAM,UAAU,IAAI,qBAAqB,IAAI,EAAE;AAC/C,OAAI,QACF,KAAI,CAAC,OAAQ,UAAS,IAAI,IAAI,QAAQ;OACjC,MAAK,MAAM,KAAK,QAAS,QAAO,IAAI,EAAE;;AAMjD,MAAI,CAAC,QAAQ;GACX,MAAM,UAAU,IAAI,qBAAqB,IAAI,KAAK;AAClD,OAAI,QAAS,UAAS,IAAI,IAAI,QAAQ;;AAGxC,SAAO;;;;;;;;;;;;CAaT,SAAS,kBACP,KACA,QACA,QACyC;EACzC,MAAM,SAAS,IAAI,0BAA0B,IAAI,OAAO;EACxD,IAAI,mBAAmB;AAEvB,MAAI,OACF,MAAK,MAAM,KAAK,QAAQ;AACtB,OAAI,EAAE,SAAS,uBAAuB,CAAE;GACxC,MAAM,UAAU,IAAI,qBAAqB,IAAI,EAAE;AAC/C,OAAI,SAAS;AACX,uBAAmB;AACnB,QAAI,QAAQ,IAAI,OAAO,CAAE,QAAO;;;AAKtC,MAAI,CAAC,kBAAkB;GACrB,MAAM,UAAU,IAAI,qBAAqB,IAAI,OAAO;AACpD,OAAI,QAAS,QAAO,QAAQ,IAAI,OAAO,GAAG,SAAS;AAInD,UAFE,IAAI,qBAAqB,IAAI,OAAO,KACnC,SAAS,OAAO,OAAO,IAAI,SACF,YAAY;;AAG1C,SAAO;;CAGT,SAAS,+BACP,KACA,MACyC;EACzC,MAAM,0BAAU,IAAI,KAAa;EACjC,MAAM,QAAuB,CAAC,KAAK;EACnC,IAAI,iBAAiB;EACrB,IAAI,KAAK;AAET,SAAO,KAAK,MAAM,QAAQ;GACxB,MAAM,UAAU,MAAM;AACtB,OAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,WAAQ,IAAI,QAAQ;AAEpB,OAAI,IAAI,MAAM,QAAQ,IAAI,QAAQ,CAChC,QAAO;GAGT,MAAM,YAAY,IAAI,MAAM,aAAa,IAAI,QAAQ;AACrD,OAAI,CAAC,UAAW;AAEhB,QAAK,MAAM,CAAC,WAAW,WAAW;AAChC,QAAI,QAAQ,IAAI,OAAO,CAAE;IACzB,MAAM,WAAW,kBAAkB,KAAK,QAAQ,QAAQ;AACxD,QAAI,aAAa,UAAU,aAAa,UAEtC,OAAM,KAAK,OAAO;aACT,aAAa,UACtB,kBAAiB;;;AAMvB,SAAO,iBAAiB,YAAY;;;;;;;;;;CAWtC,SAAS,mBACP,KACA,MACA,YAIoB;EACpB,MAAM,gBAAgB,wBAAwB,KAAK,KAAK;AAExD,MAAI,eAAe;GACjB,MAAM,YAAY,WAAW,QAC1B,OAAO,CAAC,GAAG,KAAK,YAAY,cAAc,IAAI,GAAG,KAAK,SAAS,CACjE;AACD,OAAI,UAAU,WAAW,EAAG,QAAO;AACnC,OAAI,kBAAkB,IAAI,MAAM,UAAU;AAC1C,UAAO;IAAE,QAAQ;IAAW,qBAAqB;IAAM;;AAIzD,MAAI,WAAW,MAAM,OAAO,GAAG,wBAAwB,CACrD,QAAO;AAGT,SAAO;GAAE,QAAQ;GAAY,qBAAqB;GAAO;;;;;;;;;CAU3D,eAAe,yBACb,KACA,QACe;AACf,MAAI,IAAI,kBAAkB,SAAS,EAAG;EAEtC,MAAM,WAA0B,EAAE;AAElC,OAAK,MAAM,CAAC,MAAM,eAAe,IAAI,mBAAmB;GACtD,MAAM,WAAW,mBAAmB,KAAK,MAAM,WAAW;AAE1D,OAAI,aAAa,gBAAgB;AAC/B,aAAS,KAAK,KAAK;AACnB;;AAEF,OAAI,aAAa,kBAAmB;GAEpC,MAAM,EAAE,QAAQ,wBAAwB;GAIxC,MAAM,SACJ,IAAI,MAAM,QAAQ,OAAO,IACrB,+BAA+B,KAAK,KAAK,GACzC;AAEN,OAAI,WAAW,aAAa;AAC1B,SAAK,MAAM,MAAM,OACf,OAAM,qBAAqB,KAAK,QAAQ,GAAG;AAE7C,aAAS,KAAK,KAAK;cACV,WAAW,cACpB,UAAS,KAAK,KAAK;YACV,OAAO,YAAY,SAAS;IAIrC,IAAI,aAAa;AACjB,SAAK,MAAM,MAAM,QAAQ;AACvB,SAAI,GAAG,wBAAyB;AAQhC,SALE,uBACC,GAAG,KAAK,SAAS,UAChB,CAAC,CAAC,GAAG,KAAK,YACV,kBAAkB,GAAG,KAAK,UAAU,OAAO,aAAa,CAG1D,cACG,MAAM,qBAAqB,KAAK,QAAQ,GAAG,IAAK;;AAIvD,QAAI,WACF,UAAS,KAAK,KAAK;;;AAMzB,OAAK,MAAM,QAAQ,SACjB,KAAI,kBAAkB,OAAO,KAAK;;CAItC,eAAe,qBACb,KACA,QACA,IACkB;AAClB,MAAI,CAAC,GAAG,KAAK,aAAa;GACxB,MAAM,mBAAmB,sBACvB,GAAG,KAAK,WACR,GAAG,KAAK,UACR,OAAO,KACR;GACD,MAAM,MAAM,MAAM,wBAChB,IAAI,yBACJ,KACA,GAAG,KAAK,UACR,iBACD;AAED,OAAI,KAAK;AACP,OAAG,KAAK,cAAc;AACtB,OAAG,KAAK,UAAU,iBAChB,IAAI,yBACJ,GAAG,KAAK,UACR,IACD;;;AAIL,MAAI,QAAQ,KAAK,UAAU,GAAG,KAAK,CAAC,CAClC,QAAO;EAGT,MAAM,aAAa,MAAM,wBACvB,IAAI,yBACJ,KACA,GAAG,KAAK,KACR,GAAG,KAAK,UACR,GAAG,KAAK,WACR,GAAG,KAAK,YACT;AACD,MAAI,WAAW,SAAS,GAAG,KAAK,MAAM,OACpC,IAAG,KAAK,QAAQ;AAGlB,MAAI,OAAO;OACM,MAAM,OAAO,YAAY,GAAG,KAAK,KACjC,MAAO,QAAO;;AAG/B,SAAO,gBAAgB,GAAG,MAAM,OAAO,KAAK,CAAC;AAC7C,SAAO;;;;;;CAOT,SAAS,eACP,KACA,cACA,MACA,uBACM;AACN,cAAY,IAAI,mBAAmB,oBAAoB,EAAE,CAAC,CAAC,KAAK;GAC9D;GACA,yBAAyB;GAC1B,CAAC;;;CAIJ,IAAI,wBAAwB;CAE5B,eAAe,gBACb,KACA,KACA,MACA,gBACA,eACgC;AAChC,MAAI,CAAC,eAAe,QAAQ;AAC1B,OAAI,OAAO;QACM,MAAM,OAAO,YAAY,KAAK,KAC9B,MAAO,QAAO,KAAA;;AAG/B,OAAI,OAAO,sBAAsB,QAY/B,QAAO,IAAI,MAAM,gBAAgB,MAAM,OAAO,KAAK,CAAC;AAGtD,OAAI,CAAC,QAAQ,KAAK,UAAU,KAAK,CAAC,CAChC,KAAI,KAAK,gBAAgB,MAAM,OAAO,KAAK,CAAC;aAG9C,OAAO,sBAAsB,WAC7B,OAAO,YAAY,QAEnB;AAOF,MAAI,KAAK,SAAS,OAAQ,QAAO,KAAK;AAetC,SAAO,cAAc,qBAVL,MAAM,iCACpB,KACA,KACA,MACA,eACD,EAEC,OAAO,YAAY,UACf,iCAAiC,MAAM,OAAO,YAAY,OAAO,KAAK,GACtE,GAAG,oBAAoB,0BACiC,CAAC;;;;;;;;;;;;;;;;;;;;CAqBjE,eAAe,uBACb,KACA,KACA,cACA,gBACA,MACA,aACA,uBACgC;AAChC,MAAI,aAAa;GACf,MAAM,SAAS,MAAM,gBAAgB,KAAK,KAAK,MAAM,gBAAgB,EACnE,QAAQ,MACT,CAAC;AAEF,OAAI,OAAO,YAAY,SAAS;IAG9B,MAAM,SAAS,UAAU;AACzB,QAAI,wBAAwB,KAAK;KAC/B;KACA,cAAc;KAEd,eAAe,KAAK,SAAS,WAAW,KAAK,WAAW,KAAA;KACzD,CAAC;UACG;AAEL,mBAAe,KAAK,cAAc,MAAM,sBAAsB;AAC9D,UAAM,yBAAyB,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC;;AAGzD,UAAO;;AAOT,SAAO,gBAAgB,KAAK,KAAK,MAAM,gBAAgB,EACrD,QAAQ,uBACT,CAAC;;AAGJ,QAAO,CACL;EACE,MAAM;EACN,SAAS;EAET,mBAAmB,KAAK;AACtB,OAAI,CAAC,OAAO,QAAS,QAAO;AAG5B,UAAO,iBAAiB,IAAI,IAAI,KAAK;;EAGvC,eAAe,YAAY;AACzB,UAAO,OAAO,WAAW;AACzB,UAAO,UAAU,WAAW;GAE5B,MAAM,EAAE,aAAa,wBAAwB,KAAK,WAAW;AAC7D,UAAO,eAAe,oBAAoB;GAE1C,MAAM,WACJ,YAAY;AAEd,OAAI,UAAU,YAAY,OAAO;AAC/B,WAAO,UAAU;AACjB;;AAGF,UAAO,UAAU;GAEjB,MAAM,WAAW,UAAU;AAC3B,OAAI,OAAO,aAAa,SACtB,QAAO,oBAAoB;OAE3B,QAAO,oBACL,WAAW,YAAY,UAClB,UAAU,OAAO,SACjB,UAAU,SAAS;AAG5B,UAAO,UAAU,UAAU,OAAO;AAClC,UAAO,aAAa,UAAU,cAAc;AAC5C,UAAO,gBAAgB,UAAU,iBAAiB;AAClD,OAAI,UAAU,aAAa;IACzB,MAAM,KAAK,SAAS;AACpB,WAAO,eAAe,SAAS,GAAG,KAAK;;GAGzC,MAAM,WAAW,iCAAiC;GAElD,MAAM,QAAW,MAA4B,aAC3C,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,SAAS;GAIlC,MAAM,mBAAmB,eAAe,CACtC,GAAG,SAAS,OAAO,YACnB,GAAI,UAAU,QAAQ,cAAc,EAAE,CACvC,CAAC;AAEF,UAAO,cAAc,SAAS;IAC5B,YAAY,gBAAgB,iBAAiB;IAC7C,OAAO,gBACL,KAAK,UAAU,QAAQ,OAAO,SAAS,OAAO,MAAM,CACrD;IACD,cAAc,gBACZ,KAAK,UAAU,QAAQ,cAAc,SAAS,OAAO,aAAa,CACnE;IACF;AACD,UAAO,cAAc,SAAS;IAC5B,YAAY,gBACV,eACE,KAAK,UAAU,QAAQ,YAAY,SAAS,OAAO,WAAW,CAC/D,CACF;IACD,OAAO,gBACL,KAAK,UAAU,QAAQ,OAAO,SAAS,OAAO,MAAM,CACrD;IACD,cAAc,gBACZ,KAAK,UAAU,QAAQ,cAAc,SAAS,OAAO,aAAa,CACnE;IACF;AAED,UAAO,kBAAkB,gBAAgB,UAAU,WAAW,EAAE,CAAC;AACjE,UAAO,kBAAkB,gBAAgB,UAAU,WAAW,EAAE,CAAC;AACjE,UAAO,yBAAyB,gBAC9B,UAAU,mBAAmB,EAAE,CAChC;GAGD,MAAM,UAAU,qBAAqB;AACrC,UAAO,mBAAmB;IACxB,YAAY,IAAI,IAAI,QAAQ,WAAW;IACvC,YAAY,IAAI,IAAI,QAAQ,WAAW;IACxC;;EAGH,gBAAgB,QAAQ;AACtB,eAAY;;EAGd,aAAa;AACX,OAAI,CAAC,OAAO,QAAS;AAErB,gCAA6B;AAC7B,2BAAwB,OAAO;AAC/B,sBAAmB,OAAO;AAC1B,4BAAyB,OAAO;AAGhC,QAAK,MAAM,YAAY,UAAU,QAAQ,CACvC,eAAc,SAAS;AAIzB,UAAO,eAAe,OAAO;AAE7B,oBAAiB;;EAGnB,UAAU,KAAK;AACb,OAAI,CAAC,OAAO,QAAS;AAErB,QAAK,MAAM,OAAO,IAAI,QACpB,KAAI,IAAI,IAAI;IACV,MAAM,KAAK,IAAI;IACf,MAAM,eAAe,kBAAkB,GAAG;AAG1C,4BAAwB,iBAAiB,aAAa;AACtD,WAAO,eAAe,OAAO,aAAa;AAG1C,SAAK,MAAM,YAAY,UAAU,QAAQ,CACvC,uBAAsB,UAAU,aAAa;;;EAMrD,MAAM,UAAU,QAAQ,UAAU,UAAU;GAC1C,MAAM,UAAU,KAAK,YAAY;GACjC,MAAM,MAAM,OAAO,QAAQ;GAC3B,MAAM,UAAU,WAAW,QAAQ;GACnC,MAAM,WAAW,IAAI;GACrB,MAAM,gBAAgB,CAAC,CAAE,SAAqC;AAE9D,OAAI,yBAAyB;IAC3B,MAAM,eAAe,WACjB,kBAAkB,SAAS,GAC3B;IACJ,MAAM,iBAAiB,CAAC;AAKxB,QAHE,QAAQ,IAAI,uCAAuC,UAC/C,iBACA,mBAAmB,QAAQ,aAAa,CAE5C,UAAS,aAAa;KACpB,KAAK;KACL;KACA;KACA,UAAU;KACV;KACA,SAAS,OAAO;KACjB,CAAC;;GAKN,MAAM,oBAAoB,+BAA+B,OAAO;AAChE,OAAI,kBAAmB,QAAO;AAE9B,OAAI,CAAC,UAAU;AACb,QAAI,MAAM,SAAS,OAAO;AAG1B,UAAM,yBAAyB,KAAK,KAAK,KAAK,KAAK,KAAK,CAAC;AACzD;;AAGF,OAAI,OAAO,WAAW,KAAK,IAAI,OAAO,WAAW,WAAW,CAC1D;GAGF,MAAM,qBAAqB,kBAAkB,SAAS;GACtD,MAAM,iBAAiB,SAAS,SAAS,uBAAuB;AAEhE,OAAI,eACF,KAAI,sBAAsB,IAAI,mBAAmB;GAGnD,MAAM,wBACJ,kBACA,IAAI,sBAAsB,IAAI,mBAAmB,IACjD;GAOF,MAAM,YACJ,OAAO,YAAY,WAAW,OAAO,sBAAsB;GAC7D,MAAM,UAAU,OAAO,YAAY;GACnC,MAAM,cAAc,qBAAqB;IAAE;IAAS;IAAW,CAAC;GAEhE,MAAM,yBAAyB,YAAoC;IACjE,MAAM,UAAU,MAAM,KAAK,QAAQ,QAAQ,UAAU,EACnD,UAAU,MACX,CAAC;AACF,QAAI,QACF,QAAO,uBACL,QAAQ,IACR,OAAO,MACP,+BACD;AAGH,WAAO;;GAIT,MAAM,aAAa,OAAO,iBAAiB,WAAW,IAAI,OAAO,GAC5D,WACD,OAAO,iBAAiB,WAAW,IAAI,OAAO,GAC3C,WACD,KAAA;AAEN,OAAI,YAAY;IACd,MAAM,WAAW,OAAO,eAAe,IAAI,mBAAmB;AAC9D,QAAI,YAAY,aAAa,WAC3B,MAAK,MACH,6BAA6B,gBAAgB,mBAAmB,CAAC,sEAClE;AAEH,WAAO,eAAe,IAAI,oBAAoB,WAAW;IAEzD,MAAM,cACH,YAAY,YAAY,eAAe,YACvC,YAAY,YAAY,eAAe;AAE1C,QAAI,aAAa;KACf,MAAM,OAAO,MAAM,mBACjB,UACA,KACA,SACA,SACA,UACA,oBACA,QACA;MACE,MAAM;MACN,SAAS,4BACP,gBAAgB,mBAAmB,EACnC,WACD;MACF,CACF;KACD,MAAM,eAAe,MAAM,uBACzB,MACA,KACA,oBACA,UACA,MACA,aACA,sBACD;AAQD,SAAI,WAAW,gBAAgB,KAC7B,QAAO;;IAuBX,MAAM,cAAc,gBAAgB;AACpC,QAAI,eAAe,CAAC,IAAI,eAAe,IAAI,YAAY,EAAE;AACvD,SAAI,eAAe,IAAI,YAAY;KACnC,IAAI,gBAAgB;KACpB,MAAM,eAAe,IAAI,MAAM,aAAa,IAAI,mBAAmB;AACnE,SAAI,gBAAgB,aAAa,OAAO,EACtC,MAAK,MAAM,CAAC,cAAc,cAAc,cAAc;AACpD,UAAI,CAAC,UAAW;AAChB,UAAI,CAAC,oBAAoB,aAAa,CAAE;MACxC,MAAM,aAAa,MAAM,uCACvB,UACA,KACA,SACA,SACA,cACA,WACA,oBACA,gBAAgB,mBAAmB,CACpC;AACD,UAAI,YAAY;AACd,sBACE,KACA,cACA,YACA,sBACD;AACD,uBAAgB;;;AAItB,SAAI,cACF,OAAM,yBAAyB,KAAK,KAAK,KAAK,KAAK,KAAK,CAAC;;AAI7D,WAAO,eAAe,WAClB,8BAA8B,SAAS,GACvC,8BAA8B,SAAS;;AAI7C,OAAI,CAAC,oBAAoB,mBAAmB,CAC1C;GAGF,MAAM,WAAW,uBAAuB,QAAQ;GAGhD,MAAM,iBAAiB,WAAW,QAAQ,SAAS,WAAW;AAC9D,OAAI,gBAAgB;AAClB,QAAI,CAAC,sBACH,KAAI,MAAM,QAAQ,QAAQ,oBAAoB,OAAO;IAEvD,MAAM,OAAO,MAAM,mBACjB,UACA,KACA,SACA,SACA,UACA,oBACA,QACA;KACE,MAAM;KACN,SAAS,eAAe;KACxB,SAAS,WAAW,OAAO,qBAAqB,QAAQ;KACzD,CACF;AAKD,QAAI,eAAe,CAAC,KAAK,SACvB,KAAI;KACF,MAAM,kBAAkB,MAAM,wBAAwB;AACtD,SAAI,gBAAiB,MAAK,WAAW;YAC/B;AAKV,WAAO,uBACL,MACA,KACA,oBACA,UACA,MACA,aACA,sBACD;;GAIH,MAAM,WAAW,GAAG,mBAAmB,GAAG;GAC1C,IAAI;AAEJ,OAAI,IAAI,aAAa,IAAI,SAAS,CAChC,YAAW,IAAI,aAAa,IAAI,SAAS,IAAI;QACxC;AACL,eAAW,MAAM,wBAAwB;AAKzC,QAAI,aAAa,MAAM;AACrB,SAAI,aAAa,IAAI,UAAU,SAAS;AACxC,iBACE,IAAI,oBACJ,0CACM,IAAI,KAAK,CAChB,CAAC,IAAI,SAAS;;;AAInB,OAAI,UAAU;IACZ,MAAM,eAAe,gBAAgB,SAAS;AAG9C,QAAI,yBAAyB,CAAC,cAC5B,KAAI,sBAAsB,IAAI,SAAS;AAGzC,QAAI,CAAC,sBACH,KAAI,MAAM,QAAQ,UAAU,oBAAoB,OAAO;AAczD,QAAI,EAHF,SAAS,aAAa,SAAS,KAC/B,WAAW,cAAc,SAAS,aAAa,GAE5B;KACnB,MAAM,YACJ,SAAS,MAAM,SAAS,IACpB,WAAW,cAAc,SAAS,MAAM,GACxC,KAAA;AAEN,SAAI,WAAW;MACb,MAAM,OAAO,MAAM,uBACjB,UACA,KACA,SACA,SACA,UACA,oBACA,QACA,UACA,UAAU,QACX;AACD,aAAO,uBACL,MACA,KACA,oBACA,UACA,MACA,aACA,sBACD;;KAGH,MAAM,aAAa,MAAM,uCACvB,UACA,KACA,SACA,SACA,UACA,QACA,UACA,aACD;AACD,SAAI,WACF,QAAO,uBACL,MACA,KACA,oBACA,UACA,YACA,aACA,sBACD;;;;EAQT,MAAM;GACJ,QAAQ,EACN,IAAI,IAAI,OACN,kCAAkC,CAAC,IAAI,aAAa,CAAC,KAAK,IAAI,CAC/D,EACF;GACD,QAAQ,IAAI;AACV,QAAI;SACE,mBAAmB,GAAG,CACxB,UAAS,gBAAgB;MACvB,KAAK,KAAK,YAAY;MACtB,IAAI,cAAc,GAAG;MACtB,CAAC;;AAIN,WAAO,0BAA0B,GAAG;;GAEvC;EAED,MAAM,eAAe,UAAU,QAAQ;GACrC,MAAM,UAAU,KAAK,YAAY;GACjC,MAAM,MAAM,UAAU,IAAI,QAAQ;AAClC,OAAI,CAAC,OAAO,IAAI,wBAAwB,WAAW,EAAG;GAEtD,MAAM,iCAAiB,IAAI,KAA4B;GACvD,MAAM,wBAAwB,OAA8B;IAC1D,IAAI,SAAS,eAAe,IAAI,GAAG;AACnC,QAAI,OAAQ,QAAO;IAEnB,MAAM,sBAAM,IAAI,KAAa;IAC7B,MAAM,aAAa,kBAAkB,GAAG;AACxC,QAAI,IAAI,GAAG;AACX,QAAI,IAAI,WAAW;AACnB,QAAI,IAAI,eAAe,YAAY,OAAO,KAAK,CAAC;AAEhD,QAAI,WAAW,WAAA,eAAuC,EAAE;KACtD,MAAM,WAAW,KAAK,WAAW,MAAM,4BAA4B,OAAO;AAC1E,SAAI,IAAI,SAAS;AACjB,SAAI,IAAI,eAAe,kBAAkB,SAAS,EAAE,OAAO,KAAK,CAAC;;AAGnE,QAAI,WAAW,WAAW,KAAK,EAAE;KAC/B,MAAM,UAAU,GAAG,8BAA8B,WAAW,MAAM,EAAE;AACpE,SAAI,IAAI,QAAQ;AAChB,SAAI,IAAI,eAAe,kBAAkB,QAAQ,EAAE,OAAO,KAAK,CAAC;;AAGlE,aAAS,MAAM,KAAK,IAAI;AACxB,mBAAe,IAAI,IAAI,OAAO;AAC9B,WAAO;;GAIT,MAAM,mCAAmB,IAAI,KAAa;AAC1C,QAAK,MAAM,SAAS,OAAO,OAAO,OAAO,CACvC,KAAI,MAAM,SAAS,QACjB,MAAK,MAAM,YAAY,OAAO,KAAK,MAAM,QAAQ,CAC/C,MAAK,MAAM,aAAa,qBAAqB,SAAS,CACpD,kBAAiB,IAAI,UAAU;GAMvC,MAAM,oBAAoB,aACxB,qBAAqB,SAAS,CAAC,MAAM,cACnC,iBAAiB,IAAI,UAAU,CAChC;GAIH,MAAM,iBAAuC,EAAE;AAC/C,QAAK,MAAM,EACT,MACA,cACA,mBACG,IAAI,yBAAyB;IAChC,IAAI;AACJ,QAAI,iBAAiB,MAAM;KAKzB,MAAM,qBAAqB,IAAI,IAAY,CAAC,KAAK,SAAS,CAAC;KAC3D,MAAM,eAAe,IAAI,0BAA0B,IACjD,kBAAkB,KAAK,SAAS,CACjC;AACD,SAAI,aACF,MAAK,MAAM,OAAO,aAChB,oBAAmB,IAAI,IAAI;AAG/B,gBAAW;AACX,UAAK,MAAM,cAAc,mBACvB,KAAI,iBAAiB,WAAW,EAAE;AAChC,iBAAW;AACX;;UAKJ,YAAW,iBAAiB,aAAa;AAG3C,QAAI,CAAC,SAAU;AAEf,QAAI,OAAO;SACM,MAAM,OAAO,YAAY,KAAK,KAC9B,MAAO;;AAGxB,mBAAe,KAAK,KAAK;;AAG3B,OAAI,eAAe,WAAW,EAAG;AAEjC,OAAI,OAAO,sBAAsB,QAE/B,MAAK,MAAM,gBAAgB,eAAe,IAAK,OAAO,KAAK,CAAC;QACvD;IAEL,MAAM,uBAAO,IAAI,KAAa;AAC9B,SAAK,MAAM,QAAQ,gBAAgB;KACjC,MAAM,MAAM,UAAU,KAAK;AAC3B,SAAI,CAAC,KAAK,IAAI,IAAI,EAAE;AAClB,WAAK,IAAI,IAAI;AACb,WAAK,KAAK,gBAAgB,MAAM,OAAO,KAAK,CAAC;;;;;EAKtD,EACD;EAIE,MAAM;EAEN,mBAAmB,KAAK;AACtB,OAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,UAAO,iBAAiB,IAAI,IAAI,KAAK;;EAGvC,WAAW;GACT,QAAQ,EACN,IAAI,EACF,SAAS,CAAC,uBAAuB,EAClC,EACF;GACD,MAAM,QAAQ,MAAM,IAAI;IACtB,MAAM,UAAU,KAAK,YAAY;IACjC,MAAM,OAAO,kBAAkB,GAAG;IAClC,MAAM,UAAU,WAAW,QAAQ;IACnC,MAAM,WAAW,uBAAuB,QAAQ;IAChD,MAAM,UAAU,OAAO,YAAY;AAEnC,QAAI;SACE,mBAAmB,KAAK,CAC1B,UAAS,mBAAmB;MAC1B,KAAK;MACL,IAAI,cAAc,GAAG;MACrB;MACD,CAAC;;AAIN,QAAI,CAAC,oBAAoB,KAAK,CAC5B;IAkBF,MAAM,gBAAgB,gBAAgB,gBAAgB,KAAK,EAAE,SAAS;AACtE,QAAI,eAAe;KAGjB,IAAI,cAA6B,EAAE;AACnC,SAAI;AACF,oBAAc,oBAAoB,KAAK;aACjC;AAIR,SAAI,QACF,QAAO,gCAAgC,YAAY;KAKrD,MAAM,YAAY,iCAChB;MACE,MAAM;MACN,KAAK;MACL;MACA,UACE,OAAO,sBAAsB,UAAU,UAAU;MACnD,UAAU;MACV,WAAW,eAAe,MAAM,OAAO,KAAK;MAC5C,UAAU;MACV,SAAS,cAAc;MACvB,SAAS,SAAS,eAAe,MAAM,OAAO,KAAK,CAAC,qBAAqB,QAAQ;MACjF,OAAO,EAAE;MACV,EACD,OAAO,YACP,OAAO,KACR;AACD,YAAO,4BAA4B,aAAa,UAAU;;IAI5D,IAAI;AACJ,QAAI;AACF,WAAM,KAAK,sBAAsB;YAC3B;AACN,WAAM,KAAA;;IAGR,IAAI;AACJ,QAAI,KAAK,eACP,gBAAe,mCACb,KACA,MACA,OAAO,KACR;IAGH,MAAM,YAAY,eAAe,KAAK;IACtC,MAAM,WAAW,cAAc,GAAG;IAElC,MAAM,WAAW,OAAO,QAAQ;IAChC,MAAM,mBAAmB,GAAG,SAAS,uBAAuB;AAG5D,QAAI,iBACF,UAAS,sBAAsB,IAAI,KAAK;AAS1C,yBAAqB,UAAU,MAAM,UANL;KAC9B;KACA;KACA;KACA;KACD,CACqD;AAStD,QAAI,QAAS,QAAO,KAAA;IAIpB,MAAM,YAAY,OAAO,sBAAsB;IAC/C,MAAM,gBAAgB,qBAAqB,KAAK;IAChD,MAAM,mCAAmB,IAAI,KAAa;IAC1C,MAAM,2CAA2B,IAAI,KAAqB;AAC1D,SAAK,MAAM,OAAO,cAChB,KAAI;KACF,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,IAAI,EAAE,UAAU,MAAM,CAAC;AAChE,SAAI,YAAY,CAAC,SAAS,UAAU;MAClC,MAAM,eAAe,uBACnB,SAAS,IACT,OAAO,MACP,+BACD;AAED,uBAAiB,IAAI,aAAa;AAWlC,UAAI,SAAS,GAAG,SAAS,oCAAoC,EAAE;OAC7D,IAAI;OAEJ,MAAM,UAAU,SAAS,kBAAkB,IAAI,KAAK;AACpD,WAAI,SAAS;QACX,MAAM,QAAQ,QAAQ,MACnB,OAAO,GAAG,KAAK,cAAc,OAAO,GAAG,KAAK,SAC9C;AACD,YAAI,MAAO,gBAAe,MAAM,KAAK;;AAEvC,WAAI,gBAAgB,iBAAiB,cAAc;AACjD,yBAAiB,IAAI,aAAa;AAClC,iBAAS,MAAM,QAAQ,cAAc,MAAM,IAAI;;;AAKnD,eAAS,MAAM,QAAQ,cAAc,MAAM,IAAI;AAE/C,UAAI,WAAW;OAEb,MAAM,YAAY,gBADG,gBAAgB,aAAa,EACF,SAAS;AAEzD,WAAI,WAAW;QACb,MAAM,OAAO,MAAM,uBACjB,SAAS,yBACT,UACA,SACA,SACA,IACA,MACA,KACA,cACA,UAAU,QACX;QAED,MAAM,cAAc,MAAM,uBACxB,MACA,UACA,MACA,IACA,MACA,WACA,iBACD;AAED,YAAI,YACF,0BAAyB,IACvB,KACA,YAAY,WAAW,KAAK,GACxB,8BAA8B,YAAY,MAAM,EAAE,GAClD,YACL;;;;YAKH;AAIV,aAAS,qBAAqB,IAAI,UAAU,iBAAiB;AAC7D,QAAI,aAAa,QAAQ,CAAC,iBACxB,UAAS,qBAAqB,IAAI,MAAM,iBAAiB;AAG3D,UAAM,yBAAyB,UAAU,KAAK,KAAK,KAAK,KAAK,CAAC;AAE9D,QAAI,yBAAyB,OAAO,EAClC,KAAI;KACF,MAAM,YAAY,qBAChB,MACA,IACA,IAAI,IAAI,yBAAyB,MAAM,CAAC,GACvC,WACC,yBAAyB,IAAI,OAAO,IAAI,OAC3C;AAED,SAAI,CAAC,UACH;KAGF,MAAM,gBAAgB,UAAU,MAC5B;MACE,GAAG,UAAU;MACb,SAAS,OAAO,UAAU,IAAI,QAAQ;MACtC,gBACE,UAAU,IAAI,gBAAgB,KAC3B,MAAqB,KAAK,GAC5B,IAAI,EAAE;MACV,GACD;MACE,SAAS;MACT,MAAM;MACN,OAAO,EAAE;MACT,SAAS,CAAC,GAAG;MACb,gBAAgB,CAAC,KAAK;MACtB,UAAU;MACX;AAEL,YAAO;MACL,MAAM,UAAU;MAChB,KAAK;MACN;YACK;;GAOb;EACF,CACF"}

package/dist/esm/import-protection-plugin/postCompileUsage.js

@@ -1,60 +1,63 @@
-import babel from "@babel/core";
-import * as t from "@babel/types";
 import { parseImportProtectionAst } from "./ast.js";
+import * as t from "@babel/types";
+import babel from "@babel/core";
+//#region src/import-protection-plugin/postCompileUsage.ts
+/**
+* Given transformed code, returns the first "meaningful" usage position for an
+* import from `source` that survives compilation.
+*
+* "Preferred" positions (call, new, member-access) take priority over bare
+* identifier references. The returned column is 0-based (Babel loc semantics).
+*/
 function findPostCompileUsagePos(code, source) {
-  return findPostCompileUsagePosFromAst(parseImportProtectionAst(code), source);
+	return findPostCompileUsagePosFromAst(parseImportProtectionAst(code), source);
 }
 function findPostCompileUsagePosFromAst(ast, source) {
-  const imported = /* @__PURE__ */ new Set();
-  for (const node of ast.program.body) {
-    if (t.isImportDeclaration(node) && node.source.value === source) {
-      if (node.importKind === "type") continue;
-      for (const s of node.specifiers) {
-        if (t.isImportSpecifier(s) && s.importKind === "type") continue;
-        imported.add(s.local.name);
-      }
-    }
-  }
-  if (imported.size === 0) return void 0;
-  let preferred;
-  let anyUsage;
-  try {
-    babel.traverse(ast, {
-      ImportDeclaration(path) {
-        path.skip();
-      },
-      Identifier(path) {
-        if (preferred && anyUsage) {
-          path.stop();
-          return;
-        }
-        const { node, parent, scope } = path;
-        if (!imported.has(node.name)) return;
-        if (path.isBindingIdentifier()) return;
-        if (t.isObjectProperty(parent) && parent.key === node && !parent.computed && !parent.shorthand)
-          return;
-        if (t.isObjectMethod(parent) && parent.key === node && !parent.computed)
-          return;
-        if (t.isExportSpecifier(parent) && parent.exported === node) return;
-        const binding = scope.getBinding(node.name);
-        if (binding && binding.kind !== "module") return;
-        const loc = node.loc?.start;
-        if (!loc) return;
-        const pos = { line: loc.line, column0: loc.column };
-        const isPreferred = t.isCallExpression(parent) && parent.callee === node || t.isNewExpression(parent) && parent.callee === node || t.isMemberExpression(parent) && parent.object === node;
-        if (isPreferred) {
-          preferred ||= pos;
-        } else {
-          anyUsage ||= pos;
-        }
-      }
-    });
-  } catch {
-    return void 0;
-  }
-  return preferred ?? anyUsage;
+	const imported = /* @__PURE__ */ new Set();
+	for (const node of ast.program.body) if (t.isImportDeclaration(node) && node.source.value === source) {
+		if (node.importKind === "type") continue;
+		for (const s of node.specifiers) {
+			if (t.isImportSpecifier(s) && s.importKind === "type") continue;
+			imported.add(s.local.name);
+		}
+	}
+	if (imported.size === 0) return void 0;
+	let preferred;
+	let anyUsage;
+	try {
+		babel.traverse(ast, {
+			ImportDeclaration(path) {
+				path.skip();
+			},
+			Identifier(path) {
+				if (preferred && anyUsage) {
+					path.stop();
+					return;
+				}
+				const { node, parent, scope } = path;
+				if (!imported.has(node.name)) return;
+				if (path.isBindingIdentifier()) return;
+				if (t.isObjectProperty(parent) && parent.key === node && !parent.computed && !parent.shorthand) return;
+				if (t.isObjectMethod(parent) && parent.key === node && !parent.computed) return;
+				if (t.isExportSpecifier(parent) && parent.exported === node) return;
+				const binding = scope.getBinding(node.name);
+				if (binding && binding.kind !== "module") return;
+				const loc = node.loc?.start;
+				if (!loc) return;
+				const pos = {
+					line: loc.line,
+					column0: loc.column
+				};
+				if (t.isCallExpression(parent) && parent.callee === node || t.isNewExpression(parent) && parent.callee === node || t.isMemberExpression(parent) && parent.object === node) preferred ||= pos;
+				else anyUsage ||= pos;
+			}
+		});
+	} catch {
+		return;
+	}
+	return preferred ?? anyUsage;
 }
-export {
-  findPostCompileUsagePos
-};
-//# sourceMappingURL=postCompileUsage.js.map
+//#endregion
+export { findPostCompileUsagePos };
+
+//# sourceMappingURL=postCompileUsage.js.map