@tanstack/start-plugin-core 1.167.35 → 1.169.0

package/src/{import-protection-plugin → import-protection}/constants.ts

@@ -2,6 +2,13 @@ import { SERVER_FN_LOOKUP } from '../constants'
 
 export const SERVER_FN_LOOKUP_QUERY = `?${SERVER_FN_LOOKUP}`
 
+export const MOCK_MODULE_ID = 'tanstack-start-import-protection:mock'
+export const MOCK_BUILD_PREFIX = 'tanstack-start-import-protection:mock:build:'
+export const MOCK_EDGE_PREFIX = 'tanstack-start-import-protection:mock-edge:'
+export const MOCK_RUNTIME_PREFIX =
+  'tanstack-start-import-protection:mock-runtime:'
+export const MARKER_PREFIX = 'tanstack-start-import-protection:marker:'
+
 export const IMPORT_PROTECTION_DEBUG =
   process.env.TSR_IMPORT_PROTECTION_DEBUG === '1' ||
   process.env.TSR_IMPORT_PROTECTION_DEBUG === 'true'

package/src/import-protection/rewrite.ts

@@ -0,0 +1,229 @@
+import * as t from '@babel/types'
+import { generateFromAst } from '@tanstack/router-utils'
+
+import { parseImportProtectionAst } from './ast'
+import { MOCK_MODULE_ID } from './constants'
+import type { ParsedAst } from './ast'
+import type { SourceMapLike } from './sourceLocation'
+
+function getModuleExportName(node: t.Identifier | t.StringLiteral): string {
+  return t.isIdentifier(node) ? node.name : node.value
+}
+
+function toMemberExpressionProperty(name: string): {
+  property: t.Identifier | t.StringLiteral
+  computed: boolean
+} {
+  return t.isValidIdentifier(name)
+    ? { property: t.identifier(name), computed: false }
+    : { property: t.stringLiteral(name), computed: true }
+}
+
+function toModuleExportNameNode(name: string): t.Identifier | t.StringLiteral {
+  return t.isValidIdentifier(name) ? t.identifier(name) : t.stringLiteral(name)
+}
+
+function createInternalReexportVarName(
+  localName: string,
+  mockIndex: number,
+  usedNames: Set<string>,
+): string {
+  const baseName = t.isValidIdentifier(localName)
+    ? `__tss_reexport_${localName}`
+    : `__tss_reexport_${mockIndex}`
+
+  let candidate = baseName
+  let suffix = 0
+  while (usedNames.has(candidate)) {
+    suffix++
+    candidate = `${baseName}_${suffix}`
+  }
+
+  usedNames.add(candidate)
+  return candidate
+}
+
+/**
+ * Rewrite static imports/re-exports from denied sources using Babel AST transforms.
+ *
+ * Transforms:
+ *   import { a as b, c } from 'denied'
+ * Into:
+ *   import __tss_deny_0 from 'tanstack-start-import-protection:mock'
+ *   const b = __tss_deny_0.a
+ *   const c = __tss_deny_0.c
+ *
+ * Also handles:
+ *   import def from 'denied'        -> import def from mock
+ *   import * as ns from 'denied'    -> import ns from mock
+ *   export { x } from 'denied'      -> export const x = mock.x
+ *   export * from 'denied'          -> removed
+ *   export { x as y } from 'denied' -> export const y = mock.x
+ */
+export function rewriteDeniedImports(
+  code: string,
+  id: string,
+  deniedSources: Set<string>,
+  getMockModuleId: (source: string) => string = () => MOCK_MODULE_ID,
+): { code: string; map?: SourceMapLike } | undefined {
+  return rewriteDeniedImportsFromAst(
+    parseImportProtectionAst(code),
+    id,
+    deniedSources,
+    getMockModuleId,
+  )
+}
+
+function rewriteDeniedImportsFromAst(
+  ast: ParsedAst,
+  id: string,
+  deniedSources: Set<string>,
+  getMockModuleId: (source: string) => string = () => MOCK_MODULE_ID,
+): { code: string; map?: SourceMapLike } | undefined {
+  let modified = false
+  let mockCounter = 0
+
+  // Walk program body in reverse so splice indices stay valid
+  for (let i = ast.program.body.length - 1; i >= 0; i--) {
+    const node = ast.program.body[i]!
+
+    if (t.isImportDeclaration(node)) {
+      if (node.importKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      const mockVar = `__tss_deny_${mockCounter++}`
+      const replacements: Array<t.Statement> = []
+
+      replacements.push(
+        t.importDeclaration(
+          [t.importDefaultSpecifier(t.identifier(mockVar))],
+          t.stringLiteral(getMockModuleId(node.source.value)),
+        ),
+      )
+
+      for (const specifier of node.specifiers) {
+        if (
+          t.isImportDefaultSpecifier(specifier) ||
+          t.isImportNamespaceSpecifier(specifier)
+        ) {
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(specifier.local.name),
+                t.identifier(mockVar),
+              ),
+            ]),
+          )
+        } else if (t.isImportSpecifier(specifier)) {
+          if (specifier.importKind === 'type') continue
+          const importedName = getModuleExportName(specifier.imported)
+          const memberProperty = toMemberExpressionProperty(importedName)
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(specifier.local.name),
+                t.memberExpression(
+                  t.identifier(mockVar),
+                  memberProperty.property,
+                  memberProperty.computed,
+                ),
+              ),
+            ]),
+          )
+        }
+      }
+
+      ast.program.body.splice(i, 1, ...replacements)
+      modified = true
+      continue
+    }
+
+    if (t.isExportNamedDeclaration(node) && node.source) {
+      if (node.exportKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      const mockIndex = mockCounter++
+      const mockVar = `__tss_deny_${mockIndex}`
+      const replacements: Array<t.Statement> = []
+
+      replacements.push(
+        t.importDeclaration(
+          [t.importDefaultSpecifier(t.identifier(mockVar))],
+          t.stringLiteral(getMockModuleId(node.source.value)),
+        ),
+      )
+      const usedInternalVars = new Set<string>()
+      const exportSpecifiers: Array<{
+        localName: string
+        exportedName: string
+      }> = []
+      for (const specifier of node.specifiers) {
+        if (t.isExportSpecifier(specifier)) {
+          if (specifier.exportKind === 'type') continue
+          const localName = getModuleExportName(specifier.local)
+          const exportedName = getModuleExportName(specifier.exported)
+          const memberProperty = toMemberExpressionProperty(localName)
+
+          const internalVar = createInternalReexportVarName(
+            localName,
+            mockIndex,
+            usedInternalVars,
+          )
+          replacements.push(
+            t.variableDeclaration('const', [
+              t.variableDeclarator(
+                t.identifier(internalVar),
+                t.memberExpression(
+                  t.identifier(mockVar),
+                  memberProperty.property,
+                  memberProperty.computed,
+                ),
+              ),
+            ]),
+          )
+          exportSpecifiers.push({ localName: internalVar, exportedName })
+        }
+      }
+
+      if (exportSpecifiers.length > 0) {
+        replacements.push(
+          t.exportNamedDeclaration(
+            null,
+            exportSpecifiers.map((s) =>
+              t.exportSpecifier(
+                t.identifier(s.localName),
+                toModuleExportNameNode(s.exportedName),
+              ),
+            ),
+          ),
+        )
+      }
+
+      ast.program.body.splice(i, 1, ...replacements)
+      modified = true
+      continue
+    }
+
+    if (t.isExportAllDeclaration(node)) {
+      if (node.exportKind === 'type') continue
+      if (!deniedSources.has(node.source.value)) continue
+
+      ast.program.body.splice(i, 1)
+      modified = true
+      continue
+    }
+  }
+
+  if (!modified) return undefined
+
+  const result = generateFromAst(ast, {
+    sourceMaps: true,
+    sourceFileName: id,
+    filename: id,
+  })
+
+  return {
+    code: result.code,
+    ...(result.map ? { map: result.map as SourceMapLike } : {}),
+  }
+}

package/src/{import-protection-plugin → import-protection}/sourceLocation.ts

@@ -1,8 +1,14 @@
 import { SourceMapConsumer } from 'source-map'
 import * as path from 'pathe'
 
-import { findPostCompileUsagePos } from './postCompileUsage'
+import {
+  findOriginalUnsafeUsagePosFromResult,
+  findPostCompileUsagePosFromResult,
+  getImportSpecifierLocationFromResult,
+} from './analysis'
 import { getOrCreate, normalizeFilePath } from './utils'
+import type { ImportAnalysis } from './analysis'
+import type { ParsedAst } from './ast'
 import type { Loc } from './trace'
 import type { RawSourceMap } from 'source-map'
 
@@ -27,8 +33,11 @@ export interface TransformResult {
   code: string
   map: SourceMapLike | undefined
   originalCode: string | undefined
+  originalResult?: TransformResult
   /** Precomputed line index for `code` (index → line/col). */
   lineIndex?: LineIndex
+  parsedAst?: ParsedAst
+  analysis?: ImportAnalysis
 }
 
 /**
@@ -41,6 +50,10 @@ export interface TransformResultProvider {
   getTransformResult: (id: string) => TransformResult | undefined
 }
 
+export interface ImportSpecifierLocationIndex {
+  find: FindImportSpecifierLocationIndex
+}
+
 // Index → line/column conversion
 
 export type LineIndex = {
@@ -81,6 +94,42 @@ function indexToLineColWithIndex(
   return { line, column0: Math.max(0, idx - lineStart) }
 }
 
+export function indexToLineColumn(
+  lineIndex: LineIndex,
+  idx: number,
+): { line: number; column: number } {
+  const { line, column0 } = indexToLineColWithIndex(lineIndex, idx)
+  return {
+    line,
+    column: column0 + 1,
+  }
+}
+
+export function normalizeSourceMap(map: SourceMapLike | null | undefined):
+  | {
+      version: number
+      file: string
+      sourceRoot?: string
+      sources: Array<string>
+      names: Array<string>
+      sourcesContent?: Array<string>
+      mappings: string
+    }
+  | undefined {
+  if (!map) {
+    return undefined
+  }
+
+  return {
+    ...map,
+    version: Number(map.version),
+    file: map.file ?? '',
+    names: Array.isArray(map.names) ? map.names : [],
+    sourcesContent:
+      map.sourcesContent?.map((value) => value ?? '') ?? undefined,
+  }
+}
+
 /**
  * Pick the most-likely original source text for `importerFile` from
  * a sourcemap that may contain multiple sources.
@@ -271,7 +320,40 @@ export class ImportLocCache {
   }
 }
 
-export type FindImportSpecifierIndex = (code: string, source: string) => number
+export type FindImportSpecifierLocationIndex = (
+  result: TransformResult,
+  source: string,
+) => number
+
+export function getOrCreateOriginalTransformResult(
+  result: TransformResult,
+): TransformResult | undefined {
+  if (!result.originalCode) {
+    return undefined
+  }
+
+  if (!result.originalResult) {
+    result.originalResult = {
+      code: result.originalCode,
+      map: undefined,
+      originalCode: result.originalCode,
+    }
+  }
+
+  return result.originalResult
+}
+
+export function createImportSpecifierLocationIndex(): ImportSpecifierLocationIndex {
+  return {
+    find(result: TransformResult, source: string): number {
+      if (!result.code.includes(source)) {
+        return -1
+      }
+
+      return getImportSpecifierLocationFromResult(result, source)
+    },
+  }
+}
 
 /**
  * Find the location of an import statement in a transformed module
@@ -283,7 +365,7 @@ export async function findImportStatementLocationFromTransformed(
   importerId: string,
   source: string,
   importLocCache: ImportLocCache,
-  findImportSpecifierIndex: FindImportSpecifierIndex,
+  findImportSpecifierLocationIndex: FindImportSpecifierLocationIndex,
 ): Promise<Loc | undefined> {
   const importerFile = normalizeFilePath(importerId)
   const cacheKey = `${importerFile}::${source}`
@@ -298,11 +380,12 @@ export async function findImportStatementLocationFromTransformed(
       return undefined
     }
 
-    const { code, map } = res
+    const { map } = res
 
-    const lineIndex = res.lineIndex ?? buildLineIndex(code)
+    const lineIndex =
+      res.lineIndex ?? (res.lineIndex = buildLineIndex(res.code))
 
-    const idx = findImportSpecifierIndex(code, source)
+    const idx = findImportSpecifierLocationIndex(res, source)
     if (idx === -1) {
       importLocCache.set(cacheKey, null)
       return undefined
@@ -338,7 +421,7 @@ export async function findPostCompileUsageLocation(
       res.lineIndex = buildLineIndex(code)
     }
 
-    const pos = findPostCompileUsagePos(code, source)
+    const pos = findPostCompileUsagePosFromResult(res, source)
     if (!pos) return undefined
 
     return await mapGeneratedToOriginal(map, pos, importerFile)
@@ -347,6 +430,39 @@ export async function findPostCompileUsageLocation(
   }
 }
 
+/**
+ * Best-effort original-source usage lookup for cases where a later transform
+ * removes or rewrites the import from emitted code but preserves the original
+ * source in `sourcesContent`.
+ */
+export function findOriginalUsageLocation(
+  provider: TransformResultProvider,
+  importerId: string,
+  source: string,
+  envType?: 'client' | 'server',
+): Loc | undefined {
+  try {
+    const importerFile = normalizeFilePath(importerId)
+    const res = provider.getTransformResult(importerId)
+    if (!res) return undefined
+    const originalResult = getOrCreateOriginalTransformResult(res)
+    if (!originalResult) return undefined
+
+    const pos = envType
+      ? findOriginalUnsafeUsagePosFromResult(originalResult, source, envType)
+      : findPostCompileUsagePosFromResult(originalResult, source)
+    if (!pos) return undefined
+
+    return {
+      file: importerFile,
+      line: pos.line,
+      column: pos.column0 + 1,
+    }
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Annotate each trace hop with the location of the import that created the
  * edge (file:line:col). Skips steps that already have a location.
@@ -360,7 +476,7 @@ export async function addTraceImportLocations(
     column?: number
   }>,
   importLocCache: ImportLocCache,
-  findImportSpecifierIndex: FindImportSpecifierIndex,
+  findImportSpecifierLocationIndex: FindImportSpecifierLocationIndex,
 ): Promise<void> {
   for (const step of trace) {
     if (!step.specifier) continue
@@ -370,7 +486,7 @@ export async function addTraceImportLocations(
       step.file,
       step.specifier,
       importLocCache,
-      findImportSpecifierIndex,
+      findImportSpecifierLocationIndex,
     )
     if (!loc) continue
     step.line = loc.line

package/src/{import-protection-plugin → import-protection}/trace.ts

@@ -166,7 +166,6 @@ export interface ViolationInfo {
   importerLoc?: Loc
   resolved?: string
   trace: Array<TraceStep>
-  message: string
   /** Vitest-style code snippet showing the offending usage in the leaf module. */
   snippet?: {
     lines: Array<string>

package/src/{import-protection-plugin → import-protection}/utils.ts

@@ -4,7 +4,7 @@ import {
   relative,
   resolve as resolvePath,
 } from 'node:path'
-import { normalizePath } from 'vite'
+import { normalizePath } from '../utils'
 
 import {
   IMPORT_PROTECTION_DEBUG,
@@ -26,6 +26,41 @@ export function dedupePatterns(patterns: Array<Pattern>): Array<Pattern> {
   return out
 }
 
+export interface FileMatchers {
+  files: Array<{ pattern: Pattern; test: (value: string) => boolean }>
+  excludeFiles: Array<{ pattern: Pattern; test: (value: string) => boolean }>
+}
+
+export function isFileExcluded(
+  relativePath: string,
+  matchers: Pick<FileMatchers, 'excludeFiles'>,
+): boolean {
+  return (
+    matchers.excludeFiles.length > 0 &&
+    matchers.excludeFiles.some((matcher) => matcher.test(relativePath))
+  )
+}
+
+export function checkFileDenial(
+  relativePath: string,
+  matchers: FileMatchers,
+): FileMatchers['files'][number] | undefined {
+  if (isFileExcluded(relativePath, matchers)) {
+    return undefined
+  }
+
+  return matchers.files.find((matcher) => matcher.test(relativePath))
+}
+
+export function dedupeViolationKey(info: {
+  type: string
+  importer: string
+  specifier: string
+  resolved?: string
+}): string {
+  return `${info.type}:${info.importer}:${info.specifier}:${info.resolved ?? ''}`
+}
+
 /** Strip both `?query` and `#hash` from a module ID. */
 export function stripQueryAndHash(id: string): string {
   const q = id.indexOf('?')
@@ -57,15 +92,6 @@ export function clearNormalizeFilePathCache(): void {
   normalizeFilePathCache.clear()
 }
 
-/**
- * Lightweight regex to extract all import/re-export source strings from
- * post-transform code.  Matches:
- *   - `from "..."` / `from '...'`   (static import/export)
- *   - `import("...")` / `import('...')` (dynamic import)
- */
-const importSourceRe =
-  /\bfrom\s+(?:"([^"]+)"|'([^']+)')|import\s*\(\s*(?:"([^"]+)"|'([^']+)')\s*\)/g
-
 export function escapeRegExp(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }
@@ -93,17 +119,6 @@ export function relativizePath(p: string, root: string): string {
   return ch === 47 ? p.slice(root.length + 1) : p.slice(root.length)
 }
 
-export function extractImportSources(code: string): Array<string> {
-  const sources: Array<string> = []
-  let m: RegExpExecArray | null
-  importSourceRe.lastIndex = 0
-  while ((m = importSourceRe.exec(code)) !== null) {
-    const src = m[1] ?? m[2] ?? m[3] ?? m[4]
-    if (src) sources.push(src)
-  }
-  return sources
-}
-
 /** Log import-protection debug output when debug mode is enabled. */
 export function debugLog(...args: Array<unknown>): void {
   if (!IMPORT_PROTECTION_DEBUG) return