fix(start): prevent false positives for transitively resolved imports…

e2e/react-start/import-protection/.gitignore

@@ -26,3 +26,5 @@ port-*.txt
 .tanstack
 
 webserver-*.log
+error-build-result.json
+error-build.log

e2e/react-start/import-protection/src/routes/__root.tsx

@@ -32,6 +32,8 @@ function RootComponent() {
           <Link to="/client-only-violations">Client-Only Violations</Link>
           {' | '}
           <Link to="/client-only-jsx">Client-Only JSX</Link>
+          {' | '}
+          <Link to="/beforeload-leak">Beforeload Leak</Link>
         </nav>
         <Outlet />
         <Scripts />

e2e/react-start/import-protection/src/routes/beforeload-leak.tsx

@@ -0,0 +1,24 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { getSessionFromRequest } from '../violations/beforeload-server-leak'
+
+export const Route = createFileRoute('/beforeload-leak')({
+  // beforeLoad is NOT stripped by the compiler on the client side.
+  // It is not in splitRouteIdentNodes or deleteNodes, so this import
+  // chain survives: beforeload-leak.tsx -> beforeload-server-leak.ts
+  //   -> @tanstack/react-start/server
+  // This is a TRUE POSITIVE violation in the client environment.
+  beforeLoad: () => {
+    const session = getSessionFromRequest()
+    return { session }
+  },
+  component: BeforeloadLeakRoute,
+})
+
+function BeforeloadLeakRoute() {
+  return (
+    <div>
+      <h1 data-testid="beforeload-leak-heading">Beforeload Leak</h1>
+      <p data-testid="beforeload-leak-status">Route loaded</p>
+    </div>
+  )
+}

e2e/react-start/import-protection/src/routes/index.tsx

@@ -13,6 +13,12 @@ import {
   safeServerFn,
   safeServerOnly,
 } from '../violations/boundary-safe'
+import {
+  crossBoundarySafeServerFn,
+  crossBoundarySafeWithAuth,
+} from '../violations/cross-boundary-safe/usage'
+import { safeFn } from '../violations/cross-boundary-leak/safe-consumer'
+import { leakyGetSharedData } from '../violations/cross-boundary-leak/leaky-consumer'
 
 export const Route = createFileRoute('/')({
   component: Home,
@@ -31,6 +37,16 @@ function Home() {
       <p data-testid="boundary-safe-so">{String(typeof safeServerOnly)}</p>
       <p data-testid="boundary-safe-sf">{String(typeof safeServerFn)}</p>
       <p data-testid="boundary-safe-iso">{String(typeof safeIsomorphic)}</p>
+      <p data-testid="cross-boundary-safe-sf">
+        {String(typeof crossBoundarySafeServerFn)}
+      </p>
+      <p data-testid="cross-boundary-safe-mw">
+        {String(typeof crossBoundarySafeWithAuth)}
+      </p>
+      <p data-testid="cross-boundary-leak-safe">{String(typeof safeFn)}</p>
+      <p data-testid="cross-boundary-leak-leaky">
+        {String(typeof leakyGetSharedData)}
+      </p>
     </div>
   )
 }

e2e/react-start/import-protection/src/violations/beforeload-server-leak.ts

@@ -0,0 +1,10 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+// This utility wraps a denied server import and is used in a route's
+// `beforeLoad` hook.  `beforeLoad` is NOT in the compiler's
+// splitRouteIdentNodes or deleteNodes lists, so it survives on the client.
+// Using this module in `beforeLoad` is therefore a TRUE POSITIVE violation.
+export function getSessionFromRequest() {
+  const req = getRequest()
+  return { sessionId: req.headers.get('x-session-id') }
+}

e2e/react-start/import-protection/src/violations/cross-boundary-leak/leaky-consumer.ts

@@ -0,0 +1,9 @@
+import { getSharedData } from './shared-util'
+
+// Leaky: uses the shared utility OUTSIDE any compiler boundary.
+// This must still trigger a violation in the client environment
+// even if safe-consumer.ts already loaded shared-util.ts via
+// a fetchModule chain that silenced its resolveId.
+export function leakyGetSharedData() {
+  return getSharedData()
+}

e2e/react-start/import-protection/src/violations/cross-boundary-leak/safe-consumer.ts

@@ -0,0 +1,9 @@
+import { createServerFn } from '@tanstack/react-start'
+import { getSharedData } from './shared-util'
+
+// Safe: uses the shared utility ONLY inside a compiler boundary.
+// The compiler strips this from the client; fetchModule adds shared-util.ts
+// to the serverFnLookupModules set.
+export const safeFn = createServerFn().handler(async () => {
+  return getSharedData()
+})

e2e/react-start/import-protection/src/violations/cross-boundary-leak/shared-util.ts

@@ -0,0 +1,10 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+// Utility that wraps a denied server import.  It is consumed by BOTH a
+// safe consumer (inside compiler boundaries) AND a leaky consumer (outside
+// any boundary).  The leaky consumer must still trigger a violation even
+// if the safe consumer's fetchModule chain silences the initial resolve.
+export function getSharedData() {
+  const req = getRequest()
+  return { method: req.method }
+}

e2e/react-start/import-protection/src/violations/cross-boundary-safe/auth-wrapper.ts

@@ -0,0 +1,15 @@
+import { createMiddleware, createServerFn } from '@tanstack/react-start'
+import { getSessionData } from './session-util'
+
+// This middleware uses the session utility inside a compiler boundary.
+// The compiler should strip the import of session-util from the client.
+const authMiddleware = createMiddleware({ type: 'function' }).server(
+  ({ next }) => {
+    const data = getSessionData()
+    return next({ context: { session: data } })
+  },
+)
+
+// Exports a pre-configured server fn with the middleware attached.
+// This mirrors the real-world `createAuthServerFn` pattern.
+export const createAuthServerFn = createServerFn().middleware([authMiddleware])

e2e/react-start/import-protection/src/violations/cross-boundary-safe/session-util.ts

@@ -0,0 +1,13 @@
+import { getRequest } from '@tanstack/react-start/server'
+
+// This utility wraps a denied server import but does NOT contain any
+// compiler boundaries.  All consumers use it ONLY inside compiler
+// boundaries (createServerFn().handler, createMiddleware().server, etc.)
+// so the compiler should prune this import from the client bundle.
+//
+// This mirrors the real-world pattern of a session utility that wraps
+// `useSession` from `@tanstack/react-start/server`.
+export function getSessionData() {
+  const req = getRequest()
+  return { method: req.method }
+}

e2e/react-start/import-protection/src/violations/cross-boundary-safe/usage.ts

@@ -0,0 +1,18 @@
+import { createServerFn } from '@tanstack/react-start'
+import { getSessionData } from './session-util'
+import { createAuthServerFn } from './auth-wrapper'
+
+// Pattern 1: Direct use of session utility inside a server fn handler.
+// This mirrors login.tsx importing useAppSession and using it in
+// createServerFn().handler().
+export const crossBoundarySafeServerFn = createServerFn().handler(async () => {
+  return getSessionData()
+})
+
+// Pattern 2: Using the pre-configured server fn from auth-wrapper.
+// This mirrors user.tsx importing createAuthServerFn().handler().
+export const crossBoundarySafeWithAuth = createAuthServerFn().handler(
+  async () => {
+    return { ok: true }
+  },
+)

e2e/react-start/import-protection/tests/error-mode.setup.ts

@@ -1,24 +1,71 @@
 import fs from 'node:fs'
 import path from 'node:path'
-import { execSync } from 'node:child_process'
+import { execSync, spawn } from 'node:child_process'
+import { chromium } from '@playwright/test'
+import { getTestServerPort } from '@tanstack/router-e2e-utils'
+import packageJson from '../package.json' with { type: 'json' }
 import type { FullConfig } from '@playwright/test'
 
 /**
  * Global setup for error-mode E2E tests.
  *
- * Runs `BEHAVIOR=error pnpm build` and captures the output + exit code.
- * The build is *expected* to fail because `behavior: 'error'` causes the
- * import-protection plugin to call `this.error()` on the first violation,
- * which aborts the Vite/Rollup build with a non-zero exit code.
+ * 1. Runs `BEHAVIOR=error pnpm build` — expected to fail because the plugin
+ *    calls `this.error()` on the first violation, aborting the Rollup build.
+ *    Output is written to `error-build-result.json`.
  *
- * Results are written to `error-build-result.json` for the spec to read.
+ * 2. Starts a dev server with `BEHAVIOR=error`, navigates all violation
+ *    routes, then captures the server log.  In dev mode `this.error()` causes
+ *    a module-level 500 (the server stays up).  Output is written to
+ *    `error-dev-result.json`.
  */
-export default async function globalSetup(config: FullConfig) {
-  void config
-  const cwd = path.resolve(import.meta.dirname, '..')
-  const outFile = path.resolve(cwd, 'error-build-result.json')
 
-  // Clean up from previous runs.
+async function waitForHttpOk(url: string, timeoutMs: number): Promise<void> {
+  const start = Date.now()
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  while (true) {
+    if (Date.now() - start > timeoutMs) {
+      throw new Error(`Timed out waiting for ${url}`)
+    }
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(1000) })
+      if (res.ok) return
+    } catch {
+      // ignore
+    }
+    await new Promise((r) => setTimeout(r, 200))
+  }
+}
+
+async function killChild(child: ReturnType<typeof spawn>): Promise<void> {
+  if (child.exitCode !== null || child.killed) return
+  await new Promise<void>((resolve) => {
+    let resolved = false
+    const done = () => {
+      if (resolved) return
+      resolved = true
+      resolve()
+    }
+    child.once('exit', done)
+    child.once('error', done)
+    try {
+      child.kill('SIGTERM')
+    } catch {
+      done()
+      return
+    }
+    setTimeout(() => {
+      try {
+        child.kill('SIGKILL')
+      } catch {
+        // ignore
+      }
+      setTimeout(done, 500)
+    }, 3000)
+  })
+}
+
+function captureBuild(cwd: string): void {
+  const outFile = path.resolve(cwd, 'error-build-result.json')
   for (const f of ['error-build-result.json', 'error-build.log']) {
     const p = path.resolve(cwd, f)
     if (fs.existsSync(p)) fs.unlinkSync(p)
@@ -31,38 +78,99 @@ export default async function globalSetup(config: FullConfig) {
   try {
     const output = execSync('pnpm build', {
       cwd,
-      env: {
-        ...process.env,
-        BEHAVIOR: 'error',
-      },
+      env: { ...process.env, BEHAVIOR: 'error' },
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 120_000,
     })
     stdout = output
   } catch (err: any) {
-    // execSync throws on non-zero exit code — this is the *expected* path.
     exitCode = err.status ?? 1
     stdout = err.stdout ?? ''
     stderr = err.stderr ?? ''
   }
 
   const combined = `${stdout}\n${stderr}`
-
-  // Persist the log for debugging.
   fs.writeFileSync(path.resolve(cwd, 'error-build.log'), combined)
-
   fs.writeFileSync(
     outFile,
-    JSON.stringify(
-      {
-        exitCode,
-        stdout,
-        stderr,
-        combined,
-      },
-      null,
-      2,
-    ),
+    JSON.stringify({ exitCode, stdout, stderr, combined }, null, 2),
   )
 }
+
+const routes = [
+  '/',
+  '/leaky-server-import',
+  '/client-only-violations',
+  '/client-only-jsx',
+  '/beforeload-leak',
+]
+
+async function captureDev(cwd: string): Promise<void> {
+  const outFile = path.resolve(cwd, 'error-dev-result.json')
+  for (const f of ['error-dev-result.json', 'error-dev.log']) {
+    const p = path.resolve(cwd, f)
+    if (fs.existsSync(p)) fs.unlinkSync(p)
+  }
+
+  const port = await getTestServerPort(`${packageJson.name}_error_dev`)
+  const baseURL = `http://localhost:${port}`
+  const logFile = path.resolve(cwd, 'error-dev.log')
+
+  const out = fs.createWriteStream(logFile)
+  const child = spawn('pnpm', ['exec', 'vite', 'dev', '--port', String(port)], {
+    cwd,
+    env: {
+      ...process.env,
+      BEHAVIOR: 'error',
+      PORT: String(port),
+      VITE_SERVER_PORT: String(port),
+      VITE_NODE_ENV: 'test',
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+
+  child.stdout?.on('data', (d: Buffer) => out.write(d))
+  child.stderr?.on('data', (d: Buffer) => out.write(d))
+
+  try {
+    await waitForHttpOk(baseURL, 30_000)
+
+    const browser = await chromium.launch()
+    try {
+      const context = await browser.newContext()
+      const page = await context.newPage()
+      for (const route of routes) {
+        try {
+          await page.goto(`${baseURL}${route}`, {
+            waitUntil: 'networkidle',
+            timeout: 15_000,
+          })
+        } catch {
+          // expected — modules fail with 500 in error mode
+        }
+      }
+      await context.close()
+    } finally {
+      await browser.close()
+    }
+
+    await new Promise((r) => setTimeout(r, 750))
+  } finally {
+    await killChild(child)
+    await new Promise<void>((resolve) => out.end(resolve))
+  }
+
+  const combined = fs.existsSync(logFile)
+    ? fs.readFileSync(logFile, 'utf-8')
+    : ''
+  fs.writeFileSync(outFile, JSON.stringify({ combined }, null, 2))
+}
+
+export default async function globalSetup(config: FullConfig) {
+  void config
+  const cwd = path.resolve(import.meta.dirname, '..')
+
+  captureBuild(cwd)
+  await captureDev(cwd)
+}