perf(start): optimize Rsbuild import protection reporting

.changeset/lazy-rspack-guards.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/start-plugin-core': patch
+---
+
+Improve Rsbuild import protection performance by scanning the compilation graph once and deferring diagnostic work until a violation is found.

packages/start-plugin-core/src/rsbuild/INTERNALS-import-protection.md

@@ -11,12 +11,10 @@ Rsbuild owns:
 - virtual-module transport through `VirtualModulesPlugin`
 - compilation-truth reporting in `processAssets`
 - final graph reconstruction from Rspack compilation data
-- the small build-only deferred queue for file violations that can disappear
-  from the compiled graph
 
-Shared AST analysis, rewrite logic, source extraction, usage lookup, source
-locations, trace formatting, and mock code generation are described in the
-shared internals doc.
+Shared transform-time AST analysis, rewrite logic, source extraction, usage
+lookup, source locations, trace formatting, and mock code generation are
+described in the shared internals doc.
 
 ## Mental Model
 
@@ -45,16 +43,16 @@ Per environment, Rsbuild keeps a smaller runtime state than Vite:
 
 - `resolveCache`
 - `seenViolations`
-- `buildTransformResults`
-- `deferredFileViolations`
-- `deferredFileViolationKeys`
 
-Shared state is for virtual module transport and compiler fs access:
+A per-environment resource map associates each loader resource with its Rspack
+module. It is populated by Rspack's loader hook and consumed by the matching
+post-transform callback; durable marker state lives on `module.buildInfo`.
+
+Shared state is for virtual module transport:
 
 - `virtualModules`
 - `vmPlugins`
 - `readyVmPlugins`
-- `inputFileSystems`
 - `pendingWrites`
 
 Notably absent compared to Vite:
@@ -76,10 +74,13 @@ The transform phase is responsible for:
 
 - self-denial for forbidden files
 - self-denial for marker-protected files in the wrong environment
+- persisting detected marker kinds in Rspack `module.buildInfo`
 - direct specifier rewrites to mock-edge modules
-- build-time transformed/original source preloading for later diagnostics
-- recording build-only deferred file violations when original unsafe usage may
-  outlive a direct compiled graph edge
+
+The transform treats the code it receives as authoritative. It does not read,
+parse, or analyze original source. Imports removed by the Start compiler are no
+longer part of this phase; imports with unsafe client/server usage remain in the
+transformed code and are checked normally.
 
 ## Virtual Module Transport
 
@@ -106,28 +107,51 @@ adapter queues them and flushes during compilation setup.
 
 It reconstructs the final view of the compilation from Rspack data by:
 
-1. building a `TransformResultProvider` from `compilation.modules`
-2. rebuilding the active compilation graph from outgoing connections
-3. reconstructing surviving specifier violations from compiled mock-edge files
-4. reporting live file violations from active edges
-5. reporting live marker violations from active edges plus original source
-6. reporting deferred file violations only when both importer and target truly
-   survived compilation
+1. collecting every module's active outgoing connections into
+   `RspackModuleGraphNode[]`, while a separate visitor classifies each node as
+   soon as it is created
+2. finishing marker checks after all modules are known
+3. returning immediately when collection produces no candidates
+4. building the `ImportGraph` and diagnostic indexes only for confirmed
+   candidates
+
+Each `RspackModuleGraphNode` contains only a module and its active
+`{ dependency, module }` imports. For multiple active connections to the same
+target `Module`, collection keeps only the first connection in Rspack's outgoing
+order. Collection does not filter by source-file eligibility, because every
+intermediate module is required to preserve complete entry-to-violation traces.
+The classification visitor applies source-file and rule eligibility separately;
+it does not traverse the node array afterward. Marker fallback retains only
+pending imports until every eligible node's specifier set is available. Module
+identity keeps query, layer, and other same-resource variants distinct.
+Normalized file paths remain the user-facing identity for rules, traces, source
+mapping, and diagnostics.
+
+When at least one candidate exists, the adapter replays the in-memory node array
+to build `ImportGraph`; it never calls
+`getOutgoingConnectionsInOrder(module)` a second time. A successful compilation
+therefore avoids allocating `ImportGraph`, entry data, and path-based trace
+indexes entirely.
+
+`processAssets` does not parse module source. Import requests come from
+the retained `connection.dependency.request`. Diagnostic locations come from
+that dependency's `loc`, then map through the compiled module sourcemap. The
+adapter does not distinguish import and usage locations. When Rspack does not
+expose a dependency location, the diagnostic remains valid but may omit its
+source location and snippet.
+
+When `sourceAndMap()` does not provide a sourcemap, generated dependency
+locations are not reported as original source locations. Importer and trace
+locations, along with the source snippet, are omitted in that case.
+
+`module.originalSource()` plus `sourceAndMap()` are called only for modules
+required to build a confirmed violation. A compilation with no violations
+therefore does not read dependency locations, module sources, or compilation
+entries.
 
 This is the core Rsbuild-native replacement for Vite's `generateBundle`
 verification plus dev pending-violation flow.
 
-## Why The Deferred Queue Is Narrow
-
-Rsbuild only needs explicit build deferral for file violations whose direct edge
-may disappear after compilation.
-
-Specifier violations are rediscovered from surviving mock-edge virtual files.
-Marker violations are rediscovered from live compiled edges.
-
-Only file violations need extra bookkeeping when the final compiled graph can no
-longer show the original denied edge directly.
-
 ## Source And Compilation APIs
 
 The Rsbuild adapter intentionally prefers native Rspack APIs where possible.
@@ -137,26 +161,34 @@ Transform-time:
 - `ctx.resource`
 - `ctx.context`
 - `ctx.resolve(...)`
-- captured `compiler.inputFileSystem.readFile(...)`
 
 Compilation-time:
 
-- `module.nameForCondition?.()`
 - `module.resourceResolveData?.resource`
-- `module.originalSource().sourceAndMap()`
+- `module.identifier()` (normalized fallback)
+- `module.originalSource().sourceAndMap()` (confirmed diagnostics only)
 - sourcemap `sourcesContent`
-- `compilation.inputFileSystem.readFile(...)`
+- `moduleGraph.getOutgoingConnectionsInOrder(module)`
+- `connection.dependency.request`
+- `connection.dependency.loc` (confirmed diagnostics only)
 
-This keeps the adapter closer to Rsbuild/Rspack truth and avoids falling back to
-Node fs when the compilation already has the needed data.
+Diagnostics use the retained first connection's dependency location and map it
+back through the composed compilation sourcemap.
 
 ## Marker Handling
 
 Unlike Vite, Rsbuild does not introduce plugin-owned virtual marker modules for
 normal operation.
 
-The real package marker files are used as source-level markers, and the adapter
-later infers marker kind from original source while reporting compiled edges.
+The real package marker files are used as source-level markers. Rspack's loader
+hook records the module under the exact loader resource. The matching post
+transform consumes that association and writes the detected marker kind to the
+module's `buildInfo` before replacing a wrong-environment module. This preserves
+the marker after self-denial mocking and when Rspack restores modules from its
+persistent cache.
+
+`processAssets` reads the persisted marker kind first. Dependency requests in
+the final module graph remain a fallback for modules without metadata.
 
 ## Practical Maintainer Rule