fix: avoid false positives in import protection

Author: schiller-manuel

packages/start-plugin-core/src/import-protection-plugin/plugin.ts

@@ -682,12 +682,16 @@ export function importProtectionPlugin(
 
         // Check all code-split variants for this parent. The edge is
         // live if ANY variant's resolved imports include `current`.
+        // Skip SERVER_FN_LOOKUP variants — they contain untransformed
+        // code (the compiler excludes them), so their import lists
+        // include imports that the compiler would normally strip.
         const keySet = env.transformResultKeysByFile.get(parent)
         let anyVariantCached = false
         let edgeLive = false
 
         if (keySet) {
           for (const k of keySet) {
+            if (k.includes(SERVER_FN_LOOKUP_QUERY)) continue
             const resolvedImports = env.postTransformImports.get(k)
             if (resolvedImports) {
               anyVariantCached = true
@@ -752,10 +756,15 @@ export function importProtectionPlugin(
     const toDelete: Array<string> = []
 
     for (const [file, violations] of env.pendingViolations) {
-      // On warm start, skip graph reachability — confirm immediately.
-      const status = env.hasSeenEntry
-        ? checkPostTransformReachability(env, file)
-        : 'reachable'
+      // If no entries are registered yet, keep pending — the graph
+      // isn't ready for reachability analysis.  registerEntries()
+      // populates entries during buildStart, and resolveId(!importer)
+      // may add more.  Once entries exist, the reachability check can
+      // trace paths and confirm or discard pending violations.
+      const status =
+        env.graph.entries.size > 0
+          ? checkPostTransformReachability(env, file)
+          : 'unknown'
 
       if (status === 'reachable') {
         for (const pv of violations) {
@@ -1142,6 +1151,9 @@ export function importProtectionPlugin(
         if (!importer) {
           env.graph.addEntry(source)
           env.hasSeenEntry = true
+          // Flush pending violations now that the entry is known and
+          // reachability analysis can proceed.
+          await processPendingViolations(env, this.warn.bind(this))
           return undefined
         }