@crutchcrew/oxlint-plugin-import-access 1.0.0 → 1.1.0

package/README.md

@@ -1,11 +1,11 @@
-# oxlint-plugin-import-access 📦🔒
+# @crutchcrew/oxlint-plugin-import-access 📦🔒
 
 [![npm version](https://img.shields.io/npm/v/@crutchcrew/oxlint-plugin-import-access)](https://www.npmjs.com/package/@crutchcrew/oxlint-plugin-import-access)
 [![coverage](https://img.shields.io/endpoint?url=https://crutchcrew.github.io/oxlint-plugin-import-access/badges/coverage.json)](https://github.com/crutchcrew/oxlint-plugin-import-access/actions)
 [![provenance](https://img.shields.io/badge/provenance-verified-brightgreen)](https://www.npmjs.com/package/@crutchcrew/oxlint-plugin-import-access)
 [![license](https://img.shields.io/npm/l/@crutchcrew/oxlint-plugin-import-access)](./LICENSE)
 
-JSDoc import access for TypeScript, enforced by [oxlint](https://oxc.rs/docs/guide/usage/linter). Only `@public` exports can be imported from anywhere, and an export without an access tag is `@package`: only files in its own directory can import it. Tag an export `@public` to share it with the whole project, or `@private` so no other file can import it. To make untagged exports `@public` or `@private` instead, set [`defaultImportability`](#options).
+JSDoc import access for TypeScript, enforced by [oxlint](https://oxc.rs/docs/guide/usage/linter). Only `@public` exports can be imported from anywhere, and an export without an access tag is `@package`: only files in its own package (its directory and subdirectories) can import it. Tag an export `@public` to share it with the whole project, or `@private` so no other file can import it. To make untagged exports `@public` or `@private` instead, set [`defaultImportability`](#options).
 
 A native oxlint JS plugin port of [eslint-plugin-import-access](https://github.com/uhyo/eslint-plugin-import-access) that needs **no type checker**: no `typescript` dependency, no `tsconfig.json` project loading, no typed linting setup.
 
@@ -38,7 +38,7 @@ This plugin adds a directory-level layer between a file and the whole project: a
 | **Checks unsaved edits in the editor** | ✅           | ✅                                                                                 | ❌ skipped until saved                                                                   |
 | **Same results as the original rule**  | ✅ verified¹ | –                                                                                  | ✅                                                                                       |
 
-¹ With `defaultImportability: "public"`, which makes exports without an access tag `@public` like in the original. This plugin's default is `"package"`.
+¹ With `defaultImportability: "public"`, which makes exports without an access tag `@public` like in the original. This plugin's default is `"package"`. This plugin also checks the members used through namespace imports (`import * as foo`), which the original doesn't check.
 
 ## Install
 
@@ -110,11 +110,11 @@ The original rule asks the TypeScript type checker which declaration an import r
 
 1. resolve the import like TypeScript (`tsconfig` `paths`, `package.json` `exports`, `.js` → `.ts`) with [oxc-resolver](https://github.com/oxc-project/oxc-resolver),
 2. skip builtins and anything reached through `node_modules`,
-3. read the target file's exports and JSDoc with [oxc-parser](https://github.com/oxc-project/oxc/tree/main/napi/parser) — module record and comments only, no syntax tree — and cache them,
+3. read the target file's exports and JSDoc with [oxc-parser](https://github.com/oxc-project/oxc/tree/main/napi/parser) — the module record and comments; the syntax tree only for the few files with decorators, `export =`, re-exported imports or JSDoc inside variable statements — and cache them,
 4. follow `export *`, stop at direct re-exports like upstream, and read JSDoc with TypeScript's attachment and tag rules,
 5. check ambient `declare module "…"` and wildcard `declare module "*.svg"` declarations too.
 
-**Verified against the original:** the upstream test suite passes unchanged (same lines, columns, messages), and a differential test compares this plugin with upstream's TypeScript-based rule on every fixture file and option combination, including new fixtures for re-export chains, overloads, enums, `export =`, wildcard modules and JSDoc placement. The [known differences](./docs/rule-jsdoc.md#differences-from-upstream) are edge cases such as module augmentation across files.
+**Verified against the original:** the upstream test suite passes unchanged (same lines, columns, messages), and the port was compared with upstream's TypeScript-based rule on every fixture file and option combination, including new fixtures for re-export chains, overloads, enums, `export =`, wildcard modules and JSDoc placement, whose expectations in the test suite were generated by the original rule. The [known differences](./docs/rule-jsdoc.md#differences-from-upstream) are edge cases such as module augmentation across files.
 
 ## Performance
 

package/dist/core/checkImportability.d.ts

@@ -39,7 +39,8 @@ export declare class ImportabilityChecker {
     constructor(watching?: boolean);
     /**
      * Start checking `fileName`. In a long-running host, everything read for earlier files is
-     * re-validated: exporter files are stat-ed again and specifiers resolved again.
+     * re-validated: exporter files are stat-ed again, specifiers resolved again and package names
+     * looked up again.
      */
     nextFile(fileName: string): void;
     clear(): void;
@@ -52,6 +53,11 @@ export declare class ImportabilityPolicy {
     #private;
     readonly options: PackageOptions;
     constructor(options: PackageOptions);
+    /**
+     * Whether some export of `specifier` could be reported. Cheap way to skip namespace imports
+     * of external modules and of modules whose exports are all public.
+     */
+    mayReport(checker: ImportabilityChecker, importerFileName: string, specifier: string): boolean;
     /**
      * Check importing `name` (the export name, `default` for default imports) via `specifier`.
      */

package/dist/index.js

@@ -737,6 +737,9 @@ function lookupPackageName(file) {
   }
   return result;
 }
+function clearPackageNameCache() {
+  packageNameCache.clear();
+}
 
 // src/core/resolveModule.ts
 import { realpathSync } from "node:fs";
@@ -903,6 +906,7 @@ class ImportabilityChecker {
     }
     this.exportTables.nextGeneration();
     this.resolver.clear();
+    clearPackageNameCache();
     this.#found = new WeakMap;
   }
   clear() {
@@ -910,6 +914,7 @@ class ImportabilityChecker {
     this.resolver.clear();
     this.exportTables.clear();
     this.ambientModules.clear();
+    clearPackageNameCache();
   }
 }
 
@@ -936,10 +941,17 @@ class ImportabilityPolicy {
     const packageName = lookupPackageName(importerFileName);
     return packageName !== null && (specifier === packageName || specifier.startsWith(`${packageName}/`));
   }
-  check(checker, importerFileName, specifier, name) {
+  #targetModule(checker, importerFileName, specifier) {
     const { defaultImportability, projectDirectory } = this.options;
     const assumeAllPublic = defaultImportability === "public";
-    const module = checker.targetModule(importerFileName, specifier, projectDirectory, assumeAllPublic);
+    return checker.targetModule(importerFileName, specifier, projectDirectory, assumeAllPublic);
+  }
+  mayReport(checker, importerFileName, specifier) {
+    return this.#targetModule(checker, importerFileName, specifier)?.names !== undefined;
+  }
+  check(checker, importerFileName, specifier, name) {
+    const { defaultImportability } = this.options;
+    const module = this.#targetModule(checker, importerFileName, specifier);
     const found = module && checker.findExport(module, name);
     if (found === undefined || !found.entries[0].checked) {
       return;
@@ -998,6 +1010,21 @@ function realFileName(fileName) {
 function nameOf(node) {
   return node.type === "Literal" ? node.value : node.name;
 }
+function accessedMember(identifier) {
+  const parent = identifier.parent;
+  if (parent.type === "MemberExpression" && parent.object === identifier) {
+    const { property } = parent;
+    if (property.type === "Identifier" && !parent.computed) {
+      return { node: property, name: property.name };
+    }
+    if (property.type === "Literal" && typeof property.value === "string") {
+      return { node: property, name: property.value };
+    }
+  } else if (parent.type === "TSQualifiedName") {
+    return { node: parent.right, name: parent.right.name };
+  }
+  return;
+}
 var rule = {
   meta: {
     type: "problem",
@@ -1055,6 +1082,20 @@ var rule = {
       ImportDefaultSpecifier(node) {
         check(node, node.parent.source.value, "default", false);
       },
+      ImportNamespaceSpecifier(node) {
+        const specifier = node.parent.source.value;
+        if (!policy.mayReport(checker, importer, specifier)) {
+          return;
+        }
+        for (const variable of context.sourceCode.getDeclaredVariables(node)) {
+          for (const { identifier } of variable.references) {
+            const member = accessedMember(identifier);
+            if (member !== undefined) {
+              check(member.node, specifier, member.name, false);
+            }
+          }
+        }
+      },
       ExportSpecifier(node) {
         const { source } = node.parent;
         if (source !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@crutchcrew/oxlint-plugin-import-access",
-	"version": "1.0.0",
+	"version": "1.1.0",
 	"description": "Oxlint JS plugin for import access via JSDoc @public, @package and @private, without a type checker",
 	"keywords": [
 		"import-access",