@jameswyse/oxc-config 0.4.0 → 0.5.0

package/REFERENCE.md

@@ -72,10 +72,10 @@ Native rules: `prefer-const`, `no-param-reassign` and `oxc/no-accumulating-sprea
 
 These rules run only once the project names its owners through the [project boundary options](docs/configuration.md#enforce-project-boundaries).
 
-- `wyse/no-env-access` (`env`): reading `process.env` or `import.meta.env` outside the owners, config files and scripts. That includes destructuring `env`, `globalThis.process.env`, `global.process.env`, `process["env"]` and `Reflect.get(process, "env")`, including with `"env" as const`, importing `env` from `node:process` or `process`, reading `env` from those modules' default, namespace or literal dynamic import, and re-exporting `env`, the default or the whole module from them with `export { ... } from` or `export * from`. Other `node:process` imports and re-exports, such as `argv`, type-only re-exports, and a `process` property on `window` or `self` pass. It doesn't check that the owner validates what it reads.
-- `wyse/import-boundaries` (`boundaries`): a value import, re-export, literal dynamic import, or `require` call, including a loader made with `createRequire` from `node:module`, that matches a `deny` glob. Type-only imports and `import("…")` types pass unless the boundary sets `types: true`. It doesn't check computed imports.
+- `wyse/no-env-access` (`env`): reading `process.env` or `import.meta.env` outside the owners, config files and scripts. That includes destructuring `env`, `globalThis.process.env`, `global.process.env`, `process["env"]` and `Reflect.get(process, "env")`, including with `"env" as const`, importing `env` from `node:process` or `process`, reading `env` from those modules' default, namespace, literal dynamic import or `require`, including through a loader made with `createRequire` from `node:module` or `module` or a `const` copy of a loader, and re-exporting `env`, the default or the whole module from them with `export { ... } from` or `export * from`. Other `node:process` imports and re-exports, such as `argv`, type-only re-exports, a `require` function the file defines itself, a loader variable that's reassigned, and a `process` property on `window` or `self` pass. It doesn't check that the owner validates what it reads.
+- `wyse/import-boundaries` (`boundaries`): a value import, re-export, literal dynamic import, or `require` call, including a loader made with `createRequire` from `node:module` or `module`, whether stored, copied to another `const` or called directly as `createRequire(import.meta.url)("…")`, that matches a `deny` glob. A loader variable that's reassigned doesn't count. Type-only imports and `import("…")` types pass unless the boundary sets `types: true`. It doesn't check computed imports.
 - `wyse/server-action-guard` (`serverActionGuards`): a `"use server"` action that doesn't start by awaiting a guard, and indirect or default exports from server-action modules. Non-exported helpers and test files pass.
-- `wyse/no-ambient-clock` (`clock`): `Date.now()`, `Date()` and argument-less `new Date()`, including through `globalThis` or `window`. It also reports argument-less `new TZDate()` and `new TZDateMini()` and one-argument `TZDate.tz(zone)` from `@date-fns/tz`, `@date-fns/tz/date` or `@date-fns/tz/date/mini`, and calls to the date-fns helpers that read the current time: `constructNow`, the `startOf` and `endOf` helpers for today, tomorrow and yesterday, `isToday`, `isTomorrow`, `isYesterday`, `isPast`, `isFuture`, the `isThis*` helpers, `formatDistanceToNow`, `formatDistanceToNowStrict`, `isMatch`, and `isMatch` and `isMatchWithOptions` from `date-fns/fp` at the call that supplies their last curried argument. Helpers count whether they're imported by name, through a namespace, from a `date-fns/<name>` subpath or by literal dynamic import. Re-exporting one of these helpers with `export { ... } from`, or a module that contains one, such as `date-fns` or `date-fns/fp`, with `export * from`, also reports, because calls through the re-export no longer resolve to date-fns. Helpers that compare with a given date, such as `isSameDay`, partly applied `date-fns/fp` helpers, and re-exports of `TZDate`, `TZDateMini`, other date-fns helpers or types pass. Parameter defaults, uncalled `Date.now`, provider functions that only return the read, and test files pass. Parentheses, `as`, `satisfies` and `!` don't change the result, so `(Date.now as typeof Date.now)()` reports and `{ now: () => startOfToday() as Date }` passes.
+- `wyse/no-ambient-clock` (`clock`): `Date.now()`, `Date()` and argument-less `new Date()`, including through `globalThis` or `window`. It also reports argument-less `new TZDate()` and `new TZDateMini()` and one-argument `TZDate.tz(zone)` from `@date-fns/tz`, `@date-fns/tz/date` or `@date-fns/tz/date/mini`, and the date-fns helpers that read the current time: `constructNow`, the `startOf` and `endOf` helpers for today, tomorrow and yesterday, `isToday`, `isTomorrow`, `isYesterday`, `isPast`, `isFuture`, the `isThis*` helpers, `formatDistanceToNow`, `formatDistanceToNowStrict`, `isMatch`, and `isMatch` and `isMatchWithOptions` from `date-fns/fp`. A helper reports where it's called, where it's passed or stored uncalled, such as `dates.filter(isPast)` or `{ check: isToday }`, and where it's exported by local name, such as `export { isPast }`. A `date-fns/fp` helper reports once at the end of its call chain, so the partial application in `values.filter(isMatch("yyyy"))` reports too. A `const` alias reports where it's used. Helpers count whether they're imported by name, through a namespace, from a `date-fns/<name>` subpath, by literal dynamic import or by `require`. Re-exporting one of these helpers with `export { ... } from`, or a module that contains one, such as `date-fns` or `date-fns/fp`, with `export * from`, also reports, because calls through the re-export no longer resolve to date-fns. Helpers that compare with a given date, such as `isSameDay`, type positions such as `typeof isPast`, type-only imports and exports, and re-exports of `TZDate`, `TZDateMini`, other date-fns helpers or types pass. Parameter defaults, such as `check = isPast`, uncalled `Date.now`, provider functions that only return the read, including through `.call`, `.apply` or `.bind`, write-only uses of a helper's name on a module object, such as `d.isPast = check`, `[d.isPast] = values`, `for (d.isPast of values)`, `delete d.isPast` and `delete d?.isPast`, and test files pass. Parentheses, `as`, `satisfies` and `!` don't change the result, so `(Date.now as typeof Date.now)()` reports and `{ now: () => startOfToday() as Date }` passes.
 - `wyse/no-ambient-random` (`random`): `Math.random()`, `crypto.randomUUID()`, and `randomUUID` or `randomInt` from `node:crypto`. The same exceptions and wrapper handling apply. `randomBytes` and `getRandomValues` pass because they generate secrets.
 
 ## Tests

package/dist/rules/import-boundaries.js

@@ -1,6 +1,6 @@
 import { dirname, resolve as resolvePath } from "node:path";
 import { defineRule } from "@oxlint/plugins";
-import { importedBinding, isGlobal, matchesAny, projectPath, variableFor, } from "../shared/index.js";
+import { isRequire, matchesAny, projectPath } from "../shared/index.js";
 function isStringList(value) {
     return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
@@ -29,17 +29,6 @@ function parseSettings(options) {
     }
     return { root: option.root, boundaries: option.boundaries.map(parseBoundary) };
 }
-const nodeModuleSources = new Set(["module", "node:module"]);
-function isRequire(sourceCode, callee) {
-    if (isGlobal(sourceCode, callee, "require")) {
-        return true;
-    }
-    const definition = variableFor(sourceCode, callee)?.defs[0];
-    const init = definition?.node.type === "VariableDeclarator" ? definition.node.init : null;
-    const factory = init?.type === "CallExpression" ? init.callee : null;
-    const binding = factory === null ? null : importedBinding(sourceCode, factory);
-    return (binding !== null && nodeModuleSources.has(binding.source) && binding.name === "createRequire");
-}
 export const importBoundaries = defineRule({
     meta: {
         type: "problem",

package/dist/rules/no-ambient-clock.js

@@ -1,5 +1,5 @@
 import { defineRule } from "@oxlint/plugins";
-import { importedBinding, isGlobalValue, isInjectionSeam, moduleExportName, outermostExpression, staticPropertyName, unwrapExpression, } from "../shared/index.js";
+import { importedBinding, isGlobalValue, isInjectedValue, isInjectionSeam, moduleExportName, outermostExpression, staticPropertyName, unwrapExpression, variableFor, } from "../shared/index.js";
 const timeZoneModules = new Set(["@date-fns/tz", "@date-fns/tz/date", "@date-fns/tz/date/mini"]);
 const timeZoneDates = new Set(["TZDate", "TZDateMini"]);
 const clockHelpers = new Set([
@@ -26,34 +26,88 @@ const clockHelpers = new Set([
     "date-fns/formatDistanceToNow",
     "date-fns/formatDistanceToNowStrict",
     "date-fns/isMatch",
+    "date-fns/fp/isMatch",
+    "date-fns/fp/isMatchWithOptions",
 ]);
-const curriedClockHelpers = new Map([
-    ["date-fns/fp/isMatch", 2],
-    ["date-fns/fp/isMatchWithOptions", 3],
-]);
-const clockExports = new Set([...clockHelpers, ...curriedClockHelpers.keys()]);
 function helperPath(source, name) {
     return name === "default" || source.endsWith(`/${name}`) ? source : `${source}/${name}`;
 }
-function exportPath(sourceCode, node) {
+function isClockHelper(sourceCode, node) {
     const binding = importedBinding(sourceCode, node);
-    return binding === null ? null : helperPath(binding.source, binding.name);
+    return binding !== null && clockHelpers.has(helperPath(binding.source, binding.name));
 }
 function exposesClockHelper(source) {
-    return [...clockExports].some((helper) => helperPath(source, helper.slice(helper.lastIndexOf("/") + 1)) === helper);
+    return [...clockHelpers].some((helper) => helperPath(source, helper.slice(helper.lastIndexOf("/") + 1)) === helper);
+}
+function isTypeImport(definition) {
+    const declaration = definition.parent;
+    const specifier = definition.node;
+    return (declaration?.type === "ImportDeclaration" &&
+        (declaration.importKind === "type" ||
+            (specifier.type === "ImportSpecifier" && specifier.importKind === "type")));
+}
+function isTypePosition(node) {
+    const parent = node.parent;
+    const declaration = parent?.parent;
+    return (parent?.type === "TSTypeQuery" ||
+        parent?.type === "TSQualifiedName" ||
+        (parent?.type === "ExportSpecifier" &&
+            (parent.exportKind === "type" ||
+                (declaration?.type === "ExportNamedDeclaration" && declaration.exportKind === "type"))));
 }
-function fullApplication(call, arity) {
-    if (call.arguments.some((argument) => argument.type === "SpreadElement")) {
-        return null;
+function isValueReference(sourceCode, node) {
+    const variable = variableFor(sourceCode, node);
+    const definition = variable?.defs[0];
+    return (variable !== null &&
+        definition !== undefined &&
+        !isTypeImport(definition) &&
+        !isTypePosition(node) &&
+        variable.references.some((reference) => reference.identifier === node && reference.isRead()));
+}
+const functionMethods = new Set(["call", "apply", "bind"]);
+function helperUse(node) {
+    const value = outermostExpression(node);
+    const parent = value.parent;
+    if (parent?.type === "CallExpression" && parent.callee === value) {
+        return helperUse(parent);
     }
-    const remaining = arity - call.arguments.length;
-    if (remaining <= 0) {
-        return call;
+    if (parent?.type === "MemberExpression" &&
+        parent.object === value &&
+        functionMethods.has(staticPropertyName(parent) ?? "")) {
+        const use = helperUse(parent);
+        return use === parent ? node : use;
     }
-    const parent = outermostExpression(call).parent;
-    return parent?.type === "CallExpression" && unwrapExpression(parent.callee) === call
-        ? fullApplication(parent, remaining)
-        : null;
+    return node;
+}
+function isWriteTarget(node) {
+    const expression = outermostExpression(node);
+    const target = expression.parent?.type === "ChainExpression"
+        ? outermostExpression(expression.parent)
+        : expression;
+    const parent = target.parent;
+    return ((parent?.type === "AssignmentExpression" &&
+        parent.left === target &&
+        parent.operator === "=") ||
+        ((parent?.type === "ForOfStatement" || parent?.type === "ForInStatement") &&
+            parent.left === target) ||
+        (parent?.type === "UnaryExpression" && parent.operator === "delete") ||
+        (parent?.type === "AssignmentPattern" && parent.left === target) ||
+        (parent?.type === "Property" &&
+            parent.value === target &&
+            parent.parent.type === "ObjectPattern") ||
+        parent?.type === "ArrayPattern" ||
+        parent?.type === "RestElement");
+}
+function isFollowedAlias(node) {
+    const value = outermostExpression(node);
+    const declarator = value.parent;
+    const declaration = declarator?.parent;
+    return (declarator?.type === "VariableDeclarator" &&
+        declarator.init === value &&
+        declarator.id.type === "Identifier" &&
+        declaration?.type === "VariableDeclaration" &&
+        declaration.kind === "const" &&
+        declaration.parent.type !== "ExportNamedDeclaration");
 }
 function isTimeZoneDate(sourceCode, node) {
     const binding = importedBinding(sourceCode, node);
@@ -84,11 +138,25 @@ export const noAmbientClock = defineRule({
                 context.report({ node, messageId: "clock" });
             }
         }
+        function reportHelper(reference) {
+            const use = helperUse(reference);
+            if ((use !== reference || !isFollowedAlias(reference)) && !isInjectedValue(use)) {
+                context.report({ node: use, messageId: "clock" });
+            }
+        }
         return {
+            Identifier(node) {
+                if (isClockHelper(sourceCode, node) && isValueReference(sourceCode, node)) {
+                    reportHelper(node);
+                }
+            },
             MemberExpression(node) {
                 if (staticPropertyName(node) === "now" && isGlobalValue(sourceCode, node.object, "Date")) {
                     report(node);
                 }
+                if (isClockHelper(sourceCode, node) && !isWriteTarget(node)) {
+                    reportHelper(node);
+                }
             },
             NewExpression(node) {
                 if (node.arguments.length === 0 &&
@@ -98,14 +166,7 @@ export const noAmbientClock = defineRule({
                 }
             },
             CallExpression(node) {
-                const helper = exportPath(sourceCode, node.callee);
-                const arity = helper === null ? undefined : curriedClockHelpers.get(helper);
-                const applied = arity === undefined ? null : fullApplication(node, arity);
-                if (applied !== null) {
-                    report(applied);
-                }
                 if (isGlobalValue(sourceCode, node.callee, "Date") ||
-                    (helper !== null && clockHelpers.has(helper)) ||
                     isCurrentTimeZoneDate(sourceCode, node)) {
                     report(node);
                 }
@@ -116,7 +177,7 @@ export const noAmbientClock = defineRule({
                 }
                 for (const specifier of node.specifiers) {
                     if (specifier.exportKind !== "type" &&
-                        clockExports.has(helperPath(node.source.value, moduleExportName(specifier.local)))) {
+                        clockHelpers.has(helperPath(node.source.value, moduleExportName(specifier.local)))) {
                         context.report({ node: specifier, messageId: "clock" });
                     }
                 }

package/dist/shared/index.d.ts

@@ -27,12 +27,14 @@ export declare function staticString(node: ESTree.Node | null | undefined): stri
 export declare function staticPropertyName(node: ESTree.Node): string | null;
 export declare function moduleExportName(node: ESTree.ModuleExportName): string;
 export declare function importedBinding(sourceCode: SourceCode, node: ESTree.Node): ImportedBinding | null;
+export declare function isRequire(sourceCode: SourceCode, node: ESTree.Node): boolean;
 export declare function apiReference(sourceCode: SourceCode, node: ESTree.Node): ApiReference | null;
 export declare function testContext(sourceCode: SourceCode, node: ESTree.Node): TestContext | null;
 export declare function projectPath(cwd: string, file: string): string;
 export declare function matchesAny(path: string, patterns?: readonly string[]): boolean;
 export declare function isGlobalValue(sourceCode: SourceCode, node: ESTree.Node | null | undefined, name: string): boolean;
 export declare function isNodeGlobalValue(sourceCode: SourceCode, node: ESTree.Node | null | undefined, name: string): boolean;
+export declare function isInjectedValue(source: ESTree.Node): boolean;
 export declare function isInjectionSeam(source: ESTree.Node): boolean;
 export declare function isShortCircuited(call: ESTree.CallExpression): boolean;
 export declare function isEffectModule(sourceCode: SourceCode, node: ESTree.Node, module: string): boolean;

package/dist/shared/index.js

@@ -172,6 +172,41 @@ function cached(cache, variable, resolve) {
     }
     return cache.get(variable) ?? null;
 }
+const nodeModuleSources = new Set(["module", "node:module"]);
+const loaderCache = new WeakMap();
+function unchangedInit(variable) {
+    const [definition, ...otherDefinitions] = variable.defs;
+    const declarator = definition?.node;
+    return otherDefinitions.length === 0 &&
+        definition?.type === "Variable" &&
+        declarator?.type === "VariableDeclarator" &&
+        declarator.id === definition.name &&
+        variable.references.every((reference) => reference.init || !reference.isWrite())
+        ? declarator.init
+        : null;
+}
+function isRequireFactory(node, resolve) {
+    const binding = node.type === "CallExpression" ? resolve(node.callee) : null;
+    return (binding !== null && nodeModuleSources.has(binding.source) && binding.name === "createRequire");
+}
+function isLoader(sourceCode, node, resolve) {
+    const callee = unwrapExpression(node);
+    if (isGlobal(sourceCode, callee, "require") || isRequireFactory(callee, resolve)) {
+        return true;
+    }
+    const variable = variableFor(sourceCode, callee);
+    return (variable !== null &&
+        cached(loaderCache, variable, () => {
+            const init = unchangedInit(variable);
+            return init !== null && isLoader(sourceCode, init, resolve);
+        }) === true);
+}
+function loadedSource(sourceCode, node, resolve) {
+    const required = node.type === "CallExpression" &&
+        node.arguments.length === 1 &&
+        isLoader(sourceCode, node.callee, resolve);
+    return required ? staticString(node.arguments[0]) : dynamicImportSource(node);
+}
 function importBinding(definition) {
     const declaration = definition.parent;
     const specifier = definition.node;
@@ -194,9 +229,9 @@ function importBinding(definition) {
 }
 export function importedBinding(sourceCode, node) {
     const value = unwrapExpression(node);
-    const dynamicSource = dynamicImportSource(value);
-    if (dynamicSource !== null) {
-        return { source: dynamicSource, name: "*" };
+    const source = loadedSource(sourceCode, value, (callee) => importedBinding(sourceCode, callee));
+    if (source !== null) {
+        return { source, name: "*" };
     }
     if (value.type === "MemberExpression") {
         return memberBinding(importedBinding(sourceCode, value.object), staticPropertyName(value));
@@ -213,6 +248,9 @@ export function importedBinding(sourceCode, node) {
             : aliasTarget(alias, (init) => importedBinding(sourceCode, init), memberBinding);
     });
 }
+export function isRequire(sourceCode, node) {
+    return isLoader(sourceCode, node, (callee) => importedBinding(sourceCode, callee));
+}
 function bindingReference(binding) {
     const defaultExport = defaultImports.get(binding.source);
     if (binding.name === "default") {
@@ -240,6 +278,10 @@ function memberReference(object, name) {
 }
 export function apiReference(sourceCode, node) {
     const value = unwrapExpression(node);
+    const source = loadedSource(sourceCode, value, (callee) => importedBinding(sourceCode, callee));
+    if (source !== null) {
+        return { module: source, name: "*" };
+    }
     if (value.type === "Identifier") {
         const variable = variableFor(sourceCode, value);
         if (!variable?.defs.length) {
@@ -288,8 +330,7 @@ export function apiReference(sourceCode, node) {
             ? apiReference(sourceCode, tag.object)
             : null;
     }
-    const dynamicSource = dynamicImportSource(value);
-    return dynamicSource === null ? null : { module: dynamicSource, name: "*" };
+    return null;
 }
 export function testContext(sourceCode, node) {
     for (let ancestor = node.parent; ancestor; ancestor = ancestor.parent) {
@@ -362,15 +403,9 @@ function isProvider(callback, value) {
             holder.right === provider &&
             ["??", "||"].includes(holder.operator)));
 }
-export function isInjectionSeam(source) {
-    const parent = source.parent;
-    if (source.type !== "NewExpression" && source.type !== "CallExpression") {
-        const callee = outermostExpression(source);
-        const call = callee.parent;
-        return call?.type === "CallExpression" && call.callee === callee ? isInjectionSeam(call) : true;
-    }
+export function isInjectedValue(source) {
     let child = source;
-    for (let ancestor = parent; ancestor; child = ancestor, ancestor = ancestor.parent) {
+    for (let ancestor = source.parent; ancestor; child = ancestor, ancestor = ancestor.parent) {
         if (ancestor.type === "AssignmentPattern") {
             return ancestor.right === child;
         }
@@ -380,6 +415,14 @@ export function isInjectionSeam(source) {
     }
     return false;
 }
+export function isInjectionSeam(source) {
+    if (source.type !== "NewExpression" && source.type !== "CallExpression") {
+        const callee = outermostExpression(source);
+        const call = callee.parent;
+        return call?.type === "CallExpression" && call.callee === callee ? isInjectionSeam(call) : true;
+    }
+    return isInjectedValue(source);
+}
 export function isShortCircuited(call) {
     let current = call;
     while (current.type === "CallExpression" || current.type === "MemberExpression") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameswyse/oxc-config",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Opinionated Oxlint and Oxfmt configs with custom rules for TypeScript and JavaScript projects",
   "keywords": [
     "config",