@jameswyse/oxc-config 0.5.0 → 0.6.1

package/REFERENCE.md

@@ -72,10 +72,10 @@ Native rules: `prefer-const`, `no-param-reassign` and `oxc/no-accumulating-sprea
 
 These rules run only once the project names its owners through the [project boundary options](docs/configuration.md#enforce-project-boundaries).
 
-- `wyse/no-env-access` (`env`): reading `process.env` or `import.meta.env` outside the owners, config files and scripts. That includes destructuring `env`, `globalThis.process.env`, `global.process.env`, `process["env"]` and `Reflect.get(process, "env")`, including with `"env" as const`, importing `env` from `node:process` or `process`, reading `env` from those modules' default, namespace, literal dynamic import or `require`, including through a loader made with `createRequire` from `node:module` or `module` or a `const` copy of a loader, and re-exporting `env`, the default or the whole module from them with `export { ... } from` or `export * from`. Other `node:process` imports and re-exports, such as `argv`, type-only re-exports, a `require` function the file defines itself, a loader variable that's reassigned, and a `process` property on `window` or `self` pass. It doesn't check that the owner validates what it reads.
+- `wyse/no-env-access` (`env`): reading `process.env` or `import.meta.env` outside the owners, config files and scripts. That includes `globalThis.process.env`, `global.process.env`, `process["env"]` and `Reflect.get(process, "env")`, including with `"env" as const`, importing `env` from `node:process` or `process`, reading `env` from those modules' default, namespace, literal dynamic import or `require`, including through a loader made with `createRequire` from `node:module` or `module` or a `const` copy of a loader, and re-exporting `env`, the default or the whole module from them with `export { ... } from` or `export * from`. Destructuring `env` from any of these counts in a declaration, a parameter default such as `({ env } = process) => env`, or an assignment. Destructuring `env` through a namespace's `default`, such as `({ default: { env } } = p)`, or into a rest element, such as `({ ...rest } = process)`, isn't followed. Other `node:process` imports and re-exports, such as `argv`, type-only re-exports, a `require` function the file defines itself, a loader variable that's reassigned, and a `process` property on `window` or `self` pass. It doesn't check that the owner validates what it reads.
 - `wyse/import-boundaries` (`boundaries`): a value import, re-export, literal dynamic import, or `require` call, including a loader made with `createRequire` from `node:module` or `module`, whether stored, copied to another `const` or called directly as `createRequire(import.meta.url)("…")`, that matches a `deny` glob. A loader variable that's reassigned doesn't count. Type-only imports and `import("…")` types pass unless the boundary sets `types: true`. It doesn't check computed imports.
 - `wyse/server-action-guard` (`serverActionGuards`): a `"use server"` action that doesn't start by awaiting a guard, and indirect or default exports from server-action modules. Non-exported helpers and test files pass.
-- `wyse/no-ambient-clock` (`clock`): `Date.now()`, `Date()` and argument-less `new Date()`, including through `globalThis` or `window`. It also reports argument-less `new TZDate()` and `new TZDateMini()` and one-argument `TZDate.tz(zone)` from `@date-fns/tz`, `@date-fns/tz/date` or `@date-fns/tz/date/mini`, and the date-fns helpers that read the current time: `constructNow`, the `startOf` and `endOf` helpers for today, tomorrow and yesterday, `isToday`, `isTomorrow`, `isYesterday`, `isPast`, `isFuture`, the `isThis*` helpers, `formatDistanceToNow`, `formatDistanceToNowStrict`, `isMatch`, and `isMatch` and `isMatchWithOptions` from `date-fns/fp`. A helper reports where it's called, where it's passed or stored uncalled, such as `dates.filter(isPast)` or `{ check: isToday }`, and where it's exported by local name, such as `export { isPast }`. A `date-fns/fp` helper reports once at the end of its call chain, so the partial application in `values.filter(isMatch("yyyy"))` reports too. A `const` alias reports where it's used. Helpers count whether they're imported by name, through a namespace, from a `date-fns/<name>` subpath, by literal dynamic import or by `require`. Re-exporting one of these helpers with `export { ... } from`, or a module that contains one, such as `date-fns` or `date-fns/fp`, with `export * from`, also reports, because calls through the re-export no longer resolve to date-fns. Helpers that compare with a given date, such as `isSameDay`, type positions such as `typeof isPast`, type-only imports and exports, and re-exports of `TZDate`, `TZDateMini`, other date-fns helpers or types pass. Parameter defaults, such as `check = isPast`, uncalled `Date.now`, provider functions that only return the read, including through `.call`, `.apply` or `.bind`, write-only uses of a helper's name on a module object, such as `d.isPast = check`, `[d.isPast] = values`, `for (d.isPast of values)`, `delete d.isPast` and `delete d?.isPast`, and test files pass. Parentheses, `as`, `satisfies` and `!` don't change the result, so `(Date.now as typeof Date.now)()` reports and `{ now: () => startOfToday() as Date }` passes.
+- `wyse/no-ambient-clock` (`clock`): `Date.now()`, `Date()` and argument-less `new Date()`, including through `globalThis` or `window`. It also reports argument-less `new TZDate()` and `new TZDateMini()` and one-argument `TZDate.tz(zone)` from `@date-fns/tz`, `@date-fns/tz/date` or `@date-fns/tz/date/mini`, and the date-fns helpers that read the current time: `constructNow`, the `startOf` and `endOf` helpers for today, tomorrow and yesterday, `isToday`, `isTomorrow`, `isYesterday`, `isPast`, `isFuture`, the `isThis*` helpers, `formatDistanceToNow`, `formatDistanceToNowStrict`, `isMatch`, and `isMatch` and `isMatchWithOptions` from `date-fns/fp`. A helper reports where it's called, where it's passed or stored uncalled, such as `dates.filter(isPast)` or `{ check: isToday }`, and where it's exported by local name, such as `export { isPast }`. A `date-fns/fp` helper reports once at the end of its call chain, so the partial application in `values.filter(isMatch("yyyy"))` reports too. A `const` alias reports where it's used, and an exported one where it's declared, including a name destructured from a namespace, such as `export const { isPast } = dates`. Helpers count whether they're imported by name, through a namespace, from a `date-fns/<name>` subpath, by literal dynamic import or by `require`. Re-exporting one of these helpers with `export { ... } from`, or a module that contains one, such as `date-fns` or `date-fns/fp`, with `export * from`, also reports, because calls through the re-export no longer resolve to date-fns. Helpers that compare with a given date, such as `isSameDay`, type positions such as `typeof isPast`, type-only imports and exports, and re-exports of `TZDate`, `TZDateMini`, other date-fns helpers or types pass. Parameter defaults, such as `check = isPast`, uncalled `Date.now`, provider functions that only return the read, including through `.call`, `.apply` or `.bind`, write-only uses of a helper's name on a module object, such as `d.isPast = check`, `[d.isPast] = values`, `for (d.isPast of values)`, `delete d.isPast` and `delete d?.isPast`, and test files pass. Parentheses, `as`, `satisfies` and `!` don't change the result, so `(Date.now as typeof Date.now)()` reports and `{ now: () => startOfToday() as Date }` passes.
 - `wyse/no-ambient-random` (`random`): `Math.random()`, `crypto.randomUUID()`, and `randomUUID` or `randomInt` from `node:crypto`. The same exceptions and wrapper handling apply. `randomBytes` and `getRandomValues` pass because they generate secrets.
 
 ## Tests

package/dist/rules/no-ambient-clock.js

@@ -109,6 +109,16 @@ function isFollowedAlias(node) {
         declaration.kind === "const" &&
         declaration.parent.type !== "ExportNamedDeclaration");
 }
+function destructuredExports(sourceCode, node) {
+    const declaration = node.declaration;
+    if (declaration?.type !== "VariableDeclaration") {
+        return [];
+    }
+    return declaration.declarations
+        .filter((declarator) => declarator.id.type === "ObjectPattern")
+        .flatMap((declarator) => sourceCode.getDeclaredVariables(declarator))
+        .flatMap((variable) => variable.identifiers);
+}
 function isTimeZoneDate(sourceCode, node) {
     const binding = importedBinding(sourceCode, node);
     return binding !== null && timeZoneModules.has(binding.source) && timeZoneDates.has(binding.name);
@@ -172,6 +182,11 @@ export const noAmbientClock = defineRule({
                 }
             },
             ExportNamedDeclaration(node) {
+                for (const binding of destructuredExports(sourceCode, node)) {
+                    if (isClockHelper(sourceCode, binding)) {
+                        context.report({ node: binding, messageId: "clock" });
+                    }
+                }
                 if (!node.source || node.exportKind === "type") {
                     return;
                 }

package/dist/rules/no-env-access.js

@@ -20,6 +20,11 @@ function isEnvironmentSource(sourceCode, node) {
         isImportMeta(node) ||
         isProcessModule(sourceCode, node));
 }
+function destructuresEnvironment(sourceCode, pattern, value) {
+    return (pattern.type === "ObjectPattern" &&
+        isEnvironmentSource(sourceCode, value) &&
+        pattern.properties.some((property) => property.type === "Property" && staticPropertyName(property) === "env"));
+}
 function isReflectGet(sourceCode, node) {
     const callee = unwrapExpression(node.callee);
     const [target, key] = node.arguments;
@@ -48,9 +53,17 @@ export const noEnvAccess = defineRule({
                 }
             },
             VariableDeclarator(node) {
-                if (node.id.type === "ObjectPattern" &&
-                    isEnvironmentSource(sourceCode, node.init) &&
-                    node.id.properties.some((property) => property.type === "Property" && staticPropertyName(property) === "env")) {
+                if (destructuresEnvironment(sourceCode, node.id, node.init)) {
+                    context.report({ node, messageId: "env" });
+                }
+            },
+            AssignmentPattern(node) {
+                if (destructuresEnvironment(sourceCode, node.left, node.right)) {
+                    context.report({ node, messageId: "env" });
+                }
+            },
+            AssignmentExpression(node) {
+                if (destructuresEnvironment(sourceCode, node.left, node.right)) {
                     context.report({ node, messageId: "env" });
                 }
             },

package/dist/shared/index.js

@@ -133,13 +133,6 @@ function memberBinding(owner, name) {
         ? { source: owner.source, name }
         : null;
 }
-function bindsName(property, name) {
-    if (property.type !== "Property") {
-        return false;
-    }
-    const target = property.value.type === "AssignmentPattern" ? property.value.left : property.value;
-    return target.type === "Identifier" && target.name === name;
-}
 function constAlias(definition) {
     const declaration = definition.parent;
     const declarator = definition.node;
@@ -151,19 +144,35 @@ function constAlias(definition) {
         ? { init: declarator.init, pattern: declarator.id, name: definition.name.name }
         : null;
 }
-function destructuredName(pattern, name) {
-    const property = pattern.type === "ObjectPattern"
-        ? pattern.properties.find((candidate) => bindsName(candidate, name))
-        : undefined;
-    return property ? staticPropertyName(property) : null;
+function destructuredPath(pattern, name) {
+    if (pattern.type !== "ObjectPattern") {
+        return null;
+    }
+    for (const property of pattern.properties) {
+        const key = property.type === "Property" ? staticPropertyName(property) : null;
+        if (property.type !== "Property" || key === null) {
+            continue;
+        }
+        const target = property.value.type === "AssignmentPattern" ? property.value.left : property.value;
+        if (target.type === "Identifier" && target.name === name) {
+            return [key];
+        }
+        const path = destructuredPath(target, name);
+        if (path !== null) {
+            return [key, ...path];
+        }
+    }
+    return null;
 }
 function aliasTarget(alias, resolve, member) {
     const initial = resolve(alias.init);
     if (alias.pattern.type === "Identifier") {
         return initial;
     }
-    const name = destructuredName(alias.pattern, alias.name);
-    return initial !== null && name !== null ? member(initial, name) : null;
+    const path = destructuredPath(alias.pattern, alias.name);
+    return path === null
+        ? null
+        : path.reduce((owner, name) => (owner === null ? null : member(owner, name)), initial);
 }
 function cached(cache, variable, resolve) {
     if (!cache.has(variable)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameswyse/oxc-config",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Opinionated Oxlint and Oxfmt configs with custom rules for TypeScript and JavaScript projects",
   "keywords": [
     "config",
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@e18e/eslint-plugin": "0.8.1",
-    "@oxlint/plugins": "1.88.0",
+    "@oxlint/plugins": ">=1.86.0 <2",
     "eslint-plugin-react-you-might-not-need-an-effect": "1.0.2"
   },
   "devDependencies": {