@konvert7/klint 0.27.0 → 0.28.0

package/README.md

@@ -248,6 +248,10 @@ arch:
       message: "Data modules may only depend on data, db, and types"
 ```
 
+Every rule reads the module specifier off the AST, so `import`, dynamic
+`import()`, and re-exports all count as dependencies — `export { x } from "…"`
+and `export * from "…"` cross a boundary exactly like an import does.
+
 Allow type-only imports when runtime imports are forbidden:
 
 ```yaml
@@ -259,6 +263,50 @@ arch:
       message: "Core may reference adapter types, but not adapter values"
 ```
 
+This covers `import type`, `export type … from`, and — in Python — every import
+inside an `if TYPE_CHECKING:` block. The `else` and `elif` branches of such a
+guard stay runtime imports and are still reported.
+
+Block npm packages and `node:` builtins with `deny-packages`. `deny` and `allow` work on layers of
+project files, so they can never reach a specifier that doesn't resolve to one — that is what
+`deny-packages` is for:
+
+```yaml
+arch:
+  imports:
+    - from: ["src/dao/**"]
+      deny-packages: ["next/headers", "node:fs"]
+      message: "Data access must not read request state or touch the filesystem"
+```
+
+Matching is per segment, so `next` also covers `next/headers` while leaving `nextra` alone,
+and `next/headers` does not match `next/navigation`. Python splits on dots instead, so the same
+rule blocks pip packages and stdlib modules — `os` covers `os.path` and leaves `oscrypto` alone:
+
+```yaml
+arch:
+  imports:
+    - from: ["src/app/jobs/**"]
+      deny-packages: ["requests", "os"]
+      message: "Jobs must go through the http client and config"
+```
+
+Swift splits on dots as well and matches at module granularity, which makes system frameworks —
+exactly the imports that never resolve to a project file — the natural target:
+
+```yaml
+arch:
+  imports:
+    - from: ["Sources/App/Core/**"]
+      deny-packages: ["UIKit", "Foundation"]
+      message: "Core must stay free of UI and platform frameworks"
+```
+
+The specifier comes off the AST rather than a
+text scan, so static imports and dynamic `import()` are both caught while a mention inside a comment
+or string is not. `type-only: allow` exempts `import type` here too. `deny-packages` composes with
+`deny` in the same rule — one covers packages, the other project paths.
+
 ### Forbidden Patterns
 
 Block literal string patterns inside a scoped layer:
@@ -365,7 +413,37 @@ arch:
       in: ["src/**"]
 ```
 
-Set `countDocComments: true` on either rule to count doc-comments toward the limit as well. Both rules run in the TS and Rust engines; Python files (`#` comments) are enforced by the Rust engine.
+Set `countDocComments: true` on either rule to count doc-comments toward the limit as well. Both rules run in the TS and Rust engines; Python (`#`) and Swift (`//`, `/* */`) files are enforced by the Rust engine.
+
+### Language Support
+
+klint scans TypeScript/JavaScript, Python, Swift, and Rust. Every architecture rule is enforced from the same `klint.yaml`, but what a rule can *see* depends on what the language actually has.
+
+| | TypeScript / JavaScript | Python | Swift | Rust |
+|---|---|---|---|---|
+| **Engines** | `ts`, `rust` | `rust` | `rust` | `rust` |
+| **Parser** | TypeScript compiler API (TS engine), tree-sitter (Rust engine) | tree-sitter | tree-sitter | tree-sitter |
+| `arch.imports` — static | ✅ | ✅ | ✅ | ✅ `use` |
+| `arch.imports` — dynamic | ✅ `import()` | ✅ `importlib.import_module`, `__import__` | — | — |
+| `arch.imports` — re-exports | ✅ `export … from` | — | ✅ `@_exported import` | ✅ `pub use` |
+| `arch.imports` — multi-target | — | ✅ `import a, b` | — | ✅ `use a::{b, c}` |
+| `type-only: allow` | ✅ `import type` | ✅ `if TYPE_CHECKING:` | — | — |
+| Path aliases | ✅ `tsconfig.json` `paths` | — | — | — |
+| Module resolution | relative paths + alias chains | relative, absolute, and PEP 420 namespace packages | module name against project dirs and file stems | `crate::`/`self::`/`super::` against the directory tree |
+| `deny-packages` | ✅ `/` segments | ✅ `.` segments | ✅ `.` segments, module granularity | ✅ `::` segments |
+| `arch.forbidden` / `singleton` — `pattern` | ✅ | ✅ | ✅ | ✅ |
+| `arch.forbidden` / `singleton` — `jsx-element` | ✅ | — | — | — |
+| `arch.maxLines` | ✅ | ✅ | ✅ | ✅ |
+| `arch.maxCommentDensity` / `maxCommentBlock` | ✅ `//`, `/* */`, `/** */` docs | ✅ `#` | ✅ `//`, `/* */`, `///` and `/** */` docs | ✅ `//`, `/* */`, `///` and `//!` docs |
+| Built-in rules and plugins | ✅ | ✗ | ✗ | ✗ |
+| Custom rules (`klint.rules.ts`) | ✅ | ✗ | ✗ | ✗ |
+| Type-aware rules | ✅ | ✗ | ✗ | ✗ |
+
+**✅** supported · **—** the language has no equivalent construct · **✗** not supported yet
+
+A dash is not a gap. Swift has no dynamic import expression, no `import type`, and one module per declaration; Rust has no dynamic import and no type-only import. Those rows can never be filled. The `✗` rows are real limits: the rule set and custom rules are written against the TypeScript AST, and type-aware rules need a type checker that only the TS engine has.
+
+Imports are read off the AST in every language, so a specifier written inside a comment or a string is never an import — including nested Swift block comments. Only file discovery differs: the TS engine walks `.ts`/`.tsx`/`.js`/`.jsx`/`.mts`/`.cts`, so Python, Swift, and Rust files reach klint through the Rust engine, which `auto` mode selects for them automatically.
 
 ### Python Architecture Checks
 
@@ -401,9 +479,19 @@ arch:
 
 Python import checks support relative imports such as
 `from ..lib.auth import load_key` and project-resolvable absolute imports such
-as `from app.lib.auth import load_key`. External packages that do not resolve to
-project files, such as `requests`, are ignored. This is architecture
-enforcement, not full packaging or virtual-environment analysis.
+as `from app.lib.auth import load_key`. Every target of a multi-target statement
+is checked, so `import json, app.lib.auth` and `from . import helper, sibling`
+report per target rather than only the first one. Dynamic imports count too:
+`importlib.import_module("app.lib.auth")` and `__import__("app.lib.auth")` are
+read off the AST, including a renamed `from importlib import import_module as
+load`. A same-named call that is not bound to `importlib` — `self.import_module(…)` —
+is not an import and is left alone. A package import resolves through
+`<module>.py`, `<module>/__init__.py`, or a `<module>/` directory holding
+scanned `.py` files, so PEP 420 namespace packages with no `__init__.py` are
+covered. External packages that do not resolve to project files, such as
+`requests`, are ignored by `deny`/`allow` and are the target of `deny-packages`
+instead. This is architecture enforcement, not full packaging or
+virtual-environment analysis.
 
 ### Swift Architecture Checks
 
@@ -437,12 +525,64 @@ arch:
       message: "Use AppConfig"
 ```
 
-Swift import checks parse declarations such as `import Core`,
-`@_exported import Core`, and `import struct Models.User`. Imported modules
-resolve against discovered project Swift directories and file stems. System or
-package modules that are not present in the project, such as `Foundation`, are
-ignored. This is architecture enforcement, not full SwiftPM or Xcode build graph
-analysis.
+Swift import checks read declarations off the AST, covering `import Core`,
+`@_exported import Core`, `@testable import Core`, `import struct Models.User`,
+and submodule paths such as `import Core.Session`. Because the specifier comes
+from the parse tree, an `import` written inside a `//` or `/* */` comment is not
+an import — including nested block comments. Imported modules resolve against
+discovered project Swift directories and file stems. System or package modules
+that are not present in the project, such as `Foundation`, are ignored. This is
+architecture enforcement, not full SwiftPM or Xcode build graph analysis.
+
+Comment budget rules apply to Swift too, where `///` counts as a doc-comment
+alongside `/** */`.
+
+### Rust Architecture Checks
+
+The Rust engine can apply architecture rules to Rust crates:
+
+```yaml
+include: ["crates/**/*.rs", "!target/**"]
+
+rules: {}
+
+arch:
+  layers:
+    cli: ["crates/app/src/cli/**"]
+    domain: ["crates/app/src/domain/**"]
+    storage: ["crates/app/src/storage/**"]
+
+  imports:
+    - from: domain
+      deny: storage
+      message: "Domain logic must not reach into the storage layer"
+    - from: domain
+      deny-packages: ["reqwest", "tokio"]
+      message: "Keep I/O crates out of the domain layer"
+
+  maxLines:
+    - limit: 500
+      in: [cli, domain, storage]
+```
+
+Rust import checks read `use` declarations off the AST, and every target of a
+braced list becomes its own record — `use a::{b::{c, d}, e as f}` is checked as
+`a::b::c`, `a::b::d`, and `a::e`. Aliases contribute their path, `*` wildcards
+contribute the path they glob, and a bare `self` in a list names its own prefix.
+`pub use` re-exports are checked the same way as plain `use`.
+
+Paths starting with `crate::`, `self::`, or `super::` resolve against the
+directory tree by convention: klint walks down from the crate's `src` directory
+(the one holding `lib.rs` or `main.rs`), probing `foo.rs` then `foo/mod.rs` at
+each step and keeping the longest prefix that lands on a real file. Everything
+after that prefix is treated as an item inside the module. External crates have
+no file to resolve to and are ignored by `deny`/`allow`, which is what
+`deny-packages` is for — it matches on `::` segments, so `tokio` denies
+`tokio::sync::Mutex` but never `tokio_util`. This is architecture enforcement,
+not a Cargo build graph or `#[path]` attribute resolver.
+
+Comment budget rules apply to Rust too, where both `///` and `//!` count as
+doc-comments.
 
 ## Built-in Rules
 

package/core/arch.ts

@@ -103,6 +103,12 @@ function resolveLayerFiles(
   );
 }
 
+function matchesPackage(specifier: string, entries: string[]): boolean {
+  return entries.some(
+    (entry) => specifier === entry || specifier.startsWith(`${entry}/`)
+  );
+}
+
 function inPrefixes(absPath: string, prefixes: string[]): boolean {
   return prefixes.some((p) => {
     if (absPath === p || absPath.startsWith(`${p}/`)) return true;
@@ -129,6 +135,11 @@ function scanImports(
         specifierNode = node.moduleSpecifier;
         isTypeOnly = node.importClause?.isTypeOnly ?? false;
       }
+    } else if (ts.isExportDeclaration(node)) {
+      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        specifierNode = node.moduleSpecifier;
+        isTypeOnly = node.isTypeOnly;
+      }
     } else if (
       ts.isCallExpression(node) &&
       node.expression.kind === ts.SyntaxKind.ImportKeyword &&
@@ -167,17 +178,30 @@ export function runArchRules(
   for (const rule of arch.imports ?? []) {
     const severity: Severity = rule.severity ?? "error";
     const fromFiles = resolveLayerFiles(rule.from, layers, root, allFiles);
+    const denyPackages = toArray(rule["deny-packages"] ?? []);
 
     for (const file of fromFiles) {
       const content = fileContents.get(file);
       if (!content) continue;
 
       for (const imp of scanImports(file, content, aliases)) {
-        if (isBareSpecifier(imp.resolved)) continue;
         if (rule["type-only"] === "allow" && imp.isTypeOnly) continue;
 
         const relFile = relativeSlashPath(root, file);
 
+        if (isBareSpecifier(imp.resolved)) {
+          if (matchesPackage(imp.path, denyPackages)) {
+            violations.push({
+              file: relFile,
+              line: imp.line,
+              message: rule.message ?? "Import of a denied package",
+              rule: "arch/imports",
+              severity,
+            });
+          }
+          continue;
+        }
+
         if (rule.deny !== undefined) {
           const denyPrefixes = resolveLayerPrefixes(rule.deny, layers, root);
           if (inPrefixes(imp.resolved, denyPrefixes)) {

package/core/config.schema.ts

@@ -85,11 +85,14 @@ const ArchImportRuleSchema = z
     allow: StringOrStringArray.optional().describe(
       "Allowlist of layer name(s) / glob(s) the source may import from. Anything not matching `allow` is denied."
     ),
+    "deny-packages": StringOrStringArray.optional().describe(
+      "Package specifier(s) the source is not allowed to import — npm packages, `node:` builtins, Python pip packages and stdlib modules, Swift system frameworks, and external Rust crates, which `deny`/`allow` cannot reach because they never resolve to a project file. Matching is per segment: `/` in TypeScript/JavaScript, so `next` also covers `next/headers` while `nextra` is unaffected; `.` in Python and Swift, so `os` also covers `os.path` while `oscrypto` is unaffected; and `::` in Rust, so `tokio` also covers `tokio::sync::Mutex` while `tokio_util` is unaffected. Python, Swift, and Rust sources are checked by the Rust engine."
+    ),
     "type-only": z
       .literal("allow")
       .optional()
       .describe(
-        'When set to "allow", `import type` statements that would otherwise be denied are permitted. Useful for type-only references across layers.'
+        'When set to "allow", `import type` statements that would otherwise be denied are permitted. In Python, imports inside an `if TYPE_CHECKING:` block are exempted the same way. Useful for type-only references across layers.'
       ),
     message: z
       .string()

package/core/types.ts

@@ -58,6 +58,7 @@ interface ArchImportRule {
   from: string | string[];
   deny?: string | string[];
   allow?: string | string[];
+  "deny-packages"?: string | string[];
   "type-only"?: "allow";
   message?: string;
   severity?: Exclude<Severity, "off">;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@konvert7/klint",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Architecture-as-Code linter for TypeScript. Enforce layer boundaries, import rules, and singleton patterns in YAML.",
   "type": "module",
   "bin": {
@@ -65,10 +65,10 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@konvert7/klint-darwin-arm64": "0.27.0",
-    "@konvert7/klint-darwin-x64": "0.27.0",
-    "@konvert7/klint-linux-x64": "0.27.0",
-    "@konvert7/klint-win32-x64": "0.27.0"
+    "@konvert7/klint-darwin-arm64": "0.28.0",
+    "@konvert7/klint-darwin-x64": "0.28.0",
+    "@konvert7/klint-linux-x64": "0.28.0",
+    "@konvert7/klint-win32-x64": "0.28.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.7",

package/skill/klint-rules/SKILL.md

@@ -32,6 +32,7 @@ Wire it into `klint.yaml` for editor autocomplete and validation:
    |---|---|
    | Layer X must not import from layer Y | `arch.imports` + `deny` |
    | Layer X may only import from Y and Z | `arch.imports` + `allow` |
+   | Layer X must not import an npm package or `node:` builtin | `arch.imports` + `deny-packages` |
    | Pattern P must only appear in one designated file | `arch.singleton` + `pattern` |
    | Pattern P must never appear inside a scoped layer | `arch.forbidden` + `pattern` |
    | Raw HTML/JSX element must never appear in a scoped layer | `arch.forbidden` + `jsx-element` |
@@ -78,13 +79,27 @@ arch:
       allow: ["src/dao/**", "src/prisma/**"]
       message: "DAO may only import from dao or prisma"
 
-    # type-only: allow — import type {} is permitted even when value imports are denied
+    # type-only: allow — import type {} and Python if TYPE_CHECKING: blocks stay permitted
     - from: core
       deny: targets
       type-only: allow
       message: "Core must not depend on agent-specific code"
+
+    # deny-packages: block npm packages and node: builtins, which deny/allow cannot reach
+    # because they never resolve to a project file. Composes with deny in the same rule.
+    - from: ["src/dao/**"]
+      deny-packages: ["next/headers", "node:fs"]
+      message: "Data access must not read request state or touch the filesystem"
 ```
 
+`deny-packages` matches per segment: `next` covers `next/headers`, `nextra` is unaffected, and
+`next/headers` does not match `next/navigation`. Python uses dotted segments, so `os` covers
+`os.path` and blocks pip packages and stdlib modules alike. Swift uses dotted segments too, at
+module granularity, which is what makes system frameworks like `UIKit` reachable. Rust splits on
+`::`, so `tokio` covers `tokio::sync::Mutex` while `tokio_util` is unaffected. The specifier is read off the AST, so
+static imports, dynamic `import()`, and `export … from` re-exports all count while a comment
+mentioning the package does not — unlike `forbidden` + `pattern`, which is a line-based text scan.
+
 ### Singleton — one designated location
 
 Pin a `pattern` (literal string) **or** a `jsx-element` (AST-matched tag) to exactly one file. Every other in-scope occurrence is a violation.