@makroz/web 1.2.4 → 1.2.6-rc14

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEtE,WAAW;AACX,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AAExC,QAAQ;AACR,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AAEnC,qEAAqE;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAW/C,QAAQ;AACR,cAAc,gBAAgB,CAAC;AAE/B,4EAA4E;AAC5E,uEAAuE;AACvE,qEAAqE;AACrE,2EAA2E"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEtE,WAAW;AACX,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AAExC,QAAQ;AACR,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AAEnC,qEAAqE;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAW/C,OAAO,EACH,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GAExB,MAAM,2BAA2B,CAAC;AAEnC,QAAQ;AACR,cAAc,gBAAgB,CAAC;AAE/B,4EAA4E;AAC5E,uEAAuE;AACvE,qEAAqE;AACrE,2EAA2E"}

package/eslint-plugin-mk/__tests__/no-cross-module-import-dynamic.test.js

@@ -0,0 +1,89 @@
+/**
+ * @vitest-environment node
+ *
+ * Dynamic import() coverage for the MME enforcer (R-MK-001).
+ * Blocked in rc12 because the original rule only handled
+ * `ImportDeclaration` and `ExportNamedDeclaration`/`ExportAllDeclaration`,
+ * letting `await import('@/modules/admin/...')` bypass the boundary check.
+ *
+ * Companion to `no-cross-module-import.test.js`. We keep this as a
+ * separate file so the failure mode ("dynamic imports leak") is
+ * obvious from the file name at PR review time.
+ */
+import { describe, it, expect } from 'vitest';
+import { RuleTester } from 'eslint';
+import rule from '../rules/no-cross-module-import.js';
+
+const ruleTester = new RuleTester({
+    languageOptions: {
+        ecmaVersion: 2022,
+        sourceType: 'module',
+    },
+});
+
+describe('no-cross-module-import — dynamic import()', () => {
+    ruleTester.run('no-cross-module-import (dynamic)', rule, {
+        valid: [
+            // Dynamic import of same module's deep path — OK
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = await import('@/modules/payments/components/PaymentForm');",
+            },
+            // Dynamic import of another module's public index — OK
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = await import('@/modules/admin');",
+            },
+            // Dynamic import outside any module — OK
+            {
+                filename: '/app/src/app/admin/page.tsx',
+                code: "const m = await import('@/modules/admin/components/AdminForm');",
+            },
+            // Dynamic import with non-literal expression — silently skipped
+            // (cannot be analyzed statically). This is an accepted gap, not a bug.
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = await import(someDynamicPath);",
+            },
+            // Dynamic import in test file pointing cross-module — OK (tests excluded)
+            {
+                filename: '/app/src/modules/payments/__tests__/usePayment.test.ts',
+                code: "const m = await import('@/modules/admin/components/AdminForm');",
+            },
+        ],
+
+        invalid: [
+            // Dynamic import cross-module deep path — should fail
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = await import('@/modules/admin/components/AdminForm');",
+                errors: [{ messageId: 'forbidden' }],
+            },
+            // Dynamic import cross-module via relative path — should fail
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = await import('../../admin/components/AdminForm');",
+                errors: [{ messageId: 'forbidden' }],
+            },
+            // Synchronous dynamic import (top-level await) cross-module — should fail
+            {
+                filename: '/app/src/modules/payments/hooks/usePayment.ts',
+                code: "const m = import('@/modules/admin/components/AdminForm');",
+                errors: [{ messageId: 'forbidden' }],
+            },
+        ],
+    });
+
+    it('registers the dynamic-import visitor', () => {
+        // Sanity check: the rule's create() returns an ImportExpression
+        // visitor. If a future refactor drops it, this test fails loudly
+        // instead of silently letting dynamic imports bypass the rule.
+        const sandboxFilename = '/app/src/modules/payments/hooks/usePayment.ts';
+        const context = {
+            getFilename: () => sandboxFilename,
+            report: () => {},
+        };
+        const visitors = rule.create(context);
+        expect(typeof visitors.ImportExpression).toBe('function');
+    });
+});

package/eslint-plugin-mk/rules/no-cross-module-import.js

@@ -5,6 +5,10 @@
  * inside another module. Only `@/modules/{X}` (the index/public API)
  * is allowed.
  *
+ * Covers both static `import ... from '...'` and dynamic
+ * `import('...')` (await import() for code splitting) so that
+ * R-MK-001 cannot be bypassed via dynamic imports.
+ *
  * Scenarios:
  *   Given file src/modules/payments/hooks/usePayment.ts
  *   When it imports '@/modules/admin/components/AdminForm'
@@ -14,6 +18,9 @@
  *   Given the same file imports '@/modules/admin'
  *   Then the lint passes.
  *
+ *   Given the same file does `await import('@/modules/admin/components/AdminForm')`
+ *   Then the lint also fails (dynamic imports are caught).
+ *
  *   Given a file OUTSIDE any module (e.g. src/app/admin/page.tsx)
  *   When it imports '@/modules/admin/...'
  *   Then the lint passes — the app is the consumer of the public API.
@@ -58,6 +65,12 @@ export default {
         const sourceModule = moduleMatch[1];
 
         function checkImport(node) {
+            // Both ImportDeclaration and ImportExpression (dynamic import())
+            // carry the literal source string at `node.source.value` when the
+            // argument is a string literal. For dynamic imports with a
+            // non-literal expression (e.g. `import(someVar)`), this is
+            // `undefined` and we skip the check — those cases need static
+            // analysis beyond ESLint.
             const importPath = node.source?.value;
             if (typeof importPath !== 'string') return;
 
@@ -92,6 +105,9 @@ export default {
 
         return {
             ImportDeclaration: checkImport,
+            // Catches `await import('...')` and `import('...')` so R-MK-001
+            // cannot be bypassed via dynamic imports for code splitting.
+            ImportExpression: checkImport,
             // Also catch `export ... from '...'` re-exports.
             ExportNamedDeclaration: checkImport,
             ExportAllDeclaration: checkImport,

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@makroz/web",
-  "version": "1.2.4",
+  "version": "1.2.6-rc14",
   "description": "React UI components and hooks for MK-Director web applications",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "type": "module",
+  "bin": {
+    "mk-update": "./bin/mk-update.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -17,7 +20,8 @@
   },
   "files": [
     "dist",
-    "eslint-plugin-mk"
+    "eslint-plugin-mk",
+    "bin"
   ],
   "publishConfig": {
     "access": "public"
@@ -29,7 +33,7 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.62.0",
-    "@makroz/core": "1.1.4"
+    "@makroz/core": "1.1.6-rc14"
   },
   "peerDependencies": {
     "next": "^16.0.0",