@zgeoff/oxlint-config 0.2.7 → 0.2.9

package/README.md

@@ -8,7 +8,8 @@ await arguments, awaits hidden inside a control-flow condition or a `&&`/`||`/`?
 `switch` statement, every JSDoc block, any run of more than three line comments, and a repo config
 that loosens either comment rule. `zgeoff/function-verb` enforces the function-naming taxonomy from
 the shared agent guidelines, `zgeoff/test-beside-module` keeps each test file beside the module it
-tests, `zgeoff/import-zones` fails an import that crosses a module boundary the repo declares, and
+tests, `zgeoff/import-zones` fails an import that crosses a module boundary the repo declares,
+`zgeoff/no-restricted-words` keeps the words in its `words` option out of a path's text, and
 `zgeoff/no-file-snapshot` bans file snapshots.
 
 ## Usage
@@ -86,6 +87,25 @@ first statement, so put the comment above it:
 A second test file for a module (`<name>.host.test.ts`) needs its own `<name>.host.<ext>`, so the
 rule reports it beside only `<name>.ts`.
 
+## `zgeoff/no-restricted-words`
+
+Off unless a repo configures it. The `words` option lists the words to keep out of the text of a
+file: string literals, template text and comments. A word matches whole and without case, so `imp`
+reports `'IMP daemon'` and `'imp-e2e'` but not `'impl'` or `'imp_name'`. Identifiers are code, not
+text, and the rule never reads them. Scope the rule to a path with `overrides`, and turn it off for
+the paths that may name the words:
+
+```jsonc
+{
+  "rules": {
+    "zgeoff/no-restricted-words": ["error", { "words": ["imp", "impd"] }],
+  },
+  "overrides": [
+    { "files": ["packages/execution/**"], "rules": { "zgeoff/no-restricted-words": "off" } },
+  ],
+}
+```
+
 ## `zgeoff/no-file-snapshot`
 
 Snapshots are inline only, so the golden value sits in the test that pins it. The rule reports every
@@ -102,17 +122,21 @@ the boundaries between them. A file belongs to every zone its path matches, so z
 Each entry has a `name`, which starts its report, an optional `reason`, which ends it, and optional
 `from` zones and `ignore` globs that limit which importing files it judges.
 
-- `edges` judge an import that resolves to a file: relative, or the package's own name resolved
-  through its `exports` under `conditions` plus `default`. A target in a `to` zone fails unless it
-  is also in an `allow` zone; with `allow` alone, a target in none of the `allow` zones fails, a
-  target in no zone included. `allowTypeOnly` exempts type-only imports (`true`, or globs the target
-  must match), and `allowWithin: "src/*"` exempts an import inside the importer's own `src/<name>/`.
+- `edges` judge an import that resolves to a file: relative, with any bundler query such as `?url`
+  dropped, or the package's own name resolved through its `exports` under `conditions` plus
+  `default`. A target in a `to` zone fails unless it is also in an `allow` zone; with `allow` alone,
+  a target in none of the `allow` zones fails, a target in no zone included. `allowTypeOnly` exempts
+  type-only imports (`true`, or globs the target must match), and `allowWithin: "src/*"` exempts an
+  import inside the importer's own `src/<name>/`.
 - `modules` restrict a package or builtin (`node:` prefix optional, subpaths included) to the
-  `allow` zones; `allowTypeOnly: true` exempts type-only imports.
+  `allow` zones; `allowTypeOnly: true` exempts type-only imports. A name that ends in `*` restricts
+  every specifier that starts with the text before it, such as `@scope/*`, and `node:*` restricts
+  every builtin.
 - `globals` restrict a call to a global, bare or through `globalThis`, `self` or `window`.
 - `unzoned` reports a file in a `from` zone that belongs to none of `zones`.
 - `unresolved` reports a relative or self-referencing import that resolves to no file, and a dynamic
-  `import()` or `require()` whose specifier is computed.
+  `import()`, `require()` or `import.meta.require()` whose specifier is computed. Bun's
+  `import.meta.require` used as a value counts as computed too.
 
 ```jsonc
 {

package/import-zones.js

@@ -1,3 +1,4 @@
+import { isBuiltin } from 'node:module';
 import { relative, sep } from 'node:path';
 import findRepoRoot from './find-repo-root.js';
 import importZonesSchema from './import-zones-schema.js';
@@ -114,12 +115,25 @@ function isRestrictedModule(entry, specifier) {
   const name = toModuleName(specifier);
 
   return entry.modules.some((module) => {
+    if (module.endsWith('*')) {
+      return isPrefixMatch(module.slice(0, -1), specifier);
+    }
+
     const restricted = toModuleName(module);
 
     return name === restricted || name.startsWith(`${restricted}/`);
   });
 }
 
+// `node:*` names every builtin, which a specifier may write without the prefix
+function isPrefixMatch(prefix, specifier) {
+  if (specifier.startsWith(prefix)) {
+    return true;
+  }
+
+  return prefix === 'node:' && isBuiltin(specifier);
+}
+
 function toModuleName(specifier) {
   return specifier.replace(/^node:/u, '');
 }
@@ -235,6 +249,18 @@ function isTypeOnlyExport(node) {
   );
 }
 
+function isImportMetaRequire(node) {
+  return (
+    node.type === 'MemberExpression' &&
+    !node.computed &&
+    node.object.type === 'MetaProperty' &&
+    node.object.meta.name === 'import' &&
+    node.object.property.name === 'meta' &&
+    node.property.type === 'Identifier' &&
+    node.property.name === 'require'
+  );
+}
+
 const importZones = {
   meta: {
     type: 'problem',
@@ -284,10 +310,21 @@ const importZones = {
       CallExpression(node) {
         checkGlobalCall(file, node);
 
-        if (node.callee.type === 'Identifier' && node.callee.name === 'require') {
+        if (
+          (node.callee.type === 'Identifier' && node.callee.name === 'require') ||
+          isImportMetaRequire(node.callee)
+        ) {
           checkImport(file, { node, source: node.arguments[0], typeOnly: false });
         }
       },
+
+      // Bun's import.meta.require used as a value, such as `const load =
+      // import.meta.require`, loads modules no specifier names
+      MemberExpression(node) {
+        if (isImportMetaRequire(node) && node.parent?.callee !== node) {
+          emitUnresolved(file, node, { messageId: 'computed', data: {} });
+        }
+      },
     };
   },
 };

package/no-restricted-words.js

@@ -0,0 +1,61 @@
+const noRestrictedWords = {
+  meta: {
+    type: 'problem',
+    messages: {
+      restricted:
+        'Remove `{{word}}` from this {{place}}: the repo config restricts the word in this path.',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          words: { type: 'array', items: { type: 'string', minLength: 1 }, uniqueItems: true },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  create(context) {
+    const words = context.options[0]?.words ?? [];
+
+    if (words.length === 0) {
+      return {};
+    }
+
+    const pattern = buildWordPattern(words);
+
+    const checkText = (node, text, place) => {
+      for (const match of text.matchAll(pattern)) {
+        context.report({ node, messageId: 'restricted', data: { word: match[0], place } });
+      }
+    };
+
+    return {
+      Literal(node) {
+        if (typeof node.value === 'string') {
+          checkText(node, node.value, 'string');
+        }
+      },
+      TemplateElement(node) {
+        checkText(node, node.value.cooked ?? node.value.raw, 'template');
+      },
+      Program() {
+        for (const comment of context.sourceCode.getAllComments()) {
+          checkText(comment, comment.value, 'comment');
+        }
+      },
+    };
+  },
+};
+
+// a letter, digit or underscore on either side makes the match part of a
+// longer word (`impl`, `simple`), so only those characters bound it
+function buildWordPattern(words) {
+  const alternatives = words.map((word) =>
+    word.replaceAll(/[$()*+.?[\\\]^{|}]/gu, String.raw`\$&`),
+  );
+
+  return new RegExp(`(?<![\\p{L}\\p{N}_])(?:${alternatives.join('|')})(?![\\p{L}\\p{N}_])`, 'giu');
+}
+
+export default noRestrictedWords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/oxlint-config",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Shareable oxlint config: strict categories, house-style rules, and a custom JS plugin",
   "license": "MIT",
   "repository": {
@@ -12,6 +12,7 @@
     "oxlintrc.json",
     "plugin.js",
     "function-verb.js",
+    "no-restricted-words.js",
     "max-consecutive-line-comments.js",
     "no-jsdoc.js",
     "no-comment-rule-override.js",

package/plugin.js

@@ -4,6 +4,7 @@ import maxConsecutiveLineComments from './max-consecutive-line-comments.js';
 import noCommentRuleOverride from './no-comment-rule-override.js';
 import noFileSnapshot from './no-file-snapshot.js';
 import noJSDoc from './no-jsdoc.js';
+import noRestrictedWords from './no-restricted-words.js';
 import testBesideModule from './test-beside-module.js';
 
 // custom rules loaded through oxlint's jsPlugins (ESLint v9 rule API): each
@@ -105,6 +106,7 @@ const plugin = {
     'max-consecutive-line-comments': maxConsecutiveLineComments,
     'no-comment-rule-override': noCommentRuleOverride,
     'function-verb': functionVerb,
+    'no-restricted-words': noRestrictedWords,
     'test-beside-module': testBesideModule,
     'no-file-snapshot': noFileSnapshot,
     'import-zones': importZones,

package/resolve-import-target.js

@@ -9,7 +9,7 @@ const sourceExtensions = { '.js': ['.ts', '.tsx'], '.mjs': ['.mts'], '.cjs': ['.
 // own name resolves through its `exports`, and `#` names through its `imports`.
 export default function resolveImportTarget(filename, specifier, settings) {
   if (isPathSpecifier(specifier)) {
-    return toTarget(findImportedFile(filename, specifier, settings.extensions));
+    return toTarget(findImportedFile(filename, toFileSpecifier(specifier), settings.extensions));
   }
 
   const manifest = findPackageManifest(dirname(filename), settings.root);
@@ -40,6 +40,13 @@ function resolveManifestTarget(manifest, specifier, conditions) {
   return { kind: 'module', specifier };
 }
 
+// a bundler query such as Vite's `./styles.css?url` names the file before it
+function toFileSpecifier(specifier) {
+  const query = specifier.indexOf('?');
+
+  return query === -1 ? specifier : specifier.slice(0, query);
+}
+
 function toTarget(path) {
   return path === null ? { kind: 'missing' } : { kind: 'file', path };
 }