datagrok-tools 4.14.70 → 4.14.71

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Datagrok-tools changelog
 
+## 4.14.71 (2026-01-10)
+
+### Features
+
+* Grok Check: Added validation to restrict datagrok-api imports to public API paths only (GROK-19504)
+* Only allows imports from 'datagrok-api/dg', 'datagrok-api/grok', 'datagrok-api/ui'
+* Rejects deep imports like 'datagrok-api/dg/events' or 'datagrok-api/src/...'
+* Validates both import and export statements
+
+### Bug Fixes
+
+* Fixed invalid datagrok-api imports in UsageAnalysis, ChatGPT, and PowerPack packages
+
+
 ## 4.14.70 (2026-01-10)
 
 ### Bug Fixes

package/bin/commands/check.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.check = check;
 exports.checkChangelog = checkChangelog;
+exports.checkDatagrokApiImports = checkDatagrokApiImports;
 exports.checkFuncSignatures = checkFuncSignatures;
 exports.checkImportStatements = checkImportStatements;
 exports.checkNpmIgnore = checkNpmIgnore;
@@ -66,6 +67,7 @@ function runChecks(packagePath, soft = false, noExit = false) {
     externals = extractExternals(content);
     if (externals) errors.push(...checkImportStatements(packagePath, jsTsFiles, externals));
   }
+  errors.push(...checkDatagrokApiImports(packagePath, jsTsFiles));
   if (!soft) errors.push(...checkSourceMap(packagePath));
   errors.push(...checkNpmIgnore(packagePath));
   warnings.push(...checkScriptNames(packagePath));
@@ -157,6 +159,39 @@ function checkImportStatements(packagePath, files, externals) {
   }
   return warnings;
 }
+function checkDatagrokApiImports(packagePath, files) {
+  const errors = [];
+
+  // Regex to find all datagrok-api imports/exports (including re-exports)
+  const datagrokApiImportRegex = /^\s*(import|export)\s+.*['"]datagrok-api\/[^'"]+['"]/gm;
+
+  // Regex to validate if import/export is allowed (only dg, grok, ui)
+  const allowedImportRegex = /^\s*(import|export)\s+.*['"]datagrok-api\/(dg|grok|ui)['"]/;
+
+  // Regex to extract the import path for error messages
+  const importPathRegex = /['"]datagrok-api\/([^'"]+)['"]/;
+  for (const file of files) {
+    const content = _fs.default.readFileSync(_path.default.join(packagePath, file), {
+      encoding: 'utf-8'
+    });
+    const matchedImports = content.match(datagrokApiImportRegex);
+    if (matchedImports) {
+      for (const match of matchedImports) {
+        // Check if this import/export is allowed
+        if (!allowedImportRegex.test(match)) {
+          // Extract the problematic path for error message
+          const pathMatch = match.match(importPathRegex);
+          const importedPath = pathMatch ? `datagrok-api/${pathMatch[1]}` : 'unknown';
+          errors.push(`File "${file}": Invalid datagrok-api import.
+` + `  Found: ${match.trim()}
+` + `  Only these paths are allowed: 'datagrok-api/dg', 'datagrok-api/grok', 'datagrok-api/ui'
+` + `  Deep imports like '${importedPath}' are not permitted.`);
+        }
+      }
+    }
+  }
+  return errors;
+}
 const TYPE_ALIASES = {
   file: ['fileinfo'],
   dynamic: ['searchprovider']

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "datagrok-tools",
-  "version": "4.14.70",
+  "version": "4.14.71",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {