eslint-plugin-no-mistakes 0.41.0 → 0.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "ESLint and Oxlint rules for deterministic no-mistakes code analysis",
   "license": "MIT",
   "repository": {
@@ -24,7 +24,7 @@
     "@typescript-eslint/parser": "^8.65.0",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^10.8.0",
-    "oxlint": "^1.76.0",
+    "oxlint": "^1.77.0",
     "vitest": "^4.1.6"
   },
   "peerDependencies": {

package/src/index.js

@@ -10,6 +10,7 @@ const rules = {
   "module-mock-preserve-exports": require("./rules/module-mock-preserve-exports"),
   "nextjs-metadata-exports-location": require("./rules/nextjs-metadata-exports-location"),
   "nextjs-no-manual-script-tags": require("./rules/nextjs-no-manual-script-tags"),
+  "no-banned-import-outside-allowed-paths": require("./rules/no-banned-import-outside-allowed-paths"),
   "no-global-fetch-outside-helper": require("./rules/no-global-fetch-outside-helper"),
   "no-delete-property": require("./rules/no-delete-property"),
   "no-import-only-test-files": require("./rules/no-import-only-test-files"),

package/src/rules/no-banned-import-outside-allowed-paths-aliases.js

@@ -0,0 +1,193 @@
+"use strict";
+
+const { propertyName } = require("./module-mock-helpers");
+const {
+  bindingIdentifier,
+  bindingIdentifiers,
+  resolveVariable,
+} = require("./no-global-fetch-outside-helper-bindings");
+const {
+  collectAssignmentExpressions,
+  collectVariableDeclarators,
+  isMaybeExecuted,
+  isOptionalChainArgument,
+} = require("./no-global-fetch-outside-helper-traversal");
+const { hasBannedName } = require("./no-banned-import-outside-allowed-paths-config");
+const {
+  resolveNodeModuleCreateRequireTag,
+  tagForExpression,
+} = require("./no-banned-import-outside-allowed-paths-tags");
+
+function setOrClearTag(identifier, tag, context, aliasMap, clearedAliases) {
+  const variable = resolveVariable(identifier, context);
+  if (!variable) return;
+  if (tag) {
+    aliasMap.set(variable, tag);
+    clearedAliases?.delete(variable);
+  } else {
+    aliasMap.delete(variable);
+    clearedAliases?.add(variable);
+  }
+}
+
+function resolvePropertyTag(initTag, key, config) {
+  if (initTag?.kind !== "object" || !key) return null;
+  for (const module of initTag.modules) {
+    const createRequireTag = resolveNodeModuleCreateRequireTag(module, key);
+    if (createRequireTag) return createRequireTag;
+    if (hasBannedName(config, module, key)) return { kind: "direct", module, name: key };
+  }
+  return null;
+}
+
+// Real-time (control-flow-sensitive) destructure recorder: clears every
+// destructured identifier that doesn't resolve to a banned name, and
+// conservatively keeps the whole object tag on a rest element.
+function applyObjectPatternTag(pattern, initTag, context, aliasMap, clearedAliases, config) {
+  for (const property of pattern.properties) {
+    if (property.type === "RestElement") {
+      const identifier = bindingIdentifier(property.argument);
+      const tag = initTag?.kind === "object" ? initTag : null;
+      if (identifier) setOrClearTag(identifier, tag, context, aliasMap, clearedAliases);
+      continue;
+    }
+    if (property.type !== "Property") continue;
+    const identifier = bindingIdentifier(property.value);
+    if (!identifier) {
+      // The target is itself a nested pattern (unsupported for tagging), but
+      // any identifier it rebinds must still lose a stale tag from an
+      // earlier assignment, or a later use would be a false positive.
+      for (const nested of bindingIdentifiers(property.value)) {
+        setOrClearTag(nested, null, context, aliasMap, clearedAliases);
+      }
+      continue;
+    }
+    const tag = resolvePropertyTag(initTag, propertyName(property.key), config);
+    setOrClearTag(identifier, tag, context, aliasMap, clearedAliases);
+  }
+}
+
+function recordVariableTag(
+  node,
+  context,
+  aliasMap,
+  clearedAliases,
+  config,
+  readAliasMap = aliasMap,
+) {
+  if (!node.init) return;
+  if (node.id.type === "Identifier") {
+    const tag = tagForExpression(node.init, context, readAliasMap, config);
+    setOrClearTag(node.id, tag, context, aliasMap, clearedAliases);
+    return;
+  }
+  if (node.id.type === "ObjectPattern") {
+    const initTag = tagForExpression(node.init, context, readAliasMap, config);
+    applyObjectPatternTag(node.id, initTag, context, aliasMap, clearedAliases, config);
+  }
+}
+
+function recordAssignmentTag(
+  node,
+  context,
+  aliasMap,
+  clearedAliases,
+  config,
+  readAliasMap = aliasMap,
+) {
+  if (isOptionalChainArgument(node)) return;
+  if (node.operator === "||=" || node.operator === "??=") return;
+  if (node.operator !== "=") {
+    if (node.left?.type === "Identifier") {
+      setOrClearTag(node.left, null, context, aliasMap, clearedAliases);
+    }
+    return;
+  }
+  if (node.left?.type === "Identifier") {
+    const tag = tagForExpression(node.right, context, readAliasMap, config);
+    setOrClearTag(node.left, tag, context, aliasMap, clearedAliases);
+    return;
+  }
+  if (node.left?.type === "ObjectPattern") {
+    const initTag = tagForExpression(node.right, context, readAliasMap, config);
+    applyObjectPatternTag(node.left, initTag, context, aliasMap, clearedAliases, config);
+    return;
+  }
+  if (node.left?.type === "ArrayPattern") {
+    // Array destructuring never resolves to a tracked module tag (arrays
+    // aren't "the module object" in this model), but every identifier it
+    // rebinds must still lose a stale tag from an earlier assignment.
+    for (const identifier of bindingIdentifiers(node.left)) {
+      setOrClearTag(identifier, null, context, aliasMap, clearedAliases);
+    }
+  }
+}
+
+// Fixed-point (forward-reference) seeder: add-only, never clears, so repeated
+// passes over the whole program monotonically converge (mirrors the
+// reference rule's `collectPossibleAlias`).
+function applyObjectPatternTagAddOnly(pattern, initTag, context, aliasMap, config) {
+  for (const property of pattern.properties) {
+    if (property.type === "RestElement") {
+      if (initTag.kind !== "object") continue;
+      const identifier = bindingIdentifier(property.argument);
+      if (identifier) setOrClearTag(identifier, initTag, context, aliasMap);
+      continue;
+    }
+    if (property.type !== "Property") continue;
+    const identifier = bindingIdentifier(property.value);
+    if (!identifier) continue;
+    const tag = resolvePropertyTag(initTag, propertyName(property.key), config);
+    if (tag) setOrClearTag(identifier, tag, context, aliasMap);
+  }
+}
+
+function collectPossibleTag(node, context, aliasMap, config) {
+  if (node.type === "VariableDeclarator") {
+    if (!node.init) return;
+    if (node.id.type === "Identifier") {
+      const tag = tagForExpression(node.init, context, aliasMap, config);
+      if (tag) setOrClearTag(node.id, tag, context, aliasMap);
+      return;
+    }
+    if (node.id.type === "ObjectPattern") {
+      const initTag = tagForExpression(node.init, context, aliasMap, config);
+      if (initTag) applyObjectPatternTagAddOnly(node.id, initTag, context, aliasMap, config);
+    }
+    return;
+  }
+  if (node.operator !== "=") return;
+  if (node.left?.type === "Identifier") {
+    const tag = tagForExpression(node.right, context, aliasMap, config);
+    if (tag) setOrClearTag(node.left, tag, context, aliasMap);
+    return;
+  }
+  if (node.left?.type === "ObjectPattern") {
+    const initTag = tagForExpression(node.right, context, aliasMap, config);
+    if (initTag) applyObjectPatternTagAddOnly(node.left, initTag, context, aliasMap, config);
+  }
+}
+
+function collectBannedAliases(program, context, aliasMap, config) {
+  const candidates = [
+    ...collectVariableDeclarators(program),
+    ...collectAssignmentExpressions(program),
+  ];
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const node of candidates) {
+      if (isMaybeExecuted(node)) continue;
+      const before = aliasMap.size;
+      collectPossibleTag(node, context, aliasMap, config);
+      changed ||= aliasMap.size > before;
+    }
+  }
+}
+
+module.exports = {
+  collectBannedAliases,
+  recordAssignmentTag,
+  recordVariableTag,
+  setOrClearTag,
+};

package/src/rules/no-banned-import-outside-allowed-paths-config.js

@@ -0,0 +1,64 @@
+"use strict";
+
+const { repoRelativeFilename, stringMatches } = require("./module-mock-helpers");
+
+// Modules whose `createRequire` export is Node's real createRequire()
+// regardless of how a config bans/allows their other exports; tracked
+// unconditionally (see no-banned-import-outside-allowed-paths-tags.js's
+// `resolveNodeModuleCreateRequireTag`) since createRequire is itself a
+// capability that can synchronously load any other banned module, whether
+// obtained via a static `import` or a `require()` call.
+const CREATE_REQUIRE_MODULES = new Set(["node:module", "module"]);
+
+// Normalizes the `bannedImports` option into `Map<module, Set<name>>`. The
+// sentinel name `"default"` bans the module's default export when it is used
+// as a directly callable value; any other name bans that named export (or,
+// when reached as a member off a namespace/default/require binding, that
+// method/property name).
+// `entries` is already schema-validated (each item requires a string `module`
+// and a non-empty string-array `names`), so no defensive shape-checking here.
+function normalizeBannedImports(entries) {
+  const config = new Map();
+  for (const entry of entries ?? []) {
+    const names = config.get(entry.module) ?? new Set();
+    for (const name of entry.names) names.add(name);
+    config.set(entry.module, names);
+  }
+  return config;
+}
+
+function hasBannedName(config, module, name) {
+  return config.get(module)?.has(name) ?? false;
+}
+
+function hasAnyBannedName(config, module) {
+  return Boolean(config.get(module)?.size);
+}
+
+// `export * from "mod"` never re-exports a module's default export (ES module
+// semantics), so the reserved "default" name must not by itself make an
+// unaliased export-star declaration reachable.
+function hasAnyNonDefaultBannedName(config, module) {
+  const names = config.get(module);
+  if (!names) return false;
+  for (const name of names) {
+    if (name !== "default") return true;
+  }
+  return false;
+}
+
+function shouldCheckFile(filename, options) {
+  const checked = options?.checkedPathPatterns ?? [];
+  if (checked.length === 0) return false;
+  const file = repoRelativeFilename(filename);
+  return stringMatches(file, checked) && !stringMatches(file, options.allowedPathPatterns ?? []);
+}
+
+module.exports = {
+  CREATE_REQUIRE_MODULES,
+  hasAnyBannedName,
+  hasAnyNonDefaultBannedName,
+  hasBannedName,
+  normalizeBannedImports,
+  shouldCheckFile,
+};

package/src/rules/no-banned-import-outside-allowed-paths-imports.js

@@ -0,0 +1,201 @@
+"use strict";
+
+const { importSpecifierName } = require("./module-mock-helpers");
+const { resolveVariable } = require("./no-global-fetch-outside-helper-bindings");
+const {
+  CREATE_REQUIRE_MODULES,
+  hasAnyBannedName,
+  hasAnyNonDefaultBannedName,
+  hasBannedName,
+} = require("./no-banned-import-outside-allowed-paths-config");
+const {
+  resolveNodeModuleCreateRequireTag,
+  tagForExpression,
+} = require("./no-banned-import-outside-allowed-paths-tags");
+
+function isTypeOnlyImport(node, specifier) {
+  return node.importKind === "type" || specifier.importKind === "type";
+}
+
+function isTypeOnlyExport(node, specifier) {
+  return node.exportKind === "type" || specifier.exportKind === "type";
+}
+
+function seedImportSpecifier(specifier, node, moduleSpecifier, context, config, aliasMap) {
+  if (isTypeOnlyImport(node, specifier)) return;
+  const variable = resolveVariable(specifier.local, context);
+  if (!variable) return;
+  if (specifier.type === "ImportSpecifier") {
+    const name = importSpecifierName(specifier);
+    const createRequireTag = resolveNodeModuleCreateRequireTag(moduleSpecifier, name);
+    if (createRequireTag) {
+      aliasMap.set(variable, createRequireTag);
+      return;
+    }
+    if (name && hasBannedName(config, moduleSpecifier, name)) {
+      aliasMap.set(variable, { kind: "direct", module: moduleSpecifier, name });
+    }
+    return;
+  }
+  if (
+    specifier.type === "ImportDefaultSpecifier" ||
+    specifier.type === "ImportNamespaceSpecifier"
+  ) {
+    // A CREATE_REQUIRE_MODULES namespace/default binding is tracked as an
+    // object whether or not the config separately bans anything from it, so
+    // a member access like `mod.createRequire` still resolves below (see
+    // resolveNodeModuleCreateRequireTag) even when nothing else about the
+    // module is configured as banned.
+    if (hasAnyBannedName(config, moduleSpecifier) || CREATE_REQUIRE_MODULES.has(moduleSpecifier)) {
+      aliasMap.set(variable, { kind: "object", modules: new Set([moduleSpecifier]) });
+    }
+  }
+}
+
+// Seeds import-derived tags. Import bindings are always top-level and
+// unconditional (re-assigning them is a syntax error), so this is a single
+// non-fixed-point pass, unlike the require()/createRequire() forward pass.
+function seedImportTags(program, context, config, aliasMap) {
+  for (const node of program.body) {
+    if (node.type !== "ImportDeclaration") continue;
+    const moduleSpecifier = node.source.value;
+    for (const specifier of node.specifiers) {
+      seedImportSpecifier(specifier, node, moduleSpecifier, context, config, aliasMap);
+    }
+  }
+}
+
+function specifierSourceName(node) {
+  return node.type === "Literal" ? String(node.value) : node.name;
+}
+
+function reportTagLeak(reportNode, tag, config, context) {
+  if (tag?.kind === "direct") {
+    context.report({
+      node: reportNode,
+      messageId: "bannedReExport",
+      data: { module: tag.module, name: tag.name },
+    });
+    return true;
+  }
+  if (tag?.kind !== "object") return false;
+  for (const module of tag.modules) {
+    if (hasAnyBannedName(config, module)) {
+      context.report({
+        node: reportNode,
+        messageId: "bannedReExport",
+        data: { module, name: "*" },
+      });
+      return true;
+    }
+  }
+  return false;
+}
+
+// Resolves the tag reachable through `variable` for an export check: prefer
+// a live real-time tag, but never fall back to the fixed-point forward tag
+// once the variable has been explicitly cleared (real-time overwritten to
+// something untracked) — otherwise a since-overwritten alias would "revive"
+// its stale, no-longer-true forward tag and produce a false positive. A
+// forward tag is only consulted for a variable never yet touched in real
+// time, i.e. a genuine forward reference.
+function resolveExportedTag(variable, aliasMap, clearedAliases, forwardAliasMap) {
+  if (!variable) return null;
+  if (aliasMap.has(variable)) return aliasMap.get(variable);
+  if (clearedAliases.has(variable)) return null;
+  return forwardAliasMap.get(variable) ?? null;
+}
+
+function reportLocalReExport(
+  specifier,
+  context,
+  config,
+  aliasMap,
+  clearedAliases,
+  forwardAliasMap,
+) {
+  const variable = resolveVariable(specifier.local, context);
+  const tag = resolveExportedTag(variable, aliasMap, clearedAliases, forwardAliasMap);
+  reportTagLeak(specifier, tag, config, context);
+}
+
+function checkExportedDeclaration(
+  declaration,
+  context,
+  config,
+  aliasMap,
+  clearedAliases,
+  forwardAliasMap,
+) {
+  if (declaration?.type !== "VariableDeclaration") return;
+  for (const declarator of declaration.declarations) {
+    if (declarator.id.type !== "Identifier") continue;
+    const variable = resolveVariable(declarator.id, context);
+    const tag = resolveExportedTag(variable, aliasMap, clearedAliases, forwardAliasMap);
+    reportTagLeak(declarator, tag, config, context);
+  }
+}
+
+function checkExportLeaks(node, context, config, aliasMap, clearedAliases, forwardAliasMap) {
+  if (node.type === "ExportAllDeclaration") {
+    const moduleSpecifier = node.source?.value;
+    // An unaliased `export * from "mod"` never re-exports the module's
+    // default export (ES module semantics), so a module banned only on
+    // "default" exposes nothing reachable through this form.
+    if (hasAnyNonDefaultBannedName(config, moduleSpecifier)) {
+      context.report({
+        node,
+        messageId: "bannedReExport",
+        data: { module: moduleSpecifier, name: "*" },
+      });
+    }
+    return;
+  }
+  // An inline export declaration (`export const compile = ts.createProgram;`)
+  // exposes a tagged value directly, with no `specifiers` entry to inspect.
+  checkExportedDeclaration(
+    node.declaration,
+    context,
+    config,
+    aliasMap,
+    clearedAliases,
+    forwardAliasMap,
+  );
+  for (const specifier of node.specifiers ?? []) {
+    if (specifier.type !== "ExportSpecifier" || isTypeOnlyExport(node, specifier)) continue;
+    if (node.source) {
+      const sourceName = specifierSourceName(specifier.local);
+      if (hasBannedName(config, node.source.value, sourceName)) {
+        context.report({
+          node: specifier,
+          messageId: "bannedReExport",
+          data: { module: node.source.value, name: sourceName },
+        });
+      }
+      continue;
+    }
+    reportLocalReExport(specifier, context, config, aliasMap, clearedAliases, forwardAliasMap);
+  }
+}
+
+function checkDefaultExportLeak(node, context, config, aliasMap, clearedAliases, forwardAliasMap) {
+  const { declaration } = node;
+  if (declaration.type === "Identifier") {
+    const variable = resolveVariable(declaration, context);
+    const tag = resolveExportedTag(variable, aliasMap, clearedAliases, forwardAliasMap);
+    reportTagLeak(node, tag, config, context);
+    return;
+  }
+  // A non-identifier declaration (`export default ts.createProgram;` or
+  // `export default require("typescript").createProgram;`) is resolved with
+  // the same expression tagger used for calls and aliases, matching
+  // real-time (depth-0, no forward merge) semantics.
+  const tag = tagForExpression(declaration, context, aliasMap, config);
+  reportTagLeak(node, tag, config, context);
+}
+
+module.exports = {
+  checkDefaultExportLeak,
+  checkExportLeaks,
+  seedImportTags,
+};

package/src/rules/no-banned-import-outside-allowed-paths-scopes.js

@@ -0,0 +1,117 @@
+"use strict";
+
+// Tracks binding-tag scopes with discard-on-exit semantics for conditionally
+// executed constructs, mirroring the reference rule
+// no-global-fetch-outside-helper.js's push/pop-scope pattern (if/for/while
+// bodies, switch cases with fallthrough tracking, try block/handler,
+// non-static field initializers, and conditional/logical branch
+// expressions). A tagged alias assigned inside one of these constructs must
+// not leak into the surrounding scope, since the construct may execute zero
+// or more times, or not on every path.
+function createAliasScopeTracker() {
+  let aliases = new Map();
+  let clearedForwardAliases = new Set();
+  const aliasStack = [];
+  const clearedAliasStack = [];
+  const switchStack = [];
+
+  function push() {
+    aliasStack.push(aliases);
+    clearedAliasStack.push(clearedForwardAliases);
+    aliases = new Map(aliases);
+    clearedForwardAliases = new Set(clearedForwardAliases);
+  }
+
+  function pop() {
+    aliases = aliasStack.pop();
+    clearedForwardAliases = clearedAliasStack.pop();
+  }
+
+  // Discards the current branch's mutations and starts a fresh clone from
+  // the same base a sibling branch (e.g. a ternary's alternate) should see.
+  // Used between mutually exclusive branches that share one push(), instead
+  // of a second pop-then-push pair keyed to the branch node itself: keying
+  // to the branch node races an enter/exit listener on that same node (see
+  // the call sites in the main rule file for why).
+  function resetBranch() {
+    pop();
+    push();
+  }
+
+  // A switch case's aliases start from the switch's base state, or, on
+  // fallthrough from a case with no terminating break/return/throw, from
+  // whatever the previous case left behind; they're discarded again on exit
+  // unless that case also falls through.
+  function enterSwitch() {
+    switchStack.push({ baseAliases: null, baseCleared: null, fallthrough: false });
+  }
+
+  function exitSwitch() {
+    const state = switchStack.pop();
+    if (!state.baseAliases) return;
+    aliases = state.baseAliases;
+    clearedForwardAliases = state.baseCleared;
+  }
+
+  function enterSwitchCase() {
+    const state = switchStack.at(-1);
+    if (!state) return;
+    if (!state.baseAliases) {
+      state.baseAliases = aliases;
+      state.baseCleared = clearedForwardAliases;
+    }
+    if (state.fallthrough) return;
+    aliases = new Map(state.baseAliases);
+    clearedForwardAliases = new Set(state.baseCleared);
+  }
+
+  // A terminator nested inside a bare `{ }` block still runs unconditionally
+  // (the block's statements execute in sequence, same as direct case-body
+  // children), so it's scanned too. A terminator nested inside an `if` or
+  // other conditional/repeated construct is deliberately NOT scanned: it
+  // isn't a guaranteed terminator for the whole case, and treating it as one
+  // would wrongly discard a real fallthrough — the same class of unsoundness
+  // this scope tracker exists to prevent.
+  function terminatesCase(node) {
+    if (
+      node.type === "BreakStatement" ||
+      node.type === "ReturnStatement" ||
+      node.type === "ThrowStatement"
+    ) {
+      return true;
+    }
+    return node.type === "BlockStatement" && node.body.some(terminatesCase);
+  }
+
+  function exitsSwitchCase(node) {
+    return node.consequent?.some(terminatesCase) ?? false;
+  }
+
+  function exitSwitchCase(node) {
+    const state = switchStack.at(-1);
+    if (!state) return;
+    state.fallthrough = !exitsSwitchCase(node);
+    if (!state.fallthrough) {
+      aliases = new Map(state.baseAliases);
+      clearedForwardAliases = new Set(state.baseCleared);
+    }
+  }
+
+  return {
+    push,
+    pop,
+    resetBranch,
+    enterSwitch,
+    exitSwitch,
+    enterSwitchCase,
+    exitSwitchCase,
+    get aliases() {
+      return aliases;
+    },
+    get clearedForwardAliases() {
+      return clearedForwardAliases;
+    },
+  };
+}
+
+module.exports = { createAliasScopeTracker };

package/src/rules/no-banned-import-outside-allowed-paths-tags.js

@@ -0,0 +1,133 @@
+"use strict";
+
+const { literalString, memberPropertyName } = require("./module-mock-helpers");
+const { hasLocalBinding, resolveVariable } = require("./no-global-fetch-outside-helper-bindings");
+const {
+  CREATE_REQUIRE_MODULES,
+  hasBannedName,
+} = require("./no-banned-import-outside-allowed-paths-config");
+
+// Tag shapes tracked per resolved variable:
+//   { kind: "direct", module, name }   - this binding IS a specific banned export's value
+//   { kind: "object", modules: Set }   - this binding is "the module object" (namespace/default
+//                                        import, require()/dynamic-import() result, or a spread
+//                                        merge of such objects); member access and destructure
+//                                        against it are checked against each module's banned names
+//   { kind: "require-fn" }             - this binding is a Node `require`-shaped function, either
+//                                        the global `require` or the result of calling createRequire()
+//   { kind: "create-require" }         - this binding is Node's `createRequire` itself
+
+const UNWRAP_TYPES = new Set([
+  "ChainExpression",
+  "TSAsExpression",
+  "TSSatisfiesExpression",
+  "TSNonNullExpression",
+  "TSInstantiationExpression",
+  "TSTypeAssertion",
+]);
+
+function unwrapExpression(node) {
+  let current = node;
+  while (current && (current.type === "AwaitExpression" || UNWRAP_TYPES.has(current.type))) {
+    current = current.type === "AwaitExpression" ? current.argument : current.expression;
+  }
+  return current;
+}
+
+function isUnshadowedRequire(node, context) {
+  return node?.type === "Identifier" && node.name === "require" && !hasLocalBinding(node, context);
+}
+
+function tagForIdentifier(node, context, aliasMap) {
+  if (node.type !== "Identifier") return null;
+  const variable = resolveVariable(node, context);
+  return (variable && aliasMap.get(variable)) ?? null;
+}
+
+// `createRequire` is Node's real createRequire() whenever it's reached off
+// one of CREATE_REQUIRE_MODULES, regardless of the binding form (a static
+// `import { createRequire }` specifier, a require()'d object's destructured
+// property, or a require()'d object's member access) — it's a capability in
+// its own right, not a name a config bans per module.
+function resolveNodeModuleCreateRequireTag(module, name) {
+  if (CREATE_REQUIRE_MODULES.has(module) && name === "createRequire") {
+    return { kind: "create-require" };
+  }
+  return null;
+}
+
+function tagForCallExpression(node, context, aliasMap, config) {
+  // Resolve the callee through the full expression tagger, not just
+  // identifiers, so a `createRequire` reached directly off a member
+  // expression (e.g. `nodeModuleNs.createRequire(url)`, with no
+  // intermediate variable) is recognized the same way as an aliased one.
+  const calleeTag = tagForExpression(node.callee, context, aliasMap, config);
+  if (calleeTag?.kind === "create-require") return { kind: "require-fn" };
+  const isRequireFn = calleeTag?.kind === "require-fn";
+  if (!isRequireFn && !isUnshadowedRequire(node.callee, context)) return null;
+  const specifier = literalString(node.arguments[0]);
+  if (!specifier) return null;
+  // A require()'d CREATE_REQUIRE_MODULES object is tracked whether or not
+  // the config separately bans anything from it, so its createRequire
+  // property still resolves below even when nothing else about the module
+  // is configured as banned.
+  if (!CREATE_REQUIRE_MODULES.has(specifier) && !config.has(specifier)) return null;
+  return { kind: "object", modules: new Set([specifier]) };
+}
+
+function tagForMemberExpression(node, context, aliasMap, config) {
+  // Resolve the object through the full expression tagger, not just
+  // identifiers, so member access chained directly off an inline
+  // require()/import() call (e.g. `require("typescript").createProgram()`)
+  // is tracked without first assigning the module object to a variable.
+  const objectTag = tagForExpression(node.object, context, aliasMap, config);
+  if (objectTag?.kind !== "object") return null;
+  const name = memberPropertyName(node);
+  if (!name) return null;
+  for (const module of objectTag.modules) {
+    const createRequireTag = resolveNodeModuleCreateRequireTag(module, name);
+    if (createRequireTag) return createRequireTag;
+    if (hasBannedName(config, module, name)) return { kind: "direct", module, name };
+  }
+  return null;
+}
+
+function tagForDynamicImport(node, config) {
+  const specifier = literalString(node.source);
+  if (!specifier || !config.has(specifier)) return null;
+  return { kind: "object", modules: new Set([specifier]) };
+}
+
+function tagForSpread(node, context, aliasMap, config) {
+  const modules = new Set();
+  for (const property of node.properties) {
+    if (property.type !== "SpreadElement") continue;
+    const tag = tagForExpression(property.argument, context, aliasMap, config);
+    if (tag?.kind === "object") for (const module of tag.modules) modules.add(module);
+  }
+  return modules.size > 0 ? { kind: "object", modules } : null;
+}
+
+function tagForExpression(node, context, aliasMap, config) {
+  const unwrapped = unwrapExpression(node);
+  if (!unwrapped) return null;
+  if (unwrapped.type === "Identifier") return tagForIdentifier(unwrapped, context, aliasMap);
+  if (unwrapped.type === "MemberExpression") {
+    return tagForMemberExpression(unwrapped, context, aliasMap, config);
+  }
+  if (unwrapped.type === "CallExpression") {
+    return tagForCallExpression(unwrapped, context, aliasMap, config);
+  }
+  if (unwrapped.type === "ImportExpression") return tagForDynamicImport(unwrapped, config);
+  if (unwrapped.type === "ObjectExpression")
+    return tagForSpread(unwrapped, context, aliasMap, config);
+  return null;
+}
+
+module.exports = {
+  isUnshadowedRequire,
+  resolveNodeModuleCreateRequireTag,
+  tagForExpression,
+  tagForIdentifier,
+  unwrapExpression,
+};

package/src/rules/no-banned-import-outside-allowed-paths.js

@@ -0,0 +1,225 @@
+"use strict";
+
+const { rule } = require("../helpers");
+const {
+  hasBannedName,
+  normalizeBannedImports,
+  shouldCheckFile,
+} = require("./no-banned-import-outside-allowed-paths-config");
+const {
+  checkDefaultExportLeak,
+  checkExportLeaks,
+  seedImportTags,
+} = require("./no-banned-import-outside-allowed-paths-imports");
+const {
+  collectBannedAliases,
+  recordAssignmentTag,
+  recordVariableTag,
+} = require("./no-banned-import-outside-allowed-paths-aliases");
+const { createAliasScopeTracker } = require("./no-banned-import-outside-allowed-paths-scopes");
+const { tagForExpression } = require("./no-banned-import-outside-allowed-paths-tags");
+
+module.exports = rule(
+  {
+    type: "problem",
+    docs: {
+      description: "disallow banned capability imports outside allowed paths",
+      recommended: false,
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          checkedPathPatterns: { type: "array", items: { type: "string" } },
+          allowedPathPatterns: { type: "array", items: { type: "string" } },
+          bannedImports: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                module: { type: "string" },
+                names: { type: "array", items: { type: "string" }, minItems: 1 },
+              },
+              required: ["module", "names"],
+              additionalProperties: false,
+            },
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      bannedImport:
+        'Reachable use of banned import "{{name}}" from "{{module}}" outside allowed paths. Move it into an allowed helper path.',
+      bannedReExport:
+        'Do not re-export banned import "{{name}}" from "{{module}}"; it stays reachable outside allowed paths.',
+    },
+  },
+  (context) => {
+    const options = context.options?.[0] ?? {};
+    if (!shouldCheckFile(context.filename, options)) return {};
+    const config = normalizeBannedImports(options.bannedImports);
+    if (config.size === 0) return {};
+
+    const scopes = createAliasScopeTracker();
+    const forwardAliases = new Map();
+    let functionDepth = 0;
+
+    function isIifeFunction(node) {
+      const parent = node?.parent;
+      return parent?.type === "CallExpression" && parent.callee === node;
+    }
+
+    function pushFunctionScope(node) {
+      if (isIifeFunction(node)) return;
+      functionDepth += 1;
+      scopes.push();
+    }
+
+    function popFunctionScope(node) {
+      if (isIifeFunction(node)) return;
+      scopes.pop();
+      functionDepth -= 1;
+    }
+
+    // Merges forward-declared module-scope tags (imports, plus hoistable
+    // require()/createRequire() forward references) with the current
+    // block-scoped tags when resolving inside a function body. At module
+    // depth 0, `aliases` alone reflects real top-to-bottom JS execution
+    // order, so no forward merge happens there (matches the reference rule).
+    function activeAliases() {
+      if (functionDepth === 0) return scopes.aliases;
+      const active = new Map(forwardAliases);
+      for (const variable of scopes.clearedForwardAliases) active.delete(variable);
+      for (const [variable, tag] of scopes.aliases) active.set(variable, tag);
+      return active;
+    }
+
+    function reportCall(node, module, name) {
+      context.report({ node, messageId: "bannedImport", data: { module, name } });
+    }
+
+    // Shared by CallExpression and NewExpression: a banned capability is
+    // just as reachable through `new BannedClient()` as through
+    // `BannedClient()`, and both invocation forms resolve their callee the
+    // same way.
+    function checkInvocation(node) {
+      const tag = tagForExpression(node.callee, context, activeAliases(), config);
+      if (tag?.kind === "direct") {
+        reportCall(node.callee, tag.module, tag.name);
+        return;
+      }
+      if (tag?.kind !== "object") return;
+      for (const module of tag.modules) {
+        if (hasBannedName(config, module, "default")) {
+          reportCall(node.callee, module, "default");
+          return;
+        }
+      }
+    }
+
+    return {
+      Program(node) {
+        seedImportTags(node, context, config, scopes.aliases);
+        for (const [variable, tag] of scopes.aliases) forwardAliases.set(variable, tag);
+        collectBannedAliases(node, context, forwardAliases, config);
+      },
+      FunctionDeclaration: pushFunctionScope,
+      "FunctionDeclaration:exit": popFunctionScope,
+      FunctionExpression: pushFunctionScope,
+      "FunctionExpression:exit": popFunctionScope,
+      ArrowFunctionExpression: pushFunctionScope,
+      "ArrowFunctionExpression:exit": popFunctionScope,
+      "IfStatement > .consequent": scopes.push,
+      "IfStatement > .consequent:exit": scopes.pop,
+      "IfStatement > .alternate": scopes.push,
+      "IfStatement > .alternate:exit": scopes.pop,
+      "ForStatement > .body": scopes.push,
+      "ForStatement > .body:exit": scopes.pop,
+      "ForInStatement > .body": scopes.push,
+      "ForInStatement > .body:exit": scopes.pop,
+      "ForOfStatement > .body": scopes.push,
+      "ForOfStatement > .body:exit": scopes.pop,
+      "WhileStatement > .body": scopes.push,
+      "WhileStatement > .body:exit": scopes.pop,
+      SwitchStatement: scopes.enterSwitch,
+      "SwitchStatement:exit": scopes.exitSwitch,
+      SwitchCase: scopes.enterSwitchCase,
+      "SwitchCase:exit": scopes.exitSwitchCase,
+      "TryStatement > .block": scopes.push,
+      "TryStatement > .block:exit": scopes.pop,
+      "TryStatement > .handler": scopes.push,
+      "TryStatement > .handler:exit": scopes.pop,
+      "FieldDefinition[static=false] > .value": scopes.push,
+      "FieldDefinition[static=false] > .value:exit": scopes.pop,
+      "PropertyDefinition[static=false] > .value": scopes.push,
+      "PropertyDefinition[static=false] > .value:exit": scopes.pop,
+      // A ternary's or `&&`/`||`'s conditionally-executed operand can itself
+      // be a bare AssignmentExpression (no wrapping statement), unlike an
+      // `if`/loop/switch/try body, which is always a Statement. Pushing on
+      // that operand's own field selector would race the operand's own
+      // enter listener (both fire on the same node, and the plain-type
+      // listener runs first), so the push/pop below is keyed to the
+      // guaranteed-unconditional sibling's exit and the container's exit
+      // instead, which always bracket the conditional operand's own enter
+      // and exit regardless of listener-specificity ordering.
+      "ConditionalExpression > .test:exit": scopes.push,
+      "ConditionalExpression > .consequent:exit": scopes.resetBranch,
+      "ConditionalExpression:exit": scopes.pop,
+      "LogicalExpression > .left:exit": scopes.push,
+      "LogicalExpression:exit": scopes.pop,
+      VariableDeclarator(node) {
+        recordVariableTag(
+          node,
+          context,
+          scopes.aliases,
+          scopes.clearedForwardAliases,
+          config,
+          activeAliases(),
+        );
+      },
+      AssignmentExpression(node) {
+        recordAssignmentTag(
+          node,
+          context,
+          scopes.aliases,
+          scopes.clearedForwardAliases,
+          config,
+          activeAliases(),
+        );
+      },
+      CallExpression: checkInvocation,
+      NewExpression: checkInvocation,
+      ExportNamedDeclaration(node) {
+        checkExportLeaks(
+          node,
+          context,
+          config,
+          scopes.aliases,
+          scopes.clearedForwardAliases,
+          forwardAliases,
+        );
+      },
+      ExportAllDeclaration(node) {
+        checkExportLeaks(
+          node,
+          context,
+          config,
+          scopes.aliases,
+          scopes.clearedForwardAliases,
+          forwardAliases,
+        );
+      },
+      ExportDefaultDeclaration(node) {
+        checkDefaultExportLeak(
+          node,
+          context,
+          config,
+          scopes.aliases,
+          scopes.clearedForwardAliases,
+          forwardAliases,
+        );
+      },
+    };
+  },
+);