exadev-eslint-config 2.32.1 → 2.33.1

package/README.md

@@ -233,6 +233,19 @@ React/hooks/a11y and Next.js rule blocks fold in automatically, with no separate
    pnpm add -D @next/eslint-plugin-next                                               # Next.js support
    ```
    If none of these resolve, `@exadev/eslint-config`'s default export is byte-for-byte identical to the plain TypeScript ruleset — nothing about the base package changes.
+
+   If you run [`eslint-plugin-depend`](https://github.com/es-tooling/eslint-plugin-depend)'s `ban-dependencies` on your `package.json`, it reports `eslint-plugin-react`, which the [module-replacements](https://github.com/es-tooling/module-replacements) `preferred` preset lists with a [suggested alternative](https://github.com/es-tooling/module-replacements/blob/main/docs/modules/eslint-plugin-react.md); the other React and Next.js peers are not listed. This package's React support is built on `eslint-plugin-react`, and it does not bundle `eslint-plugin-depend`, so allow the package in your own block. `allowed` takes exact package names, and the block needs no `language` of its own because `exadevConfig()` already lints `package.json` as `json/json`:
+   ```ts
+   import { defineConfig } from 'eslint/config';
+   import depend from 'eslint-plugin-depend';
+   import { exadevConfig } from '@exadev/eslint-config';
+
+   export default defineConfig(...exadevConfig(), {
+     files: ['package.json'],
+     plugins: { depend },
+     rules: { 'depend/ban-dependencies': ['error', { allowed: ['eslint-plugin-react'] }] },
+   });
+   ```
 2. **For React specifically, the file must actually be `.jsx`/`.tsx`.** The React/hooks/a11y rule block is scoped to `files: ['**/*.jsx', '**/*.tsx']`, so even if `eslint-plugin-react` is resolvable only incidentally (e.g. hoisted as a transitive dependency of something unrelated in a monorepo, with zero real JSX anywhere in the linted project), its rules never match a file that isn't JSX. `@next/eslint-plugin-next`'s own block carries no such glob: its own presence is already an unambiguous signal (nothing installs it except a real Next.js project). The [server component boundary](#server-component-boundary) rules added beside it are scoped to the same JSX files.
 
 React support pairs `eslint-plugin-react`'s `flat/recommended` with its own `flat/jsx-runtime` config, turning [`react/react-in-jsx-scope`](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/docs/rules/react-in-jsx-scope.md) and [`react/jsx-uses-react`](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/docs/rules/jsx-uses-react.md) back off. `flat/recommended` alone assumes the classic runtime, where every file using JSX needs `import React` in scope; the automatic JSX runtime (the default since React 17, and the only mode Next.js's own compiler supports) needs no such import. Without this pairing, a consumer on the automatic runtime would see `react/react-in-jsx-scope` fire on every JSX file.
@@ -322,14 +335,14 @@ The plugin's own full-canonicalization rule ([`no-insignificant-whitespace`](htt
 
 A hand-picked subset of [`@stylistic/eslint-plugin`](https://eslint.style) is bundled unconditionally, the same way jsdoc/tsdoc and RFC 8785 JSON support are: `@stylistic/eslint-plugin` is a plain dependency of this package, so every consumer already has it, and every rule below matches purely on comment shape, statement/class-member placement, or JSX prop/tag conventions, never on formatting (indentation, quotes, semicolons, trailing commas, line wrapping, bracket spacing), which stays Prettier's job in every consumer of this package. None of these rules appears in [`eslint-config-prettier`](https://github.com/prettier/eslint-config-prettier)'s own disabled-rules list.
 
-- **[`multiline-comment-style`](https://eslint.style/rules/multiline-comment-style)** is deliberately NOT enabled: the installed release's own directive-comment filter only recognises the `eslint`/`jshint`/`jslint`/`istanbul`/`globals`/`exported`/`jscs` family, so a run of `//` lines mixed with a `prettier-ignore`, `c8 ignore`/`v8 ignore`, `@ts-expect-error`/`@ts-ignore`/`@ts-nocheck`/`@ts-check`, or `TODO`/`FIXME` comment gets merged into one block and the directive lost (a lost `prettier-ignore` then lets Prettier reformat the code it protected), and two or more consecutive triple-slash reference/AMD directives break the same way regardless of file extension. This is a confirmed upstream defect, [issue #1249](https://github.com/eslint-stylistic/eslint-stylistic/issues/1249), fixed by the merged [PR #1251](https://github.com/eslint-stylistic/eslint-stylistic/pull/1251); the triple-slash gap is also tracked upstream in [issue #1285](https://github.com/eslint-stylistic/eslint-stylistic/issues/1285). This rule is re-enabled once a stable release contains PR #1251's fix, tracked at [ExaDev/eslint-config#45](https://github.com/ExaDev/eslint-config/issues/45).
-- **[`spaced-comment`](https://eslint.style/rules/spaced-comment)**: requires a space after `//`/`/*`, without fighting a `/**`-opening doc comment or a shebang line. Adds `{ block: { markers: ['!'] } }` on top of the bare default so a `/*!` license/banner block is not flagged either. A SPACED triple-slash reference/AMD directive (`/// <reference types="..." />`, TypeScript's own compiler-emitted spelling) is exempted by the installed rule's own hard-coded check; a no-space directive (`///<reference types="..." />`, also valid TypeScript syntax) is not, and gets rewritten by `--fix` into a broken `// /<reference ...>` comment TypeScript no longer recognises. Confirmed directly against the installed rule with no config-level workaround available (`markers`/`exceptions` both still require real whitespace immediately after the marker, which the no-space form never has); tracked at [ExaDev/eslint-config#47](https://github.com/ExaDev/eslint-config/issues/47). Also adds `{ line: { markers: ['#', '#region', '#endregion'] } }`: without it, the bare default rewrites a `//# sourceMappingURL=...`/`//# sourceURL=...` source-map comment into `// # sourceMappingURL=...`, which browsers and Node no longer recognise, and a bare `line: { markers: ['#'] }` alone would instead rewrite an unspaced `//#region`/`//#endregion` editor fold marker into `//# region`, which VS Code's own folding regex no longer matches. Listing all three markers together, confirmed directly against the installed rule, leaves every one of those four shapes untouched.
+- **[`multiline-comment-style`](https://eslint.style/rules/multiline-comment-style)** is deliberately NOT enabled, because its `bare-block` fixer still merges a `TODO`/`FIXME` line in a run of `//` prose into one block comment. The installed 6.0.0-beta.6 carries the fix from [PR #1251](https://github.com/eslint-stylistic/eslint-stylistic/pull/1251) for [issue #1249](https://github.com/eslint-stylistic/eslint-stylistic/issues/1249), so `prettier-ignore`, `c8 ignore`/`v8 ignore`, `istanbul ignore`, `@ts-expect-error`/`@ts-ignore`/`@ts-nocheck`/`@ts-check` and triple-slash reference/AMD directives (including the consecutive pair [issue #1285](https://github.com/eslint-stylistic/eslint-stylistic/issues/1285) reports) now stay standalone lines, but `TODO`/`FIXME` are not in the plugin's directive list and the rule has no option to add them. With the rule on, `exadev/prefer-doc-comment` stops converting the prose below a `TODO` into the declaration's doc comment, because the merged block it is left with contains a directive, so an exported declaration silently loses its doc comment. The fixer also writes a bare `\n` inside the merged block in a CRLF file. Tracked at [ExaDev/eslint-config#45](https://github.com/ExaDev/eslint-config/issues/45).
+- **[`spaced-comment`](https://eslint.style/rules/spaced-comment)**: requires a space after `//`/`/*`, without fighting a `/**`-opening doc comment or a shebang line. Adds `{ block: { markers: ['!'] } }` on top of the bare default so a `/*!` license/banner block is not flagged either. A triple-slash reference/AMD directive is exempted by the rule itself in both its spaced form (`/// <reference types="..." />`, TypeScript's own compiler-emitted spelling) and its no-space form (`///<reference types="..." />`, also valid TypeScript syntax); before `@stylistic/eslint-plugin` 6.0.0, `--fix` rewrote the no-space form into a broken `// /<reference ...>` comment ([ExaDev/eslint-config#47](https://github.com/ExaDev/eslint-config/issues/47)). Also adds `{ line: { markers: ['#', '#region', '#endregion'] } }`: without it, the bare default rewrites a `//# sourceMappingURL=...`/`//# sourceURL=...` source-map comment into `// # sourceMappingURL=...`, which browsers and Node no longer recognise, and a bare `line: { markers: ['#'] }` alone would instead rewrite an unspaced `//#region`/`//#endregion` editor fold marker into `//# region`, which VS Code's own folding regex no longer matches. Listing all three markers together, confirmed directly against the installed rule, leaves every one of those four shapes untouched.
 - **[`lines-between-class-members`](https://eslint.style/rules/lines-between-class-members)** at its bare default: a blank line between class members, except after a `.d.ts`-style method overload signature.
 - **[`line-comment-position`](https://eslint.style/rules/line-comment-position)** at `'above'`: a `//` comment belongs above the code it describes, never trailing beside it on the same line. Not autofixable; a flagged trailing comment needs moving by hand. A trailing `// cspell:disable-line` is exempt (`ignorePattern`): cspell honours that directive only on the line it suppresses, so moving it above, as the report demands, would silently disable spell-checking for the wrong line. Every other directive this package recognises applies to the line(s) below it and is correctly relocated.
 - **[`padding-line-between-statements`](https://eslint.style/rules/padding-line-between-statements)**: a blank line is required after the last statement of a directive prologue (not between two consecutive directives), after the last CommonJS or ES import in a run (not between two consecutive imports), and before a `return` statement.
-- **[`jsx-curly-brace-presence`](https://eslint.style/rules/jsx-curly-brace-presence)**, **[`jsx-pascal-case`](https://eslint.style/rules/jsx-pascal-case)**, and **[`jsx-self-closing-comp`](https://eslint.style/rules/jsx-self-closing-comp)**, each at its own bare default: none of the three has any dependency on `eslint-plugin-react` or React itself (confirmed directly against `@stylistic/eslint-plugin`'s own `package.json`, whose only `peerDependencies` entry is `eslint`), since each matches purely on a JSX AST node shape and is a structural no-op on every non-JSX file.
+- **[`jsx-curly-brace-presence`](https://eslint.style/rules/jsx-curly-brace-presence)**, **[`jsx-pascal-case`](https://eslint.style/rules/jsx-pascal-case)**, and **[`jsx-self-closing-comp`](https://eslint.style/rules/jsx-self-closing-comp)**, each at its own bare default: none of the three has any dependency on `eslint-plugin-react` or React itself (confirmed directly against `@stylistic/eslint-plugin`'s own `package.json`, whose `peerDependencies` are `eslint` and `oxlint`, both optional), since each matches purely on a JSX AST node shape and is a structural no-op on every non-JSX file.
 
-`@stylistic/eslint-plugin` has no rule covering JSX's shorthand-boolean-prop convention (`<Foo enabled />` vs `<Foo enabled={true} />`) or shorthand-fragment syntax (`<>...</>` vs `<React.Fragment>...</React.Fragment>`); those are `eslint-plugin-react`'s own `react/jsx-boolean-value` and `react/jsx-fragments`, which stay entirely within the optional [React support](#optional-react-and-nextjs-support) gate above, not this unconditional bundle.
+JSX's shorthand-boolean-prop convention (`<Foo enabled />` vs `<Foo enabled={true} />`) and shorthand-fragment syntax (`<>...</>` vs `<React.Fragment>...</React.Fragment>`) are not enforced: neither `@stylistic/eslint-plugin`'s own [`jsx-shorthand-boolean`](https://eslint.style/rules/jsx-shorthand-boolean) and [`jsx-shorthand-fragment`](https://eslint.style/rules/jsx-shorthand-fragment) nor `eslint-plugin-react`'s `react/jsx-boolean-value` and `react/jsx-fragments` are enabled, here or in the optional [React support](#optional-react-and-nextjs-support) gate above.
 
 This package's own **`exadev/prefer-doc-comment`** rule (see [Rules](#rules)) is wired alongside these, in the same unconditional bundle.
 
@@ -515,11 +528,32 @@ A policy selects files with `files` and `ignores` and holds them to:
 - `deny`: `specifiers` the files may not import. `message` is required and should name the requirement (why, and what to do instead), not the rule. `importNames` limits the ban to those imported names (`default` for a default import); a namespace import, a dynamic import, `require` and `export *` take every name, so they are still reported. `allowTypeImports` leaves erased imports alone.
 - `confine`: `specifiers` the files may import only in the files `onlyIn` selects, so the inverse case needs no hand-built complement. `allowTypeImports` and an optional `message` work as for `deny`; the default message lists `onlyIn`.
 - `exceptEdges`: one exact `file` and `specifier` pair with a required `reason`. Neither may contain a glob character, so an exception cannot widen. The specifier is compared exactly as written in that file, and `file` is normalised, so `./src/a.ts` and `src/a.ts` name the same file. Creating the config throws for an exception that could never apply (a file the policy does not select, or a specifier that no `deny` entry selects and no `confine` entry forbids in that file, such as one inside the confine's `onlyIn`), so a stale exception fails instead of lingering.
+- `computedSpecifiers`: what to do with a dynamic `import()` or `require()` whose specifier is built at runtime (`` import(`./${name}`) ``), which no restriction can match. `'ignore'` (the default) skips it; `'report'` reports it in every file the policy selects, so those files can only pull a module in by a specifier the policy can check.
 
-Specifiers follow [Specifier patterns](#specifier-patterns). The rule is syntactic and covers `import`, `import type`, `export ... from`, `export * from`, `import x = require()`, dynamic `import()` with a static string, `require()` with a static string that is not shadowed, and `import('x')` type queries. A specifier built at runtime cannot be judged and is skipped.
+Specifiers follow [Specifier patterns](#specifier-patterns). The rule is syntactic and covers `import`, `import type`, `export ... from`, `export * from`, `import x = require()`, dynamic `import()` with a string literal or a template with no substitutions, `require()` with such a string that is not shadowed, and `import('x')` type queries. A specifier built at runtime cannot be judged, so it is skipped unless the policy sets `computedSpecifiers: 'report'`.
 
 ESLint's core `no-restricted-imports` covers only the static forms (`import`, `export ... from`, `export * from` and `import x = require()`); it has no check for dynamic `import()`, `require()` or `import('x')` type queries, and `no-restricted-modules` is deprecated since ESLint 7. A preset compiled to `no-restricted-imports` blocks would also inherit flat config's rule-level override: when two policies select the same file, the later block's option list replaces the earlier one's, and an exception edge would have to restate every other restriction of the file. So the preset compiles to one block for a purpose-built rule instead, where every policy that selects a file applies to it. Files outside a policy's `files` are untouched.
 
+### Bans that dynamic `import()` bypasses
+
+A `no-restricted-imports` ban (core or `@typescript-eslint/no-restricted-imports`, which extends it) reports `import { createFake } from 'pkg/fake'` but not `await import('pkg/fake')` or `` await import(`pkg/fake`) ``, because the rule has no handler for dynamic imports. A lazy route or component is exactly where a test double or a heavy module tends to be pulled in, so a ban meant to keep it out of shipped code should be an import policy, which judges the static, dynamic and `require()` forms with the same options:
+
+```ts
+export default defineConfig(
+  ...exadevConfig(),
+  ...importPolicyConfig([
+    {
+      files: ['src/**'],
+      ignores: ['src/**/*.test.ts'],
+      deny: [{ specifiers: ['pkg/fake', 'src/testing'], message: 'test doubles stay out of shipped code; import them from tests only' }],
+      computedSpecifiers: 'report',
+    },
+  ]),
+);
+```
+
+The `no-restricted-imports` options map across as follows. A `paths` entry's `name` is a `specifiers` entry, except that a specifier also selects everything beneath it, so `pkg` covers `pkg/sub` as well. A `patterns` entry's `group` is a list of globs in the [specifier pattern](#specifier-patterns) dialect, with a leading `!` excluding. There is no `regex`: the glob dialect's `**`, `*`, `?`, `[...]`, braces and `!` excludes express the sets a ban needs, and a character class (`[Ff]ake`) stands in for case-insensitive matching. `importNames` and `message` carry over, `allowTypeImports` is the same flag, and a namespace import, dynamic import, `require()` or `export *` of a module whose `importNames` are banned is reported, since each takes every name. Avoid the `no-restricted-syntax` workaround (`ImportExpression > Literal[value=/.../]`): flat config replaces a rule's options when a later block sets the same rule for the same files, so that selector silently switches off any other `no-restricted-syntax` list the files already have.
+
 ## Pure modules
 
 A functional core should not touch I/O, read the clock, roll dice or wait on anything. `pureModulesConfig` (or `exadevConfig({ pureModules })`) wires `exadev/pure-module` onto the files that must stay pure:
@@ -1429,7 +1463,7 @@ turboConfig({
 ### Build, test, and lint
 
 ```sh
-pnpm install    # requires Node >=20 and the pnpm version pinned in package.json's packageManager field
+pnpm install    # requires Node ^20.19.0 || ^22.13.0 || >=24 and the pnpm version pinned in package.json's packageManager field
 pnpm lint
 pnpm typecheck
 pnpm test
@@ -1512,7 +1546,7 @@ pnpm build
   export type { PlaywrightWiringOptions, PublishWiringOptions, RootTool, RootWiringOptions, StrykerWiringOptions, ToolConfigsWiringOptions, ToolingWiringOptions, VitestWiringOptions } from './tooling-wiring';
   export type { EffectiveSeverity, EslintSample, EslintViolation, EslintViolationKind, RequiredSeverity, VerifyEslintOptions } from './verify-eslint';
   export type { FileRequirement, PackageCondition, PackageRequirement, PackageRequirementsOptions } from './rules/package-requirements-options';
-  export type { ImportConfine, ImportDeny, ImportExceptEdge, ImportPolicy } from './rules/import-policy-options';
+  export type { ComputedSpecifierHandling, ImportConfine, ImportDeny, ImportExceptEdge, ImportPolicy } from './rules/import-policy-options';
   export type { FilenamePatternEntry } from './rules/filename-pattern';
   export type { RequiredHeading } from './rules/markdown-required-heading';
   export type { RequiredExportsEntry } from './rules/required-exports';

package/dist/index.cjs

@@ -185,7 +185,7 @@ function buildGitignoreConfig(options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "2.32.1";
+var version = "2.33.1";
 //#endregion
 //#region src/is-record.ts
 /**
@@ -2537,6 +2537,7 @@ function stripNodePrefixFromPattern(pattern) {
 //#endregion
 //#region src/rules/import-policy-options.ts
 const OPTION_NAME$20 = "importPolicies";
+const COMPUTED_SPECIFIER_HANDLINGS = ["ignore", "report"];
 const GLOB_CHARACTERS$2 = /[*?[\]{}]/u;
 const stringList$1 = {
 	type: "array",
@@ -2616,6 +2617,10 @@ const importPoliciesSchema = {
 					],
 					additionalProperties: false
 				}
+			},
+			computedSpecifiers: {
+				type: "string",
+				enum: [...COMPUTED_SPECIFIER_HANDLINGS]
 			}
 		},
 		required: ["files"],
@@ -2632,6 +2637,14 @@ function readBoolean$3(entry, field, name) {
 	if (value !== void 0 && typeof value !== "boolean") throw new Error(`@exadev/eslint-config: "${name}" needs "${field}" to be a boolean.`);
 	return value;
 }
+function isComputedSpecifierHandling(value) {
+	return COMPUTED_SPECIFIER_HANDLINGS.some((handling) => handling === value);
+}
+function readComputedSpecifiers(entry, name) {
+	const value = entry["computedSpecifiers"];
+	if (value === void 0 || isComputedSpecifierHandling(value)) return value;
+	throw new Error(`@exadev/eslint-config: "${name}" needs "computedSpecifiers" to be one of ${COMPUTED_SPECIFIER_HANDLINGS.map((handling) => `"${handling}"`).join(", ")}.`);
+}
 function readDeny(entry, name) {
 	assertOnlyKeys(entry, [
 		"specifiers",
@@ -2686,7 +2699,7 @@ function assertEdgeIsLive(edge, policy) {
 	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$20}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
 }
 /**
-* Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
+* Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: `computedSpecifiers`, when given, to be `ignore` or `report`; at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
 */
 function readImportPolicies(value) {
 	return readEntryRecords(value, OPTION_NAME$20).map((entry) => {
@@ -2695,13 +2708,15 @@ function readImportPolicies(value) {
 			"ignores",
 			"deny",
 			"confine",
-			"exceptEdges"
+			"exceptEdges",
+			"computedSpecifiers"
 		], OPTION_NAME$20);
 		const files = readFileGlobs(entry["files"], `${OPTION_NAME$20}.files`);
 		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$20}.ignores`);
 		const deny = readOptionalList(entry, "deny", OPTION_NAME$20, readDeny);
 		const confine = readOptionalList(entry, "confine", OPTION_NAME$20, readConfine);
 		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$20, readExceptEdge);
+		const computedSpecifiers = readComputedSpecifiers(entry, OPTION_NAME$20);
 		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$20}" needs every policy to have at least one "deny" or "confine" entry.`);
 		const policy = {
 			files,
@@ -2712,7 +2727,8 @@ function readImportPolicies(value) {
 		for (const edge of exceptEdges ?? []) assertEdgeIsLive(edge, policy);
 		return {
 			...policy,
-			...exceptEdges !== void 0 && { exceptEdges }
+			...exceptEdges !== void 0 && { exceptEdges },
+			...computedSpecifiers !== void 0 && { computedSpecifiers }
 		};
 	});
 }
@@ -2768,10 +2784,22 @@ function moduleReferenceOf(node, isRequireGlobal) {
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSImportEqualsDeclaration) return node.moduleReference.type === _typescript_eslint_utils.AST_NODE_TYPES.TSExternalModuleReference ? wholeModule(node, staticString(node.moduleReference.expression), node.importKind === "type") : void 0;
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.ImportExpression) return wholeModule(node, staticString(node.source), false);
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSImportType) return wholeModule(node, node.source.value, true);
+	const argument = requireArgument(node, isRequireGlobal);
+	return argument === void 0 ? void 0 : wholeModule(node, staticString(argument), false);
+}
+function requireArgument(node, isRequireGlobal) {
 	if (node.type !== _typescript_eslint_utils.AST_NODE_TYPES.CallExpression) return void 0;
 	const [argument] = node.arguments;
 	if (node.callee.type !== _typescript_eslint_utils.AST_NODE_TYPES.Identifier || node.callee.name !== "require" || node.arguments.length !== 1 || argument === void 0 || !isRequireGlobal(node)) return void 0;
-	return wholeModule(node, staticString(argument), false);
+	return argument;
+}
+/**
+* Whether the node pulls a module in by a specifier that is not a static string, so no specifier pattern can judge it: a dynamic `import()` or a global `require()` whose argument is anything but a string literal or a substitution-free template. The static-specifier forms are `moduleReferenceOf`'s; a node is never both.
+*/
+function hasComputedSpecifier(node, isRequireGlobal) {
+	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.ImportExpression) return staticString(node.source) === void 0;
+	const argument = requireArgument(node, isRequireGlobal);
+	return argument !== void 0 && staticString(argument) === void 0;
 }
 function selectsNames(importNames, referenceNames) {
 	if (importNames === void 0) return true;
@@ -2796,7 +2824,8 @@ function compilePolicy(policy) {
 	return {
 		inScope: createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)]),
 		restrictions: [...deny, ...confine],
-		exceptEdges: policy.exceptEdges ?? []
+		exceptEdges: policy.exceptEdges ?? [],
+		reportsComputed: policy.computedSpecifiers === "report"
 	};
 }
 function isShadowed(sourceCode, call) {
@@ -2812,7 +2841,10 @@ const importPolicy = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) =>
 		type: "problem",
 		docs: { description: "Restrict which modules the files matching a glob may import: deny lists, confinement to named files, and exact exception edges." },
 		schema: [importPoliciesSchema],
-		messages: { restricted: "\"{{ specifier }}\" cannot be imported here: {{ message }}" }
+		messages: {
+			restricted: "\"{{ specifier }}\" cannot be imported here: {{ message }}",
+			computed: "This module specifier is computed at runtime, so the import policy for this file cannot check it. Write it as a string literal."
+		}
 	},
 	defaultOptions: [[]],
 	create(context, [options]) {
@@ -2820,8 +2852,17 @@ const importPolicy = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) =>
 		const policies = readImportPolicies(options).map(compilePolicy).filter((policy) => policy.inScope(filename, cwd));
 		if (policies.length === 0) return {};
 		const relativePath = relativeToCwd(filename, cwd);
+		const reportsComputed = policies.some((policy) => policy.reportsComputed);
+		const isRequireGlobal = (call) => !isShadowed(sourceCode, call);
 		const check = (node) => {
-			const reference = moduleReferenceOf(node, (call) => !isShadowed(sourceCode, call));
+			if (reportsComputed && hasComputedSpecifier(node, isRequireGlobal)) {
+				context.report({
+					node,
+					messageId: "computed"
+				});
+				return;
+			}
+			const reference = moduleReferenceOf(node, isRequireGlobal);
 			if (reference === void 0) return;
 			for (const policy of policies) {
 				if (policy.exceptEdges.some((edge) => edge.file === relativePath && edge.specifier === reference.specifier)) continue;

package/dist/index.d.cts

@@ -265,6 +265,10 @@ interface ImportExceptEdge {
   readonly specifier: string;
   readonly reason: string;
 }
+/**
+ * What a policy does with a dynamic `import()` or a `require()` whose specifier is not a static string (a variable, a concatenation, or a template with a substitution), which no restriction can match: `ignore` it (the default), or `report` it, so the files the policy selects can only pull modules in by a specifier it can check.
+ */
+type ComputedSpecifierHandling = 'ignore' | 'report';
 /**
  * Import restrictions for the files `files` selects and `ignores` does not. At least one of `deny` and `confine` is required.
  */
@@ -274,6 +278,7 @@ interface ImportPolicy {
   readonly deny?: readonly ImportDeny[];
   readonly confine?: readonly ImportConfine[];
   readonly exceptEdges?: readonly ImportExceptEdge[];
+  readonly computedSpecifiers?: ComputedSpecifierHandling;
 }
 //#endregion
 //#region src/rules/turbo-commands.d.ts
@@ -524,4 +529,4 @@ interface RequiredImportsEntry {
   readonly call?: boolean;
 }
 //#endregion
-export { type AggregateTaskOptions, type AllowedBoundariesIgnore, type AllowedEdge, type BoundaryGroup, type DependencyConstraint, type EffectiveSeverity, type EslintSample, type EslintViolation, type EslintViolationKind, type ExemptTargetGroup, type FileRequirement, type FilenamePatternEntry, type GroupSpec, type ImportConfine, type ImportDeny, type ImportExceptEdge, type ImportPolicy, type MarkdownFrontmatter, type MarkdownHeadingsOptions, type NamingOptions, type PackageCondition, type PackageRequirement, type PackageRequirementsOptions, type PackageSelector, type PackageSelectorFields, type PlaywrightWiringOptions, type PublishWiringOptions, type PureModulesOptions, type RankRule, type RankSkipOptions, type RequiredExportsEntry, type RequiredFiles, type RequiredHeading, type RequiredImportsEntry, type RequiredScripts, type RequiredSeverity, type RootTool, type RootWiringOptions, type ScriptContent, type ScriptRequirement, type SliceSpec, type StrykerWiringOptions, type TaskGraphRequirement, type TestHygieneOptions, type ToolConfigsWiringOptions, type ToolingWiringOptions, type TurboBoundariesOptions, type TurboDelegate, type TurboHygieneOptions, type TurboOptions, type VerifyEslintOptions, type VitestWiringOptions, type WorkspaceArchitectureOptions, assertEslintConfig, defaultConfig as default, exadevConfig, importPolicyConfig, markdownHeadingsConfig, publicPlugin as plugin, pureModulesConfig, testHygieneConfig, toolingWiringConfig, turboConfig, verifyEslintConfig, workspaceArchitectureConfig };
+export { type AggregateTaskOptions, type AllowedBoundariesIgnore, type AllowedEdge, type BoundaryGroup, type ComputedSpecifierHandling, type DependencyConstraint, type EffectiveSeverity, type EslintSample, type EslintViolation, type EslintViolationKind, type ExemptTargetGroup, type FileRequirement, type FilenamePatternEntry, type GroupSpec, type ImportConfine, type ImportDeny, type ImportExceptEdge, type ImportPolicy, type MarkdownFrontmatter, type MarkdownHeadingsOptions, type NamingOptions, type PackageCondition, type PackageRequirement, type PackageRequirementsOptions, type PackageSelector, type PackageSelectorFields, type PlaywrightWiringOptions, type PublishWiringOptions, type PureModulesOptions, type RankRule, type RankSkipOptions, type RequiredExportsEntry, type RequiredFiles, type RequiredHeading, type RequiredImportsEntry, type RequiredScripts, type RequiredSeverity, type RootTool, type RootWiringOptions, type ScriptContent, type ScriptRequirement, type SliceSpec, type StrykerWiringOptions, type TaskGraphRequirement, type TestHygieneOptions, type ToolConfigsWiringOptions, type ToolingWiringOptions, type TurboBoundariesOptions, type TurboDelegate, type TurboHygieneOptions, type TurboOptions, type VerifyEslintOptions, type VitestWiringOptions, type WorkspaceArchitectureOptions, assertEslintConfig, defaultConfig as default, exadevConfig, importPolicyConfig, markdownHeadingsConfig, publicPlugin as plugin, pureModulesConfig, testHygieneConfig, toolingWiringConfig, turboConfig, verifyEslintConfig, workspaceArchitectureConfig };

package/dist/index.d.ts

@@ -265,6 +265,10 @@ interface ImportExceptEdge {
   readonly specifier: string;
   readonly reason: string;
 }
+/**
+ * What a policy does with a dynamic `import()` or a `require()` whose specifier is not a static string (a variable, a concatenation, or a template with a substitution), which no restriction can match: `ignore` it (the default), or `report` it, so the files the policy selects can only pull modules in by a specifier it can check.
+ */
+type ComputedSpecifierHandling = 'ignore' | 'report';
 /**
  * Import restrictions for the files `files` selects and `ignores` does not. At least one of `deny` and `confine` is required.
  */
@@ -274,6 +278,7 @@ interface ImportPolicy {
   readonly deny?: readonly ImportDeny[];
   readonly confine?: readonly ImportConfine[];
   readonly exceptEdges?: readonly ImportExceptEdge[];
+  readonly computedSpecifiers?: ComputedSpecifierHandling;
 }
 //#endregion
 //#region src/rules/turbo-commands.d.ts
@@ -524,4 +529,4 @@ interface RequiredImportsEntry {
   readonly call?: boolean;
 }
 //#endregion
-export { type AggregateTaskOptions, type AllowedBoundariesIgnore, type AllowedEdge, type BoundaryGroup, type DependencyConstraint, type EffectiveSeverity, type EslintSample, type EslintViolation, type EslintViolationKind, type ExemptTargetGroup, type FileRequirement, type FilenamePatternEntry, type GroupSpec, type ImportConfine, type ImportDeny, type ImportExceptEdge, type ImportPolicy, type MarkdownFrontmatter, type MarkdownHeadingsOptions, type NamingOptions, type PackageCondition, type PackageRequirement, type PackageRequirementsOptions, type PackageSelector, type PackageSelectorFields, type PlaywrightWiringOptions, type PublishWiringOptions, type PureModulesOptions, type RankRule, type RankSkipOptions, type RequiredExportsEntry, type RequiredFiles, type RequiredHeading, type RequiredImportsEntry, type RequiredScripts, type RequiredSeverity, type RootTool, type RootWiringOptions, type ScriptContent, type ScriptRequirement, type SliceSpec, type StrykerWiringOptions, type TaskGraphRequirement, type TestHygieneOptions, type ToolConfigsWiringOptions, type ToolingWiringOptions, type TurboBoundariesOptions, type TurboDelegate, type TurboHygieneOptions, type TurboOptions, type VerifyEslintOptions, type VitestWiringOptions, type WorkspaceArchitectureOptions, assertEslintConfig, defaultConfig as default, exadevConfig, importPolicyConfig, markdownHeadingsConfig, publicPlugin as plugin, pureModulesConfig, testHygieneConfig, toolingWiringConfig, turboConfig, verifyEslintConfig, workspaceArchitectureConfig };
+export { type AggregateTaskOptions, type AllowedBoundariesIgnore, type AllowedEdge, type BoundaryGroup, type ComputedSpecifierHandling, type DependencyConstraint, type EffectiveSeverity, type EslintSample, type EslintViolation, type EslintViolationKind, type ExemptTargetGroup, type FileRequirement, type FilenamePatternEntry, type GroupSpec, type ImportConfine, type ImportDeny, type ImportExceptEdge, type ImportPolicy, type MarkdownFrontmatter, type MarkdownHeadingsOptions, type NamingOptions, type PackageCondition, type PackageRequirement, type PackageRequirementsOptions, type PackageSelector, type PackageSelectorFields, type PlaywrightWiringOptions, type PublishWiringOptions, type PureModulesOptions, type RankRule, type RankSkipOptions, type RequiredExportsEntry, type RequiredFiles, type RequiredHeading, type RequiredImportsEntry, type RequiredScripts, type RequiredSeverity, type RootTool, type RootWiringOptions, type ScriptContent, type ScriptRequirement, type SliceSpec, type StrykerWiringOptions, type TaskGraphRequirement, type TestHygieneOptions, type ToolConfigsWiringOptions, type ToolingWiringOptions, type TurboBoundariesOptions, type TurboDelegate, type TurboHygieneOptions, type TurboOptions, type VerifyEslintOptions, type VitestWiringOptions, type WorkspaceArchitectureOptions, assertEslintConfig, defaultConfig as default, exadevConfig, importPolicyConfig, markdownHeadingsConfig, publicPlugin as plugin, pureModulesConfig, testHygieneConfig, toolingWiringConfig, turboConfig, verifyEslintConfig, workspaceArchitectureConfig };

package/dist/index.js

@@ -150,7 +150,7 @@ function buildGitignoreConfig(options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "2.32.1";
+var version = "2.33.1";
 //#endregion
 //#region src/is-record.ts
 /**
@@ -2502,6 +2502,7 @@ function stripNodePrefixFromPattern(pattern) {
 //#endregion
 //#region src/rules/import-policy-options.ts
 const OPTION_NAME$20 = "importPolicies";
+const COMPUTED_SPECIFIER_HANDLINGS = ["ignore", "report"];
 const GLOB_CHARACTERS$2 = /[*?[\]{}]/u;
 const stringList$1 = {
 	type: "array",
@@ -2581,6 +2582,10 @@ const importPoliciesSchema = {
 					],
 					additionalProperties: false
 				}
+			},
+			computedSpecifiers: {
+				type: "string",
+				enum: [...COMPUTED_SPECIFIER_HANDLINGS]
 			}
 		},
 		required: ["files"],
@@ -2597,6 +2602,14 @@ function readBoolean$3(entry, field, name) {
 	if (value !== void 0 && typeof value !== "boolean") throw new Error(`@exadev/eslint-config: "${name}" needs "${field}" to be a boolean.`);
 	return value;
 }
+function isComputedSpecifierHandling(value) {
+	return COMPUTED_SPECIFIER_HANDLINGS.some((handling) => handling === value);
+}
+function readComputedSpecifiers(entry, name) {
+	const value = entry["computedSpecifiers"];
+	if (value === void 0 || isComputedSpecifierHandling(value)) return value;
+	throw new Error(`@exadev/eslint-config: "${name}" needs "computedSpecifiers" to be one of ${COMPUTED_SPECIFIER_HANDLINGS.map((handling) => `"${handling}"`).join(", ")}.`);
+}
 function readDeny(entry, name) {
 	assertOnlyKeys(entry, [
 		"specifiers",
@@ -2651,7 +2664,7 @@ function assertEdgeIsLive(edge, policy) {
 	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$20}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
 }
 /**
-* Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
+* Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: `computedSpecifiers`, when given, to be `ignore` or `report`; at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
 */
 function readImportPolicies(value) {
 	return readEntryRecords(value, OPTION_NAME$20).map((entry) => {
@@ -2660,13 +2673,15 @@ function readImportPolicies(value) {
 			"ignores",
 			"deny",
 			"confine",
-			"exceptEdges"
+			"exceptEdges",
+			"computedSpecifiers"
 		], OPTION_NAME$20);
 		const files = readFileGlobs(entry["files"], `${OPTION_NAME$20}.files`);
 		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$20}.ignores`);
 		const deny = readOptionalList(entry, "deny", OPTION_NAME$20, readDeny);
 		const confine = readOptionalList(entry, "confine", OPTION_NAME$20, readConfine);
 		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$20, readExceptEdge);
+		const computedSpecifiers = readComputedSpecifiers(entry, OPTION_NAME$20);
 		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$20}" needs every policy to have at least one "deny" or "confine" entry.`);
 		const policy = {
 			files,
@@ -2677,7 +2692,8 @@ function readImportPolicies(value) {
 		for (const edge of exceptEdges ?? []) assertEdgeIsLive(edge, policy);
 		return {
 			...policy,
-			...exceptEdges !== void 0 && { exceptEdges }
+			...exceptEdges !== void 0 && { exceptEdges },
+			...computedSpecifiers !== void 0 && { computedSpecifiers }
 		};
 	});
 }
@@ -2733,10 +2749,22 @@ function moduleReferenceOf(node, isRequireGlobal) {
 	if (node.type === AST_NODE_TYPES.TSImportEqualsDeclaration) return node.moduleReference.type === AST_NODE_TYPES.TSExternalModuleReference ? wholeModule(node, staticString(node.moduleReference.expression), node.importKind === "type") : void 0;
 	if (node.type === AST_NODE_TYPES.ImportExpression) return wholeModule(node, staticString(node.source), false);
 	if (node.type === AST_NODE_TYPES.TSImportType) return wholeModule(node, node.source.value, true);
+	const argument = requireArgument(node, isRequireGlobal);
+	return argument === void 0 ? void 0 : wholeModule(node, staticString(argument), false);
+}
+function requireArgument(node, isRequireGlobal) {
 	if (node.type !== AST_NODE_TYPES.CallExpression) return void 0;
 	const [argument] = node.arguments;
 	if (node.callee.type !== AST_NODE_TYPES.Identifier || node.callee.name !== "require" || node.arguments.length !== 1 || argument === void 0 || !isRequireGlobal(node)) return void 0;
-	return wholeModule(node, staticString(argument), false);
+	return argument;
+}
+/**
+* Whether the node pulls a module in by a specifier that is not a static string, so no specifier pattern can judge it: a dynamic `import()` or a global `require()` whose argument is anything but a string literal or a substitution-free template. The static-specifier forms are `moduleReferenceOf`'s; a node is never both.
+*/
+function hasComputedSpecifier(node, isRequireGlobal) {
+	if (node.type === AST_NODE_TYPES.ImportExpression) return staticString(node.source) === void 0;
+	const argument = requireArgument(node, isRequireGlobal);
+	return argument !== void 0 && staticString(argument) === void 0;
 }
 function selectsNames(importNames, referenceNames) {
 	if (importNames === void 0) return true;
@@ -2761,7 +2789,8 @@ function compilePolicy(policy) {
 	return {
 		inScope: createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)]),
 		restrictions: [...deny, ...confine],
-		exceptEdges: policy.exceptEdges ?? []
+		exceptEdges: policy.exceptEdges ?? [],
+		reportsComputed: policy.computedSpecifiers === "report"
 	};
 }
 function isShadowed(sourceCode, call) {
@@ -2777,7 +2806,10 @@ const importPolicy = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDe
 		type: "problem",
 		docs: { description: "Restrict which modules the files matching a glob may import: deny lists, confinement to named files, and exact exception edges." },
 		schema: [importPoliciesSchema],
-		messages: { restricted: "\"{{ specifier }}\" cannot be imported here: {{ message }}" }
+		messages: {
+			restricted: "\"{{ specifier }}\" cannot be imported here: {{ message }}",
+			computed: "This module specifier is computed at runtime, so the import policy for this file cannot check it. Write it as a string literal."
+		}
 	},
 	defaultOptions: [[]],
 	create(context, [options]) {
@@ -2785,8 +2817,17 @@ const importPolicy = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDe
 		const policies = readImportPolicies(options).map(compilePolicy).filter((policy) => policy.inScope(filename, cwd));
 		if (policies.length === 0) return {};
 		const relativePath = relativeToCwd(filename, cwd);
+		const reportsComputed = policies.some((policy) => policy.reportsComputed);
+		const isRequireGlobal = (call) => !isShadowed(sourceCode, call);
 		const check = (node) => {
-			const reference = moduleReferenceOf(node, (call) => !isShadowed(sourceCode, call));
+			if (reportsComputed && hasComputedSpecifier(node, isRequireGlobal)) {
+				context.report({
+					node,
+					messageId: "computed"
+				});
+				return;
+			}
+			const reference = moduleReferenceOf(node, isRequireGlobal);
 			if (reference === void 0) return;
 			for (const policy of policies) {
 				if (policy.exceptEdges.some((edge) => edge.file === relativePath && edge.specifier === reference.specifier)) continue;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "exadev-eslint-config",
   "description": "Shared custom ESLint rules and plugin for ExaDev projects",
-  "version": "2.32.1",
+  "version": "2.33.1",
   "dependencies": {
     "@eslint/js": "^10.0.1",
     "@microsoft/tsdoc": "0.17.0",
-    "@stylistic/eslint-plugin": "5.10.0",
+    "@stylistic/eslint-plugin": "6.0.0-beta.6",
     "@typescript-eslint/typescript-estree": "8.67.0",
     "@typescript-eslint/utils": "8.67.0",
     "eslint-plugin-jsdoc": "64.3.6",
@@ -35,6 +35,7 @@
     "@vitest/eslint-plugin": "^1.6.27",
     "cosmiconfig": "10.0.1",
     "eslint": "^10.8.0",
+    "eslint-plugin-depend": "1.5.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
@@ -50,7 +51,7 @@
     "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^20.19.0 || ^22.13.0 || >=24"
   },
   "exports": {
     ".": {