@composurecdk/eslint-plugin 0.10.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jason Duffett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# @composurecdk/eslint-plugin
+
+Internal ESLint plugin encoding ComposureCDK architectural invariants — tagged builders, lifecycle context, builder copy state.
+
+```sh
+npm install --save-dev @composurecdk/eslint-plugin
+```
+
+Ships a dual ESM/CommonJS build, so it loads from either kind of flat config. Rule names, messages, preset names and option names are public API — see [Versioning](#versioning).
+
+## Usage
+
+### Presets
+
+Rules are grouped by **what must be true of you** for the rule to be correct, so you enable the tiers that describe your package ([ADR-0019](../../docs/adr/0019-lint-rules-as-public-contract.md)):
+
+| Preset           | Enable it if                                                                  |
+| ---------------- | ----------------------------------------------------------------------------- |
+| `recommended`    | You write a `Lifecycle` or a builder — whatever shape your project is.        |
+| `libraryAuthor`  | You also publish a package other people compile against.                      |
+| `dualPublishing` | You also ship both an ESM and a CommonJS build from one source.               |
+| `internal`       | You are composureCDK. Published for reproducibility, not as a recommendation. |
+
+They are additive, so extend every tier that describes you. A CDK **application** takes `recommended` alone: the `libraryAuthor` rules guard hazards that exist only once you emit a `.d.ts` someone else compiles against, and one of them (`lifecycle-build-must-forward-context`) reports on the root-level builds an application does as a matter of course.
+
+Each is a self-contained flat config entry that registers the plugin, so extending it is all that is needed:
+
+```js
+import composurecdk from "@composurecdk/eslint-plugin";
+
+export default [
+  {
+    files: ["src/**/*.ts"],
+    extends: [composurecdk.configs.recommended, composurecdk.configs.libraryAuthor],
+  },
+];
+```
+
+From a CommonJS flat config the `require()` result is itself the plugin — `rules` and `configs` are own properties of it, so no `.default` unwrapping is needed:
+
+```js
+const composurecdk = require("@composurecdk/eslint-plugin");
+
+module.exports = [
+  {
+    files: ["src/**/*.ts"],
+    extends: [composurecdk.configs.recommended],
+  },
+];
+```
+
+### Scoping is yours
+
+No preset declares `files`. The rules are written for **library source** — applying them unscoped will flag test, fixture and config code — but only you know where your source lives, so pick the glob as above. (This repo uses `packages/*/src/**/*.ts`.)
+
+File-level overrides (e.g. disabling a rule on a specific file) likewise belong in your config, not in the preset.
+
+### Picking rules individually
+
+`configs.recommended.rules` is still a plain severity map, so you can register the plugin yourself and take a subset:
+
+```js
+import composurecdk from "@composurecdk/eslint-plugin";
+
+export default [
+  {
+    files: ["src/**/*.ts"],
+    plugins: { composurecdk },
+    rules: { "composurecdk/lifecycle-build-context-required": "error" },
+  },
+];
+```
+
+Mixing the two forms is safe: the preset registers the same plugin object this `plugins` entry does, so ESLint sees one plugin rather than a conflicting redefinition.
+
+## Rules
+
+Each rule has a documentation page with its rationale, examples, deliberate exclusions and known gaps. `meta.docs.url` points at it, so an editor can open it straight from a reported violation.
+
+| Rule                                                                                                      | Preset           | What it flags                                                                                                                             |
+| --------------------------------------------------------------------------------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| [`composurecdk/builder-must-be-tagged`](docs/rules/builder-must-be-tagged.md)                             | `internal`       | `Builder` / `IBuilder` from `@composurecdk/core` in a library builder — use the tagged equivalents.                                       |
+| [`composurecdk/builder-must-implement-copy-state`](docs/rules/builder-must-implement-copy-state.md)       | `recommended`    | A builder class holding private state with no `[COPY_STATE]` hook, so `.copy()` silently drops it.                                        |
+| [`composurecdk/constraint-metadata-required`](docs/rules/constraint-metadata-required.md)                 | `internal`       | A `stringConstraint({ … })` call with an empty `name`, `allowed` or `source`, degrading every error it produces.                          |
+| [`composurecdk/lifecycle-build-context-required`](docs/rules/lifecycle-build-context-required.md)         | `recommended`    | `Lifecycle.build()` missing the `context` param when the class uses `Resolvable<…>`.                                                      |
+| [`composurecdk/lifecycle-build-must-forward-context`](docs/rules/lifecycle-build-must-forward-context.md) | `libraryAuthor`  | A two-argument `builder.build(scope, id)` — the sub-builder gets no context, so refs cannot resolve.                                      |
+| [`composurecdk/no-cdk-api-above-floor`](docs/rules/no-cdk-api-above-floor.md)                             | `internal`       | `aws-cdk-lib` APIs newer than the supported peer floor — they throw on older versions in the range.                                       |
+| [`composurecdk/no-cjs-incompatible-syntax`](docs/rules/no-cjs-incompatible-syntax.md)                     | `dualPublishing` | `import.meta` / top-level `await` in library `src/` — neither emits to CommonJS.                                                          |
+| [`composurecdk/no-realm-bound-instanceof`](docs/rules/no-realm-bound-instanceof.md)                       | `recommended`    | `instanceof` against an imported class — realm-bound, so it silently returns false across the dual-package boundary. **Takes an option.** |
+| [`composurecdk/no-typescript-private-modifier`](docs/rules/no-typescript-private-modifier.md)             | `libraryAuthor`  | The TypeScript `private` modifier — it stays in `keyof T` and leaks through mapped types into the emitted `.d.ts`.                        |
+| [`composurecdk/redeclared-prop-must-track-cdk-type`](docs/rules/redeclared-prop-must-track-cdk-type.md)   | `libraryAuthor`  | A prop re-declared out of an `Omit<CdkProps, …>` that pins a CDK interface instead of reading CDK's own prop type.                        |
+
+## Versioning
+
+Rule names, messages and default severities are public API ([ADR-0019](../../docs/adr/0019-lint-rules-as-public-contract.md)):
+
+- **A new rule ships registered but in no preset**, so you can enable it the day it lands. It **joins a preset in a major**: a caret range — what `npm install` writes — picks up minors automatically, so a new rule in a preset turns green CI red on unchanged code.
+- **Tightening an existing rule is breaking**, including a widened selector or a narrowed exemption. New code failing an unchanged rule is not.
+- **Loosening a rule, removing one, or renaming one is breaking.** A removed or renamed rule id in your own `rules:` block is a hard config error, not a silent gap.
+- **Moving a rule between presets, or renaming a preset, is breaking.** Adding a new preset is not.
+- **Option names and their defaults are API too.** Adding an option is minor when its default preserves behaviour, and breaking otherwise. Renaming one is breaking — the schemas reject unknown keys, so an old name becomes a hard config error rather than a silent no-op.
+
+## Adding a new rule
+
+1. Create `src/rules/<kebab-name>.ts`:
+
+   ```ts
+   import type { Rule } from "eslint";
+
+   export const rule: Rule.RuleModule = {
+     meta: {
+       type: "problem",
+       docs: { description: "..." },
+       schema: [],
+       messages: { someId: "..." },
+     },
+     create(ctx) {
+       return {/* visitor */};
+     },
+   };
+   ```
+
+2. Register it in `src/rules/index.ts`.
+3. Decide its tier in `src/configs/presets.ts` — the preset whose truth condition it matches, or none if it is landing ahead of the next major. A test asserts no rule lands in two tiers, and that a rule in none is listed as deliberate — see [ADR-0019](../../docs/adr/0019-lint-rules-as-public-contract.md).
+4. Write `docs/rules/<kebab-name>.md`, leading with `# composurecdk/<kebab-name>`. This is where rationale, examples, deliberate exclusions and known gaps live — the rule's own source comment stays a summary plus a link. `meta.docs.url` is derived from the name you registered, so there is nothing to wire up.
+5. Add a row to the table above, linking the page.
+6. Write `test/rules/<kebab-name>.test.ts` using `RuleTester` (see existing tests). Cover at least one valid and one invalid case per `messageId`.
+7. If the rule takes options, give each schema property a `description` (it is what `--print-config` and config inspectors show), keep `additionalProperties: false` so a typo fails loudly, and cover both settings in the tests. Option names are API — see Versioning above.
+
+Steps 3–5 are each asserted by `test/docs.test.ts` and `test/configs/presets.test.ts` — skip one and the suite fails rather than the omission going unnoticed.
+
+## Running tests
+
+```sh
+npx nx test eslint-plugin
+```
+
+Tests use Vitest as the runner with ESLint's `RuleTester` driving fixtures. The shared `RuleTester` instance (configured with the typescript-eslint parser) lives in `test/rule-tester.ts`.

package/dist/commonjs/configs/presets.d.ts

@@ -0,0 +1,42 @@
+import type { Linter } from "eslint";
+/**
+ * The rule sets behind each preset, grouped by **what must be true of the
+ * consumer** for the rule to be correct — not by subject matter. Every rule
+ * belongs to exactly one, which a test enforces.
+ *
+ * The reasoning behind the tiers, and what moving a rule between them costs,
+ * is in ADR-0019.
+ */
+/**
+ * True for anyone writing a `Lifecycle` or a builder, in any shape of project —
+ * an application as much as a library.
+ */
+export declare const recommendedRules: Linter.RulesRecord;
+/**
+ * Additionally true for a package other people compile against.
+ *
+ * Each hazard here exists only once you emit a `.d.ts` someone else consumes:
+ * TS4094 and TS2883 need an exported mapped type, and a narrowed prop type only
+ * hurts when it is your published API. An application emits none of that.
+ *
+ * `lifecycle-build-must-forward-context` sits here for a different reason — a
+ * root-level build has no context to forward and is correct, and in an
+ * application nearly every build is a root build. That is a property of where
+ * the call sits in the composition graph, so no amount of narrowing the rule
+ * fixes it.
+ */
+export declare const libraryAuthorRules: Linter.RulesRecord;
+/**
+ * Additionally true for a package shipping both an ESM and a CommonJS build.
+ * Out of `recommended` because banning `import.meta` is a false positive for an
+ * ESM-only library, where it is legal and idiomatic.
+ */
+export declare const dualPublishingRules: Linter.RulesRecord;
+/**
+ * composureCDK's own house rules. Each encodes a convention or a hardcoded
+ * value — this repo's CDK floor, its tagging wrapper, its constraint catalogue
+ * — that is wrong elsewhere. Published so the preset is reproducible, not as a
+ * recommendation.
+ */
+export declare const internalRules: Linter.RulesRecord;
+//# sourceMappingURL=presets.d.ts.map

package/dist/commonjs/configs/presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../../src/configs/presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC;;;;;;;GAOG;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAIrC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,WAIvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,WAExC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,WAIlC,CAAC"}

package/dist/commonjs/configs/presets.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.internalRules = exports.dualPublishingRules = exports.libraryAuthorRules = exports.recommendedRules = void 0;
+/**
+ * The rule sets behind each preset, grouped by **what must be true of the
+ * consumer** for the rule to be correct — not by subject matter. Every rule
+ * belongs to exactly one, which a test enforces.
+ *
+ * The reasoning behind the tiers, and what moving a rule between them costs,
+ * is in ADR-0019.
+ */
+/**
+ * True for anyone writing a `Lifecycle` or a builder, in any shape of project —
+ * an application as much as a library.
+ */
+exports.recommendedRules = {
+    "composurecdk/builder-must-implement-copy-state": "error",
+    "composurecdk/lifecycle-build-context-required": "error",
+    "composurecdk/no-realm-bound-instanceof": "error",
+};
+/**
+ * Additionally true for a package other people compile against.
+ *
+ * Each hazard here exists only once you emit a `.d.ts` someone else consumes:
+ * TS4094 and TS2883 need an exported mapped type, and a narrowed prop type only
+ * hurts when it is your published API. An application emits none of that.
+ *
+ * `lifecycle-build-must-forward-context` sits here for a different reason — a
+ * root-level build has no context to forward and is correct, and in an
+ * application nearly every build is a root build. That is a property of where
+ * the call sits in the composition graph, so no amount of narrowing the rule
+ * fixes it.
+ */
+exports.libraryAuthorRules = {
+    "composurecdk/lifecycle-build-must-forward-context": "error",
+    "composurecdk/no-typescript-private-modifier": "error",
+    "composurecdk/redeclared-prop-must-track-cdk-type": "error",
+};
+/**
+ * Additionally true for a package shipping both an ESM and a CommonJS build.
+ * Out of `recommended` because banning `import.meta` is a false positive for an
+ * ESM-only library, where it is legal and idiomatic.
+ */
+exports.dualPublishingRules = {
+    "composurecdk/no-cjs-incompatible-syntax": "error",
+};
+/**
+ * composureCDK's own house rules. Each encodes a convention or a hardcoded
+ * value — this repo's CDK floor, its tagging wrapper, its constraint catalogue
+ * — that is wrong elsewhere. Published so the preset is reproducible, not as a
+ * recommendation.
+ */
+exports.internalRules = {
+    "composurecdk/builder-must-be-tagged": "error",
+    "composurecdk/constraint-metadata-required": "error",
+    "composurecdk/no-cdk-api-above-floor": "error",
+};
+//# sourceMappingURL=presets.js.map

package/dist/commonjs/configs/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../../src/configs/presets.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AAEH;;;GAGG;AACU,QAAA,gBAAgB,GAAuB;IAClD,gDAAgD,EAAE,OAAO;IACzD,+CAA+C,EAAE,OAAO;IACxD,wCAAwC,EAAE,OAAO;CAClD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAuB;IACpD,mDAAmD,EAAE,OAAO;IAC5D,6CAA6C,EAAE,OAAO;IACtD,kDAAkD,EAAE,OAAO;CAC5D,CAAC;AAEF;;;;GAIG;AACU,QAAA,mBAAmB,GAAuB;IACrD,yCAAyC,EAAE,OAAO;CACnD,CAAC;AAEF;;;;;GAKG;AACU,QAAA,aAAa,GAAuB;IAC/C,qCAAqC,EAAE,OAAO;IAC9C,2CAA2C,EAAE,OAAO;IACpD,qCAAqC,EAAE,OAAO;CAC/C,CAAC"}

package/dist/commonjs/index.d.ts

@@ -0,0 +1,84 @@
+import { rules } from "./rules/index.js";
+/**
+ * Self-contained flat config entries — each registers the plugin, so a consumer
+ * needs no `plugins` entry of their own, and they compose:
+ *
+ * ```js
+ * import composurecdk from "@composurecdk/eslint-plugin";
+ * export default [
+ *   {
+ *     files: ["src/**\/*.ts"],
+ *     extends: [composurecdk.configs.recommended, composurecdk.configs.dualPublishing],
+ *   },
+ * ];
+ * ```
+ *
+ * None declares `files`: the rules target library source, but only the consumer
+ * knows where theirs lives. See `./configs/presets.ts` for which rules each
+ * holds and why.
+ */
+export declare const configs: {
+    recommended: {
+        name: string;
+        plugins: {
+            composurecdk: import("@eslint/core").Plugin;
+        };
+        rules: import("@eslint/core").RulesConfig;
+    };
+    libraryAuthor: {
+        name: string;
+        plugins: {
+            composurecdk: import("@eslint/core").Plugin;
+        };
+        rules: import("@eslint/core").RulesConfig;
+    };
+    dualPublishing: {
+        name: string;
+        plugins: {
+            composurecdk: import("@eslint/core").Plugin;
+        };
+        rules: import("@eslint/core").RulesConfig;
+    };
+    internal: {
+        name: string;
+        plugins: {
+            composurecdk: import("@eslint/core").Plugin;
+        };
+        rules: import("@eslint/core").RulesConfig;
+    };
+};
+export { rules };
+declare const _default: import("@eslint/core").Plugin & {
+    configs: {
+        recommended: {
+            name: string;
+            plugins: {
+                composurecdk: import("@eslint/core").Plugin;
+            };
+            rules: import("@eslint/core").RulesConfig;
+        };
+        libraryAuthor: {
+            name: string;
+            plugins: {
+                composurecdk: import("@eslint/core").Plugin;
+            };
+            rules: import("@eslint/core").RulesConfig;
+        };
+        dualPublishing: {
+            name: string;
+            plugins: {
+                composurecdk: import("@eslint/core").Plugin;
+            };
+            rules: import("@eslint/core").RulesConfig;
+        };
+        internal: {
+            name: string;
+            plugins: {
+                composurecdk: import("@eslint/core").Plugin;
+            };
+            rules: import("@eslint/core").RulesConfig;
+        };
+    };
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAkBzC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBqB,CAAC;AAE1C,OAAO,EAAE,KAAK,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjB,wBAAkD"}

package/dist/commonjs/index.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rules = exports.configs = void 0;
+const presets_js_1 = require("./configs/presets.js");
+const index_js_1 = require("./rules/index.js");
+Object.defineProperty(exports, "rules", { enumerable: true, get: function () { return index_js_1.rules; } });
+/**
+ * The plugin object, built before `configs` so every preset can register *this*
+ * object under `plugins`.
+ *
+ * The identity matters. ESLint rejects a flat config whose entries register two
+ * different objects under one plugin name, so a consumer extending two presets
+ * at once — or extending one and writing `plugins: { composurecdk }` themselves
+ * — must be handing ESLint the same reference each time. `Object.assign` below
+ * attaches `configs` to this object rather than producing a second one.
+ */
+const plugin = {
+    // Names the plugin in `--print-config` output and the flat config inspector.
+    meta: { name: "@composurecdk/eslint-plugin" },
+    rules: index_js_1.rules,
+};
+/**
+ * Self-contained flat config entries — each registers the plugin, so a consumer
+ * needs no `plugins` entry of their own, and they compose:
+ *
+ * ```js
+ * import composurecdk from "@composurecdk/eslint-plugin";
+ * export default [
+ *   {
+ *     files: ["src/**\/*.ts"],
+ *     extends: [composurecdk.configs.recommended, composurecdk.configs.dualPublishing],
+ *   },
+ * ];
+ * ```
+ *
+ * None declares `files`: the rules target library source, but only the consumer
+ * knows where theirs lives. See `./configs/presets.ts` for which rules each
+ * holds and why.
+ */
+exports.configs = {
+    recommended: {
+        name: "composurecdk/recommended",
+        plugins: { composurecdk: plugin },
+        rules: presets_js_1.recommendedRules,
+    },
+    libraryAuthor: {
+        name: "composurecdk/library-author",
+        plugins: { composurecdk: plugin },
+        rules: presets_js_1.libraryAuthorRules,
+    },
+    dualPublishing: {
+        name: "composurecdk/dual-publishing",
+        plugins: { composurecdk: plugin },
+        rules: presets_js_1.dualPublishingRules,
+    },
+    internal: {
+        name: "composurecdk/internal",
+        plugins: { composurecdk: plugin },
+        rules: presets_js_1.internalRules,
+    },
+};
+exports.default = Object.assign(plugin, { configs: exports.configs });
+//# sourceMappingURL=index.js.map

package/dist/commonjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AACA,qDAK8B;AAC9B,+CAAyC;AA2DhC,sFA3DA,gBAAK,OA2DA;AAzDd;;;;;;;;;GASG;AACH,MAAM,MAAM,GAAkB;IAC5B,6EAA6E;IAC7E,IAAI,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE;IAC7C,KAAK,EAAL,gBAAK;CACN,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,OAAO,GAAG;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,6BAAgB;KACxB;IACD,aAAa,EAAE;QACb,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,+BAAkB;KAC1B;IACD,cAAc,EAAE;QACd,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,gCAAmB;KAC3B;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,0BAAa;KACrB;CACsC,CAAC;AAI1C,kBAAe,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAP,eAAO,EAAE,CAAC,CAAC"}

package/dist/commonjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/commonjs/rules/builder-must-be-tagged.d.ts

@@ -0,0 +1,15 @@
+import type { Rule } from "eslint";
+/**
+ * Flags `Builder()` or `IBuilder<…>` from `@composurecdk/core` in a builder that
+ * wraps a taggable resource.
+ *
+ * Tagging is cross-cutting: every deployable resource needs it, and a consumer
+ * expects the same tagging surface on every builder rather than on whichever
+ * ones remembered to add it. `taggedBuilder` / `ITaggedBuilder` from
+ * `@composurecdk/cloudformation` supply that surface; the core builder does not,
+ * because core stays independent of CloudFormation.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/builder-must-be-tagged.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=builder-must-be-tagged.d.ts.map

package/dist/commonjs/rules/builder-must-be-tagged.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-must-be-tagged.d.ts","sourceRoot":"","sources":["../../../src/rules/builder-must-be-tagged.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAanC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAkDvB,CAAC"}

package/dist/commonjs/rules/builder-must-be-tagged.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const taggedSuffix = "If the wrapped CFN resource has no Tags property (Route53 records, IAM ManagedPolicy, " +
+    "SNS Subscription, AWS Budgets), disable this rule on the offending line with a directive " +
+    "naming the resource: `// eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::… has no Tags property`.";
+/**
+ * Flags `Builder()` or `IBuilder<…>` from `@composurecdk/core` in a builder that
+ * wraps a taggable resource.
+ *
+ * Tagging is cross-cutting: every deployable resource needs it, and a consumer
+ * expects the same tagging surface on every builder rather than on whichever
+ * ones remembered to add it. `taggedBuilder` / `ITaggedBuilder` from
+ * `@composurecdk/cloudformation` supply that surface; the core builder does not,
+ * because core stays independent of CloudFormation.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/builder-must-be-tagged.md | the rule documentation}.
+ */
+exports.rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Library builders must use `taggedBuilder` / `ITaggedBuilder` from `@composurecdk/cloudformation` " +
+                "unless the wrapped CFN resource has no Tags property.",
+        },
+        schema: [],
+        messages: {
+            restrictedCall: "Use `taggedBuilder` from `@composurecdk/cloudformation` instead of `Builder` from `@composurecdk/core`. " +
+                taggedSuffix,
+            restrictedType: "Use `ITaggedBuilder` from `@composurecdk/cloudformation` instead of `IBuilder` from `@composurecdk/core`. " +
+                taggedSuffix,
+        },
+    },
+    create(ctx) {
+        const localBuilderNames = new Set();
+        const localIBuilderNames = new Set();
+        const listener = {
+            ImportDeclaration(node) {
+                if (node.source.value !== "@composurecdk/core")
+                    return;
+                for (const spec of node.specifiers) {
+                    if (spec.type !== "ImportSpecifier")
+                        continue;
+                    if (spec.imported.type !== "Identifier")
+                        continue;
+                    if (spec.imported.name === "Builder")
+                        localBuilderNames.add(spec.local.name);
+                    if (spec.imported.name === "IBuilder")
+                        localIBuilderNames.add(spec.local.name);
+                }
+            },
+            CallExpression(node) {
+                if (node.callee.type === "Identifier" && localBuilderNames.has(node.callee.name)) {
+                    ctx.report({ node: node.callee, messageId: "restrictedCall" });
+                }
+            },
+        };
+        listener.TSTypeReference = (node) => {
+            const ref = node;
+            const name = ref.typeName.name;
+            if (ref.typeName.type === "Identifier" &&
+                name !== undefined &&
+                localIBuilderNames.has(name)) {
+                ctx.report({ node: ref.typeName, messageId: "restrictedType" });
+            }
+        };
+        return listener;
+    },
+};
+//# sourceMappingURL=builder-must-be-tagged.js.map

package/dist/commonjs/rules/builder-must-be-tagged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-must-be-tagged.js","sourceRoot":"","sources":["../../../src/rules/builder-must-be-tagged.ts"],"names":[],"mappings":";;;AAGA,MAAM,YAAY,GAChB,wFAAwF;IACxF,2FAA2F;IAC3F,wHAAwH,CAAC;AAO3H;;;;;;;;;;;GAWG;AACU,QAAA,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,mGAAmG;gBACnG,uDAAuD;SAC1D;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,cAAc,EACZ,0GAA0G;gBAC1G,YAAY;YACd,cAAc,EACZ,4GAA4G;gBAC5G,YAAY;SACf;KACF;IACD,MAAM,CAAC,GAAG;QACR,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,QAAQ,GAAsB;YAClC,iBAAiB,CAAC,IAAI;gBACpB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,oBAAoB;oBAAE,OAAO;gBACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACnC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;wBAAE,SAAS;oBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBAAE,SAAS;oBAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;wBAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;YACD,cAAc,CAAC,IAAI;gBACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC,eAAe,GAAG,CAAC,IAAU,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,IAAsC,CAAC;YACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC/B,IACE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAClC,IAAI,KAAK,SAAS;gBAClB,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAC5B,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/commonjs/rules/builder-must-implement-copy-state.d.ts

@@ -0,0 +1,13 @@
+import type { Rule } from "eslint";
+/**
+ * Flags a builder class holding private state with no `[COPY_STATE]` hook.
+ *
+ * `.copy()` shallow-clones the builder's props. State held in private fields sits
+ * outside that copy, so without the hook it is silently dropped: the clone looks
+ * correct and behaves differently. Implement `[COPY_STATE]` to carry such state
+ * onto the clone.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/builder-must-implement-copy-state.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=builder-must-implement-copy-state.d.ts.map

package/dist/commonjs/rules/builder-must-implement-copy-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-must-implement-copy-state.d.ts","sourceRoot":"","sources":["../../../src/rules/builder-must-implement-copy-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,QAAQ,CAAC;AAkB/C;;;;;;;;;GASG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAkGvB,CAAC"}