@composurecdk/eslint-plugin 0.10.0

package/dist/esm/rules/lib/imports.d.ts

@@ -0,0 +1,24 @@
+import type { Scope } from "eslint";
+import type { Identifier, MemberExpression } from "estree";
+/** Strip any TS-only wrappers from an expression, returning the node inside. */
+export declare function unwrapWrappers<T>(expr: T): T;
+/**
+ * The leftmost identifier a member chain reads from — `CfnAlarm` in
+ * `cdk.aws_cloudwatch.CfnAlarm`, unwrapping TS wrappers as it goes.
+ *
+ * Returns `undefined` when a call or other expression breaks the chain:
+ * `f().CfnAlarm` reads a runtime value rather than the imported binding, so no
+ * rule that reasons about imports should fire on it.
+ */
+export declare function chainRoot(expr: MemberExpression["object"]): Identifier | undefined;
+/**
+ * The module specifier `name` was imported from, or `undefined` when it
+ * resolves to anything else — a global, a local declaration, a parameter.
+ *
+ * Walks outward through the scope chain so a local that shadows an import name
+ * wins, matching what the runtime would do.
+ */
+export declare function importSourceOf(scope: Scope.Scope, name: string): string | undefined;
+/** True for `aws-cdk-lib` and any submodule of it. */
+export declare function isCdkSource(source: string): boolean;
+//# sourceMappingURL=imports.d.ts.map

package/dist/esm/rules/lib/imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../../../src/rules/lib/imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AA4B3D,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAM5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,UAAU,GAAG,SAAS,CAMlF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBnF;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/esm/rules/lib/imports.js

@@ -0,0 +1,70 @@
+/**
+ * TS-only wrappers a developer might use to silence types. Peeled by
+ * {@link unwrapWrappers} and {@link chainRoot} so they cannot smuggle an
+ * expression past a rule.
+ */
+const TS_WRAPPERS = new Set([
+    "ChainExpression",
+    "TSAsExpression",
+    "TSNonNullExpression",
+    "TSSatisfiesExpression",
+    "TSTypeAssertion",
+]);
+/** Strip any TS-only wrappers from an expression, returning the node inside. */
+export function unwrapWrappers(expr) {
+    let current = expr;
+    while (TS_WRAPPERS.has(current.type)) {
+        current = current.expression;
+    }
+    return current;
+}
+/**
+ * The leftmost identifier a member chain reads from — `CfnAlarm` in
+ * `cdk.aws_cloudwatch.CfnAlarm`, unwrapping TS wrappers as it goes.
+ *
+ * Returns `undefined` when a call or other expression breaks the chain:
+ * `f().CfnAlarm` reads a runtime value rather than the imported binding, so no
+ * rule that reasons about imports should fire on it.
+ */
+export function chainRoot(expr) {
+    let current = unwrapWrappers(expr);
+    while (current.type === "MemberExpression") {
+        current = unwrapWrappers(current.object);
+    }
+    return current.type === "Identifier" ? current : undefined;
+}
+/**
+ * The module specifier `name` was imported from, or `undefined` when it
+ * resolves to anything else — a global, a local declaration, a parameter.
+ *
+ * Walks outward through the scope chain so a local that shadows an import name
+ * wins, matching what the runtime would do.
+ */
+export function importSourceOf(scope, name) {
+    for (let current = scope; current !== null; current = current.upper) {
+        const variable = current.set.get(name);
+        if (variable === undefined)
+            continue;
+        // `.at(0)` (not `[0]`) — defs can be empty at runtime for predefined
+        // globals (e.g. `console`), even though `Variable.defs: Definition[]` says
+        // otherwise; `.at` gives us the honest `Definition | undefined`.
+        const def = variable.defs.at(0);
+        if (def?.type !== "ImportBinding")
+            return undefined;
+        // `def.parent` is typed as `ImportDeclaration` but at runtime
+        // typescript-eslint also reports `ImportBinding` for `import x =
+        // require(...)`, whose parent is a `TSImportEqualsDeclaration` with no
+        // `.source`. Widen and check the discriminator before reading `source`.
+        const parent = def.parent;
+        if (parent.type !== "ImportDeclaration")
+            return undefined;
+        const source = parent.source?.value;
+        return typeof source === "string" ? source : undefined;
+    }
+    return undefined;
+}
+/** True for `aws-cdk-lib` and any submodule of it. */
+export function isCdkSource(source) {
+    return source === "aws-cdk-lib" || source.startsWith("aws-cdk-lib/");
+}
+//# sourceMappingURL=imports.js.map

package/dist/esm/rules/lib/imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../../../src/rules/lib/imports.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;CAClB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAI,IAAO;IACvC,IAAI,OAAO,GAAG,IAA2B,CAAC;IAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,OAAO,CAAC,UAAsB,CAAC;IAC3C,CAAC;IACD,OAAO,OAAuB,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAgC;IACxD,IAAI,OAAO,GAAG,cAAc,CAAC,IAAI,CAAwB,CAAC;IAC1D,OAAO,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3C,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAa,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,OAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,IAAY;IAC7D,KAAK,IAAI,OAAO,GAAuB,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,qEAAqE;QACrE,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe;YAAE,OAAO,SAAS,CAAC;QACpD,8DAA8D;QAC9D,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAwD,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QACpC,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,KAAK,aAAa,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACvE,CAAC"}

package/dist/esm/rules/lifecycle-build-context-required.d.ts

@@ -0,0 +1,14 @@
+import type { Rule } from "eslint";
+/**
+ * Flags a `Lifecycle` class whose `build` takes no `context` parameter although
+ * the class body uses `Resolvable<…>`.
+ *
+ * A builder holding a `Resolvable<…>` accepts refs when it is configured, but
+ * resolving one needs the build context. With no `context` parameter the
+ * resolution receives `undefined` and the ref throws at synth, so the builder
+ * offers an API it cannot honour.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/lifecycle-build-context-required.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=lifecycle-build-context-required.d.ts.map

package/dist/esm/rules/lifecycle-build-context-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-build-context-required.d.ts","sourceRoot":"","sources":["../../../src/rules/lifecycle-build-context-required.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGnC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAiCvB,CAAC"}

package/dist/esm/rules/lifecycle-build-context-required.js

@@ -0,0 +1,43 @@
+/**
+ * Flags a `Lifecycle` class whose `build` takes no `context` parameter although
+ * the class body uses `Resolvable<…>`.
+ *
+ * A builder holding a `Resolvable<…>` accepts refs when it is configured, but
+ * resolving one needs the build context. With no `context` parameter the
+ * resolution receives `undefined` and the ref throws at synth, so the builder
+ * offers an API it cannot honour.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/lifecycle-build-context-required.md | the rule documentation}.
+ */
+export const rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Lifecycle.build() must accept context when the builder uses Resolvable<…>",
+        },
+        schema: [],
+        messages: {
+            missingContext: "`build()` is missing the `context` parameter, but this class uses `Resolvable<…>`. " +
+                "Refs need context to resolve — add `context?: Record<string, object>` (or a typed dependency record) and pass it to `resolve(value, context)`.",
+        },
+    },
+    create(ctx) {
+        const sourceCode = ctx.sourceCode;
+        return {
+            ClassBody(node) {
+                const build = node.body.find((member) => member.type === "MethodDefinition" &&
+                    member.key.type === "Identifier" &&
+                    member.key.name === "build");
+                if (!build)
+                    return;
+                // Lifecycle.build(scope, id, context?) — 3rd param is context.
+                if (build.value.params.length >= 3)
+                    return;
+                if (/\bResolvable\s*</.test(sourceCode.getText(node))) {
+                    ctx.report({ node: build, messageId: "missingContext" });
+                }
+            },
+        };
+    },
+};
+//# sourceMappingURL=lifecycle-build-context-required.js.map

package/dist/esm/rules/lifecycle-build-context-required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-build-context-required.js","sourceRoot":"","sources":["../../../src/rules/lifecycle-build-context-required.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,2EAA2E;SACzF;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,cAAc,EACZ,qFAAqF;gBACrF,gJAAgJ;SACnJ;KACF;IACD,MAAM,CAAC,GAAG;QACR,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,OAAO;YACL,SAAS,CAAC,IAAe;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAC1B,CAAC,MAAM,EAA8B,EAAE,CACrC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAClC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;oBAChC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAC9B,CAAC;gBACF,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,+DAA+D;gBAC/D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;oBAAE,OAAO;gBAE3C,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/esm/rules/lifecycle-build-must-forward-context.d.ts

@@ -0,0 +1,18 @@
+import type { Rule } from "eslint";
+/**
+ * Flags a two-argument `builder.build(scope, id)` call, which gives the
+ * sub-builder no context to resolve refs against.
+ *
+ * A builder that delegates must pass its context on. When it does not, the
+ * sub-builder resolves against an empty context, and any ref the caller supplied
+ * through a `configure` callback fails at synth with "component not found in
+ * context".
+ *
+ * This is the call-site counterpart to `lifecycle-build-context-required`, which
+ * checks the declaration. Accepting the parameter is not enough — the common
+ * failure is a builder that takes `context` and then drops it on the way down.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/lifecycle-build-must-forward-context.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=lifecycle-build-must-forward-context.d.ts.map

package/dist/esm/rules/lifecycle-build-must-forward-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-build-must-forward-context.d.ts","sourceRoot":"","sources":["../../../src/rules/lifecycle-build-must-forward-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGnC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAgCvB,CAAC"}

package/dist/esm/rules/lifecycle-build-must-forward-context.js

@@ -0,0 +1,51 @@
+/**
+ * Flags a two-argument `builder.build(scope, id)` call, which gives the
+ * sub-builder no context to resolve refs against.
+ *
+ * A builder that delegates must pass its context on. When it does not, the
+ * sub-builder resolves against an empty context, and any ref the caller supplied
+ * through a `configure` callback fails at synth with "component not found in
+ * context".
+ *
+ * This is the call-site counterpart to `lifecycle-build-context-required`, which
+ * checks the declaration. Accepting the parameter is not enough — the common
+ * failure is a builder that takes `context` and then drops it on the way down.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/lifecycle-build-must-forward-context.md | the rule documentation}.
+ */
+export const rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "A Lifecycle build() call must forward the build context to sub-builders",
+        },
+        schema: [],
+        messages: {
+            missingContext: "`build(scope, id)` drops the build context. A sub-builder resolves refs against `{}` " +
+                "without it, so a `ref()` passed through a `configure` callback throws " +
+                '"component not found in context". Pass the context as the third argument — ' +
+                "threading it through any helper function in between. If this is a deliberate root " +
+                "build with no context to forward, disable this rule on the line and say why.",
+        },
+    },
+    create(ctx) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== "MemberExpression")
+                    return;
+                if (callee.computed)
+                    return;
+                if (callee.property.type !== "Identifier" || callee.property.name !== "build")
+                    return;
+                // Exactly (scope, id) — see the "Why exactly two arguments" note above.
+                if (node.arguments.length !== 2)
+                    return;
+                if (node.arguments.some((arg) => arg.type === "SpreadElement"))
+                    return;
+                ctx.report({ node: node, messageId: "missingContext" });
+            },
+        };
+    },
+};
+//# sourceMappingURL=lifecycle-build-must-forward-context.js.map

package/dist/esm/rules/lifecycle-build-must-forward-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-build-must-forward-context.js","sourceRoot":"","sources":["../../../src/rules/lifecycle-build-must-forward-context.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,yEAAyE;SACvF;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,cAAc,EACZ,uFAAuF;gBACvF,wEAAwE;gBACxE,6EAA6E;gBAC7E,oFAAoF;gBACpF,8EAA8E;SACjF;KACF;IACD,MAAM,CAAC,GAAG;QACR,OAAO;YACL,cAAc,CAAC,IAAoB;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAAE,OAAO;gBAC/C,IAAI,MAAM,CAAC,QAAQ;oBAAE,OAAO;gBAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO;gBAEtF,wEAAwE;gBACxE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBACxC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC;oBAAE,OAAO;gBAEvE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/esm/rules/no-cdk-api-above-floor.d.ts

@@ -0,0 +1,15 @@
+import type { Rule } from "eslint";
+/**
+ * Flags an `aws-cdk-lib` API newer than the oldest CDK version this package
+ * supports.
+ *
+ * Such a call type-checks and passes tests, because both run against whichever
+ * CDK is installed here — the newest. It then throws at runtime for anyone whose
+ * own `aws-cdk-lib` is older, while still inside the range the package declares
+ * it supports. The fix is a form of the same check that works across the whole
+ * range; the rule's message names one per banned API.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-cdk-api-above-floor.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=no-cdk-api-above-floor.d.ts.map

package/dist/esm/rules/no-cdk-api-above-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cdk-api-above-floor.d.ts","sourceRoot":"","sources":["../../../src/rules/no-cdk-api-above-floor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAqDnC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAiCvB,CAAC"}

package/dist/esm/rules/no-cdk-api-above-floor.js

@@ -0,0 +1,77 @@
+import { chainRoot, importSourceOf, isCdkSource } from "./lib/imports.js";
+/**
+ * Foundational `isCfn*` guards that predate the floor (core, since v2.0) and
+ * are therefore allowed — `isCfnResource` is in fact the portable replacement
+ * for the banned per-resource guards.
+ */
+const ALLOWED_CFN_GUARDS = new Set(["isCfnResource", "isCfnElement"]);
+/**
+ * The ban list. Add an entry whenever an `aws-cdk-lib` API we reach for turns
+ * out to postdate the supported floor — this list is expected to grow as the
+ * floor is pinned and lowered ahead of 1.0.0.
+ *
+ * Seeded with the per-resource `isCfn<Resource>` static type guards, which
+ * aws-cdk-lib first shipped on every generated L1 in 2.231.0 (verified by
+ * installing real versions: 2.230.0 lacks them, 2.231.0 has them). Calling
+ * them (e.g. `CfnAlarm.isCfnAlarm(node)`) throws `TypeError` on the older
+ * versions in our `^2` peer range — see issue #146.
+ */
+const FORBIDDEN = [
+    {
+        matches: (name) => /^isCfn[A-Z]/.test(name) && !ALLOWED_CFN_GUARDS.has(name),
+        label: "the per-resource `Cfn<Resource>.isCfn<Resource>` L1 static type guards",
+        since: "2.231.0",
+        use: "`CfnResource.isCfnResource(x) && x.cfnResourceType === Cfn<Resource>.CFN_RESOURCE_TYPE_NAME` " +
+            "(what the static does internally, but valid across the whole peer range), e.g. the " +
+            "`isCfnAlarm` helper in @composurecdk/cloudwatch",
+    },
+];
+/**
+ * Flags an `aws-cdk-lib` API newer than the oldest CDK version this package
+ * supports.
+ *
+ * Such a call type-checks and passes tests, because both run against whichever
+ * CDK is installed here — the newest. It then throws at runtime for anyone whose
+ * own `aws-cdk-lib` is older, while still inside the range the package declares
+ * it supports. The fix is a form of the same check that works across the whole
+ * range; the rule's message names one per banned API.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-cdk-api-above-floor.md | the rule documentation}.
+ */
+export const rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Ban aws-cdk-lib APIs newer than the supported peer-dependency floor",
+        },
+        schema: [],
+        messages: {
+            aboveFloor: "{{label}} were added in aws-cdk-lib {{since}}, above the supported floor — they throw on " +
+                "older versions in the peer range. Use {{use}}.",
+        },
+    },
+    create(ctx) {
+        return {
+            MemberExpression(node) {
+                if (node.property.type !== "Identifier")
+                    return;
+                const property = node.property;
+                const root = chainRoot(node.object);
+                if (root === undefined)
+                    return;
+                const source = importSourceOf(ctx.sourceCode.getScope(node), root.name);
+                if (source === undefined || !isCdkSource(source))
+                    return;
+                const forbidden = FORBIDDEN.find((entry) => entry.matches(property.name));
+                if (forbidden === undefined)
+                    return;
+                ctx.report({
+                    node: property,
+                    messageId: "aboveFloor",
+                    data: { label: forbidden.label, since: forbidden.since, use: forbidden.use },
+                });
+            },
+        };
+    },
+};
+//# sourceMappingURL=no-cdk-api-above-floor.js.map

package/dist/esm/rules/no-cdk-api-above-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cdk-api-above-floor.js","sourceRoot":"","sources":["../../../src/rules/no-cdk-api-above-floor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAqB1E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAsB;IACnC;QACE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5E,KAAK,EAAE,wEAAwE;QAC/E,KAAK,EAAE,SAAS;QAChB,GAAG,EACD,+FAA+F;YAC/F,qFAAqF;YACrF,iDAAiD;KACpD;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,qEAAqE;SACnF;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,UAAU,EACR,2FAA2F;gBAC3F,gDAAgD;SACnD;KACF;IACD,MAAM,CAAC,GAAG;QACR,OAAO;YACL,gBAAgB,CAAC,IAAsB;gBACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO;gBAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO;gBAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAEzD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1E,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO;gBACpC,GAAG,CAAC,MAAM,CAAC;oBACT,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,YAAY;oBACvB,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/esm/rules/no-cjs-incompatible-syntax.d.ts

@@ -0,0 +1,14 @@
+import type { Rule } from "eslint";
+/**
+ * Flags syntax with no CommonJS equivalent: `import.meta`, top-level `await` and
+ * top-level `for await…of`.
+ *
+ * These packages are published as both ECMAScript and CommonJS modules from one
+ * source. All three constructs are valid ESM that the CommonJS compile cannot
+ * emit, so each one breaks half the build. Reporting them as you type beats
+ * discovering it when the second dialect compiles.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-cjs-incompatible-syntax.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=no-cjs-incompatible-syntax.d.ts.map

package/dist/esm/rules/no-cjs-incompatible-syntax.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cjs-incompatible-syntax.d.ts","sourceRoot":"","sources":["../../../src/rules/no-cjs-incompatible-syntax.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AASnC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAuCvB,CAAC"}

package/dist/esm/rules/no-cjs-incompatible-syntax.js

@@ -0,0 +1,52 @@
+const FUNCTION_TYPES = new Set([
+    "FunctionDeclaration",
+    "FunctionExpression",
+    "ArrowFunctionExpression",
+]);
+/**
+ * Flags syntax with no CommonJS equivalent: `import.meta`, top-level `await` and
+ * top-level `for await…of`.
+ *
+ * These packages are published as both ECMAScript and CommonJS modules from one
+ * source. All three constructs are valid ESM that the CommonJS compile cannot
+ * emit, so each one breaks half the build. Reporting them as you type beats
+ * discovering it when the second dialect compiles.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-cjs-incompatible-syntax.md | the rule documentation}.
+ */
+export const rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Ban ESM-only syntax (import.meta, top-level await) that cannot emit to CommonJS",
+        },
+        schema: [],
+        messages: {
+            importMeta: "`import.meta` has no CommonJS equivalent, so it breaks the CommonJS half of a " +
+                "dual-published build. Take the value from a parameter or a caller instead.",
+            topLevelAwait: "Top-level `await` has no CommonJS equivalent, so it breaks the CommonJS half of a " +
+                "dual-published build. Move the `await` inside an async function.",
+        },
+    },
+    create(ctx) {
+        const isTopLevel = (node) => !ctx.sourceCode.getAncestors(node).some((ancestor) => FUNCTION_TYPES.has(ancestor.type));
+        return {
+            MetaProperty(node) {
+                if (node.meta.name === "import" && node.property.name === "meta") {
+                    ctx.report({ node, messageId: "importMeta" });
+                }
+            },
+            AwaitExpression(node) {
+                if (isTopLevel(node)) {
+                    ctx.report({ node, messageId: "topLevelAwait" });
+                }
+            },
+            "ForOfStatement[await=true]"(node) {
+                if (isTopLevel(node)) {
+                    ctx.report({ node, messageId: "topLevelAwait" });
+                }
+            },
+        };
+    },
+};
+//# sourceMappingURL=no-cjs-incompatible-syntax.js.map

package/dist/esm/rules/no-cjs-incompatible-syntax.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cjs-incompatible-syntax.js","sourceRoot":"","sources":["../../../src/rules/no-cjs-incompatible-syntax.ts"],"names":[],"mappings":"AAGA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,qBAAqB;IACrB,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,iFAAiF;SACpF;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,UAAU,EACR,gFAAgF;gBAChF,4EAA4E;YAC9E,aAAa,EACX,oFAAoF;gBACpF,kEAAkE;SACrE;KACF;IACD,MAAM,CAAC,GAAG;QACR,MAAM,UAAU,GAAG,CAAC,IAAU,EAAW,EAAE,CACzC,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE3F,OAAO;YACL,YAAY,CAAC,IAAkB;gBAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACjE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,eAAe,CAAC,IAAqB;gBACnC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,4BAA4B,CAAC,IAAoB;gBAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/esm/rules/no-realm-bound-instanceof.d.ts

@@ -0,0 +1,25 @@
+import type { Rule } from "eslint";
+/**
+ * Bans `instanceof` against a class reached through an `import`.
+ *
+ * These packages ship as both ECMAScript and CommonJS modules, and both copies
+ * can load in the same process — a consumer importing one while a dependency
+ * requires the other. Each copy evaluates its own class objects, so an instance
+ * created by one fails `instanceof` against the other's class: the check returns
+ * `false` for a value that is plainly of that type.
+ *
+ * It fails silently, which is what makes it dangerous — a deduplication quietly
+ * skipped, a guard quietly bypassed, and no error to trace. Use a `Symbol.for(…)`
+ * brand instead, which is shared across copies.
+ *
+ * A relative import is no safer by default: it resolves separately in each copy.
+ * A package nothing can install twice may say so with
+ * `assumeNeverInstalledAsADependency`, which treats its own modules as
+ * same-realm while still flagging dependencies. An application is the archetype;
+ * being private is not enough, since a private package can still be a
+ * dependency.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-realm-bound-instanceof.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=no-realm-bound-instanceof.d.ts.map

package/dist/esm/rules/no-realm-bound-instanceof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-realm-bound-instanceof.d.ts","sourceRoot":"","sources":["../../../src/rules/no-realm-bound-instanceof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAInC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UA8EvB,CAAC"}

package/dist/esm/rules/no-realm-bound-instanceof.js

@@ -0,0 +1,95 @@
+import { chainRoot, importSourceOf, isCdkSource, unwrapWrappers } from "./lib/imports.js";
+/**
+ * Bans `instanceof` against a class reached through an `import`.
+ *
+ * These packages ship as both ECMAScript and CommonJS modules, and both copies
+ * can load in the same process — a consumer importing one while a dependency
+ * requires the other. Each copy evaluates its own class objects, so an instance
+ * created by one fails `instanceof` against the other's class: the check returns
+ * `false` for a value that is plainly of that type.
+ *
+ * It fails silently, which is what makes it dangerous — a deduplication quietly
+ * skipped, a guard quietly bypassed, and no error to trace. Use a `Symbol.for(…)`
+ * brand instead, which is shared across copies.
+ *
+ * A relative import is no safer by default: it resolves separately in each copy.
+ * A package nothing can install twice may say so with
+ * `assumeNeverInstalledAsADependency`, which treats its own modules as
+ * same-realm while still flagging dependencies. An application is the archetype;
+ * being private is not enough, since a private package can still be a
+ * dependency.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-realm-bound-instanceof.md | the rule documentation}.
+ */
+export const rule = {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Ban realm-bound `instanceof` against imported classes",
+        },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    assumeNeverInstalledAsADependency: {
+                        type: "boolean",
+                        description: "Exempt this package's own relative imports, on the basis that nothing can " +
+                            "install it twice. An application's claim to make; a library must not, since a " +
+                            "consumer can install two versions of it side by side.",
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            cdkClass: "`instanceof {{name}}` is realm-bound: it returns false for a value created by another " +
+                "copy of `aws-cdk-lib`. Identify the construct by its L1 instead — " +
+                "`CfnResource.isCfnResource(x) && x.cfnResourceType === Cfn{{name}}.CFN_RESOURCE_TYPE_NAME`.",
+            ownClass: "`instanceof {{name}}` is realm-bound: `{{source}}` resolves separately in each copy of " +
+                "this package, so the check returns false for a value that is plainly of that type. " +
+                "Brand the class with `Symbol.for(...)` and test for that brand instead.",
+            dependencyClass: "`instanceof {{name}}` is realm-bound: `{{source}}` can load twice in one process, so the " +
+                "check returns false for a value that is plainly of that type. Prefer a type guard the " +
+                "package provides, or test a distinguishing property rather than identity. If the class " +
+                "is one you own, brand it with `Symbol.for(...)`.",
+        },
+    },
+    create(ctx) {
+        const { assumeNeverInstalledAsADependency = false } = (ctx.options[0] ?? {});
+        return {
+            BinaryExpression(node) {
+                if (node.operator !== "instanceof")
+                    return;
+                const root = chainRoot(node.right);
+                if (root === undefined)
+                    return;
+                const source = importSourceOf(ctx.sourceCode.getScope(node), root.name);
+                if (source === undefined)
+                    return;
+                // A relative specifier resolves inside this package, so it duplicates
+                // only if the package itself does. Deliberately not `#` subpaths: the
+                // `imports` field can map one to an external package.
+                if (assumeNeverInstalledAsADependency && source.startsWith("."))
+                    return;
+                // Name the class, not the namespace it was reached through:
+                // `cdk.aws_s3.Bucket` is "Bucket", and the cdk message interpolates
+                // that into `Cfn<name>.CFN_RESOURCE_TYPE_NAME`.
+                const target = unwrapWrappers(node.right);
+                const name = target.type === "MemberExpression" && target.property.type === "Identifier"
+                    ? target.property.name
+                    : root.name;
+                // Report on the class reference, not the whole expression: the fix
+                // replaces the right-hand side, and a narrow squiggle points at it.
+                // The specifier says whether the reader can brand the class: a relative
+                // import is their own module, anything else is someone else's package.
+                const messageId = isCdkSource(source)
+                    ? "cdkClass"
+                    : source.startsWith(".")
+                        ? "ownClass"
+                        : "dependencyClass";
+                ctx.report({ node: node.right, messageId, data: { name, source } });
+            },
+        };
+    },
+};
+//# sourceMappingURL=no-realm-bound-instanceof.js.map

package/dist/esm/rules/no-realm-bound-instanceof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-realm-bound-instanceof.js","sourceRoot":"","sources":["../../../src/rules/no-realm-bound-instanceof.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAoB;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,uDAAuD;SACrE;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,iCAAiC,EAAE;wBACjC,IAAI,EAAE,SAAS;wBACf,WAAW,EACT,4EAA4E;4BAC5E,gFAAgF;4BAChF,uDAAuD;qBAC1D;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;QACD,QAAQ,EAAE;YACR,QAAQ,EACN,wFAAwF;gBACxF,oEAAoE;gBACpE,6FAA6F;YAC/F,QAAQ,EACN,yFAAyF;gBACzF,qFAAqF;gBACrF,yEAAyE;YAC3E,eAAe,EACb,2FAA2F;gBAC3F,wFAAwF;gBACxF,yFAAyF;gBACzF,kDAAkD;SACrD;KACF;IACD,MAAM,CAAC,GAAG;QACR,MAAM,EAAE,iCAAiC,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAE1E,CAAC;QAEF,OAAO;YACL,gBAAgB,CAAC,IAAsB;gBACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY;oBAAE,OAAO;gBAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO;gBAE/B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxE,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO;gBACjC,sEAAsE;gBACtE,sEAAsE;gBACtE,sDAAsD;gBACtD,IAAI,iCAAiC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO;gBAExE,4DAA4D;gBAC5D,oEAAoE;gBACpE,gDAAgD;gBAChD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1C,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACzE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;oBACtB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAEhB,mEAAmE;gBACnE,oEAAoE;gBACpE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;oBACnC,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACtB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,iBAAiB,CAAC;gBAExB,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/esm/rules/no-typescript-private-modifier.d.ts

@@ -0,0 +1,17 @@
+import type { Rule } from "eslint";
+/**
+ * Bans the TypeScript `private` modifier in favour of ECMAScript private fields.
+ *
+ * The two are not interchangeable once a class is generic over its own members.
+ * A TypeScript `private` member is still part of the type, so it appears in
+ * `keyof T`, survives into a mapped type, and reaches the emitted `.d.ts` — where
+ * a consumer's compiler cannot name it and reports TS4094. A `#field` is not
+ * part of the type at all, so it never gets that far.
+ *
+ * A private constructor stays allowed: `#constructor` is not valid syntax, so
+ * there is nothing to prefer over it.
+ *
+ * See {@link https://github.com/laazyj/composureCDK/blob/main/packages/eslint-plugin/docs/rules/no-typescript-private-modifier.md | the rule documentation}.
+ */
+export declare const rule: Rule.RuleModule;
+//# sourceMappingURL=no-typescript-private-modifier.d.ts.map

package/dist/esm/rules/no-typescript-private-modifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-typescript-private-modifier.d.ts","sourceRoot":"","sources":["../../../src/rules/no-typescript-private-modifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAkCnC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,UAwDvB,CAAC"}