@eslint-sh/eslint-plugin 0.1.1 → 0.3.0

package/README.md

@@ -42,6 +42,10 @@ ShellLanguage }, rules: {} }`. `meta.version` always matches this package's `pac
   prefix directive/inline-config comments must start with — e.g. the default `"eslint"` recognizes
   `# eslint-disable-next-line ...`; consumers who already overload `# eslint-*` comments for
   something else can configure a different prefix (e.g. `directivePrefix: 'shellcheck-sh'`).
+- `resolveWord` — re-export of `sh-ast`'s word-resolution helper, so a project that installs only
+  this package can write custom rules that resolve static shell words (e.g. the `no-rm-rf` example
+  in the [custom-rule tutorial](./docs/custom-rule-tutorial.md)) without a separate `sh-ast`
+  install.
 
 Parse failures surface as fatal lint messages at mvdan/sh's real reported position (never a 1:1
 placeholder) — see `ShParseError` in `sh-ast`.

package/dist/eslint-plugin.d.ts

@@ -4,6 +4,7 @@ import type { FileProblem } from '@eslint/core';
 import type { Language } from '@eslint/core';
 import type { OkParseResult } from '@eslint/core';
 import type { ParseResult } from '@eslint/core';
+import { resolveWord as resolveWord_2 } from 'sh-ast/analyze';
 import type { RulesConfig } from '@eslint/core';
 import type { ShellDialect } from 'sh-ast';
 import type { ShFile } from 'sh-ast';
@@ -62,6 +63,20 @@ export declare interface NormalizedShellLanguageOptions extends Record<string, u
     toJSON(): ShellLanguageOptionsJSON;
 }
 
+/**
+ * Re-exported from `sh-ast/analyze` so a project that installs only
+ * `@eslint-sh/eslint-plugin` can write custom rules that resolve static
+ * shell words (e.g. `docs/custom-rule-tutorial.md`'s `no-rm-rf` example)
+ * without a separate `sh-ast` install or relying on npm hoisting to make
+ * `sh-ast` resolvable from the consumer's own `node_modules`. Declared
+ * locally (instead of a bare re-export statement) so API Extractor
+ * attaches this doc comment and its public release tag to the committed
+ * api-report instead of emitting it as an untagged export.
+ *
+ * @public
+ */
+export declare const resolveWord: typeof resolveWord_2;
+
 /**
  * `ShellLanguage` — the `@eslint/core` `Language` implementation for shell
  * scripts (design/ARCHITECTURE.md, "SourceCode and Language objects";

package/dist/index.d.ts

@@ -1,7 +1,21 @@
+import { resolveWord as shAstResolveWord } from 'sh-ast/analyze';
 import { ShellLanguage } from './language/shell-language.js';
 export { ShellLanguage } from './language/shell-language.js';
 export { ShellSourceCode } from './language/shell-source-code.js';
 export type { NormalizedShellLanguageOptions, ShellLanguageOptions, ShellLanguageOptionsJSON, } from './language/shell-language-options.js';
+/**
+ * Re-exported from `sh-ast/analyze` so a project that installs only
+ * `@eslint-sh/eslint-plugin` can write custom rules that resolve static
+ * shell words (e.g. `docs/custom-rule-tutorial.md`'s `no-rm-rf` example)
+ * without a separate `sh-ast` install or relying on npm hoisting to make
+ * `sh-ast` resolvable from the consumer's own `node_modules`. Declared
+ * locally (instead of a bare re-export statement) so API Extractor
+ * attaches this doc comment and its public release tag to the committed
+ * api-report instead of emitting it as an untagged export.
+ *
+ * @public
+ */
+export declare const resolveWord: typeof shAstResolveWord;
 /**
  * The `@eslint-sh/eslint-plugin` plugin object (design/PACKAGES.md,
  * `@eslint-sh/eslint-plugin`): `languages.sh` provides `ShellLanguage` /

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EACV,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;AACH,wBAUmB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EACV,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,yBAAmB,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;AACH,wBAUmB"}

package/dist/index.js

@@ -1,7 +1,21 @@
+import { resolveWord as shAstResolveWord } from 'sh-ast/analyze';
 import { ShellLanguage } from './language/shell-language.js';
 import { readPackageVersion } from './version.js';
 export { ShellLanguage } from './language/shell-language.js';
 export { ShellSourceCode } from './language/shell-source-code.js';
+/**
+ * Re-exported from `sh-ast/analyze` so a project that installs only
+ * `@eslint-sh/eslint-plugin` can write custom rules that resolve static
+ * shell words (e.g. `docs/custom-rule-tutorial.md`'s `no-rm-rf` example)
+ * without a separate `sh-ast` install or relying on npm hoisting to make
+ * `sh-ast` resolvable from the consumer's own `node_modules`. Declared
+ * locally (instead of a bare re-export statement) so API Extractor
+ * attaches this doc comment and its public release tag to the committed
+ * api-report instead of emitting it as an untagged export.
+ *
+ * @public
+ */
+export const resolveWord = shAstResolveWord;
 /**
  * The `@eslint-sh/eslint-plugin` plugin object (design/PACKAGES.md,
  * `@eslint-sh/eslint-plugin`): `languages.sh` provides `ShellLanguage` /

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAOlE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAe;IACb,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,kBAAkB,EAAE;QAC7B,SAAS,EAAE,IAAI;KAChB;IACD,SAAS,EAAE;QACT,EAAE,EAAE,IAAI,aAAa,EAAE;KACxB;IACD,KAAK,EAAE,EAAE;CACO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAOlE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAe;IACb,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,kBAAkB,EAAE;QAC7B,SAAS,EAAE,IAAI;KAChB;IACD,SAAS,EAAE;QACT,EAAE,EAAE,IAAI,aAAa,EAAE;KACxB;IACD,KAAK,EAAE,EAAE;CACO,CAAC"}

package/dist/language/shell-language.js

@@ -1,4 +1,4 @@
-import { ShBridgeError, ShParseError, parseSync, visitorKeys as shellVisitorKeys } from 'sh-ast';
+import { ShAstError, ShParseError, parseSync, visitorKeys as shellVisitorKeys } from 'sh-ast';
 import { matchesSelectorClass as matchesShellSelectorClass } from './selector-classes.js';
 import { ShellSourceCode } from './shell-source-code.js';
 import { normalizeShellLanguageOptions, validateShellLanguageOptions, } from './shell-language-options.js';
@@ -63,7 +63,7 @@ function stripPositionPrefix(message, filename) {
  *
  * Any other error reaching here (`ShInvalidDialectError` — unreachable in
  * practice, since `validateLanguageOptions` rejects a bad dialect before
- * ESLint ever calls `parse()`; or `ShBridgeInternalError` — a shim contract
+ * ESLint ever calls `parse()`; or `ShInternalError` — a shim contract
  * violation) has no real source position to report, so `1:1` is used as an
  * explicit, honest fallback for the "no position available" case — not a
  * stand-in for an actual parse error's position.
@@ -76,7 +76,7 @@ function toFileError(error) {
             column: error.column,
         };
     }
-    const message = error instanceof ShBridgeError || error instanceof Error ? error.message : String(error);
+    const message = error instanceof ShAstError || error instanceof Error ? error.message : String(error);
     return { message, line: 1, column: 1 };
 }
 /**

package/dist/language/shell-language.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-language.js","sourceRoot":"","sources":["../../src/language/shell-language.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAGjG,OAAO,EAAE,oBAAoB,IAAI,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAG7B,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAA6B,MAAM,CAAC,WAAW,CAC1E,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAC1E,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,KAAK,YAAY,aAAa,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,aAAa;IACf,QAAQ,GAAG,MAAe,CAAC;IAC3B,SAAS,GAAG,CAAU,CAAC;IACvB,WAAW,GAAG,CAAU,CAAC;IACzB,WAAW,GAAW,MAAM,CAAC;IAC7B,WAAW,GAA6B,uBAAuB,CAAC;IAChE,sBAAsB,GAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE5E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,eAAqC;QAC3D,4BAA4B,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,eAAqC;QAC5D,OAAO,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,SAAiB,EAAE,IAAY,EAAE,SAAmB;QACvE,OAAO,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAU,EAAE,OAAkD;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,MAAM,OAAO,GAAiB,OAAO,CAAC,eAAe,CAAC,OAAO,IAAI,MAAM,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,IAAU,EACV,WAAkC,EAClC,OAAkD;QAElD,OAAO,IAAI,eAAe,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAAe,IAAI,QAAQ;SACrE,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"shell-language.js","sourceRoot":"","sources":["../../src/language/shell-language.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAG9F,OAAO,EAAE,oBAAoB,IAAI,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAG7B,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAA6B,MAAM,CAAC,WAAW,CAC1E,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAC1E,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,KAAK,YAAY,UAAU,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,aAAa;IACf,QAAQ,GAAG,MAAe,CAAC;IAC3B,SAAS,GAAG,CAAU,CAAC;IACvB,WAAW,GAAG,CAAU,CAAC;IACzB,WAAW,GAAW,MAAM,CAAC;IAC7B,WAAW,GAA6B,uBAAuB,CAAC;IAChE,sBAAsB,GAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE5E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,eAAqC;QAC3D,4BAA4B,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,eAAqC;QAC5D,OAAO,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,SAAiB,EAAE,IAAY,EAAE,SAAmB;QACvE,OAAO,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAU,EAAE,OAAkD;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,MAAM,OAAO,GAAiB,OAAO,CAAC,eAAe,CAAC,OAAO,IAAI,MAAM,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,IAAU,EACV,WAAkC,EAClC,OAAkD;QAElD,OAAO,IAAI,eAAe,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAAe,IAAI,QAAQ;SACrE,CAAC,CAAC;IACL,CAAC;CACF"}

package/docs/custom-rule-tutorial.md

@@ -7,11 +7,16 @@ wiring — `plugins`, `rules`, `language` — needed to run it.
 
 Every code block on this page is the literal, shipped file it names — not a paraphrase — and both
 files are executed verbatim in CI (`test/custom-rule-tutorial.test.ts` imports
-[`examples/no-rm-rf-rule.js`](./examples/no-rm-rf-rule.js) and
+[`examples/no-rm-rf-rule.mjs`](./examples/no-rm-rf-rule.mjs) and
 [`examples/eslint.config.mjs`](./examples/eslint.config.mjs) directly and runs them through a real
 `eslint` `Linter.verify()`): the rule fires on a fixture script and does not fire on a clean one,
 so this tutorial cannot silently drift from working code. Both example files ship with this
-package (`docs/examples/`), so you can copy them into your own project as-is.
+package (`docs/examples/`), so you can copy them into your own project as-is. Both use the `.mjs`
+extension deliberately: they are ES modules (`import`/`export`), and a default `npm init -y`
+project is CommonJS, so a plain `.js` extension would make Node — and ESLint's own config
+loader — try to parse them as CommonJS and fail with `SyntaxError: Cannot use import statement
+outside a module`. `.mjs` marks each file as an ES module regardless of the surrounding project's
+`"type"` field.
 
 ## 1. Pick a selector from the cookbook
 
@@ -22,9 +27,9 @@ flag?) the same way a hand-written rule narrows any other selector-first ESLint
 
 ## 2. Write the rule module
 
-`docs/examples/no-rm-rf-rule.js`:
+`docs/examples/no-rm-rf-rule.mjs`:
 
-```js
+```mjs
 /**
  * The complete "flag `rm -rf`" custom rule from the custom-rule tutorial
  * (`../custom-rule-tutorial.md`). Plain, directly-runnable JavaScript (no
@@ -41,18 +46,23 @@ flag?) the same way a hand-written rule narrows any other selector-first ESLint
  * here the selector does the node-type narrowing, `create()` only does the
  * domain-specific check).
  *
- * Flag words are resolved with `sh-ast/analyze`'s `resolveWord` rather than
- * a hand-rolled scan: a word is only ever treated as the literal text
+ * Flag words are resolved with `@eslint-sh/eslint-plugin`'s re-exported
+ * `resolveWord` (originally from `sh-ast/analyze`) rather than a
+ * hand-rolled scan: a word is only ever treated as the literal text
  * `-rf`/`-fr` when it is *statically* that string (bare or quoted literal
  * concatenations); a word containing a `ParamExp`/`CmdSubst`/`ArithmExp`/
  * `ProcSubst` resolves to `null` ("unknown") rather than being silently
  * erased into a static match or a static non-match — the same static-word
- * contract `design/PACKAGES.md` documents for `resolveWordText`.
+ * contract `design/PACKAGES.md` documents for `resolveWordText`. Importing
+ * it from the plugin package (rather than `sh-ast/analyze` directly) means
+ * a project that installs only `@eslint-sh/eslint-plugin` has everything
+ * this rule needs, with no separate `sh-ast` install or npm-hoisting
+ * reliance.
  *
  * @see ../custom-rule-tutorial.md — the tutorial this rule backs
  * @see ../selectors.md — the `:command` launch class
  */
-import { resolveWord } from 'sh-ast/analyze';
+import { resolveWord } from '@eslint-sh/eslint-plugin';
 
 const noRmRf = {
   meta: {
@@ -107,8 +117,9 @@ A few things worth calling out:
   classes](./selectors.md#the-six-launch-classes) — not a bare node-type name. ESLint's
   `esquery`-based rule-listener matching (via `ShellLanguage.matchesSelectorClass`) treats it
   exactly like any other selector key such as `CallExpr` or `CallExpr[args.0.parts.0.value='jq']`.
-- `resolveWord(arg, { context: 'command-argument' })` — from `sh-ast/analyze` — is the correct way
-  to ask "is this word statically the string X": it returns `{ static: true, text }` for a bare or
+- `resolveWord(arg, { context: 'command-argument' })` — re-exported from `@eslint-sh/eslint-plugin`
+  (originally `sh-ast/analyze`) — is the correct way to ask "is this word statically the string X":
+  it returns `{ static: true, text }` for a bare or
   quoted literal (`rm`, `'r'm`, `"-rf"` all resolve), and `{ static: false, reason }` the moment any
   part of the word depends on a `ParamExp`/`CmdSubst`/`ArithmExp`/`ProcSubst` — never inventing a
   value for a dynamic word.
@@ -121,7 +132,7 @@ A few things worth calling out:
 
 `docs/examples/eslint.config.mjs`:
 
-```js
+```mjs
 // eslint.config.mjs
 //
 // The custom-rule tutorial's exact flat-config wiring
@@ -130,7 +141,7 @@ A few things worth calling out:
 // `eslint` `Linter.verify()` — not a reconstruction of this shape — so the
 // documented wiring is genuinely tested.
 import sh from '@eslint-sh/eslint-plugin'; // or the umbrella: import sh from 'eslint-sh'
-import noRmRf from './no-rm-rf-rule.js';
+import noRmRf from './no-rm-rf-rule.mjs';
 
 export default [
   {

package/docs/examples/eslint.config.mjs

@@ -6,7 +6,7 @@
 // `eslint` `Linter.verify()` — not a reconstruction of this shape — so the
 // documented wiring is genuinely tested.
 import sh from '@eslint-sh/eslint-plugin'; // or the umbrella: import sh from 'eslint-sh'
-import noRmRf from './no-rm-rf-rule.js';
+import noRmRf from './no-rm-rf-rule.mjs';
 
 export default [
   {

package/docs/examples/{no-rm-rf-rule.js → no-rm-rf-rule.mjs}

@@ -14,18 +14,23 @@
  * here the selector does the node-type narrowing, `create()` only does the
  * domain-specific check).
  *
- * Flag words are resolved with `sh-ast/analyze`'s `resolveWord` rather than
- * a hand-rolled scan: a word is only ever treated as the literal text
+ * Flag words are resolved with `@eslint-sh/eslint-plugin`'s re-exported
+ * `resolveWord` (originally from `sh-ast/analyze`) rather than a
+ * hand-rolled scan: a word is only ever treated as the literal text
  * `-rf`/`-fr` when it is *statically* that string (bare or quoted literal
  * concatenations); a word containing a `ParamExp`/`CmdSubst`/`ArithmExp`/
  * `ProcSubst` resolves to `null` ("unknown") rather than being silently
  * erased into a static match or a static non-match — the same static-word
- * contract `design/PACKAGES.md` documents for `resolveWordText`.
+ * contract `design/PACKAGES.md` documents for `resolveWordText`. Importing
+ * it from the plugin package (rather than `sh-ast/analyze` directly) means
+ * a project that installs only `@eslint-sh/eslint-plugin` has everything
+ * this rule needs, with no separate `sh-ast` install or npm-hoisting
+ * reliance.
  *
  * @see ../custom-rule-tutorial.md — the tutorial this rule backs
  * @see ../selectors.md — the `:command` launch class
  */
-import { resolveWord } from 'sh-ast/analyze';
+import { resolveWord } from '@eslint-sh/eslint-plugin';
 
 const noRmRf = {
   meta: {

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@eslint-sh/eslint-plugin",
   "description": "Shell script parsing and syntax-error reporting for ESLint, with custom-rule authoring over a typed shell AST, backed by sh-ast.",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "author": "Mike North <michael.l.north@gmail.com>",
   "dependencies": {
     "@eslint/core": "^1.2.1",
     "@eslint/plugin-kit": "^0.7.2",
-    "sh-ast": "^0.1.0"
+    "sh-ast": "^0.3.0"
   },
   "devDependencies": {
     "eslint": "^10.7.0"