@fjall/eslint-plugin 31.0.0 → 33.0.0

package/no-clickhouse-internal-reexport.js

@@ -45,7 +45,7 @@ export default {
     },
     messages: {
       forbiddenReexport:
-        "Symbol `{{name}}` is ClickHouse-internal plumbing and must not appear on the public surface. Consume via the DatabaseFactory or a typed connector instead. See aiDocs/patterns/clickhouse-database-factory-pattern.md."
+        "Symbol `{{name}}` is ClickHouse-internal plumbing and must not appear on the public surface. Consume via the DatabaseFactory or a typed connector instead."
     },
     schema: []
   },

package/no-l2-asg-lifecycle-hook.js

@@ -7,7 +7,7 @@
  * first instance launches BEFORE the hook is attached, and the hook fires
  * zero notifications for that instance.
  *
- * Production-confirmed in account 985539798308 on 2026-05-19: the ClickHouse
+ * Production-confirmed on 2026-05-19: the ClickHouse
  * PDV LAUNCHING hook never fired for the first instance — the Lambda log
  * group only saw a TEST_NOTIFICATION ~30s after instance launch. The volume
  * was never attached, cloud-init timed out, ECS agent never started.
@@ -38,7 +38,7 @@ export default {
     },
     messages: {
       l2AsgHook:
-        "ASG L2 `addLifecycleHook(id, props)` emits a standalone AWS::AutoScaling::LifecycleHook resource that creates AFTER the ASG — the first instance launches before the hook is attached (production-confirmed regression, account 985539798308, 2026-05-19). Use `attachInlineAsgLifecycleHook` from `lib/resources/aws/compute/asgInlineLifecycleHook.ts`, which appends to `CfnAutoScalingGroup.lifecycleHookSpecificationList` atomically with the ASG."
+        "ASG L2 `addLifecycleHook(id, props)` emits a standalone AWS::AutoScaling::LifecycleHook resource that creates AFTER the ASG — the first instance launches before the hook is attached (production-confirmed regression, 2026-05-19). Use `attachInlineAsgLifecycleHook` from `lib/resources/aws/compute/asgInlineLifecycleHook.ts`, which appends to `CfnAutoScalingGroup.lifecycleHookSpecificationList` atomically with the ASG."
     },
     schema: []
   },

package/no-raw-block-device-volume.js

@@ -38,7 +38,7 @@ export default {
     },
     messages: {
       rawBlockDeviceVolume:
-        "Raw `{{name}}` import from `{{source}}` is forbidden. Use `safeEbs` from `lib/resources/aws/compute/blockDeviceVolume` for ephemeral / root volumes, or `PersistentDataVolume` (Phase 1.75) for data that must survive instance refresh. See aiDocs/patterns/infrastructure-wrapper-routing-pattern.md."
+        "Raw `{{name}}` import from `{{source}}` is forbidden. Use `safeEbs` from `lib/resources/aws/compute/blockDeviceVolume` for ephemeral / root volumes, or `PersistentDataVolume` (Phase 1.75) for data that must survive instance refresh."
     },
     schema: []
   },

package/no-raw-cdk-properties-on-public-constructs.js

@@ -53,7 +53,7 @@ export default {
     },
     messages: {
       rawCdkProperty:
-        "Public property `{{name}}` exposes raw CDK plumbing. Mark it `private readonly` and surface a typed accessor (ARN, endpoint, connector) instead. See aiDocs/patterns/clickhouse-database-factory-pattern.md § Hygiene rules."
+        "Public property `{{name}}` exposes raw CDK plumbing. Mark it `private readonly` and surface a typed accessor (ARN, endpoint, connector) instead."
     },
     schema: []
   },

package/no-undefined-prop-in-construct-id.js

@@ -63,7 +63,7 @@ export default {
     },
     messages: {
       optionalInConstructId:
-        "Construct ID interpolates `props.{{field}}` which is optionally typed; when the caller omits this field the literal string 'undefined' is baked into the CloudFormation logical ID. Resolve in the constructor (`this.{{field}}Value = props.{{field}} ?? <fallback>`) and use `this.{{field}}Value` here. See aiDocs/research/2026-05-17-review-deltas.md § M-9."
+        "Construct ID interpolates `props.{{field}}` which is optionally typed; when the caller omits this field the literal string 'undefined' is baked into the CloudFormation logical ID. Resolve in the constructor (`this.{{field}}Value = props.{{field}} ?? <fallback>`) and use `this.{{field}}Value` here."
     },
     schema: []
   },

package/no-zod-enum-redeclaring-named-constant.js

@@ -3,7 +3,8 @@
  *
  * Catches `z.enum([<string-literal>, ...])` declarations whose literal set
  * matches any named SCREAMING_SNAKE_CASE `as const` tuple in
- * `generator/src/schemas/constants.ts` or `sharedTypes.ts` — covers the
+ * `generator/src/schemas/constants.ts`, `sharedTypes.ts` or
+ * `util/src/backupTiers.ts` (the backup tier vocabulary's home) — covers the
  * `_TYPES`, `_TIERS`, `_PRESETS`, `_PROVIDERS`, `_ENGINES`, `_METHODS`,
  * `_NAMES`, `_INTERVALS`, `_ARCHITECTURES`, `_VALUES` suffix families. Any
  * exported tuple matching `/^[A-Z][A-Z0-9_]*$/` participates; suffix is not
@@ -20,12 +21,15 @@
  * arm and `z.enum(["AWS_IAM","NONE"])` at another) are themselves a
  * silent-drift hazard — both should route through the named tuple.
  *
- * The registry is built dynamically at rule-init time by reading
- * `constants.ts` + `sharedTypes.ts` relative to this rule file. Adding a
+ * The registry is built dynamically at rule-init time by reading the
+ * source files in `REGISTRY_SOURCES` relative to this rule file. Adding a
  * new `<NAME> = [...] as const` tuple (any SCREAMING_SNAKE_CASE name) to
- * either source file automatically extends the rule's catch surface — no
- * rule edits needed. Spread/concat forms (`APP_TYPES = [...TIER_NAMES, X]`)
- * are intentionally not extracted — they would yield partial literal sets.
+ * any of them automatically extends the rule's catch surface — no rule
+ * edits needed. A tuple that moves home (an alias such as
+ * `BACKUP_VAULT_TIERS = BACKUP_TIERS` is not a literal tuple) needs its new
+ * home added to the list, or the vocabulary silently drops out of the
+ * registry. Spread/concat forms (`APP_TYPES = [...TIER_NAMES, X]`) are
+ * intentionally not extracted — they would yield partial literal sets.
  *
  * Codifies typescript-standards.md § "Zod-Derived Type Guards (MANDATORY)".
  */
@@ -45,19 +49,31 @@ function getRegistry() {
   return registryCache;
 }
 
+// Earlier entries win the name reported for a literal set, so the canonical
+// home of a vocabulary comes first: `@fjall/util` owns the backup tier tuple
+// and the generator re-exports it.
+const REGISTRY_SOURCES = [
+  ["util", "src", "backupTiers.ts"],
+  ["generator", "src", "schemas", "constants.ts"],
+  ["generator", "src", "schemas", "sharedTypes.ts"]
+];
+
 function buildRegistry() {
-  const schemasDir = join(__dirname, "..", "..", "generator", "src", "schemas");
+  const monorepoRoot = join(__dirname, "..", "..");
   const registry = new Map();
+  const sources = REGISTRY_SOURCES.map((segments) =>
+    join(monorepoRoot, ...segments)
+  );
   // Source tree absent → published-package context, no-op silently; the warning
-  // below is reserved for the dir present but a file unreadable.
-  if (!existsSync(schemasDir)) return registry;
+  // below is reserved for a source present but unreadable.
+  if (!sources.some((path) => existsSync(path))) return registry;
 
-  const sources = [
-    join(schemasDir, "constants.ts"),
-    join(schemasDir, "sharedTypes.ts")
-  ];
   const failures = [];
   for (const path of sources) {
+    if (!existsSync(path)) {
+      failures.push({ path, error: "missing" });
+      continue;
+    }
     let text;
     try {
       text = readFileSync(path, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/eslint-plugin",
-  "version": "31.0.0",
+  "version": "33.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",