chore: fix the use of mixed dep/devdeps (#27652)

`fs-extra` is sometimes not included in the `npm pack` tarball, depending on the version of NPM.

The reason is that it occurs in both `dependencies` and `devDependencies`, which is not a useful dependency specification.

This is breaking jsii builds, depending on the NPM version used.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/@aws-cdk/app-staging-synthesizer-alpha/package.json

@@ -83,10 +83,6 @@
       "AWSLINT_BASE_CONSTRUCT": true
     }
   },
-  "dependencies": {
-    "aws-cdk-lib": "0.0.0",
-    "constructs": "^10.0.0"
-  },
   "devDependencies": {
     "aws-cdk-lib": "0.0.0",
     "@aws-cdk/integ-runner": "0.0.0",

packages/@aws-cdk/aws-appconfig-alpha/package.json

@@ -87,8 +87,6 @@
     "jest": "^29.7.0"
   },
   "dependencies": {
-    "aws-cdk-lib": "0.0.0",
-    "constructs": "^10.0.0",
     "mime-types": "^2.1.35"
   },
   "homepage": "https://github.com/aws/aws-cdk",

packages/@aws-cdk/cx-api/package.json

@@ -79,7 +79,6 @@
     "organization": true
   },
   "dependencies": {
-    "@aws-cdk/cloud-assembly-schema": "0.0.0",
     "semver": "^7.5.4"
   },
   "peerDependencies": {

packages/@aws-cdk/example-construct-library/package.json

@@ -80,10 +80,6 @@
     "@types/jest": "^29.5.5",
     "jest": "^29.7.0"
   },
-  "dependencies": {
-    "aws-cdk-lib": "0.0.0",
-    "constructs": "^10.0.0"
-  },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
     "aws-cdk-lib": "^0.0.0",

packages/aws-cdk-lib/package.json

@@ -108,7 +108,7 @@
     "organization": true
   },
   "license": "Apache-2.0",
-  "bundledDependencies": [
+  "bundleDependencies": [
     "@balena/dockerignore",
     "case",
     "fs-extra",
@@ -176,7 +176,6 @@
     "delay": "5.0.0",
     "esbuild": "^0.19.4",
     "fast-check": "^3.13.1",
-    "fs-extra": "^11.1.1",
     "jest": "^29.7.0",
     "jest-each": "^29.7.0",
     "lambda-tester": "^4.0.1",

packages/aws-cdk/package.json

@@ -82,7 +82,6 @@
     "aws-cdk-lib": "0.0.0",
     "aws-sdk-mock": "5.6.0",
     "axios": "^0.27.2",
-    "cdk-from-cfn": "^0.47.0",
     "constructs": "^10.0.0",
     "fast-check": "^3.13.1",
     "jest": "^29.7.0",

tools/@aws-cdk/cdk-build-tools/config/eslintrc.js

@@ -73,7 +73,6 @@ module.exports = {
           '**/test/**', // --> Unit tests
         ],
         optionalDependencies: false, // Disallow importing optional dependencies (those shouldn't be in use in the project)
-        peerDependencies: false, // Disallow importing peer dependencies (that aren't also direct dependencies)
       },
     ],
 

tools/@aws-cdk/cfn2ts/package.json

@@ -40,7 +40,6 @@
   },
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/pkglint": "0.0.0",
     "@types/fs-extra": "^9.0.13",
     "@types/jest": "^29.5.5",
     "@types/yargs": "^15.0.16",

tools/@aws-cdk/pkglint/lib/rules.ts

@@ -1258,6 +1258,11 @@ export class PkgLintAsScript extends ValidationRule {
   public readonly name = 'package-info/scripts/pkglint';
 
   public validate(pkg: PackageJson): void {
+    if (pkg.packageName === '@aws-cdk/cfn2ts') {
+      // cfn2ts uses pkglint as a real dependency, and it can't be both.
+      return;
+    }
+
     const script = 'pkglint -f';
 
     expectDevDependency(this.name, pkg, '@aws-cdk/pkglint', `${PKGLINT_VERSION}`); // eslint-disable-line @typescript-eslint/no-require-imports
@@ -1301,6 +1306,24 @@ export class NoStarDeps extends ValidationRule {
   }
 }
 
+export class NoMixedDeps extends ValidationRule {
+  public readonly name = 'dependencies/no-mixed-deps';
+
+  public validate(pkg: PackageJson) {
+    const deps = Object.keys(pkg.json.dependencies ?? {});
+    const devDeps = Object.keys(pkg.json.devDependencies ?? {});
+
+    const shared = deps.filter((dep) => devDeps.includes(dep));
+    for (const dep of shared) {
+      pkg.report({
+        ruleName: this.name,
+        message: `dependency may not be both in dependencies and devDependencies: ${dep}`,
+        fix: () => pkg.removeDevDependency(dep),
+      });
+    }
+  }
+}
+
 interface VersionCount {
   version: string;
   count: number;
@@ -1836,6 +1859,7 @@ function shouldUseCDKBuildTools(pkg: PackageJson) {
   const exclude = [
     '@aws-cdk/cdk-build-tools',
     '@aws-cdk/script-tests',
+    '@aws-cdk/cfn2ts',
     'awslint',
   ];