@starci/eslint-canon-be 3.0.10 → 3.2.0

package/runtime/scripts/hfs/trailing-slashes.mjs

@@ -0,0 +1,8 @@
+// Trailing-slash trimming for slot paths and generated roots, linear in the length of the text.
+
+/** `text` without its trailing `/` characters. */
+export function trimTrailingSlashes(text) {
+  let end = text.length;
+  while (end > 0 && text.codePointAt(end - 1) === 47) end -= 1;
+  return text.slice(0, end);
+}

package/runtime/scripts/hfs/typescript-programs.mjs

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { createRequire } from 'node:module';
 import path from 'node:path';
+import { byCodeUnit } from '../lib/list.mjs';
 
 // One TypeScript program per (compiler, root names, compiler options, project references) inside a program run, and
 // one value per (kind, compiler, input) for what callers derive from those programs (the architecture context).
@@ -27,7 +27,7 @@ function keyOf(value) {
   }
   if (typeof value !== 'object' || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) return null;
   const entries = [];
-  for (const name of Object.keys(value).sort()) {
+  for (const name of Object.keys(value).sort(byCodeUnit)) {
     const item = keyOf(value[name]);
     if (item === null) return null;
     entries.push(`${JSON.stringify(name)}:${item}`);
@@ -44,7 +44,10 @@ export function sharedInProgramRun(kind, ts, input, build) {
   const key = values ? keyOf(input) : null;
   if (key === null) return build();
   let byKey = values.get(ts);
-  if (!byKey) values.set(ts, byKey = new Map());
+  if (!byKey) {
+    byKey = new Map();
+    values.set(ts, byKey);
+  }
   const id = `${kind}\0${key}`;
   if (!byKey.has(id)) byKey.set(id, build());
   return byKey.get(id);
@@ -74,4 +77,3 @@ export function typeScriptProjectReferencePath(ts, reference) {
 export function resolveTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
   return ts.resolveModuleName(specifier, from, options, host).resolvedModule?.resolvedFileName;
 }
-

package/runtime/scripts/hfs/view.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { allowsFile } from './allows.mjs';
 import { openHfs } from './slots.mjs';
 
-const posix = (p) => String(p).replace(/\\/g, '/');
+const posix = (p) => String(p).replaceAll('\\', '/');
 const isAbsoluteAny = (text) => path.isAbsolute(text) || /^[A-Za-z]:\//.test(text);
 
 /**

package/runtime/scripts/lib/dockerfile.mjs

@@ -58,8 +58,8 @@ export function shellCommands(body) {
     } else if (char === '"' || char === "'") {
       quote = char;
       current += char;
-    } else if (char === ';' || char === '|' || (char === '&' && body[i + 1] === '&')) {
-      if (char !== ';' && body[i + 1] === char) i += 1;
+    } else if (isCommandSeparator(body, i, char)) {
+      i += commandSeparatorAdvance(body, i, char);
       flush();
     } else if (char === '\\' && body[i + 1] === '\n') {
       i += 1;
@@ -71,43 +71,17 @@ export function shellCommands(body) {
   return commands;
 }
 
+const isCommandSeparator = (body, index, char) => char === ';' || char === '|' || (char === '&' && body[index + 1] === '&');
+const commandSeparatorAdvance = (body, index, char) => char !== ';' && body[index + 1] === char ? 1 : 0;
+
 /**
  * Parse a Dockerfile: { instructions: [{ keyword, text, line, stage }], stages: [{ index, name, image, line, instructions }],
  * comments: [{ text, line }], preamble: [instruction before the first FROM (ARG)] }. `keyword` is upper-case; `text` is the
  * argument text of the logical line; `stage` is the index of the stage the instruction belongs to (-1 before the first FROM).
  */
 export function parseDockerfile(source) {
-  const lines = String(source).replace(/\r\n/g, '\n').split('\n');
-  const instructions = [];
-  const comments = [];
-  let escape = '\\';
-  let directives = true;
-  for (let i = 0; i < lines.length; i += 1) {
-    const raw = lines[i];
-    const trimmed = raw.trim();
-    if (trimmed === '') { directives = false; continue; }
-    if (trimmed.startsWith('#')) {
-      const body = trimmed.slice(1).trim();
-      const directive = directives ? /^(syntax|escape|check)\s*=\s*(\S+)$/i.exec(body) : null;
-      if (directive) { if (directive[1].toLowerCase() === 'escape') escape = directive[2]; continue; }
-      directives = false;
-      comments.push({ text: body, line: i + 1 });
-      continue;
-    }
-    directives = false;
-    const start = i + 1;
-    let logical = trimmed;
-    while (logical.endsWith(escape) && i + 1 < lines.length) {
-      logical = logical.slice(0, -1).trimEnd();
-      i += 1;
-      while (i < lines.length && lines[i].trim().startsWith('#')) i += 1;
-      if (i >= lines.length) break;
-      logical = `${logical} ${lines[i].trim()}`;
-    }
-    const split = logical.search(/\s/);
-    const keyword = (split < 0 ? logical : logical.slice(0, split)).toUpperCase();
-    instructions.push({ keyword, text: split < 0 ? '' : logical.slice(split).trim(), line: start, stage: -1 });
-  }
+  const lines = String(source).replaceAll('\r\n', '\n').split('\n');
+  const { instructions, comments } = parseInstructions(lines);
   const stages = [];
   const preamble = [];
   for (const instruction of instructions) {
@@ -122,3 +96,52 @@ export function parseDockerfile(source) {
   }
   return { instructions, stages, comments, preamble };
 }
+
+function parseInstructions(lines) {
+  const instructions = [];
+  const comments = [];
+  const state = { escape: '\\', directives: true };
+  let i = 0;
+  while (i < lines.length) {
+    const parsed = parseInstructionLine(lines, i, state);
+    if (parsed.comment) comments.push(parsed.comment);
+    if (parsed.instruction) instructions.push(parsed.instruction);
+    i = parsed.nextLine + 1;
+  }
+  return { instructions, comments };
+}
+
+function parseInstructionLine(lines, index, state) {
+  const trimmed = lines[index].trim();
+  if (trimmed === '') { state.directives = false; return { nextLine: index }; }
+  if (trimmed.startsWith('#')) return parseCommentLine(trimmed, index, state);
+  state.directives = false;
+  const { logical, nextLine } = logicalInstructionOf(lines, index, state.escape);
+  const split = logical.search(/\s/);
+  const keyword = (split < 0 ? logical : logical.slice(0, split)).toUpperCase();
+  return { nextLine, instruction: { keyword, text: split < 0 ? '' : logical.slice(split).trim(), line: index + 1, stage: -1 } };
+}
+
+function parseCommentLine(trimmed, index, state) {
+  const body = trimmed.slice(1).trim();
+  const directive = state.directives ? /^(syntax|escape|check)\s*=\s*(\S+)$/i.exec(body) : null;
+  if (directive) {
+    if (directive[1].toLowerCase() === 'escape') state.escape = directive[2];
+    return { nextLine: index };
+  }
+  state.directives = false;
+  return { nextLine: index, comment: { text: body, line: index + 1 } };
+}
+
+function logicalInstructionOf(lines, index, escape) {
+  let logical = lines[index].trim();
+  let nextLine = index;
+  while (logical.endsWith(escape) && nextLine + 1 < lines.length) {
+    logical = logical.slice(0, -1).trimEnd();
+    nextLine += 1;
+    while (nextLine < lines.length && lines[nextLine].trim().startsWith('#')) nextLine += 1;
+    if (nextLine >= lines.length) break;
+    logical = `${logical} ${lines[nextLine].trim()}`;
+  }
+  return { logical, nextLine };
+}

package/runtime/scripts/lib/git.mjs

@@ -7,13 +7,13 @@
  */
 export const unquoteDiffPath = (value) =>
   /^".*"$/.test(value)
-    ? JSON.parse(value.replace(/\\([0-7]{3})/g, (_, octal) => `\\u00${Number.parseInt(octal, 8).toString(16).padStart(2, '0')}`))
+    ? JSON.parse(value.replace(/\\([0-7]{3})/g, (_, octal) => String.raw`\u00${Number.parseInt(octal, 8).toString(16).padStart(2, '0')}`))
     : value;
 
 // git's repository-local variables (git rev-parse --local-env-vars). A hook or alias run in a linked worktree exports
 // GIT_DIR=<main>/.git/worktrees/<wt>; a spec inheriting it pointed every fixture git at the LIVE .claude repo and re-inited
 // it core.bare=true (2026-09-29, a6f60352c). tests/setup/isolated-registry.mjs drops the same list.
-export const GIT_LOCAL_ENV_VARS = ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_IMPLICIT_WORK_TREE', 'GIT_PREFIX', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_COUNT', 'GIT_GRAFT_FILE', 'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_SHALLOW_FILE'];
+export const GIT_LOCAL_ENV_VARS = ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_IMPLICIT_WORK_TREE', 'GIT_PREFIX', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_COUNT', 'GIT_GRAFT_FILE', 'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_SHALLOW_FILE', 'GIT_INTERNAL_SUPER_PREFIX'];
 /** `parent` (the caller's env) without git's repository-local variables (GIT_CONFIG_KEY_n/VALUE_n go with GIT_CONFIG_COUNT). Pure. */
 export function withoutGitLocalEnv(parent) {
   const env = { ...parent };

package/runtime/scripts/lib/i18n.mjs

@@ -11,6 +11,7 @@
 // A placeholder is `{name}`; the English and the Vietnamese of one entry carry exactly the same placeholders
 // (scripts/checks/check-i18n-catalog.mjs). An English source with no entry is returned as is: a missing translation degrades
 // to English, never to a blank.
+import { byCodeUnit } from './list.mjs';
 import { escapeRegExp } from './regex.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -19,7 +20,7 @@ import { parseYaml } from '../../engine/yaml.mjs';
 import { DEFAULT_OWNER_LANGUAGE, loadConfig } from '../../engine/config.mjs';
 
 export const CATALOG_DIR = 'modules/i18n/messages';
-export const PLACEHOLDER = /\{([A-Za-z_][\w]*)\}/g;
+export const PLACEHOLDER = /\{([A-Za-z_]\w*)\}/g;
 
 const cache = new Map();
 
@@ -54,7 +55,7 @@ export const resetCatalogCache = () => cache.clear();
 /** The names each `pattern` match captures (group 1) in `text`, in match order (`sort` sorts them). */
 export const captureNames = (text, pattern, { sort = false } = {}) => {
   const names = [...String(text).matchAll(pattern)].map((m) => m[1]);
-  return sort ? names.sort() : names;
+  return sort ? names.sort(byCodeUnit) : names;
 };
 
 /** The names of the placeholders of a message. */

package/runtime/scripts/lib/language.mjs

@@ -50,13 +50,13 @@ export const DECLARED_VIETNAMESE_FIELDS = Object.freeze({
   'modules/ops/_labels.yaml': Object.freeze({ flowFields: Object.freeze(['vi']) }),
   'modules/goal/archetypes.yaml': Object.freeze({
     fields: Object.freeze([
-      'buildIntent', 'canonIntent', 'e2eIntent', 'uatIntent', 'proofNegation', 'integrationIntent', 'integrationNegation', 'brandIntent',
+      'buildIntent', 'canonIntent', 'e2eIntent', 'uatIntent', 'proofNegation', 'proofStateCue', 'integrationIntent', 'brandIntent',
       'phrases', 'requires', 'excludes', 'backend', 'frontend', 'package',
     ]),
   }),
   'modules/goal/source-phrases.yaml': Object.freeze({
     fields: Object.freeze([
-      'prefer', 'avoid', 'negation', 'refused', 'accept', 'golden',
+      'prefer', 'avoid', 'only', 'negation', 'refused', 'accept', 'golden',
       'missingPaths', 'grantTooNarrow', 'toolTimeout', 'testGap', 'checkerUnavailable',
       'supervisorVerbs', 'ownerWord', 'orWord', 'beyondAuthority', 'ownerOnly', 'workerDied', 'contractConflict', 'decision',
       'product', 'grammar', 'knowledge', 'sourceLabel', 'internalVocabulary', 'actor', 'success',
@@ -124,7 +124,7 @@ export function documentLanguageHits(rel, text) {
     if (declared.fields?.includes(keys[hit.line - 1])) return false;
     if (!declared.flowFields) return true;
     // an inline flow map: drop the declared fields' values and judge what is left of the line
-    const rest = declared.flowFields.reduce((line, field) => line.replace(new RegExp(`\\b${field}\\s*:\\s*(?:"(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*'|[^,}]*)`, 'g'), ''), lines[hit.line - 1]);
+    const rest = declared.flowFields.reduce((line, field) => line.replace(new RegExp(String.raw`\b${field}\s*:\s*(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^,}]*)`, 'g'), ''), lines[hit.line - 1]);
     return hasSecondLanguage(rest);
   });
 }

package/runtime/scripts/lib/list.mjs

@@ -4,7 +4,11 @@
 export const list = (v) => (Array.isArray(v) ? v : []);
 
 /** `v` as an array: itself when already one, [] for null/undefined, else [v]. */
-export const asList = (v) => (Array.isArray(v) ? v : v == null ? [] : [v]);
+export const asList = (v) => {
+  if (Array.isArray(v)) return v;
+  if (v == null) return [];
+  return [v];
+};
 
 /** The object entries of `v` (a non-array reads as []). */
 export const objectList = (v) => (Array.isArray(v) ? v : []).filter((item) => item && typeof item === 'object');
@@ -18,3 +22,6 @@ export const splitList = (v, { sep = ',', dedupe = false } = {}) => {
   const items = String(v ?? '').split(sep).map((s) => s.trim()).filter(Boolean);
   return dedupe ? [...new Set(items)] : items;
 };
+
+// The comparator of a bare `sort()` (UTF-16 code-unit order) is owned by the engine, which cannot import scripts/lib.
+export { byCodeUnit } from '../../engine/by-code-unit.mjs';

package/runtime/scripts/lib/path-key.mjs

@@ -6,6 +6,17 @@ const WIN = process.platform === 'win32';
 
 /** `p` with every backslash turned into a forward slash; null and undefined read as ''. */
 export const slash = (p) => String(p ?? '').replaceAll('\\', '/');
+/** `text` without its trailing '/' run (a loop: a trailing-run pattern backtracks super-linearly). */
+export const trimTrailingSlashes = (text) => {
+  for (let end = text.length; ; end -= 1) if (end === 0 || text[end - 1] !== '/') return text.slice(0, end);
+};
+// A trailing '*' run with the one '/' before it (the glob suffix of 'dir/**'); text without a trailing '*' is unchanged.
+const stripTrailingStars = (text) => {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === '*') end -= 1;
+  if (end === text.length) return text;
+  return text.slice(0, end > 0 && text[end - 1] === '/' ? end - 1 : end);
+};
 /** A relative path in git's spelling: forward slashes, no leading './'. */
 export const posixPath = (p) => slash(p).replace(/^\.\//, '');
 /** Whether posix `file` is `prefix` itself or under it (`file === prefix || file` starts with `prefix/`). */
@@ -19,7 +30,7 @@ export const samePath = (a, b) => foldCase(a) === foldCase(b);
  * `fold: true` folds case on every platform (a comparison against a lowercase-stored root needs it).
  */
 export const pathKey = (p, { fold = WIN } = {}) => {
-  const key = slash(path.resolve(p)).replace(/\/+$/, '');
+  const key = trimTrailingSlashes(slash(path.resolve(p)));
   return fold ? key.toLowerCase() : key;
 };
 /** `a` is `b` or under it, or the reverse: two path spellings whose trees touch. */
@@ -36,19 +47,28 @@ export const normPath = (p, { trim = false, collapse = false, dot = false, glob
   s = slash(s);
   if (collapse) s = s.replace(/\/{2,}/g, '/');
   if (dot) s = s.replace(/^\.\//, '');
-  if (glob === 'star') s = s.replace(/\/?\*+$/, '');
+  if (glob === 'star') s = stripTrailingStars(s);
   else if (glob === 'double') s = s.replace(/\/\*\*$/, '');
-  s = s.replace(/\/+$/, '');
+  s = trimTrailingSlashes(s);
   return fold ? s.toLowerCase() : s;
 };
 /** A work-relative path in one spelling: forward slashes, no leading ./, no trailing slash. */
-export const normWork = (p) => String(p ?? '').trim().replaceAll('\\', '/').replace(/^\.\/+/, '').replace(/\/+$/, '');
+export const normWork = (p) => trimTrailingSlashes(String(p ?? '').trim().replaceAll('\\', '/').replace(/^\.\/+/, ''));
 
 /** `p` resolved and dereferenced (realpath where the path exists) — the canonical spelling of a checkout dir. */
 export const realPath = (p) => {
   const resolved = path.resolve(p);
   try { return fs.realpathSync.native(resolved); } catch { return resolved; }
 };
+/** `p` with its nearest existing ancestor dereferenced and the not-yet-created rest appended: a root's canonical spelling before it exists. */
+export const canonicalPath = (p) => {
+  const rest = [];
+  for (let at = path.resolve(p); ; at = path.dirname(at)) {
+    try { return path.join(fs.realpathSync.native(at), ...rest); } catch { /* not created yet */ }
+    if (path.dirname(at) === at) return path.resolve(p);
+    rest.unshift(path.basename(at));
+  }
+};
 /** `p` resolved and case-folded where the filesystem ignores case — the Map key of an absolute path. */
 export const resolvedKey = (p) => foldCase(path.resolve(p));
 /** Whether `a` and `b` resolve to the same path (always case-folded, so differently-cased spellings count). */
@@ -61,12 +81,25 @@ export const insidePath = (root, file, { key = (p) => p, includeSelf = false } =
   const rel = path.relative(key(root), key(file));
   return (includeSelf || Boolean(rel)) && !rel.startsWith('..') && !path.isAbsolute(rel);
 };
+/**
+ * `candidate` (absolute, or relative to `base`) resolved and dereferenced, required to sit under `base` (or be it):
+ * the boundary check for a path an operator, an agent or another process hands in. `base` is canonicalised once and the
+ * candidate is judged below it, so `..` segments and links leading out are refused; returns the canonical path, or throws
+ * a PATH_OUTSIDE_BASE refusal (`label` names the argument in the message).
+ */
+export const containedPath = (base, candidate, { label = 'path' } = {}) => {
+  const root = canonicalPath(base);
+  const resolved = canonicalPath(path.resolve(root, String(candidate ?? '')));
+  const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+  if (!insidePath(root, resolved, { includeSelf: true }) || (resolved !== root && !resolved.startsWith(prefix))) throw Object.assign(new Error(`${label} ${String(candidate)} is outside ${root} [PATH_OUTSIDE_BASE]`), { code: 'PATH_OUTSIDE_BASE' });
+  return resolved;
+};
 /**
  * A path-ish value (a string or a {path} entry) in relative compare form: trimmed, forward slashes,
  * no trailing '/**' glob or slashes, no leading './'; `fold` lowercases for a case-insensitive key.
  */
 export const normRel = (p, { fold = false } = {}) => {
-  const s = String(typeof p === 'string' ? p : p?.path ?? '').trim().replace(/\\/g, '/').replace(/\/\*\*$/, '').replace(/\/+$/, '').replace(/^\.\//, '');
+  const s = trimTrailingSlashes(String(typeof p === 'string' ? p : p?.path ?? '').trim().replaceAll('\\', '/').replace(/\/\*\*$/, '')).replace(/^\.\//, '');
   return fold ? s.toLowerCase() : s;
 };
 /** Whether `file` equals or sits under one of `prefixes` (posix spellings; `dot` counts a '.' prefix as covering all). */

package/runtime/scripts/lib/regex.mjs

@@ -1,4 +1,4 @@
 // regex.mjs - building a RegExp from text.
 
 /** `text` with every regular-expression metacharacter escaped, so it matches itself literally. */
-export const escapeRegExp = (text) => String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+export const escapeRegExp = (text) => String(text).replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);

package/runtime/scripts/lib/secret-patterns.mjs

@@ -15,7 +15,7 @@ export const FORBIDDEN_FILES = [
 export const SECRET_PATTERNS = [
   { name: 'private-key-block', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
   { name: 'aws-access-key', re: /\bAKIA[0-9A-Z]{16}\b/ },
-  { name: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{50,}\b/ },
+  { name: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_\w{50,}\b/ },
   { name: 'anthropic-key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
   { name: 'openai-key', re: /\bsk-(?:proj-)?[A-Za-z0-9]{32,}\b/ },
   { name: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
@@ -28,7 +28,11 @@ export const SECRET_PATTERNS = [
   // candidate; only this heuristic takes the exemption, never a provider-shaped token above.
   // A spec file's keyword-assigned values are test inputs (a spec's sign-in
   // form password and a mocked accessToken once refused a push): the heuristic skips spec files too.
-  { name: 'assigned-secret', re: /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*['"](?!env\([A-Z_][A-Z0-9_]*\)['"])([^'"\s$<{]{12,})['"]/i, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
+  { name: 'assigned-secret', re: new RegExp([
+    String.raw`\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)`,
+    String.raw`\b\s*[:=]\s*['"](?!env\([A-Z_][A-Z0-9_]*\)['"])([^'"\s$<{]{12,})`,
+    `['"]`,
+  ].join(''), 'i'), placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
     skipFile: /\.(?:spec|test|e2e-spec)\.[cm]?[jt]sx?$/ },
 ];
 

package/runtime/scripts/lib/sonar-syntax-rules.mjs

@@ -0,0 +1,225 @@
+// sonar-syntax-rules.mjs - the ESLint rules that keep a TypeScript app clear of the smells SonarCloud flagged in the example apps, judged on
+// the syntax tree alone (no type information, no dependency). Both lint canons (@starci/eslint-canon-be and -fe) publish them from their
+// bundled runtime copy under the names below, so a product inherits them and `starci app lint` refuses the finding before the scan sees it.
+// Each message names the Sonar rule it stands for, and a rule judges the files the example scans judge: a unit or end-to-end spec is outside the
+// scan (`sonar.exclusions`), so it is outside these rules. The rules that need the type checker (S1874, S6551, S7503) are borrowed from
+// typescript-eslint by the canon factories; the one that needs a regex ambiguity analysis (S8786) runs in the runtime's own `sonar-rules` check.
+
+const FUNCTIONS = new Set(['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression']);
+const REPEATED = Object.freeze({
+  ForStatement: ['body', 'test', 'update'],
+  ForInStatement: ['body'],
+  ForOfStatement: ['body'],
+  WhileStatement: ['body', 'test'],
+  DoWhileStatement: ['body', 'test'],
+});
+
+/** The first ancestor of `node` that is `type`-matching per `test`, stopping at a function or class boundary. */
+function ancestorWithin(node, test) {
+  for (let child = node, parent = node.parent; parent; child = parent, parent = parent.parent) {
+    if (FUNCTIONS.has(parent.type) || parent.type === 'StaticBlock') return null;
+    if (test(parent, child)) return parent;
+  }
+  return null;
+}
+
+const repeatsChild = (loop, child) => (REPEATED[loop.type] ?? []).some((key) => loop[key] === child);
+
+/** A loop with no condition (`for (;;)`, `while (true)`) walks pages or polls: each turn needs the one before, so it cannot be run together. */
+const isEndless = (loop) => (loop.type === 'ForStatement' && loop.test === null) || (['WhileStatement', 'DoWhileStatement'].includes(loop.type) && loop.test.type === 'Literal' && loop.test.value === true);
+
+/** S9382: an `await` inside a loop body runs one step after the other; say the sequence by name or run the independent steps together. */
+const noAwaitInLoop = {
+  meta: {
+    type: 'suggestion',
+    schema: [],
+    messages: { loop: 'S9382: do not `await` inside a loop. Run independent steps together with `Promise.all`, or state the sequence by name with a helper that chains the promises (`eachInOrder` of the back end\'s `platform/primitives`).' },
+  },
+  create: (context) => ({
+    AwaitExpression: (node) => {
+      if (ancestorWithin(node, (loop, child) => repeatsChild(loop, child) && !isEndless(loop))) context.report({ node, messageId: 'loop' });
+    },
+  }),
+};
+
+/** S7758: `codePointAt` and `fromCodePoint` handle every code point; `charCodeAt` and `fromCharCode` stop at 16 bits. */
+const preferCodePoint = {
+  meta: { type: 'suggestion', schema: [], messages: { codePoint: 'S7758: use `{{ better }}` instead of `{{ worse }}`; it reads whole code points, not 16-bit halves.' } },
+  create: (context) => ({
+    CallExpression: (node) => {
+      const callee = node.callee;
+      if (callee.type !== 'MemberExpression' || callee.computed || callee.property.type !== 'Identifier') return;
+      const name = callee.property.name;
+      if (name === 'charCodeAt') context.report({ node, messageId: 'codePoint', data: { better: 'codePointAt', worse: 'charCodeAt' } });
+      else if (name === 'fromCharCode' && callee.object.type === 'Identifier' && callee.object.name === 'String') context.report({ node, messageId: 'codePoint', data: { better: 'String.fromCodePoint', worse: 'String.fromCharCode' } });
+    },
+  }),
+};
+
+const BACKSLASH_PAIR = '\\\\';
+
+/** Whether the string literal only escapes backslashes: its value is its raw text with each pair read as one. */
+function onlyBackslashEscapes(node) {
+  const raw = node.raw;
+  if (typeof node.value !== 'string' || !raw.includes(BACKSLASH_PAIR) || raw.at(-2) === '\\') return false;
+  if (node.value.includes('`') || node.value.includes('${')) return false;
+  return raw.slice(1, -1).replaceAll(BACKSLASH_PAIR, '\\') === node.value;
+}
+
+const KEEPS_ITS_ESCAPES = new Set(['ImportDeclaration', 'ExportAllDeclaration', 'ExportNamedDeclaration', 'TSLiteralType', 'TSExternalModuleReference', 'JSXAttribute']);
+
+/** A property named `matcher` is read statically by Next (a template literal there kills the build), so its text keeps the escape. */
+const isMatcherValue = (node) => (node.parent?.type === 'Property' && node.parent.value === node && node.parent.key?.name === 'matcher')
+  || (node.parent?.type === 'ArrayExpression' && isMatcherValue(node.parent));
+
+/** S7780: a string whose only escapes are backslashes reads better as `String.raw`. */
+const preferStringRaw = {
+  meta: { type: 'suggestion', schema: [], messages: { raw: 'S7780: write this string with `String.raw` so its backslashes are not escaped.' } },
+  create: (context) => ({
+    Literal: (node) => {
+      if (KEEPS_ITS_ESCAPES.has(node.parent?.type) || node.parent?.type === 'ExpressionStatement' || isMatcherValue(node)) return;
+      if (onlyBackslashEscapes(node)) context.report({ node, messageId: 'raw' });
+    },
+  }),
+};
+
+/** S3358: a conditional expression inside another conditional expression is read inside out; name the inner one. */
+const noNestedConditional = {
+  meta: { type: 'suggestion', schema: [], messages: { nested: 'S3358: extract this nested conditional expression into its own statement or a named function.' } },
+  create: (context) => ({
+    ConditionalExpression: (node) => {
+      if (node.parent?.type === 'ConditionalExpression') context.report({ node, messageId: 'nested' });
+    },
+  }),
+};
+
+/** Whether `void` is used on a call: the explicit discard of a promise that Sonar and no-floating-promises both accept. */
+const discardsACall = (argument) => argument.type === 'CallExpression' || argument.type === 'AwaitExpression' || (argument.type === 'ChainExpression' && argument.expression.type === 'CallExpression');
+
+/** S3735: `void` on anything but a call hides what the code does; `void principal` says nothing, `undefined` or no statement says it. */
+const noVoidOperator = {
+  meta: { type: 'suggestion', schema: [], messages: { void: 'S3735: remove this `void`; it discards a value the code never needed. Only `void call()` (an explicit discard of a promise) is kept.' } },
+  create: (context) => ({
+    UnaryExpression: (node) => {
+      if (node.operator === 'void' && !discardsACall(node.argument)) context.report({ node, messageId: 'void' });
+    },
+  }),
+};
+
+/** S1128: an import no reference reads is removed. */
+const noUnusedImport = {
+  meta: { type: 'suggestion', schema: [], messages: { unused: 'S1128: remove the unused import of `{{ name }}`.' } },
+  create: (context) => ({
+    ImportDeclaration: (node) => {
+      for (const variable of context.sourceCode.getDeclaredVariables(node)) {
+        if (variable.references.length === 0) context.report({ node: variable.identifiers[0] ?? node, messageId: 'unused', data: { name: variable.name } });
+      }
+    },
+  }),
+};
+
+/** Whether `identifier` names an import of the file that nothing else reads. */
+function onlyReExported(sourceCode, identifier) {
+  let scope = sourceCode.getScope(identifier);
+  while (scope?.set.has(identifier.name) === false) scope = scope.upper;
+  const variable = scope?.set.get(identifier.name);
+  const definition = variable?.defs[0];
+  return definition?.type === 'ImportBinding' && variable.references.length === 1;
+}
+
+/** S7763: an import that is only handed on is re-exported with `export ... from`. */
+const preferExportFrom = {
+  meta: { type: 'suggestion', schema: [], messages: { reexport: 'S7763: use `export ... from` to re-export `{{ name }}` instead of importing it first.' } },
+  create: (context) => {
+    const { sourceCode } = context;
+    const check = (identifier, node) => {
+      if (identifier?.type === 'Identifier' && onlyReExported(sourceCode, identifier)) context.report({ node, messageId: 'reexport', data: { name: identifier.name } });
+    };
+    return {
+      ExportNamedDeclaration: (node) => {
+        if (node.source) return;
+        for (const specifier of node.specifiers) check(specifier.local, specifier);
+        for (const declarator of node.declaration?.declarations ?? []) if (!declarator.id.typeAnnotation) check(declarator.init, declarator);
+      },
+      ExportDefaultDeclaration: (node) => check(node.declaration, node),
+    };
+  },
+};
+
+/** The members a props type declares: [{name, node}] from a type literal, an interface body, `Readonly<...>` or an intersection of those declared in the file. */
+function declaredMembers(program, type) {
+  if (!type) return [];
+  if (type.type === 'TSTypeLiteral') return type.members.filter((member) => !member.computed && member.key).map((member) => ({ name: member.key.name ?? member.key.value, node: member.key }));
+  if (type.type === 'TSIntersectionType') return type.types.flatMap((part) => declaredMembers(program, part));
+  if (type.type !== 'TSTypeReference' || type.typeName.type !== 'Identifier') return [];
+  if (type.typeName.name === 'Readonly') return declaredMembers(program, type.typeArguments?.params?.[0]);
+  const declaration = program.body.map((statement) => statement.declaration ?? statement).find((statement) => (statement.type === 'TSTypeAliasDeclaration' || statement.type === 'TSInterfaceDeclaration') && statement.id.name === type.typeName.name);
+  if (declaration?.type === 'TSInterfaceDeclaration') return declaredMembers(program, { type: 'TSTypeLiteral', members: declaration.body.body });
+  return declaredMembers(program, declaration?.typeAnnotation);
+}
+
+const keyName = (key) => (key.type === 'Identifier' ? key.name : key.value);
+
+/** The prop names a use of the parameter variable reads, or null when it escapes whole (passed on, spread, indexed dynamically). */
+function readNames(variable) {
+  const names = new Set();
+  for (const reference of variable.references) {
+    const parent = reference.identifier.parent;
+    if (parent.type === 'MemberExpression' && parent.object === reference.identifier && (!parent.computed || parent.property.type === 'Literal')) names.add(keyName(parent.property));
+    else if (parent.type === 'VariableDeclarator' && parent.init === reference.identifier && parent.id.type === 'ObjectPattern' && parent.id.properties.every((property) => property.type === 'Property' && !property.computed)) parent.id.properties.forEach((property) => names.add(keyName(property.key)));
+    else return null;
+  }
+  return names;
+}
+
+/** The names a parameter reads: an object pattern's own keys, or what its variable's uses read; null means "all of them". */
+function readByParameter(sourceCode, fn, parameter) {
+  if (parameter.type === 'ObjectPattern') {
+    if (parameter.properties.some((property) => property.type !== 'Property' || property.computed)) return null;
+    return new Set(parameter.properties.map((property) => keyName(property.key)));
+  }
+  if (parameter.type !== 'Identifier') return null;
+  const variable = sourceCode.getDeclaredVariables(fn).find((candidate) => candidate.name === parameter.name);
+  return variable ? readNames(variable) : null;
+}
+
+/** S6767: a member of a component's props type that the component never reads is removed from the type. */
+const noUnusedPropTypes = {
+  meta: { type: 'suggestion', schema: [], messages: { unused: 'S6767: the prop `{{ name }}` is declared in the props type but the component never reads it; remove it.' } },
+  create: (context) => {
+    const { sourceCode } = context;
+    const frames = [];
+    const enter = (node) => frames.push({ node, jsx: false });
+    const markJsx = () => frames.forEach((frame) => { frame.jsx = true; });
+    const exit = () => {
+      const { node, jsx } = frames.pop();
+      const parameter = node.params[0];
+      const annotation = parameter?.typeAnnotation?.typeAnnotation;
+      if (!jsx || !annotation) return;
+      const read = readByParameter(sourceCode, node, parameter);
+      if (read === null) return;
+      for (const member of declaredMembers(sourceCode.ast, annotation)) {
+        if (!read.has(member.name)) context.report({ node: member.node, messageId: 'unused', data: { name: member.name } });
+      }
+    };
+    return { FunctionDeclaration: enter, FunctionExpression: enter, ArrowFunctionExpression: enter, 'FunctionDeclaration:exit': exit, 'FunctionExpression:exit': exit, 'ArrowFunctionExpression:exit': exit, JSXElement: markJsx, JSXFragment: markJsx };
+  },
+};
+
+/** The files the example scans leave out: a unit spec and an end-to-end spec. */
+const OUTSIDE_THE_SCAN = /\.(?:e2e-)?spec\.[cm]?[jt]sx?$/;
+
+/** The rule judging only the files the scan judges. */
+const scanned = (rule) => ({ ...rule, create: (context) => (OUTSIDE_THE_SCAN.test(context.filename) ? {} : rule.create(context)) });
+
+/** The rules both canons publish, by published name. */
+export const SONAR_SYNTAX_RULES = Object.freeze({
+  'no-await-in-loop': scanned(noAwaitInLoop),
+  'prefer-code-point': scanned(preferCodePoint),
+  'prefer-string-raw': scanned(preferStringRaw),
+  'no-nested-conditional': scanned(noNestedConditional),
+  'no-void-operator': scanned(noVoidOperator),
+  'no-unused-import': scanned(noUnusedImport),
+  'prefer-export-from': scanned(preferExportFrom),
+  'no-unused-prop-types': scanned(noUnusedPropTypes),
+});