@starci/eslint-canon-be 3.0.9 → 3.1.0

package/runtime/scripts/lib/sonar-syntax-rules.mjs

@@ -0,0 +1,225 @@
+// sonar-syntax-rules.mjs - the ESLint rules that keep a TypeScript app clear of the smells SonarCloud flagged in the example apps, judged on
+// the syntax tree alone (no type information, no dependency). Both lint canons (@starci/eslint-canon-be and -fe) publish them from their
+// bundled runtime copy under the names below, so a product inherits them and `starci app lint` refuses the finding before the scan sees it.
+// Each message names the Sonar rule it stands for, and a rule judges the files the example scans judge: a unit or end-to-end spec is outside the
+// scan (`sonar.exclusions`), so it is outside these rules. The rules that need the type checker (S1874, S6551, S7503) are borrowed from
+// typescript-eslint by the canon factories; the one that needs a regex ambiguity analysis (S8786) runs in the runtime's own `sonar-rules` check.
+
+const FUNCTIONS = new Set(['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression']);
+const REPEATED = Object.freeze({
+  ForStatement: ['body', 'test', 'update'],
+  ForInStatement: ['body'],
+  ForOfStatement: ['body'],
+  WhileStatement: ['body', 'test'],
+  DoWhileStatement: ['body', 'test'],
+});
+
+/** The first ancestor of `node` that is `type`-matching per `test`, stopping at a function or class boundary. */
+function ancestorWithin(node, test) {
+  for (let child = node, parent = node.parent; parent; child = parent, parent = parent.parent) {
+    if (FUNCTIONS.has(parent.type) || parent.type === 'StaticBlock') return null;
+    if (test(parent, child)) return parent;
+  }
+  return null;
+}
+
+const repeatsChild = (loop, child) => (REPEATED[loop.type] ?? []).some((key) => loop[key] === child);
+
+/** A loop with no condition (`for (;;)`, `while (true)`) walks pages or polls: each turn needs the one before, so it cannot be run together. */
+const isEndless = (loop) => (loop.type === 'ForStatement' && loop.test === null) || (['WhileStatement', 'DoWhileStatement'].includes(loop.type) && loop.test.type === 'Literal' && loop.test.value === true);
+
+/** S9382: an `await` inside a loop body runs one step after the other; say the sequence by name or run the independent steps together. */
+const noAwaitInLoop = {
+  meta: {
+    type: 'suggestion',
+    schema: [],
+    messages: { loop: 'S9382: do not `await` inside a loop. Run independent steps together with `Promise.all`, or state the sequence by name with a helper that chains the promises (`eachInOrder` of the back end\'s `platform/primitives`).' },
+  },
+  create: (context) => ({
+    AwaitExpression: (node) => {
+      if (ancestorWithin(node, (loop, child) => repeatsChild(loop, child) && !isEndless(loop))) context.report({ node, messageId: 'loop' });
+    },
+  }),
+};
+
+/** S7758: `codePointAt` and `fromCodePoint` handle every code point; `charCodeAt` and `fromCharCode` stop at 16 bits. */
+const preferCodePoint = {
+  meta: { type: 'suggestion', schema: [], messages: { codePoint: 'S7758: use `{{ better }}` instead of `{{ worse }}`; it reads whole code points, not 16-bit halves.' } },
+  create: (context) => ({
+    CallExpression: (node) => {
+      const callee = node.callee;
+      if (callee.type !== 'MemberExpression' || callee.computed || callee.property.type !== 'Identifier') return;
+      const name = callee.property.name;
+      if (name === 'charCodeAt') context.report({ node, messageId: 'codePoint', data: { better: 'codePointAt', worse: 'charCodeAt' } });
+      else if (name === 'fromCharCode' && callee.object.type === 'Identifier' && callee.object.name === 'String') context.report({ node, messageId: 'codePoint', data: { better: 'String.fromCodePoint', worse: 'String.fromCharCode' } });
+    },
+  }),
+};
+
+const BACKSLASH_PAIR = '\\\\';
+
+/** Whether the string literal only escapes backslashes: its value is its raw text with each pair read as one. */
+function onlyBackslashEscapes(node) {
+  const raw = node.raw;
+  if (typeof node.value !== 'string' || !raw.includes(BACKSLASH_PAIR) || raw.at(-2) === '\\') return false;
+  if (node.value.includes('`') || node.value.includes('${')) return false;
+  return raw.slice(1, -1).replaceAll(BACKSLASH_PAIR, '\\') === node.value;
+}
+
+const KEEPS_ITS_ESCAPES = new Set(['ImportDeclaration', 'ExportAllDeclaration', 'ExportNamedDeclaration', 'TSLiteralType', 'TSExternalModuleReference', 'JSXAttribute']);
+
+/** A property named `matcher` is read statically by Next (a template literal there kills the build), so its text keeps the escape. */
+const isMatcherValue = (node) => (node.parent?.type === 'Property' && node.parent.value === node && node.parent.key?.name === 'matcher')
+  || (node.parent?.type === 'ArrayExpression' && isMatcherValue(node.parent));
+
+/** S7780: a string whose only escapes are backslashes reads better as `String.raw`. */
+const preferStringRaw = {
+  meta: { type: 'suggestion', schema: [], messages: { raw: 'S7780: write this string with `String.raw` so its backslashes are not escaped.' } },
+  create: (context) => ({
+    Literal: (node) => {
+      if (KEEPS_ITS_ESCAPES.has(node.parent?.type) || node.parent?.type === 'ExpressionStatement' || isMatcherValue(node)) return;
+      if (onlyBackslashEscapes(node)) context.report({ node, messageId: 'raw' });
+    },
+  }),
+};
+
+/** S3358: a conditional expression inside another conditional expression is read inside out; name the inner one. */
+const noNestedConditional = {
+  meta: { type: 'suggestion', schema: [], messages: { nested: 'S3358: extract this nested conditional expression into its own statement or a named function.' } },
+  create: (context) => ({
+    ConditionalExpression: (node) => {
+      if (node.parent?.type === 'ConditionalExpression') context.report({ node, messageId: 'nested' });
+    },
+  }),
+};
+
+/** Whether `void` is used on a call: the explicit discard of a promise that Sonar and no-floating-promises both accept. */
+const discardsACall = (argument) => argument.type === 'CallExpression' || argument.type === 'AwaitExpression' || (argument.type === 'ChainExpression' && argument.expression.type === 'CallExpression');
+
+/** S3735: `void` on anything but a call hides what the code does; `void principal` says nothing, `undefined` or no statement says it. */
+const noVoidOperator = {
+  meta: { type: 'suggestion', schema: [], messages: { void: 'S3735: remove this `void`; it discards a value the code never needed. Only `void call()` (an explicit discard of a promise) is kept.' } },
+  create: (context) => ({
+    UnaryExpression: (node) => {
+      if (node.operator === 'void' && !discardsACall(node.argument)) context.report({ node, messageId: 'void' });
+    },
+  }),
+};
+
+/** S1128: an import no reference reads is removed. */
+const noUnusedImport = {
+  meta: { type: 'suggestion', schema: [], messages: { unused: 'S1128: remove the unused import of `{{ name }}`.' } },
+  create: (context) => ({
+    ImportDeclaration: (node) => {
+      for (const variable of context.sourceCode.getDeclaredVariables(node)) {
+        if (variable.references.length === 0) context.report({ node: variable.identifiers[0] ?? node, messageId: 'unused', data: { name: variable.name } });
+      }
+    },
+  }),
+};
+
+/** Whether `identifier` names an import of the file that nothing else reads. */
+function onlyReExported(sourceCode, identifier) {
+  let scope = sourceCode.getScope(identifier);
+  while (scope?.set.has(identifier.name) === false) scope = scope.upper;
+  const variable = scope?.set.get(identifier.name);
+  const definition = variable?.defs[0];
+  return definition?.type === 'ImportBinding' && variable.references.length === 1;
+}
+
+/** S7763: an import that is only handed on is re-exported with `export ... from`. */
+const preferExportFrom = {
+  meta: { type: 'suggestion', schema: [], messages: { reexport: 'S7763: use `export ... from` to re-export `{{ name }}` instead of importing it first.' } },
+  create: (context) => {
+    const { sourceCode } = context;
+    const check = (identifier, node) => {
+      if (identifier?.type === 'Identifier' && onlyReExported(sourceCode, identifier)) context.report({ node, messageId: 'reexport', data: { name: identifier.name } });
+    };
+    return {
+      ExportNamedDeclaration: (node) => {
+        if (node.source) return;
+        for (const specifier of node.specifiers) check(specifier.local, specifier);
+        for (const declarator of node.declaration?.declarations ?? []) if (!declarator.id.typeAnnotation) check(declarator.init, declarator);
+      },
+      ExportDefaultDeclaration: (node) => check(node.declaration, node),
+    };
+  },
+};
+
+/** The members a props type declares: [{name, node}] from a type literal, an interface body, `Readonly<...>` or an intersection of those declared in the file. */
+function declaredMembers(program, type) {
+  if (!type) return [];
+  if (type.type === 'TSTypeLiteral') return type.members.filter((member) => !member.computed && member.key).map((member) => ({ name: member.key.name ?? member.key.value, node: member.key }));
+  if (type.type === 'TSIntersectionType') return type.types.flatMap((part) => declaredMembers(program, part));
+  if (type.type !== 'TSTypeReference' || type.typeName.type !== 'Identifier') return [];
+  if (type.typeName.name === 'Readonly') return declaredMembers(program, type.typeArguments?.params?.[0]);
+  const declaration = program.body.map((statement) => statement.declaration ?? statement).find((statement) => (statement.type === 'TSTypeAliasDeclaration' || statement.type === 'TSInterfaceDeclaration') && statement.id.name === type.typeName.name);
+  if (declaration?.type === 'TSInterfaceDeclaration') return declaredMembers(program, { type: 'TSTypeLiteral', members: declaration.body.body });
+  return declaredMembers(program, declaration?.typeAnnotation);
+}
+
+const keyName = (key) => (key.type === 'Identifier' ? key.name : key.value);
+
+/** The prop names a use of the parameter variable reads, or null when it escapes whole (passed on, spread, indexed dynamically). */
+function readNames(variable) {
+  const names = new Set();
+  for (const reference of variable.references) {
+    const parent = reference.identifier.parent;
+    if (parent.type === 'MemberExpression' && parent.object === reference.identifier && (!parent.computed || parent.property.type === 'Literal')) names.add(keyName(parent.property));
+    else if (parent.type === 'VariableDeclarator' && parent.init === reference.identifier && parent.id.type === 'ObjectPattern' && parent.id.properties.every((property) => property.type === 'Property' && !property.computed)) parent.id.properties.forEach((property) => names.add(keyName(property.key)));
+    else return null;
+  }
+  return names;
+}
+
+/** The names a parameter reads: an object pattern's own keys, or what its variable's uses read; null means "all of them". */
+function readByParameter(sourceCode, fn, parameter) {
+  if (parameter.type === 'ObjectPattern') {
+    if (parameter.properties.some((property) => property.type !== 'Property' || property.computed)) return null;
+    return new Set(parameter.properties.map((property) => keyName(property.key)));
+  }
+  if (parameter.type !== 'Identifier') return null;
+  const variable = sourceCode.getDeclaredVariables(fn).find((candidate) => candidate.name === parameter.name);
+  return variable ? readNames(variable) : null;
+}
+
+/** S6767: a member of a component's props type that the component never reads is removed from the type. */
+const noUnusedPropTypes = {
+  meta: { type: 'suggestion', schema: [], messages: { unused: 'S6767: the prop `{{ name }}` is declared in the props type but the component never reads it; remove it.' } },
+  create: (context) => {
+    const { sourceCode } = context;
+    const frames = [];
+    const enter = (node) => frames.push({ node, jsx: false });
+    const markJsx = () => frames.forEach((frame) => { frame.jsx = true; });
+    const exit = () => {
+      const { node, jsx } = frames.pop();
+      const parameter = node.params[0];
+      const annotation = parameter?.typeAnnotation?.typeAnnotation;
+      if (!jsx || !annotation) return;
+      const read = readByParameter(sourceCode, node, parameter);
+      if (read === null) return;
+      for (const member of declaredMembers(sourceCode.ast, annotation)) {
+        if (!read.has(member.name)) context.report({ node: member.node, messageId: 'unused', data: { name: member.name } });
+      }
+    };
+    return { FunctionDeclaration: enter, FunctionExpression: enter, ArrowFunctionExpression: enter, 'FunctionDeclaration:exit': exit, 'FunctionExpression:exit': exit, 'ArrowFunctionExpression:exit': exit, JSXElement: markJsx, JSXFragment: markJsx };
+  },
+};
+
+/** The files the example scans leave out: a unit spec and an end-to-end spec. */
+const OUTSIDE_THE_SCAN = /\.(?:e2e-)?spec\.[cm]?[jt]sx?$/;
+
+/** The rule judging only the files the scan judges. */
+const scanned = (rule) => ({ ...rule, create: (context) => (OUTSIDE_THE_SCAN.test(context.filename) ? {} : rule.create(context)) });
+
+/** The rules both canons publish, by published name. */
+export const SONAR_SYNTAX_RULES = Object.freeze({
+  'no-await-in-loop': scanned(noAwaitInLoop),
+  'prefer-code-point': scanned(preferCodePoint),
+  'prefer-string-raw': scanned(preferStringRaw),
+  'no-nested-conditional': scanned(noNestedConditional),
+  'no-void-operator': scanned(noVoidOperator),
+  'no-unused-import': scanned(noUnusedImport),
+  'prefer-export-from': scanned(preferExportFrom),
+  'no-unused-prop-types': scanned(noUnusedPropTypes),
+});

package/runtime/scripts/lib/sops-envelope.mjs

@@ -25,7 +25,12 @@ export function testSecretPaths(name, { repo, stack = 'dev' } = {}) {
 export const setCommand = (name = '<name>', stack = 'dev') => `node scripts/stack-secret.mjs set ${stack}/secrets/test/${name}`;
 
 /** sops' format for a plaintext path, as the repository's stack-secret.mjs formatFor decides it. */
-export const sopsFormatFor = (file) => (file.endsWith('.env') ? 'dotenv' : /\.json$/.test(file) ? 'json' : /\.(ya?ml|kubeconfig)$/.test(file) ? 'yaml' : 'binary');
+export const sopsFormatFor = (file) => {
+  if (file.endsWith('.env')) return 'dotenv';
+  if (file.endsWith('.json')) return 'json';
+  if (/\.(ya?ml|kubeconfig)$/.test(file)) return 'yaml';
+  return 'binary';
+};
 
 /** Every leaf outside the `sops` block is an ENC[...] value (or null); the block itself carries a mac. */
 const allEncrypted = (node) => {
@@ -48,7 +53,7 @@ export function isSopsEnvelope(text) {
   if (!src.trim()) return false;
   try { return sopsTree(JSON.parse(src)); } catch { /* not JSON */ }
   const lines = src.split(/\r?\n/).filter((l) => l.trim() && !/^\s*#/.test(l));
-  if (lines.length && lines.every((l) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(l))) {
+  if (lines.length && lines.every((l) => /^[A-Za-z_]\w*=/.test(l))) {
     const pairs = lines.map((l) => [l.slice(0, l.indexOf('=')), l.slice(l.indexOf('=') + 1)]);
     const meta = pairs.filter(([k]) => k.startsWith('sops_'));
     const vals = pairs.filter(([k]) => !k.startsWith('sops_'));
@@ -56,3 +61,99 @@ export function isSopsEnvelope(text) {
   }
   try { return sopsTree(parseYaml(src)); } catch { return false; }
 }
+
+/** Admit one flat age envelope for the native selected-identity invocation; this is shape admission, never cryptographic proof. */
+const refusal = (reason) => ({ ok: false, reason });
+
+function dotenvMetadataValue(meta, age, key, value) {
+  if (key === 'age__list_0__map_recipient') age.recipient = value;
+  else if (key === 'age__list_0__map_enc') age.enc = value;
+  else if (key === 'mac_only_encrypted') {
+    if (value !== 'false') return 'partial-mac';
+    meta[key] = false;
+  } else if (key.includes('__')) return 'unsupported-key-group';
+  else meta[key] = value;
+  return null;
+}
+
+function readDotenvMetadata(text) {
+  const pairs = new Map();
+  for (const line of String(text).split('\n')) {
+    if (!line || line.startsWith('#')) continue;
+    if (line.includes('\r')) return { refusal: 'unsupported-dotenv' };
+    const at = line.indexOf('=');
+    if (at < 1) return { refusal: 'unsupported-dotenv' };
+    const name = line.slice(0, at);
+    if (pairs.has(name)) return { refusal: 'duplicate-key' };
+    pairs.set(name, line.slice(at + 1).replaceAll(String.raw`\n`, '\n'));
+  }
+  const meta = {};
+  const age = {};
+  for (const [name, value] of pairs) {
+    if (!name.startsWith('sops_')) continue;
+    const reason = dotenvMetadataValue(meta, age, name.slice('sops_'.length), value);
+    if (reason) return { refusal: reason };
+  }
+  meta.age = [age];
+  return { meta };
+}
+
+function readStructuredMetadata(text, format) {
+  const doc = parseYaml(String(text));
+  if (format !== 'yaml') JSON.parse(String(text));
+  if (format === 'binary' && (!doc || Object.keys(doc).length !== 2 || !Object.hasOwn(doc, 'data') || !Object.hasOwn(doc, 'sops') || typeof doc.data !== 'string'))
+    return { refusal: 'unsupported-binary-shape' };
+  return { meta: doc?.sops };
+}
+
+function readAgeMetadata(text, format) {
+  try {
+    return format === 'dotenv' ? readDotenvMetadata(text) : readStructuredMetadata(text, format);
+  } catch { return { refusal: 'invalid-envelope' }; }
+}
+
+function hasNonAgeProvider(meta, providers) {
+  for (const name of providers) {
+    if (Object.hasOwn(meta, name) && (!Array.isArray(meta[name]) || meta[name].length)) return true;
+  }
+  return false;
+}
+
+function isAgeEntry(entry) {
+  return !!entry && typeof entry === 'object' && !Array.isArray(entry)
+    && !Object.keys(entry).some(name => !['recipient', 'enc'].includes(name));
+}
+
+function hasValidAgePayload(entry) {
+  return typeof entry.enc === 'string' && entry.enc.startsWith('-----BEGIN AGE ENCRYPTED FILE-----\n')
+    && entry.enc.includes('\n-----END AGE ENCRYPTED FILE-----');
+}
+
+function hasValidEnvelopeVersion(meta) {
+  return typeof meta.version === 'string' && /^\d+\.\d+\.\d+$/.test(meta.version)
+    && typeof meta.lastmodified === 'string' && Number.isFinite(Date.parse(meta.lastmodified));
+}
+
+function validateAgeMetadata(meta, text, recipient) {
+  if (!meta || typeof meta !== 'object' || Array.isArray(meta) || !isSopsEnvelope(text)) return refusal('invalid-envelope');
+  if (Object.hasOwn(meta, 'key_groups') || Object.hasOwn(meta, 'shamir_threshold')) return refusal('unsupported-key-group');
+  const providers = ['kms', 'gcp_kms', 'hckms', 'azure_kv', 'hc_vault', 'pgp'];
+  if (hasNonAgeProvider(meta, providers)) return refusal('non-age-provider');
+  const fields = new Set([...providers, 'age', 'lastmodified', 'mac', 'version', 'unencrypted_suffix', 'encrypted_suffix', 'unencrypted_regex', 'encrypted_regex', 'unencrypted_comment_regex', 'encrypted_comment_regex', 'mac_only_encrypted']);
+  if (Object.keys(meta).some(name => !fields.has(name))) return refusal('unknown-metadata');
+  if (Object.hasOwn(meta, 'mac_only_encrypted') && meta.mac_only_encrypted !== false) return refusal('partial-mac');
+  if (!Array.isArray(meta.age) || meta.age.length !== 1) return refusal('unsupported-age-set');
+  const entry = meta.age[0];
+  if (!isAgeEntry(entry)) return refusal('invalid-age-entry');
+  if (typeof entry.recipient !== 'string' || entry.recipient !== recipient) return refusal('recipient-mismatch');
+  if (!hasValidAgePayload(entry)) return refusal('invalid-age-entry');
+  if (!hasValidEnvelopeVersion(meta)) return refusal('invalid-envelope');
+  return { ok: true };
+}
+
+export function selectedAgeEnvelope(text, format, recipient) {
+  if (!['binary', 'json', 'yaml', 'dotenv'].includes(format)) return refusal('unsupported-format');
+  const parsed = readAgeMetadata(text, format);
+  if (parsed.refusal) return refusal(parsed.refusal);
+  return validateAgeMetadata(parsed.meta, text, recipient);
+}

package/runtime/scripts/lib/stack-services.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../../engine/yaml.mjs';
 import { words } from './dockerfile.mjs';
+import { asList } from './list.mjs';
 
 /**
  * The services of a repository's own stack definition, read from `.starcistacks/application-stacks.yaml` and the compose
@@ -74,8 +75,6 @@ const imagePathOf = image => {
 /** True when the image reference carries a tag or digest (an external image, not a placeholder of the repository's own build). */
 const isTagged = image => image.includes('@') || image.slice(image.lastIndexOf('/') + 1).includes(':');
 
-const asList = value => (Array.isArray(value) ? value : value === undefined || value === null ? [] : [value]);
-
 /** A compose `environment` (map or `KEY=VALUE` list) as a plain object; a `*_FILE` variable becomes the plain variable with the test value. */
 const environmentOf = value => {
   const entries = Array.isArray(value)

package/runtime/scripts/lib/ts-ast.mjs

@@ -2,6 +2,15 @@
 // literal text, a node's 1-based position, a named property's initializer text. `ts` is the caller's
 // already-resolved compiler (see package-at.mjs loadTypescript); nothing here resolves a package.
 
+/** Whether the single-bit `flag` (a ts.NodeFlags member) is set in `flags`: the bit read as arithmetic, no bitwise operator in the condition. */
+export const hasFlag = (flags, flag) => Math.floor(flags / flag) % 2 === 1;
+
+/** Whether any bit of `mask` (a ts flag or an OR of flags) is set in `flags` (absent flags read as none): an explicit comparison of the masked value. */
+export const hasAnyFlag = (flags, mask) => ((flags ?? 0) & mask) !== 0;
+
+/** Whether the variable `declaration` belongs to a `const` list: the TypeScript node-flag test, an explicit comparison of the masked flags. */
+export const isConstVariable = (ts, declaration) => (ts.getCombinedNodeFlags(declaration.parent) & ts.NodeFlags.Const) !== 0;
+
 /** The text of an identifier or a string-literal-like `node`, or null (property names, literal specifiers). */
 export const nameText = (ts, node) => (node && (ts.isIdentifier(node) || ts.isStringLiteralLike(node)) ? node.text : null);
 

package/runtime/scripts/lib/walk.mjs

@@ -20,7 +20,12 @@ export function walkFiles(dir, {filter = () => true, sorted = false, exclude = (
     if (depth > maxDepth) return;
     let entries;
     try { entries = fs.readdirSync(current, {withFileTypes: true}); }
-    catch (error) { if (ignoreReadErrors) return; throw error; }
+    catch (error) {
+      if (ignoreReadErrors) {
+        return;
+      }
+      throw error;
+    }
     if (sorted) entries = entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const full = path.join(current, entry.name);

package/schema-authority.mjs

@@ -224,7 +224,7 @@ export const noRuntimeSchema = {
 const isEntityDecorator = (checker, decorator) => {
     const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression
     let symbol = checker.getSymbolAtLocation(callee)
-    if (symbol && symbol.flags & ts.SymbolFlags.Alias) symbol = checker.getAliasedSymbol(symbol)
+    if (symbol && (symbol.flags & ts.SymbolFlags.Alias) !== 0) symbol = checker.getAliasedSymbol(symbol)
     return symbol?.name === "Entity" && (symbol.declarations ?? []).some((declaration) => packageOfFile(declaration.getSourceFile().fileName) === "typeorm")
 }
 

package/service-deps.mjs

@@ -59,7 +59,7 @@ const isClassToken = (context, annotation) => {
     if (!tsNode) return false
     const type = checker.getTypeFromTypeNode(tsNode)
     const symbol = type.getSymbol()
-    if (!symbol || !(symbol.flags & ts.SymbolFlags.Class)) return false
+    if (!symbol || (symbol.flags & ts.SymbolFlags.Class) === 0) return false
     const declaration = symbol.declarations?.find((entry) => ts.isClassDeclaration(entry) || ts.isClassExpression(entry))
     return Boolean(declaration)
 }

package/sonar-parity.mjs

@@ -0,0 +1,19 @@
+/**
+ * The law that keeps the code clear of the smells SonarCloud measures (R235 `SCAN_SMELL`).
+ *
+ * Each rule is the syntax-tree form of one Sonar rule, shared with the front-end canon (scripts/lib/sonar-syntax-rules.mjs,
+ * bundled under `runtime/`): `no-await-in-loop` (S9382), `prefer-code-point` (S7758), `prefer-string-raw` (S7780),
+ * `no-nested-conditional` (S3358), `no-void-operator` (S3735), `no-unused-import` (S1128) and `prefer-export-from` (S7763).
+ * The three Sonar rules that need the type checker, S1874 (a deprecated API), S6551 (an object turned into text) and S7503 (an `async`
+ * function that never awaits and returns no promise), are the typescript-eslint rules `no-deprecated`, `no-base-to-string` and
+ * `require-await` the factory turns on.
+ */
+import { SONAR_SYNTAX_RULES } from "./runtime/scripts/lib/sonar-syntax-rules.mjs"
+
+const NAMES = ["no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import", "prefer-export-from"]
+
+/** The rules this law contributes to the plugin. */
+export const rules = Object.fromEntries(NAMES.map((name) => [name, SONAR_SYNTAX_RULES[name]]))
+
+/** Starts at error: a repository's fix lane clears the debt before the rule ships. */
+export const recommended = Object.fromEntries(NAMES.map((name) => [`starci-be/${name}`, "error"]))

package/suppression.mjs

@@ -9,8 +9,7 @@
  *   - TypeScript: `@ts-ignore`, `@ts-expect-error` and `@ts-nocheck`, wherever they sit in a comment;
  *   - coverage: `istanbul ignore`, `c8 ignore`, `v8 ignore`;
  *   - Sonar: `NOSONAR` and `sonar-disable`;
- *   - Prettier: `prettier-ignore`;
- *   - the `vn-ok` language marker.
+ *   - Prettier: `prettier-ignore`.
  *
  * The factory also sets `noInlineConfig: true`, so ESLint itself ignores such a comment; this rule is what turns the
  * ignored comment into a failure a person reads, instead of a silent no-op that looks like an exemption. There is no
@@ -24,7 +23,6 @@ const TS_DIRECTIVE = /@ts-(?:ignore|expect-error|nocheck)\b/
 const COVERAGE_IGNORE = /(?:^|[\s*/])(?:istanbul|c8|v8)\s+ignore\b/
 const SONAR = /\bNOSONAR\b|\bsonar-(?:disable|enable)\b/i
 const PRETTIER_IGNORE = /(?:^|[\s*/])prettier-ignore\b/
-const LANGUAGE_MARKER = /\bvn-ok\b/
 
 /** The finding a comment is, or null when it is ordinary prose. `/* global x *\/` is a block-comment form only. */
 const kindOf = (comment) => {
@@ -35,7 +33,6 @@ const kindOf = (comment) => {
     if (COVERAGE_IGNORE.test(text)) return "coverage"
     if (SONAR.test(text)) return "sonar"
     if (PRETTIER_IGNORE.test(text)) return "prettier"
-    if (LANGUAGE_MARKER.test(text)) return "vn-ok"
     return null
 }
 
@@ -43,7 +40,7 @@ const kindOf = (comment) => {
 export const noInlineSuppression = {
     meta: {
         type: "problem",
-        docs: { description: "No eslint, TypeScript, coverage, Sonar or Prettier suppression comment, and no vn-ok marker." },
+        docs: { description: "No eslint, TypeScript, coverage, Sonar or Prettier suppression comment." },
         schema: [],
         messages: {
             eslint: "An `eslint-disable`/`eslint-enable`, `eslint-env`, `/* global */` or rule-configuration comment. HFS does not switch a rule off or declare a global in place: fix the code, or propose a change to the rule in the canon.",
@@ -51,7 +48,6 @@ export const noInlineSuppression = {
             coverage: "An `istanbul`/`c8`/`v8 ignore` comment hides code from coverage. Write the test that covers it, or delete the code that nothing reaches.",
             sonar: "A `NOSONAR` or `sonar-disable` comment hides a finding from Sonar. Fix the finding.",
             prettier: "A `prettier-ignore` comment exempts code from the formatter. Let the formatter write it.",
-            "vn-ok": "A `vn-ok` marker exempts a line from the language rule. HFS keeps no exemption marker: write the text in English, or move the data to a locale or data file.",
         },
     },
     create(context) {

package/test-world.mjs

@@ -145,8 +145,7 @@ const plainKey = (property) => {
 
 /**
  * The world an integration spec (`{ modules }`, with real peer apps beside them as `apps` when its client calls another app of
- * ours) or an e2e spec (`{ apps }`, never `modules`) asks for; every such spec asks for one; the retired name `useE2eWorld`
- * exists nowhere.
+ * ours) or an e2e spec (`{ apps }`, never `modules`) asks for; every such spec asks for one.
  */
 export const testWorldShape = {
     meta: {
@@ -158,21 +157,14 @@ export const testWorldShape = {
             apps: "An e2e spec boots applications: call `useTestWorld({ apps: {...} })`, not `modules`.",
             literal: "The options of `useTestWorld(...)` must be one object literal with plain keys: a variable, a spread or a computed key hides whether the spec asks for `modules` or `apps`.",
             missing: "This spec never calls `useTestWorld(...)`: integration and e2e specs run inside the one test world.",
-            retired: "`useE2eWorld` is the retired name of `useTestWorld`; there is one name, no alias.",
         },
     },
     create(context) {
         const slot = hfsOf(context).slotOf(context.filename || context.getFilename())
         const wants = slot === "be.tests.integration" ? "modules" : slot === "be.tests.e2e" ? "apps" : null
-        const retired = {
-            Identifier(node) {
-                if (node.name === "useE2eWorld") context.report({ node, messageId: "retired" })
-            },
-        }
-        if (!wants) return retired
+        if (!wants) return {}
         let seen = false
         return {
-            ...retired,
             CallExpression(node) {
                 if (node.callee.type !== "Identifier" || node.callee.name !== "useTestWorld") return
                 seen = true