@starci/eslint-canon-fe 9.16.5 → 9.16.7

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 9.16.7 - 2026-11-08
+
+- Fixed: the test-scope Sonar way block (the app config and the plain-source config) selects the specs with positive selectors (`SPEC_FILES`, `apps/*/src/**/*.{spec,e2e-spec}.{ts,tsx}` and the package twin) instead of `ignores: ['**/*', '!**/*.spec...']`. The harness lint scope (`canonScope` of `@starci/hfs`) refuses a negated selector, so every app's `starci app check --gate lint` ended in `ESLint tool error: eslint source scope is unavailable ... unsupported canon ignores selectors` and linted nothing. The block selects the same files as before and carries the name `starci-fe/sonar-way-tests`, by which `scopeToPackages` narrows it to the specs of the package subpaths.
+
+## 9.16.6 - 2026-11-08
+
+- Added (R235 `SCAN_SMELL`, the first Sonar way scan of a real app against local lint): the lint now reports what the server reported. `starci-fe/no-duplicate-import` (S3863, fixable) replaces the core `no-duplicate-imports` that spared a separate type import: a value and a type from one module are one `import { value, type Type }`, and `--fix` merges them. `starci-fe/no-nested-conditional` (S3358) now follows the server: a conditional inside a branch, a test, a call argument, a template or a cast is nested, and only an array, object, function or JSX expression starts a new reading. `starci-fe/prefer-string-raw` (S7780) also refuses a `String.raw` template that holds no backslash (fixable). `starci-fe/no-bidirectional-character` (text:S6389) refuses a raw bidirectional control character in any file. Front end: `no-useless-fragment` (S6749, fixable when the one child is an element), `no-nested-component` (S6478), `no-children-prop` (S6748; its message says a connected block passes the slot under another prop name to the pure component, FE_CONNECTED_BLOCK_RENDER_PAIR and FE_WORLD_OWNER_RENDER_BOUNDARY), `use-state-destructured` (S6754), `prefer-tag-over-role` (S6819).
+- Added: the Sonar way block maps S7739 `unicorn/no-thenable`, S7746 `unicorn/no-useless-promise-resolve-reject` (fixable), S6606 `@typescript-eslint/prefer-nullish-coalescing`, S7781 `unicorn/prefer-string-replace-all` (fixable), S7718 `unicorn/catch-error-name` (fixable), S7727 `unicorn/no-array-callback-reference`, S6671 `prefer-promise-reject-errors`, S6325 `prefer-regex-literals`, S1186 `@typescript-eslint/no-empty-function`, S878 `no-sequences`, S6535 `no-useless-escape`, S7753 `unicorn/prefer-array-index-of` (fixable), S7737 `unicorn/no-object-as-default-parameter`, S7755 `unicorn/prefer-at` (fixable), S7787 `unicorn/require-module-specifiers`, S7766 `unicorn/prefer-math-min-max` (fixable), S6661 `prefer-object-spread` (fixable) and S4123 `@typescript-eslint/await-thenable`, all at error. A catch parameter is `error` (`error_` where `error` is already declared in scope; `cause` stays allowed, the scan accepts it and a back end's wrapped failures are named so).
+- Added: the specs of the product source run the test-scoped Sonar way rules (the sonarjs rules whose Sonar scope is Tests, among them S5906, S8754 and S9073) in a fourth block, because the scan reads `sonar.tests` with them; the product source block still leaves the specs out.
+
 ## 9.16.5 - 2026-11-08
 
 - Fixed: the `@starci/hfs` peer is `~6.2.0`, the range of the hfs the canon pins name, so an app on hfs 6.2 installs with `npm ci`.

package/dist/lib/config.d.ts

@@ -12,6 +12,8 @@ export interface SonarPlugins {
     readonly sonarjs: ESLint.Plugin;
     readonly unicorn: ESLint.Plugin;
 }
+/** The name of the test-scope Sonar way block, which the package scoping narrows to the specs of the package subpaths. */
+export declare const TEST_SCOPE_BLOCK = "starci-fe/sonar-way-tests";
 /** A disable directive is a weakening of lint, and one that suppresses nothing is dead weight. */
 export declare const linterOptions: Readonly<{
     noInlineConfig: true;
@@ -19,6 +21,8 @@ export declare const linterOptions: Readonly<{
 }>;
 /** The product source of a front end: every app's `src/` and every workspace package's `src/` (slots fe.* and repo.packages). */
 export declare const SOURCE_FILES: readonly string[];
+/** The specs of that source, the positive `files` of the block that judges the specs alone (no negated selector: the lint scope of the harness proves a scope from plain globs only). */
+export declare const SPEC_FILES: readonly string[];
 /** Build output, installed packages, generated wire types and the harness's report directory are never linted. */
 export declare const IGNORED: readonly string[];
 /**
@@ -89,6 +93,7 @@ export declare const buildPlainSourceConfig: ({ root, plugin, hooks, reactHooks,
 }) => Linter.Config[];
 /** The front-end files of a root workspace package: its workbench (drawn with Grammar) and its public face, and every `.tsx` file of the package source wherever it sits (a `src/client/` renderer is drawn too: FE-PACKAGES-2); the React-free workbench contract stays back end. */
 export declare const PACKAGE_SOURCE_FILES: readonly string[];
+export declare const PACKAGE_SPEC_FILES: readonly string[];
 /** What a package folder never lints: installed packages, build output, generated wire types. */
 export declare const PACKAGE_IGNORED: readonly string[];
 /**

package/dist/lib/config.js

@@ -12,13 +12,17 @@
  */
 import tsParser from "@typescript-eslint/parser";
 import { OUTSIDE_THE_SCAN_FILES } from "#runtime/scripts/lib/sonar-syntax-rules.mjs";
-import { sonarWayRules } from "#runtime/scripts/lib/sonar-way.mjs";
+import { sonarWayRules, sonarWayTestRules } from "#runtime/scripts/lib/sonar-way.mjs";
 import { eslintPlugin } from "./eslint-boundary.js";
 import { isHfsView } from "./hfs.js";
+/** The name of the test-scope Sonar way block, which the package scoping narrows to the specs of the package subpaths. */
+export const TEST_SCOPE_BLOCK = "starci-fe/sonar-way-tests";
 /** A disable directive is a weakening of lint, and one that suppresses nothing is dead weight. */
 export const linterOptions = Object.freeze({ noInlineConfig: true, reportUnusedDisableDirectives: "error" });
 /** The product source of a front end: every app's `src/` and every workspace package's `src/` (slots fe.* and repo.packages). */
 export const SOURCE_FILES = Object.freeze(["apps/*/src/**/*.{ts,tsx}", "packages/*/src/**/*.{ts,tsx}"]);
+/** The specs of that source, the positive `files` of the block that judges the specs alone (no negated selector: the lint scope of the harness proves a scope from plain globs only). */
+export const SPEC_FILES = Object.freeze(["apps/*/src/**/*.{spec,e2e-spec}.{ts,tsx}", "packages/*/src/**/*.{spec,e2e-spec}.{ts,tsx}"]);
 /** Build output, installed packages, generated wire types and the harness's report directory are never linted. */
 export const IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**", "**/dist/**", "**/coverage/**", "**/__generated__/**", ".starci/**"]);
 /**
@@ -89,6 +93,8 @@ export const buildFeConfig = ({ hfs, plugin, source, reactHooks, tsPlugin, sonar
         },
         // Sonar way: what the scan raises is refused while the code is written; a spec is outside the scan, so outside this block.
         { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
+        // Sonar way, test scope: the scan reads the specs with the rules of the tests (sonar.tests), so the specs of the source are judged by those and by no other.
+        { name: TEST_SCOPE_BLOCK, files: [...SPEC_FILES], plugins: { sonarjs: sonar.sonarjs }, rules: sonarWayTestRules(sonar.sonarjs) },
     ];
 };
 /**
@@ -104,12 +110,14 @@ export const SLOT_FREE_RULES = Object.freeze([
     "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "no-copy-in-call", "no-alert", "no-failure-collapse",
     "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
     "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params", "no-line-separator-literal",
+    "no-bidirectional-character", "no-duplicate-import", "no-useless-fragment", "no-nested-component", "no-children-prop", "use-state-destructured", "prefer-tag-over-role",
     "no-list-panel-padding", "no-hand-built-panes", "no-table-in-card", "no-heading-above-card", "no-selectable-tag-group", "no-fill-command-in-header", "no-app-surface-paint", "divider-full-bleed", "control-height", "selection-fill-no-check", "no-grammar-shim",
     "no-swr-default-array", "no-foreign-slot-status", "no-validating-as-loading", "no-placeholder-object", "no-hand-skeleton", "explicit-export-surface", "directive-first", "renderer-presentation-only",
     "button-intent-required", "destructive-confirm-in-dialog", "single-commit-per-render", "no-commit-in-collection-item",
 ]);
 /** The source of a plain front-end tree: its `src/`. */
 export const PLAIN_SOURCE_FILES = Object.freeze(["src/**/*.{ts,tsx}"]);
+const PLAIN_SPEC_FILES = Object.freeze(["src/**/*.{spec,e2e-spec}.{ts,tsx}"]);
 /**
  * The flat config of a TypeScript front-end tree that is no HFS app: the same fences as an app (typed linting, no inline directive, every rule at
  * `error`) over the rules that need no slot view. It takes the root of the tree and nothing else.
@@ -146,10 +154,12 @@ export const buildPlainSourceConfig = ({ root, plugin, hooks, reactHooks, tsPlug
             rules: { ...canonRules, ...hooks, ...BORROWED },
         },
         { files: [...PLAIN_SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
+        { name: TEST_SCOPE_BLOCK, files: [...PLAIN_SPEC_FILES], plugins: { sonarjs: sonar.sonarjs }, rules: sonarWayTestRules(sonar.sonarjs) },
     ];
 };
 /** The front-end files of a root workspace package: its workbench (drawn with Grammar) and its public face, and every `.tsx` file of the package source wherever it sits (a `src/client/` renderer is drawn too: FE-PACKAGES-2); the React-free workbench contract stays back end. */
 export const PACKAGE_SOURCE_FILES = Object.freeze(["packages/*/src/workbench/**/*.{ts,tsx}", "packages/*/src/public/**/*.{ts,tsx}", "packages/*/src/**/*.tsx"]);
+export const PACKAGE_SPEC_FILES = Object.freeze(["packages/*/src/workbench/**/*.{spec,e2e-spec}.{ts,tsx}", "packages/*/src/public/**/*.{spec,e2e-spec}.{ts,tsx}", "packages/*/src/**/*.{spec,e2e-spec}.tsx"]);
 const PACKAGE_CONTRACT = Object.freeze(["packages/*/src/workbench/contract/**"]);
 /** What a package folder never lints: installed packages, build output, generated wire types. */
 export const PACKAGE_IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**", "**/dist/**", "**/coverage/**", "**/__generated__/**"]);
@@ -164,5 +174,5 @@ export const PACKAGE_IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**
 export const scopeToPackages = (config) => config.map((block) => {
     if (block.files === undefined)
         return { ...block, ignores: [...PACKAGE_IGNORED] };
-    return { ...block, files: [...PACKAGE_SOURCE_FILES], ignores: [...(block.ignores ?? []), ...PACKAGE_CONTRACT] };
+    return { ...block, files: [...(block.name === TEST_SCOPE_BLOCK ? PACKAGE_SPEC_FILES : PACKAGE_SOURCE_FILES)], ignores: [...(block.ignores ?? []), ...PACKAGE_CONTRACT] };
 });

package/dist/sonar-parity.js

@@ -4,7 +4,7 @@
  * Each rule is the syntax-tree form of one Sonar rule, shared with the back-end canon (scripts/lib/sonar-syntax-rules.mjs,
  * bundled under `runtime/`): `no-await-in-loop` (S9382), `prefer-code-point` (S7758),
  * `prefer-string-raw` (S7780), `no-nested-conditional` (S3358), `no-void-operator` (S3735), `no-unused-import` (S1128),
- * `prefer-export-from` (S7763), `no-unused-prop-types` (S6767) and `media-has-caption` (S4084). The rest of Sonar way is the factory's
+ * `prefer-export-from` (S7763), `no-unused-prop-types` (S6767), `media-has-caption` (S4084), `no-duplicate-import` (S3863, fixable), `no-useless-fragment` (S6749, fixable), `no-nested-component` (S6478), `no-children-prop` (S6748), `use-state-destructured` (S6754), `prefer-tag-over-role` (S6819) and `no-bidirectional-character` (text:S6389). The rest of Sonar way is the factory's
  * Sonar way block (scripts/lib/sonar-way.mjs). The three Sonar rules that need the type checker, S1874 (a deprecated
  * API), S6551 (an object turned into text) and S7503 (an `async` function that never awaits), are the typescript-eslint rules
  * `no-deprecated`, `no-base-to-string` and `require-await` the factory turns on.
@@ -17,7 +17,7 @@ const syntaxRule = (name) => {
         throw new TypeError(`the runtime Sonar syntax rules publish no ${name}`);
     return rule;
 };
-const NAMES = ["no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import", "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params", "no-line-separator-literal"];
+const NAMES = ["no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import", "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params", "no-line-separator-literal", "no-bidirectional-character", "no-duplicate-import", "no-useless-fragment", "no-nested-component", "no-children-prop", "use-state-destructured", "prefer-tag-over-role"];
 /** The rules this law contributes to the plugin. */
 export const rules = Object.fromEntries(NAMES.map((name) => [name, syntaxRule(name)]));
 /** Starts at error: a repository's fix lane clears the debt before the rule ships. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.16.5",
+  "version": "9.16.7",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",
@@ -85,5 +85,7 @@
     "eslint": "^9.18.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "typescript": "^6.0.3"
-  }
+  },
+  "gitHead": "1ac3e3ed36e167ca7dbed5cad593ca8033106f44",
+  "starciSource": "7fed82137872a789ce9a69b64d07ddaca1758b3f96b2b0a8ef36935de076f28a"
 }

package/runtime/scripts/lib/sonar-syntax-rules.mjs

@@ -74,23 +74,47 @@ const KEEPS_ITS_ESCAPES = new Set(['ImportDeclaration', 'ExportAllDeclaration',
 const isMatcherValue = (node) => (node.parent?.type === 'Property' && node.parent.value === node && node.parent.key?.name === 'matcher')
   || (node.parent?.type === 'ArrayExpression' && isMatcherValue(node.parent));
 
-/** S7780: a string whose only escapes are backslashes reads better as `String.raw`. */
+/** Whether the tag is `String.raw`. */
+const isStringRaw = (tag) => tag.type === 'MemberExpression' && !tag.computed && tag.object.type === 'Identifier' && tag.object.name === 'String' && tag.property.type === 'Identifier' && tag.property.name === 'raw';
+
+/** S7780: a string whose only escapes are backslashes reads better as `String.raw`; a `String.raw` template with no backslash in it needs no tag. */
 const preferStringRaw = {
-  meta: { type: 'suggestion', schema: [], messages: { raw: 'S7780: write this string with `String.raw` so its backslashes are not escaped.' } },
+  meta: {
+    type: 'suggestion',
+    fixable: 'code',
+    schema: [],
+    messages: {
+      raw: 'S7780: write this string with `String.raw` so its backslashes are not escaped.',
+      needless: 'S7780: this `String.raw` template holds no backslash; write a plain template literal.',
+    },
+  },
   create: (context) => ({
     Literal: (node) => {
       if (KEEPS_ITS_ESCAPES.has(node.parent?.type) || node.parent?.type === 'ExpressionStatement' || isMatcherValue(node)) return;
       if (onlyBackslashEscapes(node)) context.report({ node, messageId: 'raw' });
     },
+    TaggedTemplateExpression: (node) => {
+      if (!isStringRaw(node.tag) || node.quasi.quasis.some((quasi) => quasi.value.raw.includes('\\'))) return;
+      context.report({ node, messageId: 'needless', fix: (fixer) => fixer.removeRange([node.tag.range[0], node.quasi.range[0]]) });
+    },
   }),
 };
 
-/** S3358: a conditional expression inside another conditional expression is read inside out; name the inner one. */
+/** What starts a new reading context between two conditional expressions: the inner one is then a value of its own, not a branch of the outer. */
+const BREAKS_NESTING = new Set(['ArrayExpression', 'ObjectExpression', 'FunctionExpression', 'ArrowFunctionExpression', 'JSXExpressionContainer']);
+
+/** S3358: a conditional expression anywhere inside another one (a branch, a test, a call argument, a template, a cast), up to an array, object, function or JSX expression, is read inside out; name the inner one. */
 const noNestedConditional = {
   meta: { type: 'suggestion', schema: [], messages: { nested: 'S3358: extract this nested conditional expression into its own statement or a named function.' } },
   create: (context) => ({
     ConditionalExpression: (node) => {
-      if (node.parent?.type === 'ConditionalExpression') context.report({ node, messageId: 'nested' });
+      for (let parent = node.parent; parent; parent = parent.parent) {
+        if (parent.type === 'ConditionalExpression') {
+          context.report({ node, messageId: 'nested' });
+          return;
+        }
+        if (BREAKS_NESTING.has(parent.type)) return;
+      }
     },
   }),
 };
@@ -264,6 +288,233 @@ const noLineSeparatorLiteral = {
   }),
 };
 
+/** The line width of @starci/prettier-config: a merged import longer than this is laid out one specifier a line. */
+const PRINT_WIDTH = 120;
+const TRAILING_BLANK = /[ \t]*\r?\n?/y;
+
+/** S3863: one module is imported once; a value and a type from the same module are one `import { value, type Type }`. */
+const noDuplicateImport = {
+  meta: { type: 'suggestion', fixable: 'code', schema: [], messages: { duplicate: 'S3863: \'{{ source }}\' is imported more than once. Merge the imports into one: `import { value, type Type } from \'{{ source }}\'`.' } },
+  create: (context) => {
+    const { sourceCode } = context;
+    const groups = new Map();
+    /** The specifier list of one merged import, or null when the group cannot be merged without changing what it binds. */
+    const mergedText = (group) => {
+      const defaults = group.filter((declaration) => declaration.specifiers.some((specifier) => specifier.type === 'ImportDefaultSpecifier'));
+      const mergeable = group.every((declaration) => (declaration.attributes?.length ?? 0) === 0 && declaration.specifiers.every((specifier) => specifier.type !== 'ImportNamespaceSpecifier'))
+        && defaults.length <= 1 && defaults.every((declaration) => declaration.importKind !== 'type');
+      if (!mergeable) return null;
+      const allType = group.every((declaration) => declaration.importKind === 'type');
+      const names = new Set();
+      for (const declaration of group) {
+        for (const specifier of declaration.specifiers) {
+          if (specifier.type !== 'ImportSpecifier') continue;
+          const text = sourceCode.getText(specifier);
+          names.add(declaration.importKind === 'type' && !allType && specifier.importKind !== 'type' ? `type ${text}` : text);
+        }
+      }
+      const head = defaults[0]?.specifiers.find((specifier) => specifier.type === 'ImportDefaultSpecifier');
+      const parts = [head ? sourceCode.getText(head) : null, names.size > 0 ? `{ ${[...names].join(', ')} }` : null].filter(Boolean);
+      const semicolon = sourceCode.getText(group[0]).endsWith(';') ? ';' : '';
+      const kind = allType ? 'type ' : '';
+      const tail = ` from ${sourceCode.getText(group[0].source)}${semicolon}`;
+      const single = `import ${kind}${parts.join(', ')}${tail}`;
+      if (single.length <= PRINT_WIDTH || names.size === 0) return single;
+      // as Prettier lays out an import that does not fit one line: one specifier a line, a trailing comma
+      const lines = [...names].map((name) => `    ${name},`).join('\n');
+      return `import ${kind}${head ? `${sourceCode.getText(head)}, ` : ''}{\n${lines}\n}${tail}`;
+    };
+    const removal = (declaration) => {
+      TRAILING_BLANK.lastIndex = declaration.range[1];
+      const tail = TRAILING_BLANK.exec(sourceCode.text);
+      return [declaration.range[0], declaration.range[1] + (tail ? tail[0].length : 0)];
+    };
+    return {
+      ImportDeclaration: (node) => {
+        if (node.specifiers.length === 0) return;
+        const key = `${String(node.source.value)}\u0000${(node.attributes ?? []).map((attribute) => sourceCode.getText(attribute)).join(',')}`;
+        groups.set(key, [...(groups.get(key) ?? []), node]);
+      },
+      'Program:exit': () => {
+        for (const group of groups.values()) {
+          if (group.length < 2) continue;
+          const merged = mergedText(group);
+          group.slice(1).forEach((declaration, index) => {
+            const fix = index === 0 && merged !== null
+              ? (fixer) => [fixer.replaceText(group[0], merged), ...group.slice(1).map((later) => fixer.removeRange(removal(later)))]
+              : undefined;
+            context.report({ node: declaration, messageId: 'duplicate', data: { source: String(declaration.source.value) }, fix });
+          });
+        }
+      },
+    };
+  },
+};
+
+/** The first non-whitespace-only children of a fragment or element: JSX trims a text of blanks that holds a line break. */
+const significantChildren = (children) => children.filter((child) => !(child.type === 'JSXText' && /^\s*$/u.test(child.value) && /[\r\n]/u.test(child.value)) && !(child.type === 'JSXExpressionContainer' && child.expression.type === 'JSXEmptyExpression'));
+
+/** Whether the opening element is a fragment: `<>` (a JSXFragment) is handled apart, this is `<Fragment>` or `<React.Fragment>`. */
+const isFragmentElement = (opening) => (opening.name.type === 'JSXIdentifier' && opening.name.name === 'Fragment')
+  || (opening.name.type === 'JSXMemberExpression' && opening.name.property.name === 'Fragment' && opening.name.object.type === 'JSXIdentifier');
+
+/** S6749: a fragment that wraps nothing or one child is removed; the child stands for it. */
+const noUselessFragment = {
+  meta: {
+    type: 'suggestion',
+    fixable: 'code',
+    schema: [],
+    messages: {
+      empty: 'S6749: remove this empty fragment.',
+      single: 'S6749: this fragment wraps one child; remove the fragment and keep the child.',
+    },
+  },
+  create: (context) => {
+    const { sourceCode } = context;
+    const check = (node, children) => {
+      const parentIsJsx = node.parent?.type === 'JSXElement' || node.parent?.type === 'JSXFragment';
+      const kept = significantChildren(children);
+      if (kept.length === 0) {
+        context.report({ node, messageId: 'empty' });
+        return;
+      }
+      if (kept.length !== 1) return;
+      const [only] = kept;
+      if (only.type === 'JSXText' && !parentIsJsx) return;
+      const fix = only.type === 'JSXElement' || only.type === 'JSXFragment' ? (fixer) => fixer.replaceText(node, sourceCode.getText(only)) : undefined;
+      context.report({ node, messageId: 'single', fix });
+    };
+    return {
+      JSXFragment: (node) => check(node, node.children),
+      JSXElement: (node) => {
+        if (isFragmentElement(node.openingElement) && node.openingElement.attributes.length === 0) check(node, node.children);
+      },
+    };
+  },
+};
+
+const isUppercaseName = (name) => typeof name === 'string' && /^[A-Z]/u.test(name);
+
+/** The name a function is bound to: its own id, or the variable that holds it directly or through `memo(...)` / `forwardRef(...)`. */
+function functionName(node) {
+  if (node.id?.name) return node.id.name;
+  let holder = node.parent;
+  while (holder?.type === 'CallExpression') holder = holder.parent;
+  return holder?.type === 'VariableDeclarator' && holder.id.type === 'Identifier' ? holder.id.name : null;
+}
+
+/** S6478: a component declared inside another component is a new type on every render and remounts its subtree; declare it at module level. */
+const noNestedComponent = {
+  meta: { type: 'problem', schema: [], messages: { nested: 'S6478: the component `{{ name }}` is declared inside the component `{{ outer }}`, so it is a new component on every render and its state is lost. Move it to module level and pass what it reads as props.' } },
+  create: (context) => {
+    const frames = [];
+    const enter = (node) => frames.push({ node, name: functionName(node), jsx: false, nested: [] });
+    const markJsx = () => frames.forEach((frame) => { frame.jsx = true; });
+    const exit = () => {
+      const frame = frames.pop();
+      if (isUppercaseName(frame.name) && frame.jsx) {
+        const outer = [...frames].reverse().find((candidate) => isUppercaseName(candidate.name));
+        outer?.nested.push(frame);
+      }
+      if (frame.jsx) for (const inner of frame.nested) context.report({ node: inner.node.id ?? inner.node.parent ?? inner.node, messageId: 'nested', data: { name: inner.name, outer: frame.name } });
+    };
+    return { FunctionDeclaration: enter, FunctionExpression: enter, ArrowFunctionExpression: enter, 'FunctionDeclaration:exit': exit, 'FunctionExpression:exit': exit, 'ArrowFunctionExpression:exit': exit, JSXElement: markJsx, JSXFragment: markJsx };
+  },
+};
+
+/** S6748: children go between the tags. Where they cannot (a connected block that renders a pure component), the slot has a name of its own. */
+const noChildrenProp = {
+  meta: {
+    type: 'problem',
+    schema: [],
+    messages: {
+      children: 'S6748: do not pass `children` as a prop; nest the content between the tags. In a connected block (`blocks/*/index.tsx`, FE_CONNECTED_BLOCK_RENDER_PAIR, FE_WORLD_OWNER_RENDER_BOUNDARY) nesting is not available: pass the slot under a prop of another name (`content`, `footer`, ...) to the pure component.',
+    },
+  },
+  create: (context) => ({
+    JSXAttribute: (node) => {
+      if (node.name.type === 'JSXIdentifier' && node.name.name === 'children') context.report({ node, messageId: 'children' });
+    },
+    CallExpression: (node) => {
+      const callee = node.callee;
+      const creates = (callee.type === 'Identifier' && callee.name === 'createElement') || (callee.type === 'MemberExpression' && !callee.computed && callee.property.type === 'Identifier' && callee.property.name === 'createElement');
+      const props = node.arguments[1];
+      if (!creates || props?.type !== 'ObjectExpression') return;
+      for (const property of props.properties) {
+        if (property.type === 'Property' && !property.computed && (property.key.name === 'children' || property.key.value === 'children')) context.report({ node: property, messageId: 'children' });
+      }
+    },
+  }),
+};
+
+/** S6754: `useState` is destructured into a value and its setter, named after each other. */
+const useStateDestructured = {
+  meta: {
+    type: 'suggestion',
+    schema: [],
+    messages: {
+      pair: 'S6754: destructure the `useState` result into a value and its setter: `const [value, setValue] = useState(...)`.',
+      symmetric: 'S6754: name the setter after the value: `[{{ value }}, set{{ Value }}]`.',
+    },
+  },
+  create: (context) => ({
+    CallExpression: (node) => {
+      const callee = node.callee;
+      const isUseState = (callee.type === 'Identifier' && callee.name === 'useState') || (callee.type === 'MemberExpression' && !callee.computed && callee.property.type === 'Identifier' && callee.property.name === 'useState');
+      if (!isUseState || node.parent?.type !== 'VariableDeclarator' || node.parent.init !== node) return;
+      const id = node.parent.id;
+      if (id.type !== 'ArrayPattern' || id.elements.length !== 2) {
+        context.report({ node: id, messageId: 'pair' });
+        return;
+      }
+      const [value, setter] = id.elements;
+      if (value?.type !== 'Identifier' || setter?.type !== 'Identifier') return;
+      const Value = value.name.charAt(0).toUpperCase() + value.name.slice(1);
+      if (setter.name !== `set${Value}`) context.report({ node: setter, messageId: 'symmetric', data: { value: value.name, Value } });
+    },
+  }),
+};
+
+/** The native element each ARIA role stands for: a host element with the role and another tag is written as the native one (S6819). A role with no native element, or an ambiguous one (`img` on an `svg`, `group`), is not listed. */
+const NATIVE_FOR_ROLE = Object.freeze({
+  status: ['output'], navigation: ['nav'], main: ['main'], article: ['article'], complementary: ['aside'], contentinfo: ['footer'], banner: ['header'],
+  form: ['form'], button: ['button'], dialog: ['dialog'], figure: ['figure'], heading: ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'], link: ['a'],
+  list: ['ul', 'ol', 'menu'], listitem: ['li'], progressbar: ['progress'], region: ['section'], separator: ['hr'], table: ['table'], row: ['tr'], cell: ['td'],
+  columnheader: ['th'], rowheader: ['th'], checkbox: ['input'], radio: ['input'], slider: ['input'], spinbutton: ['input'], searchbox: ['input'],
+  textbox: ['input', 'textarea'], option: ['option'], combobox: ['select', 'input'], term: ['dt'], definition: ['dd'],
+});
+
+/** S6819: a native element carries its role; a host element given a `role` that another native element has is that element. */
+const preferTagOverRole = {
+  meta: { type: 'suggestion', schema: [], messages: { tag: 'S6819: use the native <{{ tag }}> element instead of role="{{ role }}" on <{{ name }}>.' } },
+  create: (context) => ({
+    JSXOpeningElement: (node) => {
+      if (node.name.type !== 'JSXIdentifier' || !/^[a-z]/u.test(node.name.name)) return;
+      const attribute = attributeOf(node, 'role');
+      const literal = attribute?.value?.type === 'JSXExpressionContainer' ? attribute.value.expression : attribute?.value;
+      const role = literal?.type === 'Literal' ? literal.value : undefined;
+      const tags = typeof role === 'string' ? NATIVE_FOR_ROLE[role.trim().split(/\s+/u)[0]] : undefined;
+      if (tags === undefined || tags.includes(node.name.name)) return;
+      context.report({ node: attribute, messageId: 'tag', data: { tag: tags[0], role: role.trim(), name: node.name.name } });
+    },
+  }),
+};
+
+/** The bidirectional control characters of text:S6389: they reorder the text a reader sees against the text the compiler reads. */
+const BIDI_CONTROLS = /[‪-‮⁦-⁩]/gu;
+/** text:S6389 (Trojan Source): a raw embedding, override, isolate or pop control character anywhere in a file, specs included, is refused. */
+const noBidirectionalCharacter = {
+  meta: { type: 'problem', schema: [], messages: { raw: 'A bidirectional control character ({{ code }}) reorders how this line reads. Write the escape `\\u{{{ hex }}}` inside a string, template or regular expression, or delete the character anywhere else.' } },
+  create: (context) => ({
+    Program: () => {
+      for (const found of context.sourceCode.text.matchAll(BIDI_CONTROLS)) {
+        const hex = found[0].codePointAt(0).toString(16).toUpperCase();
+        context.report({ loc: context.sourceCode.getLocFromIndex(found.index), messageId: 'raw', data: { code: `U+${hex}`, hex } });
+      }
+    },
+  }),
+};
+
 /** The files the example scans leave out: a unit spec and an end-to-end spec (the regex, and the flat-config globs of the same set). */
 const OUTSIDE_THE_SCAN = /\.(?:e2e-)?spec\.[cm]?[jt]sx?$/;
 export const OUTSIDE_THE_SCAN_FILES = Object.freeze(['**/*.spec.{js,mjs,cjs,ts,mts,cts,jsx,tsx}', '**/*.e2e-spec.{js,mjs,cjs,ts,mts,cts,jsx,tsx}']);
@@ -271,7 +522,7 @@ export const OUTSIDE_THE_SCAN_FILES = Object.freeze(['**/*.spec.{js,mjs,cjs,ts,m
 /** The rule judging only the files the scan judges. */
 const scanned = (rule) => ({ ...rule, create: (context) => (OUTSIDE_THE_SCAN.test(context.filename) ? {} : rule.create(context)) });
 
-/** The rules both canons publish, by published name. */
+/** The rules both canons publish, by published name (the React ones, from `no-useless-fragment` to `prefer-tag-over-role`, only the front end names). */
 export const SONAR_SYNTAX_RULES = Object.freeze({
   'no-await-in-loop': scanned(noAwaitInLoop),
   'prefer-code-point': scanned(preferCodePoint),
@@ -284,4 +535,11 @@ export const SONAR_SYNTAX_RULES = Object.freeze({
   'media-has-caption': scanned(mediaHasCaption),
   'max-params': scanned(maxParams),
   'no-line-separator-literal': noLineSeparatorLiteral,
+  'no-bidirectional-character': noBidirectionalCharacter,
+  'no-duplicate-import': scanned(noDuplicateImport),
+  'no-useless-fragment': scanned(noUselessFragment),
+  'no-nested-component': scanned(noNestedComponent),
+  'no-children-prop': scanned(noChildrenProp),
+  'use-state-destructured': scanned(useStateDestructured),
+  'prefer-tag-over-role': scanned(preferTagOverRole),
 });

package/runtime/scripts/lib/sonar-way.mjs

@@ -34,12 +34,33 @@ export const SONAR_WAY_NOT_APPLICABLE = Object.freeze({
 
 /**
  * The Sonar way rules SonarSource implements on an ESLint rule outside eslint-plugin-sonarjs: `{ sonar, rule, options? }`. The canon syntax
- * rules carry S107 (`max-params`, which spares the constructor of an injectable class as the server does) and S4084 (`media-has-caption`,
- * front end); S6582 is typescript-eslint's `prefer-optional-chain`, which needs the type information the canons' typed block provides.
+ * rules (sonar-syntax-rules.mjs) carry S107 (`max-params`, which spares the constructor of an injectable class as the server does), S3863
+ * (`no-duplicate-import`: a value and a type from one module are one import, and `--fix` merges them), S4084 (`media-has-caption`), S6478
+ * (`no-nested-component`), S6748 (`no-children-prop`), S6749 (`no-useless-fragment`), S6754 (`use-state-destructured`) and S6819
+ * (`prefer-tag-over-role`), the last five front end; S6582 is typescript-eslint's `prefer-optional-chain`, which needs the type information
+ * the canons' typed block provides, and so do S6606 and S4123. S7718 keeps `cause` as a catch parameter's name beside `error` (and `error_`
+ * where `error` is already declared): the scan accepts it, and the back end's wrapped failures are named so.
  */
 export const SONAR_WAY_EXTRA = Object.freeze([
-  { sonar: 'S3863', rule: 'no-duplicate-imports', options: [{ allowSeparateTypeImports: true }] },
   { sonar: 'S6582', rule: '@typescript-eslint/prefer-optional-chain' },
+  { sonar: 'S6606', rule: '@typescript-eslint/prefer-nullish-coalescing' },
+  { sonar: 'S4123', rule: '@typescript-eslint/await-thenable' },
+  { sonar: 'S1186', rule: '@typescript-eslint/no-empty-function' },
+  { sonar: 'S6671', rule: 'prefer-promise-reject-errors', options: [{ allowEmptyReject: false }] },
+  { sonar: 'S6325', rule: 'prefer-regex-literals' },
+  { sonar: 'S878', rule: 'no-sequences', options: [{ allowInParentheses: false }] },
+  { sonar: 'S6535', rule: 'no-useless-escape' },
+  { sonar: 'S6661', rule: 'prefer-object-spread' },
+  { sonar: 'S7718', rule: 'unicorn/catch-error-name', options: [{ name: 'error', ignore: [/^cause$/u] }] },
+  { sonar: 'S7727', rule: 'unicorn/no-array-callback-reference' },
+  { sonar: 'S7737', rule: 'unicorn/no-object-as-default-parameter' },
+  { sonar: 'S7739', rule: 'unicorn/no-thenable' },
+  { sonar: 'S7746', rule: 'unicorn/no-useless-promise-resolve-reject' },
+  { sonar: 'S7753', rule: 'unicorn/prefer-array-index-of' },
+  { sonar: 'S7755', rule: 'unicorn/prefer-at' },
+  { sonar: 'S7766', rule: 'unicorn/prefer-math-min-max' },
+  { sonar: 'S7781', rule: 'unicorn/prefer-string-replace-all' },
+  { sonar: 'S7787', rule: 'unicorn/require-module-specifiers' },
   { sonar: 'S4138', rule: 'unicorn/no-for-loop' },
   { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping' },
   { sonar: 'S7732', rule: 'unicorn/no-instanceof-builtins' },
@@ -56,6 +77,36 @@ export const SONAR_WAY_EXTRA = Object.freeze([
   { sonar: 'S7784', rule: 'unicorn/prefer-structured-clone' },
 ]);
 
+/**
+ * The sonarjs rules whose Sonar scope is Tests (a `scope = 'Tests'` in the rule's generated meta, asserted in sonar-way.spec.ts): the scan
+ * runs them over the files `sonar.tests` names and not over the product source, so the canons run them over the specs and nowhere else
+ * is added. S9073 is outside sonarjs' own recommended set and inside the profile.
+ */
+export const SONAR_WAY_TEST_RULES = Object.freeze([
+  'no-skipped-tests', 'no-empty-test-file', 'assertions-in-tests', 'no-fixed-wait-in-tests', 'no-incomplete-assertions', 'inverted-assertion-arguments',
+  'no-incompatible-assertion-types', 'no-same-argument-assert', 'prefer-specific-assertions', 'no-trivial-assertions', 'test-check-exception',
+  'stable-tests', 'parameterized-tests', 'no-code-after-done', 'disabled-timeout', 'chai-determinate-assertion', 'no-exclusive-tests',
+  'no-duplicate-test-title', 'async-test-assertions', 'no-empty-test-title', 'hooks-before-test-cases', 'no-forced-browser-interaction',
+  'assertions-in-test-cases', 'synchronous-suite-callback', 'no-debug-commands-in-ui-tests', 'no-interpolation-in-inline-snapshots',
+  'explicit-test-skip', 'no-empty-parameterized-test-dataset', 'testing-library-query-assertion', 'synchronous-exception-assertions',
+  'composite-assertions', 'no-duplicate-parameterized-test-case', 'testing-library-prefer-query-by-disappearance', 'prefer-cypress-should',
+  'vitest-mock-at-module-scope', 'no-networkidle-wait',
+]);
+
+/**
+ * The flat-config rule levels of the test-scoped Sonar way rules, for the spec files the product source block leaves out.
+ *
+ * @param {object} sonarjs - The eslint-plugin-sonarjs plugin.
+ */
+export function sonarWayTestRules(sonarjs) {
+  const rules = {};
+  for (const name of SONAR_WAY_TEST_RULES) {
+    const declared = sonarjs.configs.recommended.rules[`sonarjs/${name}`];
+    rules[`sonarjs/${name}`] = ['error', ...(Array.isArray(declared) ? declared.slice(1) : [])];
+  }
+  return rules;
+}
+
 /** The ESM-only Sonar way rules: S7785 prefers top-level await (see SONAR_WAY_NOT_APPLICABLE). */
 const SONAR_WAY_ESM = Object.freeze([{ sonar: 'S7785', rule: 'unicorn/prefer-top-level-await' }]);