@ttsc/lint 0.30.3 → 0.31.0

package/linthost/jsdoc_helpers_test.go

@@ -0,0 +1,30 @@
+package linthost
+
+import (
+  "testing"
+
+  shimast "github.com/microsoft/typescript-go/shim/ast"
+)
+
+func assertJSDocRuleLines(t *testing.T, ruleName, source string, lines ...int) {
+  t.Helper()
+  file := parseTSFile(t, "/virtual/jsdoc.ts", source)
+  findings := NewEngine(RuleConfig{ruleName: SeverityError}).Run([]*shimast.SourceFile{file}, nil)
+  for _, finding := range findings {
+    if finding.engineFailure {
+      t.Fatalf("%s: expected ordinary rule findings, got engine failure: %+v", ruleName, finding)
+    }
+  }
+  actual := normalizeRuleFindings(file, findings)
+  if len(actual) != len(lines) {
+    t.Fatalf("%s: want lines %v, got %+v", ruleName, lines, actual)
+  }
+  for i, line := range lines {
+    if actual[i].Rule != ruleName || actual[i].Severity != SeverityError || actual[i].Line != line {
+      t.Fatalf("%s[%d]: want line %d, got %+v; all findings=%+v", ruleName, i, line, actual[i], actual)
+    }
+  }
+  if len(lines) != 0 {
+    recordBehavioralWitness(t, ruleName, behavioralWitnessEngine)
+  }
+}

package/linthost/jsx_a11y_alt_text_allows_img_spread_props_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAltTextAllowsImgSpreadProps verifies jsx-a11y/alt-text stays quiet
+// for an img whose only attribute is a spread.
+//
+// A `{...props}` spread makes the attribute set unknown at lint time, and the
+// alt text may be inside it, so the rule must not guess. This case also guards
+// the former crash of the attribute walk on spread members.
+//
+// 1. Run only `jsx-a11y/alt-text` over `<img {...props} />` in a TSX file.
+// 2. Require no finding, which also fails on a recovered rule panic.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleSkips parses the TSX source with parseTSXFile and runs NewEngine.Run with only jsx-a11y/alt-text enabled at error severity. The Test requires zero findings for the spread-only img, so a missing-alt report and an engine-failure finding produced by a recovered panic would both fail it.
+// @evidence contracts/testing.md#independent-expectations Because the missing-attribute check is conservative, alt may arrive through an unknown spread. The authored source and the zero expectation follow from that policy rather than from sampling rule output.
+// @evidence contracts/testing.md#distinguishing-cases The Test is the spread-accepted case. TestJsxA11yAltTextRequiresImgAlt reports an img with a known set of attributes that lacks alt and accepts one with alt.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleSkips call, executing the rule engine on a parsed virtual TSX file in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAltTextAllowsImgSpreadProps(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/alt-text", `declare const props: object; const Component = () => <img {...props} />;`)
+}

package/linthost/jsx_a11y_alt_text_requires_img_alt_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAltTextRequiresImgAlt verifies jsx-a11y/alt-text reports an img
+// without a text alternative and accepts one with alt.
+//
+// This is the intrinsic-element branch of the rule, which reads JSX attributes
+// without any React component metadata.
+//
+//  1. Run only `jsx-a11y/alt-text` over `<img src="avatar.png" />` and expect
+//     one finding whose message contains "alt text".
+//  2. Run it over the same img with `alt="Profile"` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/alt-text enabled. The img without alt yields exactly one ordinary SeverityError finding from that rule whose message contains "alt text"; assertJsxA11yRuleSkips requires zero findings for the img with alt="Profile".
+// @evidence contracts/testing.md#independent-expectations An image needs a text alternative, and an explicit alt string provides one. The two literal sources and the "alt text" message fragment are authored from that accessibility policy.
+// @evidence contracts/testing.md#distinguishing-cases The two sources are the same avatar img with and without the alt attribute. The alternatives alt can be replaced by (aria-label, aria-labelledby) and the spread case are not exercised here; the spread case belongs to TestJsxA11yAltTextAllowsImgSpreadProps.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAltTextRequiresImgAlt(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/alt-text", `const Component = () => <img src="avatar.png" />;`, "alt text")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/alt-text", "declare const props: object; const Component = () => <img src=\"avatar.png\" alt=\"Profile\" />;")
+}

package/linthost/jsx_a11y_anchor_ambiguous_text_test.go

@@ -0,0 +1,24 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAnchorAmbiguousTextRejectsClickHere verifies
+// jsx-a11y/anchor-ambiguous-text reports an anchor whose text is the ambiguous
+// phrase "click here" and accepts descriptive text.
+//
+// Screen-reader users navigate by listing links, where "click here" or "more"
+// carry no information about the destination.
+//
+//  1. Run only `jsx-a11y/anchor-ambiguous-text` over
+//     `<a href="/docs">click here</a>` and expect one finding whose message
+//     contains "ambiguous".
+//  2. Run it over `<a href="/docs">Documentation</a>` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/anchor-ambiguous-text enabled. The "click here" anchor yields exactly one ordinary SeverityError finding from that rule whose message contains "ambiguous"; assertJsxA11yRuleSkips requires zero findings for the Documentation anchor.
+// @evidence contracts/testing.md#independent-expectations Descriptive link text identifies the destination for assistive navigation, while "click here" does not. The two literal sources and the "ambiguous" message fragment are authored from that policy.
+// @evidence contracts/testing.md#distinguishing-cases The two anchors share the same /docs href and differ only in their text. The other phrases in the rule's list ("here", "link", "more", "read more", ...) and case or whitespace normalisation are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAnchorAmbiguousTextRejectsClickHere(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/anchor-ambiguous-text", `const Component = () => <a href="/docs">click here</a>;`, "ambiguous")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/anchor-ambiguous-text", "declare const props: object; const Component = () => <a href=\"/docs\">Documentation</a>;")
+}

package/linthost/jsx_a11y_anchor_has_content_rejects_empty_anchor_test.go

@@ -0,0 +1,25 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAnchorHasContentRejectsEmptyAnchor verifies
+// jsx-a11y/anchor-has-content reports empty paired and self-closing anchors
+// and accepts an anchor with text.
+//
+// These links have neither content nor an explicit accessible label.
+// Both paired and self-closing JSX can omit those name sources.
+//
+//  1. Run only `jsx-a11y/anchor-has-content` over `<a href="/home"></a>` and
+//     over `<a href="/home" />`, expecting one finding each whose message
+//     contains "content".
+//  2. Run it over `<a href="/home">Home</a>` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses each TSX source and runs NewEngine.Run with only jsx-a11y/anchor-has-content enabled. The paired empty anchor and the self-closing anchor each yield exactly one ordinary SeverityError finding from that rule whose message contains "content"; assertJsxA11yRuleSkips requires zero findings for the anchor containing Home.
+// @evidence contracts/testing.md#independent-expectations Visible text gives a link its accessible name, so an anchor with neither text nor a label is a violation in both element syntaxes. The three literal sources and the "content" fragment are authored from that policy.
+// @evidence contracts/testing.md#distinguishing-cases All three anchors share the /home href; the paired and self-closing forms report and the form with child text does not. Other accessible-name sources (aria-label and similar) are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with two assertJsxA11yRuleFinds calls and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAnchorHasContentRejectsEmptyAnchor(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/anchor-has-content", `const Component = () => <a href="/home"></a>;`, "content")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/anchor-has-content", `const Component = () => <a href="/home" />;`, "content")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/anchor-has-content", "declare const props: object; const Component = () => <a href=\"/home\">Home</a>;")
+}

package/linthost/jsx_a11y_anchor_is_valid_allows_spread_props_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAnchorIsValidAllowsSpreadProps verifies jsx-a11y/anchor-is-valid
+// stays quiet for an anchor whose only attribute is a spread.
+//
+// The href may arrive through `{...props}`, so the missing-href report must not
+// fire; this also guards the former crash of the attribute walk on spread
+// members.
+//
+// 1. Run only `jsx-a11y/anchor-is-valid` over `<a {...props}>documentation</a>`.
+// 2. Require no finding, which also fails on a recovered rule panic.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleSkips parses the TSX source and runs NewEngine.Run with only jsx-a11y/anchor-is-valid enabled at error severity. The Test requires zero findings for the spread-only anchor, so a missing-href report and an engine-failure finding produced by a recovered panic would both fail it.
+// @evidence contracts/testing.md#independent-expectations A spread may supply href, so its absence cannot be proven statically and must not be reported. The authored source and the zero expectation follow from that policy rather than from sampling rule output.
+// @evidence contracts/testing.md#distinguishing-cases This is the spread-accepted case with no explicit href. TestJsxA11yAnchorIsValidRejectsHashHrefDespiteSpread covers an explicit invalid href beside a spread, and the hash-href Test covers it without a spread.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleSkips call, executing the rule engine on a parsed virtual TSX file in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAnchorIsValidAllowsSpreadProps(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/anchor-is-valid", `declare const props: object; const Component = () => <a {...props}>documentation</a>;`)
+}

package/linthost/jsx_a11y_anchor_is_valid_rejects_hash_href_despite_spread_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAnchorIsValidRejectsHashHrefDespiteSpread verifies a spread does
+// not suppress an explicit invalid href in jsx-a11y/anchor-is-valid.
+//
+// The conservative spread handling applies only to reports about an absent
+// attribute; an explicitly written `href="#"` is a violation on its own.
+//
+//  1. Run only `jsx-a11y/anchor-is-valid` over `<a href="#" {...props}>` and
+//     expect one finding whose message contains "valid navigation target".
+//  2. Run it over `<a href="/docs" {...props}>` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/anchor-is-valid enabled. The anchor with href="#" and a spread yields exactly one ordinary SeverityError finding from that rule whose message contains "valid navigation target"; assertJsxA11yRuleSkips requires zero findings for href="/docs" with the same spread.
+// @evidence contracts/testing.md#independent-expectations The lint policy reports an explicitly authored hash-only placeholder despite an unknown spread, and accepts the authored /docs path. Literal fixtures and the message fragment independently pin that static policy; the test does not certify browser navigation, destination existence or the final runtime spread value.
+// @evidence contracts/testing.md#distinguishing-cases The two sources keep the same spread and differ only in the href value, so the spread cannot be what silences or triggers the report. The spread-only anchor is covered by TestJsxA11yAnchorIsValidAllowsSpreadProps.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAnchorIsValidRejectsHashHrefDespiteSpread(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/anchor-is-valid", `declare const props: object; const Component = () => <a href="#" {...props}>documentation</a>;`, "valid navigation target")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/anchor-is-valid", "declare const props: object; const Component = () => <a href=\"/docs\" {...props}>documentation</a>;")
+}

package/linthost/jsx_a11y_anchor_is_valid_rejects_hash_href_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAnchorIsValidRejectsHashHref verifies jsx-a11y/anchor-is-valid
+// reports a hash-only href and accepts a real relative path.
+//
+// The rule handles the high-confidence invalid targets that need no router
+// settings: an empty href, a hash-only href and a javascript: URL.
+//
+//  1. Run only `jsx-a11y/anchor-is-valid` over `<a href="#">Home</a>` and
+//     expect one finding whose message contains "href".
+//  2. Run it over `<a href="/home">Home</a>` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/anchor-is-valid enabled. The anchor with href="#" yields exactly one ordinary SeverityError finding from that rule whose message contains "href"; assertJsxA11yRuleSkips requires zero findings for href="/home".
+// @evidence contracts/testing.md#independent-expectations The lint policy treats the literal hash-only href as a placeholder and accepts the authored /home path. The literal pair and message fragment are independent policy expectations; no browser navigation or destination existence is asserted.
+// @evidence contracts/testing.md#distinguishing-cases The two anchors share the Home label and differ only in the href value. The empty href and javascript: URL branches, and spread handling, are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAnchorIsValidRejectsHashHref(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/anchor-is-valid", `const Component = () => <a href="#">Home</a>;`, "href")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/anchor-is-valid", "declare const props: object; const Component = () => <a href=\"/home\">Home</a>;")
+}

package/linthost/jsx_a11y_aria_activedescendant_has_tabindex_requires_focus_target_test.go

@@ -0,0 +1,23 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaActivedescendantHasTabindexRequiresFocusTarget verifies
+// jsx-a11y/aria-activedescendant-has-tabindex reports an element that sets
+// aria-activedescendant without tabIndex and accepts one with tabIndex.
+//
+// aria-activedescendant only works from a focused container, so the rule ties
+// the attribute to a sibling tabIndex on the same tag.
+//
+//  1. Run only the rule over `<div aria-activedescendant="item-1" />` and
+//     expect one finding whose message contains "tabIndex".
+//  2. Run it over the same div with `tabIndex={0}` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-activedescendant-has-tabindex enabled. The div without tabIndex yields exactly one ordinary SeverityError finding from that rule whose message contains "tabIndex"; assertJsxA11yRuleSkips requires zero findings for the div with tabIndex={0}.
+// @evidence contracts/testing.md#independent-expectations A tabIndex of zero makes the controlling container focusable, which is what aria-activedescendant requires. The two literal sources and the "tabIndex" fragment are authored from that policy.
+// @evidence contracts/testing.md#distinguishing-cases The two sources are the same div with and without tabIndex={0}. A negative tabIndex, a lowercase tabindex attribute and spread attributes are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaActivedescendantHasTabindexRequiresFocusTarget(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-activedescendant-has-tabindex", `const Component = () => <div aria-activedescendant="item-1" />;`, "tabIndex")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-activedescendant-has-tabindex", "declare const props: object; const Component = () => <div aria-activedescendant=\"item-1\" tabIndex={0} />;")
+}

package/linthost/jsx_a11y_aria_props_rejects_unknown_prop_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaPropsRejectsUnknownProp verifies jsx-a11y/aria-props reports a
+// misspelled aria-* attribute and accepts the canonical spelling.
+//
+// The rule is attribute-local and checks the aria-* name against the ARIA
+// vocabulary before any role compatibility rule applies.
+//
+//  1. Run only `jsx-a11y/aria-props` over `<div aria-labeledby="title" />` and
+//     expect one finding whose message contains "Unknown ARIA".
+//  2. Run it over `<div aria-labelledby="title" />` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-props enabled. The attribute aria-labeledby yields exactly one ordinary SeverityError finding from that rule whose message contains "Unknown ARIA"; assertJsxA11yRuleSkips requires zero findings for aria-labelledby.
+// @evidence contracts/testing.md#independent-expectations The ARIA vocabulary spells the reference attribute aria-labelledby with two l characters, so the one-l spelling is unknown. The two literal sources and the "Unknown ARIA" fragment are authored from the ARIA specification.
+// @evidence contracts/testing.md#distinguishing-cases The two divs share the title value and differ only in the attribute spelling. Other aria-* attributes are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaPropsRejectsUnknownProp(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-props", `const Component = () => <div aria-labeledby="title" />;`, "Unknown ARIA")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-props", "declare const props: object; const Component = () => <div aria-labelledby=\"title\" />;")
+}

package/linthost/jsx_a11y_aria_proptypes_rejects_bad_boolean_test.go

@@ -0,0 +1,23 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaProptypesRejectsBadBoolean verifies jsx-a11y/aria-proptypes
+// reports a non-boolean string literal on a boolean ARIA attribute and accepts
+// a boolean literal.
+//
+// The rule checks known string literals against the attribute's value shape and
+// leaves dynamic expressions alone.
+//
+//  1. Run only `jsx-a11y/aria-proptypes` over `<div aria-hidden="maybe" />` and
+//     expect one finding whose message contains "true or false".
+//  2. Run it over `<div aria-hidden="false" />` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-proptypes enabled. aria-hidden="maybe" yields exactly one ordinary SeverityError finding from that rule whose message contains "true or false"; assertJsxA11yRuleSkips requires zero findings for aria-hidden="false".
+// @evidence contracts/testing.md#independent-expectations The ARIA boolean attributes accept the tokens true and false, so "maybe" is invalid and "false" is valid. The two literal sources and the message fragment are authored from that vocabulary.
+// @evidence contracts/testing.md#distinguishing-cases The two divs differ only in the aria-hidden literal. Dynamic expressions, the tristate and numeric attribute families are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaProptypesRejectsBadBoolean(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-proptypes", `const Component = () => <div aria-hidden="maybe" />;`, "true or false")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-proptypes", "declare const props: object; const Component = () => <div aria-hidden=\"false\" />;")
+}

package/linthost/jsx_a11y_aria_role_rejects_unknown_role_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaRoleRejectsUnknownRole verifies jsx-a11y/aria-role reports an
+// unknown role token and accepts a supported role.
+//
+// Role validation does not depend on the JSX tag, so the rule reads the role
+// attribute and validates its token list directly.
+//
+//  1. Run only `jsx-a11y/aria-role` over `<div role="banana" />` and expect one
+//     finding whose message contains "valid ARIA role".
+//  2. Run it over `<div role="button" />` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-role enabled. role="banana" yields exactly one ordinary SeverityError finding from that rule whose message contains "valid ARIA role"; assertJsxA11yRuleSkips requires zero findings for role="button".
+// @evidence contracts/testing.md#independent-expectations button is a defined ARIA role and banana is not. The two literal sources and the "valid ARIA role" fragment are authored from the ARIA role vocabulary.
+// @evidence contracts/testing.md#distinguishing-cases The two divs differ only in the role token. Empty roles and multi-token role lists are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaRoleRejectsUnknownRole(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-role", `const Component = () => <div role="banana" />;`, "valid ARIA role")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-role", "declare const props: object; const Component = () => <div role=\"button\" />;")
+}

package/linthost/jsx_a11y_aria_unsupported_elements_rejects_meta_aria_test.go

@@ -0,0 +1,23 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaUnsupportedElementsRejectsMetaAria verifies
+// jsx-a11y/aria-unsupported-elements reports an aria-* attribute on a meta
+// element and accepts the same attribute on a div.
+//
+// Elements such as meta cannot expose ARIA semantics, so the rule guards the
+// tag rather than the attribute.
+//
+//  1. Run only the rule over `<meta aria-label="description" />` and expect one
+//     finding whose message contains "ARIA".
+//  2. Run it over `<div aria-label="description" />` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-unsupported-elements enabled. The meta element with aria-label yields exactly one ordinary SeverityError finding from that rule whose message contains "ARIA"; assertJsxA11yRuleSkips requires zero findings for a div with the same attribute.
+// @evidence contracts/testing.md#independent-expectations The metadata-tag restriction prohibits explicit ARIA on meta, while this rule does not classify div as an unsupported tag. The authored tag pair pins that rule boundary; accepting div here does not certify its accessible name or compliance with other ARIA rules.
+// @evidence contracts/testing.md#distinguishing-cases The two elements carry the same aria-label and differ only in the tag. The html, script and style tags and the role attribute are not exercised by this Test.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaUnsupportedElementsRejectsMetaAria(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-unsupported-elements", `const Component = () => <meta aria-label="description" />;`, "ARIA")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-unsupported-elements", "declare const props: object; const Component = () => <div aria-label=\"description\" />;")
+}

package/linthost/jsx_a11y_aria_unsupported_elements_rejects_role_despite_spread_test.go

@@ -0,0 +1,24 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAriaUnsupportedElementsRejectsRoleDespiteSpread verifies a spread
+// does not suppress an explicit role on an unsupported element.
+//
+// The rule judges explicitly written role and aria-* attributes on meta, html,
+// script and style, so a sibling spread changes nothing about the violation.
+// This also guards the former crash of the attribute walk on spread members.
+//
+//  1. Run only `jsx-a11y/aria-unsupported-elements` over
+//     `<meta charSet="utf-8" role="none" {...props} />` and expect one finding
+//     whose message contains "ARIA roles".
+//  2. Run it over `<meta charSet="utf-8" {...props} />` and expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification assertJsxA11yRuleFinds parses the TSX source and runs NewEngine.Run with only jsx-a11y/aria-unsupported-elements enabled. The meta element with role="none" and a spread yields exactly one ordinary SeverityError finding from that rule whose message contains "ARIA roles"; assertJsxA11yRuleSkips requires zero findings for the same meta and spread without the role.
+// @evidence contracts/testing.md#independent-expectations The static policy rejects an explicitly written role on meta despite an unknown spread; removing that explicit role leaves no known ARIA attribute for this rule to report. The literal pair and message fragment independently pin known-attribute handling, not the unknown runtime spread contents.
+// @evidence contracts/testing.md#distinguishing-cases The two sources keep the meta tag, charSet and spread, and differ only in the role attribute, so the spread cannot be what silences or triggers the report.
+// @evidence contracts/testing.md#execution-ownership The Test is one Go unit with one assertJsxA11yRuleFinds and one assertJsxA11yRuleSkips call, executing the rule engine on parsed virtual TSX files in the test process with no browser, accessibility runtime or product host.
+func TestJsxA11yAriaUnsupportedElementsRejectsRoleDespiteSpread(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/aria-unsupported-elements", `declare const props: object; const Component = () => <meta charSet="utf-8" role="none" {...props} />;`, "ARIA roles")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/aria-unsupported-elements", "declare const props: object; const Component = () => <meta charSet=\"utf-8\" {...props} />;")
+}

package/linthost/jsx_a11y_autocomplete_valid_allows_appropriate_input_type_test.go

@@ -0,0 +1,29 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAutocompleteValidAllowsAppropriateInputType verifies compatible purposes remain valid.
+//
+// Specialized inputs should retain the autofill purpose designed for their
+// value domain. Invalid types use HTML's text fallback; non-inputs are ignored.
+//
+// 1. Parse matching inputs and a non-input carrying an arbitrary value.
+// 2. Enable only `jsx-a11y/autocomplete-valid`.
+// 3. Assert each compatible pair reports no diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify ten compatible, fallback, shorthand, non-string or out-of-scope values remain accepted; clean sources require zero findings, so recovered-panic and unrelated reports also fail.
+// @evidence contracts/testing.md#independent-expectations The HTML autocomplete contract permits the matching purpose/type and ordered token forms; ttsc leaves unsupported non-string and non-input shapes alone. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Email/URL matching, invalid type text fallback, section/contact order, username webauthn, non-string attributes and div scope remain distinct controls.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yAutocompleteValidAllowsAppropriateInputType owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yAutocompleteValidAllowsAppropriateInputType(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type="email" autoComplete="email" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type="url" autoComplete="url" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type="potato" autoComplete="name" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type autoComplete="name" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type="email" autoComplete="section-blue shipping home email" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="username webauthn" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete={true} />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete={42} />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", `const Component = () => <div autoComplete="definitely" />;`)
+}

package/linthost/jsx_a11y_autocomplete_valid_rejects_inappropriate_input_type_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAutocompleteValidRejectsInappropriateInputType verifies purpose/type compatibility.
+//
+// A registered autofill purpose can still be invalid for a specialized input.
+// URL data must not be offered to an email control.
+//
+// 1. Parse an email input with the registered `url` autocomplete purpose.
+// 2. Enable only `jsx-a11y/autocomplete-valid`.
+// 3. Assert one compatibility diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify email input requests URL autofill; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations email purpose matches the email value domain. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases An email input with url autocomplete reports; replacing its purpose with email is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yAutocompleteValidRejectsInappropriateInputType owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yAutocompleteValidRejectsInappropriateInputType(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input type="email" autoComplete="url" />;`, "input type")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", "declare const props: object; const Component = () => <input type=\"email\" autoComplete=\"email\" />;")
+}

package/linthost/jsx_a11y_autocomplete_valid_rejects_invalid_token_sequence_test.go

@@ -0,0 +1,26 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAutocompleteValidRejectsInvalidTokenSequence verifies token grammar.
+//
+// Contact qualifiers apply only to contact purposes, and every detail list has
+// exactly one purpose, optionally followed by webauthn. This case follows
+// the upstream validator in requiring a suffix after section-; that check
+// is stricter than the HTML specification's section-prefix wording.
+//
+// 1. Parse qualified, multiple-purpose, mixed-state, and empty-section lists.
+// 2. Enable only `jsx-a11y/autocomplete-valid`.
+// 3. Assert every invalid sequence reports a diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify qualifier, multiple-purpose, mixed state and empty-section lists are invalid; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The authored ordered contact list follows HTML token order; upstream jsx-a11y's axe-core isValidAutocomplete additionally requires a section-name suffix and rejects section- name. That independently implemented compatibility policy supplies this stricter expectation; it is not claimed to follow the literal HTML section-prefix wording or sampled ttsc output.
+// @evidence contracts/testing.md#distinguishing-cases home url, name email and on email reject incompatible or multiple purpose/state positions; section- name reports under the stricter upstream section-name policy. section-blue shipping home email is the ordered clean counterpart.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yAutocompleteValidRejectsInvalidTokenSequence owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yAutocompleteValidRejectsInvalidTokenSequence(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="home url" />;`, "invalid token sequence")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="name email" />;`, "invalid token sequence")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="on email" />;`, "invalid token sequence")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="section- name" />;`, "invalid token sequence")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", "declare const props: object; const Component = () => <input type=\"email\" autoComplete=\"section-blue shipping home email\" />;")
+}

package/linthost/jsx_a11y_autocomplete_valid_rejects_unknown_token_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yAutocompleteValidRejectsUnknownToken verifies autocomplete tokens are checked.
+//
+// Registered autofill purposes have a defined vocabulary. This case
+// contrasts an unknown literal purpose with name, without certifying
+// all autocomplete values or dynamic expressions.
+//
+// 1. Parse an input with an invalid autocomplete token.
+// 2. Enable only `jsx-a11y/autocomplete-valid`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify definitely is not an autocomplete token; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations name is a registered purpose in the supported HTML token vocabulary. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Unknown autocomplete purpose definitely reports; the supported name token is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yAutocompleteValidRejectsUnknownToken owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yAutocompleteValidRejectsUnknownToken(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/autocomplete-valid", `const Component = () => <input autoComplete="definitely" />;`, "autocomplete")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/autocomplete-valid", "declare const props: object; const Component = () => <input autoComplete=\"name\" />;")
+}

package/linthost/jsx_a11y_click_events_have_key_events_requires_keyboard_handler_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yClickEventsHaveKeyEventsRequiresKeyboardHandler verifies click handlers need keyboard parity.
+//
+// The rule intentionally skips native interactive elements, so a plain div with
+// only onClick exercises the static non-interactive branch.
+//
+// 1. Parse a div with onClick and no keyboard handler.
+// 2. Enable only `jsx-a11y/click-events-have-key-events`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify static div click has no keyboard handler; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations onKeyDown is the supported static keyboard-handler counterpart for this click-handler policy; the test does not execute browser activation. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The div with only onClick reports; adding onKeyDown while retaining the click handler is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yClickEventsHaveKeyEventsRequiresKeyboardHandler owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yClickEventsHaveKeyEventsRequiresKeyboardHandler(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/click-events-have-key-events", `const Component = () => <div onClick={() => {}} />;`, "keyboard")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/click-events-have-key-events", "declare const props: object; const Component = () => <div onClick={() => {}} onKeyDown={() => {}} />;")
+}

package/linthost/jsx_a11y_control_has_associated_label_requires_button_label_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yControlHasAssociatedLabelRequiresButtonLabel verifies controls need names.
+//
+// This catches native interactive controls that are otherwise focusable but do
+// not expose text, aria-label, aria-labelledby, title, or children.
+//
+// 1. Parse an empty button.
+// 2. Enable only `jsx-a11y/control-has-associated-label`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify empty button has no accessible name; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Text content supplies the control label. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases An empty button reports; adding its Save text label is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yControlHasAssociatedLabelRequiresButtonLabel owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yControlHasAssociatedLabelRequiresButtonLabel(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/control-has-associated-label", `const Component = () => <button />;`, "label")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/control-has-associated-label", "declare const props: object; const Component = () => <button>Save</button>;")
+}

package/linthost/jsx_a11y_heading_has_content_rejects_empty_heading_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yHeadingHasContentRejectsEmptyHeading verifies headings need content.
+//
+// Both normal empty headings and self-closing headings omit child text. The
+// rule must visit both JSX node kinds for intrinsic heading tags.
+//
+// 1. Parse normal and self-closing empty h2 elements.
+// 2. Enable only `jsx-a11y/heading-has-content`.
+// 3. Assert each empty heading reports a diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify normal and self-closing h2 have no content; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Text content gives the heading its accessible name. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Both empty paired and self-closing h2 shapes report; adding Title content is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yHeadingHasContentRejectsEmptyHeading owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yHeadingHasContentRejectsEmptyHeading(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/heading-has-content", `const Component = () => <h2></h2>;`, "Headings")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/heading-has-content", `const Component = () => <h2 />;`, "Headings")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/heading-has-content", "declare const props: object; const Component = () => <h2>Title</h2>;")
+}

package/linthost/jsx_a11y_helpers_test.go

@@ -0,0 +1,33 @@
+package linthost
+
+import (
+  "strings"
+  "testing"
+
+  shimast "github.com/microsoft/typescript-go/shim/ast"
+)
+
+func assertJsxA11yRuleFinds(t *testing.T, ruleName, source, messagePart string) {
+  t.Helper()
+  file := parseTSXFile(t, "/virtual/component.tsx", source)
+  findings := NewEngine(RuleConfig{ruleName: SeverityError}).Run([]*shimast.SourceFile{file}, nil)
+  if len(findings) != 1 {
+    t.Fatalf("%s: expected one finding, got %d: %+v", ruleName, len(findings), findings)
+  }
+  if findings[0].engineFailure || findings[0].Severity != SeverityError || findings[0].Rule != ruleName {
+    t.Fatalf("%s: expected ordinary error finding, got %+v", ruleName, findings[0])
+  }
+  if messagePart != "" && !strings.Contains(findings[0].Message, messagePart) {
+    t.Fatalf("%s: message %q does not contain %q", ruleName, findings[0].Message, messagePart)
+  }
+  recordBehavioralWitness(t, ruleName, behavioralWitnessEngine)
+}
+
+func assertJsxA11yRuleSkips(t *testing.T, ruleName, source string) {
+  t.Helper()
+  file := parseTSXFile(t, "/virtual/component.tsx", source)
+  findings := NewEngine(RuleConfig{ruleName: SeverityError}).Run([]*shimast.SourceFile{file}, nil)
+  if len(findings) != 0 {
+    t.Fatalf("%s: expected zero findings, got %d: %+v", ruleName, len(findings), findings)
+  }
+}

package/linthost/jsx_a11y_html_has_lang_allows_non_empty_lang_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yHtmlHasLangAllowsNonEmptyLang verifies valid content is preserved.
+//
+// The empty-value branch must not turn every explicit lang attribute into a
+// diagnostic.
+//
+// 1. Parse html elements with a non-empty value and boolean shorthand.
+// 2. Enable only `jsx-a11y/html-has-lang`.
+// 3. Assert the valid attribute is not reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify en and boolean shorthand remain accepted by html-has-lang; clean sources require zero findings, so recovered-panic and unrelated reports also fail.
+// @evidence contracts/testing.md#independent-expectations This presence/content rule accepts nonempty language content and shorthand; registry validity belongs to the distinct lang rule. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases HtmlHasLangRejectsEmptyLang owns explicit falsy values, while LangRejectsInvalidBcp47Tag owns registry validity.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yHtmlHasLangAllowsNonEmptyLang owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yHtmlHasLangAllowsNonEmptyLang(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang="en" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang />;`)
+}