@ttsc/lint 0.30.4 → 0.31.1

package/linthost/jsx_a11y_html_has_lang_allows_spread_props_test.go

@@ -0,0 +1,24 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yHtmlHasLangAllowsSpreadProps verifies html-has-lang abstains
+// when an unknown spread may supply lang.
+//
+// The lang attribute may come through the `{...props}` spread. Upstream
+// eslint-plugin-jsx-a11y still reports `<html {...props} />`, but `@ttsc/lint`
+// findings are build-breaking compiler errors, so absence-predicated reports
+// deliberately stay conservative when the prop set is unknown. Also pins the
+// panic regression in jsxAttrs on JsxSpreadAttribute members.
+//
+// 1. Parse an html element whose only attribute is a spread.
+// 2. Enable only `jsx-a11y/html-has-lang`.
+// 3. Assert no diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify html with only unknown props remains accepted; clean sources require zero findings, so recovered-panic and unrelated reports also fail.
+// @evidence contracts/testing.md#independent-expectations ttsc deliberately cannot prove lang absence across an unknown spread, unlike the stricter upstream policy. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases RequiresLang owns known absence and RejectsEmptyLang owns explicit invalid values; spread acceptance is not claimed as upstream equivalence.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yHtmlHasLangAllowsSpreadProps owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yHtmlHasLangAllowsSpreadProps(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/html-has-lang", `declare const props: object; const Component = () => <html {...props} />;`)
+}

package/linthost/jsx_a11y_html_has_lang_rejects_empty_lang_test.go

@@ -0,0 +1,27 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yHtmlHasLangRejectsEmptyLang verifies an explicit lang has content.
+//
+// Presence alone is insufficient for screen readers to select a language, and
+// the upstream html-has-lang rule rejects empty values.
+//
+// 1. Parse empty strings and statically falsy lang values, including a spread.
+// 2. Enable only `jsx-a11y/html-has-lang`.
+// 3. Assert every explicitly falsy attribute is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify empty, whitespace and static falsy lang values are rejected even after a spread; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations A nonempty language string supplies actual content; the existing seven invalid values remain checked. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Empty, whitespace, false, zero, null and undefined lang values report, including an explicit empty value after a spread; en is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yHtmlHasLangRejectsEmptyLang owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yHtmlHasLangRejectsEmptyLang(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang="" />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang="   " />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang={false} />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang={0} />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang={null} />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html lang={undefined} />;`, "non-empty")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `declare const props: object; const Component = () => <html {...props} lang="" />;`, "non-empty")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/html-has-lang", "declare const props: object; const Component = () => <html lang=\"en\" />;")
+}

package/linthost/jsx_a11y_html_has_lang_requires_lang_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yHtmlHasLangRequiresLang verifies html elements declare language.
+//
+// The rule is a simple intrinsic tag check, but it needs coverage because TSX
+// applications often render document shells directly.
+//
+// 1. Parse an html element without lang.
+// 2. Enable only `jsx-a11y/html-has-lang`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify html omits lang; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations An explicit nonempty language supplies the required declaration. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Missing html lang reports; explicit en is clean. The empty-lang host owns invalid present values.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yHtmlHasLangRequiresLang owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yHtmlHasLangRequiresLang(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/html-has-lang", `const Component = () => <html />;`, "lang")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/html-has-lang", "declare const props: object; const Component = () => <html lang=\"en\" />;")
+}

package/linthost/jsx_a11y_iframe_has_title_allows_spread_props_test.go

@@ -0,0 +1,23 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yIframeHasTitleAllowsSpreadProps verifies iframe-has-title
+// abstains when an unknown spread may supply title.
+//
+// The title may come through the `{...props}` spread, so the rule must not
+// report while the prop set is unknown — `@ttsc/lint` findings are
+// build-breaking compiler errors. Also pins the panic regression in jsxAttrs
+// on JsxSpreadAttribute members.
+//
+// 1. Parse an iframe whose only attribute is a spread.
+// 2. Enable only `jsx-a11y/iframe-has-title`.
+// 3. Assert no diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify iframe with unknown props remains accepted; clean sources require zero findings, so recovered-panic and unrelated reports also fail.
+// @evidence contracts/testing.md#independent-expectations The conservative missing-title policy leaves an unknown spread that may supply a title alone. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases IframeHasTitleRequiresTitle owns known missing attributes.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yIframeHasTitleAllowsSpreadProps owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yIframeHasTitleAllowsSpreadProps(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/iframe-has-title", `declare const props: object; const Component = () => <iframe {...props} />;`)
+}

package/linthost/jsx_a11y_iframe_has_title_requires_title_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yIframeHasTitleRequiresTitle verifies iframe titles are required.
+//
+// Iframes need a non-empty title for assistive technology. This test covers the
+// self-closing JSX branch.
+//
+// 1. Parse an iframe without title.
+// 2. Enable only `jsx-a11y/iframe-has-title`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify iframe omits title; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations A title labels the embedded content. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The /embed iframe without title reports; adding title="Content" is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yIframeHasTitleRequiresTitle owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yIframeHasTitleRequiresTitle(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/iframe-has-title", `const Component = () => <iframe src="/embed" />;`, "title")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/iframe-has-title", "declare const props: object; const Component = () => <iframe src=\"/embed\" title=\"Content\" />;")
+}

package/linthost/jsx_a11y_img_redundant_alt_rejects_image_word_despite_spread_test.go

@@ -0,0 +1,25 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yImgRedundantAltRejectsImageWordDespiteSpread verifies spreads do
+// not suppress explicit redundant alt text.
+//
+// img-redundant-alt judges an explicitly written alt value, so a sibling
+// spread does not suppress this static report. The case pins this rule's
+// known-alt policy, not every rule's spread handling or the final runtime
+// alt value after a spread. The attribute walk must not panic on the
+// JsxSpreadAttribute member.
+//
+// 1. Parse an img with a redundant alt plus a spread.
+// 2. Enable only `jsx-a11y/img-redundant-alt`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify photo wording redundantly repeats the image role beside a spread; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations An explicit descriptive alt avoids repeated role wording with the same unknown props. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The photo of me alternative reports despite a spread; Profile with the same spread is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yImgRedundantAltRejectsImageWordDespiteSpread owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yImgRedundantAltRejectsImageWordDespiteSpread(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/img-redundant-alt", `declare const props: object; const Component = () => <img alt="photo of me" {...props} />;`, "redundant")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/img-redundant-alt", "declare const props: object; const Component = () => <img alt=\"Profile\" {...props} />;")
+}

package/linthost/jsx_a11y_img_redundant_alt_rejects_image_word_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yImgRedundantAltRejectsImageWord verifies redundant image wording is rejected.
+//
+// Screen readers already announce image roles, so this rule inspects literal alt
+// text for repeated words such as image, photo, or picture.
+//
+// 1. Parse an img whose alt text starts with "image".
+// 2. Enable only `jsx-a11y/img-redundant-alt`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify image wording redundantly repeats the image role; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Describing the subject without image/photo wording avoids the redundancy. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The image of profile alternative reports; the nonredundant Profile alternative is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yImgRedundantAltRejectsImageWord owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yImgRedundantAltRejectsImageWord(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/img-redundant-alt", `const Component = () => <img alt="image of profile" />;`, "redundant")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/img-redundant-alt", "declare const props: object; const Component = () => <img alt=\"Profile\" />;")
+}

package/linthost/jsx_a11y_interactive_supports_focus_requires_tabindex_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yInteractiveSupportsFocusRequiresTabindex verifies interactive roles need focus.
+//
+// A div with role button needs keyboard focus under this policy. This case
+// locks the explicit-role path separate from native button handling.
+//
+// 1. Parse a div with role button and no tabIndex.
+// 2. Enable only `jsx-a11y/interactive-supports-focus`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify button-role div is not focusable; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations tabIndex zero supplies keyboard focus for this explicit interactive role. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases A button-role div without tabIndex reports; adding tabIndex={0} is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yInteractiveSupportsFocusRequiresTabindex owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yInteractiveSupportsFocusRequiresTabindex(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/interactive-supports-focus", `const Component = () => <div role="button" />;`, "focusable")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/interactive-supports-focus", "declare const props: object; const Component = () => <div role=\"button\" tabIndex={0} />;")
+}

package/linthost/jsx_a11y_label_has_associated_control_requires_for_or_child_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yLabelHasAssociatedControlRequiresForOrChild verifies labels need controls.
+//
+// The rule checks both association patterns: htmlFor/for attributes and nested
+// form controls. This failing case covers the absence of both.
+//
+// 1. Parse a label with text but no associated control.
+// 2. Enable only `jsx-a11y/label-has-associated-control`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify label has neither reference nor nested control; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The authored htmlFor attribute supplies the static reference marker this rule accepts. The literal pair pins that attribute policy without sampling implementation output; no matching control exists in this fixture, so target existence or a working browser association is not asserted.
+// @evidence contracts/testing.md#distinguishing-cases A text-only Name label reports; adding htmlFor="name" is clean. This host owns reference-attribute presence, not target resolution or the nested-control branch.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yLabelHasAssociatedControlRequiresForOrChild owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yLabelHasAssociatedControlRequiresForOrChild(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/label-has-associated-control", `const Component = () => <label>Name</label>;`, "control")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/label-has-associated-control", "declare const props: object; const Component = () => <label htmlFor=\"name\">Name</label>;")
+}

package/linthost/jsx_a11y_label_has_for_alias_matches_associated_control_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yLabelHasForAliasMatchesAssociatedControl verifies the legacy label rule aliases behavior.
+//
+// `label-has-for` is retained for compatibility with eslint-plugin-jsx-a11y
+// configurations and should report the same static missing-association case.
+//
+// 1. Parse a label with no htmlFor/for and no nested control.
+// 2. Enable only `jsx-a11y/label-has-for`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify legacy label-has-for alias reports missing association; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The compatibility alias accepts the same authored htmlFor reference marker as label-has-associated-control. The literal pair supplies independent static-policy expectations; it contains no matching control and does not assert target existence or browser association.
+// @evidence contracts/testing.md#distinguishing-cases The label-has-for alias rejects an Email label without a known reference marker; adding htmlFor="email" is clean. Target resolution and nested-control alternatives are not exercised here.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yLabelHasForAliasMatchesAssociatedControl owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yLabelHasForAliasMatchesAssociatedControl(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/label-has-for", `const Component = () => <label>Email</label>;`, "control")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/label-has-for", "declare const props: object; const Component = () => <label htmlFor=\"email\">Email</label>;")
+}

package/linthost/jsx_a11y_lang_allows_valid_bcp47_tag_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yLangAllowsValidBcp47Tag verifies registered language tags are accepted.
+//
+// BCP 47 permits regional and script subtags. Registry-backed validation must
+// preserve these standard forms on html and ignore other JSX elements.
+//
+// 1. Parse html elements with registered tags and a non-html invalid tag.
+// 2. Enable only `jsx-a11y/lang`.
+// 3. Assert valid html tags and the out-of-scope element report no diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify registered en-US and zh-Hant-HK plus out-of-scope div remain accepted; clean sources require zero findings, so recovered-panic and unrelated reports also fail.
+// @evidence contracts/testing.md#independent-expectations BCP 47 permits registered language/region/script combinations; this html-scoped rule does not govern div language. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Script/region lengths and tag scope contrast with empty and invalid-tag rejection cases.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yLangAllowsValidBcp47Tag owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yLangAllowsValidBcp47Tag(t *testing.T) {
+  assertJsxA11yRuleSkips(t, "jsx-a11y/lang", `const Component = () => <html lang="en-US" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/lang", `const Component = () => <html lang="zh-Hant-HK" />;`)
+  assertJsxA11yRuleSkips(t, "jsx-a11y/lang", `const Component = () => <div lang="foo" />;`)
+}

package/linthost/jsx_a11y_lang_rejects_empty_lang_test.go

@@ -0,0 +1,20 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yLangRejectsEmptyLang verifies literal language tags are validated.
+//
+// Registry-backed parsing must reject an empty value before language matching.
+//
+// 1. Parse an html element with an empty lang string.
+// 2. Enable only `jsx-a11y/lang`.
+// 3. Assert the empty literal reports a diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify empty html language is invalid; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations en-US is a registered BCP 47 language-region tag. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases An empty language tag reports; en-US is clean. The invalid-tag host owns broader registry and syntax distinctions.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yLangRejectsEmptyLang owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yLangRejectsEmptyLang(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang="" />;`, "lang")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/lang", "declare const props: object; const Component = () => <html lang=\"en-US\" />;")
+}

package/linthost/jsx_a11y_lang_rejects_invalid_bcp47_tag_test.go

@@ -0,0 +1,25 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yLangRejectsInvalidBcp47Tag verifies registry-backed validation.
+//
+// Non-empty syntax is insufficient: whitespace, unknown language subtags, and
+// statically undefined or non-string values cannot identify a language.
+//
+// 1. Parse padded, unregistered, malformed, undefined, and shorthand values.
+// 2. Enable only `jsx-a11y/lang`.
+// 3. Assert every statically invalid attribute reports a diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify padded, unregistered, undefined and shorthand html language values are invalid; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The authored zh-Hant-HK language/script/region sequence is registered; the controls separately reject padding, unknown language/region identifiers and attributes without a string tag. These are distinct static validation failures, not five malformed BCP 47 strings, and the expectations are literal policy inputs rather than sampled output.
+// @evidence contracts/testing.md#distinguishing-cases Padded en, unknown foo, zz-LL, undefined and boolean shorthand report; the language/script/region tag zh-Hant-HK is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yLangRejectsInvalidBcp47Tag owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yLangRejectsInvalidBcp47Tag(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang=" en " />;`, "lang")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang="foo" />;`, "lang")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang="zz-LL" />;`, "lang")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang={undefined} />;`, "lang")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/lang", `const Component = () => <html lang />;`, "lang")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/lang", "declare const props: object; const Component = () => <html lang=\"zh-Hant-HK\" />;")
+}

package/linthost/jsx_a11y_media_has_caption_requires_track_test.go

@@ -0,0 +1,22 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yMediaHasCaptionRequiresTrack verifies media elements need captions.
+//
+// Empty normal and self-closing media elements cannot provide caption tracks.
+// The rule must visit both JSX node kinds for video elements.
+//
+// 1. Parse normal and self-closing videos with no track child.
+// 2. Enable only `jsx-a11y/media-has-caption`.
+// 3. Assert each captionless video reports a diagnostic.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify normal and self-closing videos lack a track child; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations An authored track child with kind="captions" satisfies this static track-marker policy. The clean input supplies no track src or caption text, so it does not establish a working text alternative. The literal expected findings distinguish the required marker without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases Both paired-empty and self-closing video report; a track kind="captions" child with the same media source is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yMediaHasCaptionRequiresTrack owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yMediaHasCaptionRequiresTrack(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/media-has-caption", `const Component = () => <video src="/movie.mp4"></video>;`, "caption")
+  assertJsxA11yRuleFinds(t, "jsx-a11y/media-has-caption", `const Component = () => <video src="/movie.mp4" />;`, "caption")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/media-has-caption", "declare const props: object; const Component = () => <video src=\"/movie.mp4\"><track kind=\"captions\" /></video>;")
+}

package/linthost/jsx_a11y_mouse_events_have_key_events_requires_focus_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yMouseEventsHaveKeyEventsRequiresFocus verifies mouseover has focus parity.
+//
+// Hover-only behavior excludes keyboard users. This case locks the sibling
+// handler check for onMouseOver and onFocus.
+//
+// 1. Parse a div with onMouseOver and no onFocus.
+// 2. Enable only `jsx-a11y/mouse-events-have-key-events`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify mouseover has no corresponding focus event; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations onFocus is the supported static focus-handler counterpart for this hover-handler policy; the test does not execute browser interaction. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The div with only onMouseOver reports; adding onFocus while retaining the mouse handler is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yMouseEventsHaveKeyEventsRequiresFocus owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yMouseEventsHaveKeyEventsRequiresFocus(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/mouse-events-have-key-events", `const Component = () => <div onMouseOver={() => {}} />;`, "onFocus")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/mouse-events-have-key-events", "declare const props: object; const Component = () => <div onMouseOver={() => {}} onFocus={() => {}} />;")
+}

package/linthost/jsx_a11y_no_access_key_rejects_access_key_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoAccessKeyRejectsAccessKey verifies accessKey is rejected.
+//
+// Keyboard shortcut conflicts are global and hard to predict, so the JSX
+// attribute itself is enough to diagnose the issue.
+//
+// 1. Parse a button with accessKey.
+// 2. Enable only `jsx-a11y/no-access-key`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify the disallowed accessKey attribute is reported; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations A button without accessKey avoids that shortcut assignment. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases A Save button with accessKey="s" reports; removing only that shortcut attribute is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoAccessKeyRejectsAccessKey owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoAccessKeyRejectsAccessKey(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-access-key", `const Component = () => <button accessKey="s">Save</button>;`, "accessKey")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-access-key", "declare const props: object; const Component = () => <button>Save</button>;")
+}

package/linthost/jsx_a11y_no_aria_hidden_on_focusable_rejects_hidden_button_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoAriaHiddenOnFocusableRejectsHiddenButton verifies focusable nodes are not aria-hidden.
+//
+// A focused control hidden from the accessibility tree is contradictory. This
+// case covers native focusability without requiring tabIndex.
+//
+// 1. Parse a button with aria-hidden true.
+// 2. Enable only `jsx-a11y/no-aria-hidden-on-focusable`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify a native button declaring aria-hidden true is reported; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Changing aria-hidden from true to false removes this explicit hiding marker from the native button. The literal findings follow the static focusability policy without sampling implementation output; actual focus and accessibility-tree exposure are not observed.
+// @evidence contracts/testing.md#distinguishing-cases A native button with aria-hidden="true" reports; changing the state to false is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoAriaHiddenOnFocusableRejectsHiddenButton owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoAriaHiddenOnFocusableRejectsHiddenButton(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-aria-hidden-on-focusable", `const Component = () => <button aria-hidden="true">Save</button>;`, "aria-hidden")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-aria-hidden-on-focusable", "declare const props: object; const Component = () => <button aria-hidden=\"false\">Save</button>;")
+}

package/linthost/jsx_a11y_no_autofocus_rejects_autofocus_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoAutofocusRejectsAutofocus verifies autoFocus is rejected.
+//
+// Autofocus can move users unexpectedly when a view loads. This rule is an
+// attribute-local check and should fire on JSX camel-case spelling.
+//
+// 1. Parse an input with autoFocus.
+// 2. Enable only `jsx-a11y/no-autofocus`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify the autoFocus attribute is reported; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The input without autoFocus contains no declarative autofocus request. Literal findings follow that static attribute policy without sampling implementation output; browser focus or script-driven focus is not observed.
+// @evidence contracts/testing.md#distinguishing-cases An input with bare autoFocus reports; removing the autoFocus attribute is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoAutofocusRejectsAutofocus owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoAutofocusRejectsAutofocus(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-autofocus", `const Component = () => <input autoFocus />;`, "autoFocus")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-autofocus", "declare const props: object; const Component = () => <input />;")
+}

package/linthost/jsx_a11y_no_distracting_elements_rejects_marquee_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoDistractingElementsRejectsMarquee verifies distracting tags are rejected.
+//
+// Legacy animated elements are intrinsic tags, so this rule should diagnose them
+// without attribute or child inspection.
+//
+// 1. Parse a marquee element.
+// 2. Enable only `jsx-a11y/no-distracting-elements`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify marquee is a distracting intrinsic tag; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations A normal static div preserves content without forced animation. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The marquee carrying Sale reports; a div with the same content is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoDistractingElementsRejectsMarquee owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoDistractingElementsRejectsMarquee(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-distracting-elements", `const Component = () => <marquee>Sale</marquee>;`, "distracting")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-distracting-elements", "declare const props: object; const Component = () => <div>Sale</div>;")
+}

package/linthost/jsx_a11y_no_interactive_element_to_noninteractive_role_rejects_button_presentation_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoInteractiveElementToNoninteractiveRoleRejectsButtonPresentation verifies role downgrades are rejected.
+//
+// Native controls should keep their interactive semantics. This case covers the
+// implicit-role branch for a button with a non-interactive explicit role.
+//
+// 1. Parse a button with role presentation.
+// 2. Enable only `jsx-a11y/no-interactive-element-to-noninteractive-role`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify a native button declaring role="presentation" violates the static role policy; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations The native button should not declare this incompatible presentation role under the supported lint policy. WAI-ARIA conflict resolution requires user agents to ignore presentation on focusable or interactive elements; this test does not establish a runtime role downgrade. Literal findings are authored policy expectations, not sampled output.
+// @evidence contracts/testing.md#distinguishing-cases A native button with presentation role reports; removing that incompatible role preserves Save and is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoInteractiveElementToNoninteractiveRoleRejectsButtonPresentation owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoInteractiveElementToNoninteractiveRoleRejectsButtonPresentation(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-interactive-element-to-noninteractive-role", `const Component = () => <button role="presentation">Save</button>;`, "Interactive")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-interactive-element-to-noninteractive-role", "declare const props: object; const Component = () => <button>Save</button>;")
+}

package/linthost/jsx_a11y_no_noninteractive_element_interactions_rejects_li_click_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoNoninteractiveElementInteractionsRejectsLiClick verifies non-interactive elements avoid handlers.
+//
+// List items have structural semantics, not activation semantics. This rule
+// catches direct interaction handlers on those known non-interactive tags.
+//
+// 1. Parse an li with onClick.
+// 2. Enable only `jsx-a11y/no-noninteractive-element-interactions`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify structural li has a click handler; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations An li without a handler keeps structural rather than activation behavior. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The li with onClick reports; removing the handler while preserving Item content is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoNoninteractiveElementInteractionsRejectsLiClick owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoNoninteractiveElementInteractionsRejectsLiClick(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-noninteractive-element-interactions", `const Component = () => <li onClick={() => {}}>Item</li>;`, "Non-interactive")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-noninteractive-element-interactions", "declare const props: object; const Component = () => <li>Item</li>;")
+}

package/linthost/jsx_a11y_no_noninteractive_element_to_interactive_role_rejects_ul_button_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoNoninteractiveElementToInteractiveRoleRejectsUlButton verifies role upgrades are rejected.
+//
+// Structural elements should not become controls via role alone. This pins the
+// non-interactive intrinsic tag plus interactive role branch.
+//
+// 1. Parse a ul with role button.
+// 2. Enable only `jsx-a11y/no-noninteractive-element-to-interactive-role`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify structural ul is assigned button role; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations A plain ul retains the list role. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The ul with button role reports; the same list element without the interactive role is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoNoninteractiveElementToInteractiveRoleRejectsUlButton owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoNoninteractiveElementToInteractiveRoleRejectsUlButton(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-noninteractive-element-to-interactive-role", `const Component = () => <ul role="button" />;`, "Non-interactive")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-noninteractive-element-to-interactive-role", "declare const props: object; const Component = () => <ul />;")
+}

package/linthost/jsx_a11y_no_noninteractive_tabindex_rejects_section_tabindex_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoNoninteractiveTabindexRejectsSectionTabindex verifies tabIndex is limited to interactive elements.
+//
+// Focus order should not include static regions unless they have interactive
+// semantics. This case covers numeric JSX expression values.
+//
+// 1. Parse a section with tabIndex 0.
+// 2. Enable only `jsx-a11y/no-noninteractive-tabindex`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify section tabIndex zero is reported; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Removing tabIndex removes the authored tab-order request from this section. Literal findings follow the static non-interactive-element policy without sampling implementation output; actual browser focus order is not observed.
+// @evidence contracts/testing.md#distinguishing-cases A section with tabIndex={0} reports; the same section without tabIndex is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoNoninteractiveTabindexRejectsSectionTabindex owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoNoninteractiveTabindexRejectsSectionTabindex(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-noninteractive-tabindex", `const Component = () => <section tabIndex={0} />;`, "tabIndex")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-noninteractive-tabindex", "declare const props: object; const Component = () => <section />;")
+}

package/linthost/jsx_a11y_no_redundant_roles_rejects_button_role_button_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoRedundantRolesRejectsButtonRoleButton verifies native roles are not repeated.
+//
+// Redundant roles add noise and can hide accidental semantic changes. This
+// case covers implicit role detection for native button elements.
+//
+// 1. Parse a button with role button.
+// 2. Enable only `jsx-a11y/no-redundant-roles`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify native button repeats its implicit button role; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations Omitting explicit role retains the same native semantics. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The native button redundantly declaring button role reports; removing only the duplicate role is clean.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoRedundantRolesRejectsButtonRoleButton owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoRedundantRolesRejectsButtonRoleButton(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-redundant-roles", `const Component = () => <button role="button">Save</button>;`, "redundant")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-redundant-roles", "declare const props: object; const Component = () => <button>Save</button>;")
+}

package/linthost/jsx_a11y_no_static_element_interactions_requires_role_test.go

@@ -0,0 +1,21 @@
+package linthost
+
+import "testing"
+
+// TestJsxA11yNoStaticElementInteractionsRequiresRole verifies static elements with handlers need roles.
+//
+// A div with an activation handler has no native control semantics. This rule
+// asks for an explicit role when static markup becomes interactive.
+//
+// 1. Parse a div with onClick and no role.
+// 2. Enable only `jsx-a11y/no-static-element-interactions`.
+// 3. Assert one diagnostic is reported.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual TSX parsing and NewEngine.Run verify clickable static div has no interactive role; reported variants require one ordinary SeverityError finding from the named rule with the authored message fragment, and clean variants require zero findings.
+// @evidence contracts/testing.md#independent-expectations An explicit button role satisfies this static role requirement; the role alone does not add keyboard activation. The source inputs and literal expected findings follow this supported accessibility policy without sampling implementation output.
+// @evidence contracts/testing.md#distinguishing-cases The onClick div without role reports; adding button role while retaining its handler is clean for this rule.
+// @evidence contracts/testing.md#execution-ownership TestJsxA11yNoStaticElementInteractionsRequiresRole owns these explicit AST variants as a named Go unit entry; the owning engine executes in the shared test process without a browser, accessibility runtime installation or product child host.
+func TestJsxA11yNoStaticElementInteractionsRequiresRole(t *testing.T) {
+  assertJsxA11yRuleFinds(t, "jsx-a11y/no-static-element-interactions", `const Component = () => <div onClick={() => {}} />;`, "Static")
+  assertJsxA11yRuleSkips(t, "jsx-a11y/no-static-element-interactions", "declare const props: object; const Component = () => <div role=\"button\" onClick={() => {}} />;")
+}