@decantr/verifier 3.4.0 → 3.4.1

package/dist/index.js

@@ -1160,13 +1160,16 @@ function isAcceptedTokenValue(value, tokenHints) {
     return value.includes(normalizedHint) || value.includes(`var(${normalizedHint})`);
   });
 }
-function arbitraryInlineStyleValue(property, value, tokenHints) {
+function arbitraryInlineStyleValue(property, value, tokenHints, options = {}) {
   const normalizedProperty = property.trim();
   const normalizedValue = value.trim();
   if (!normalizedProperty || !normalizedValue) return null;
   const isVisualProperty = INLINE_STYLE_PROPERTIES.has(normalizedProperty) || STYLESHEET_VISUAL_PROPERTIES.has(normalizedProperty) || normalizedProperty.startsWith("--");
   if (!isVisualProperty) return null;
   if (isAcceptedTokenValue(normalizedValue, tokenHints)) return null;
+  if (options.allowCssVariableValues && /\bvar\(\s*--[A-Za-z0-9_-]+/i.test(normalizedValue)) {
+    return null;
+  }
   if (/(?:^|[\s,(])#[0-9a-f]{3,8}\b|(?:rgba?|hsla?|oklch|oklab|lch|lab|color-mix)\(/i.test(
     normalizedValue
   )) {
@@ -1286,7 +1289,9 @@ function collectStylesheetBridgeDriftFindings(input) {
       const property = match.groups?.property;
       const rawValue = match.groups?.value;
       if (!property || !rawValue) continue;
-      const value = arbitraryInlineStyleValue(property, rawValue, input.bridge.tokenHints);
+      const value = arbitraryInlineStyleValue(property, rawValue, input.bridge.tokenHints, {
+        allowCssVariableValues: true
+      });
       if (!value) continue;
       const lineNumber = lineIndex + 1;
       const key = `${file}:${lineNumber}:${value}`;
@@ -3941,7 +3946,8 @@ function createContractAssertions(projectRoot, audit) {
   if (v4) {
     const declaredRoutes = Object.keys(v4.blueprint.routes ?? {}).sort();
     for (const route of declaredRoutes) {
-      const routeTarget = (v4.blueprint.routes ?? {})[route];
+      const routeTarget = v4.blueprint.routes?.[route];
+      if (!routeTarget) continue;
       const section = v4.blueprint.sections.find((entry) => entry.id === routeTarget.section);
       const page = section?.pages.find((entry) => entry.id === routeTarget.page);
       assertions.push(
@@ -7666,9 +7672,15 @@ function getJsxTextContent(node) {
   });
   return text;
 }
+function hasNonEmptyJsxAttribute(attributes, ...names) {
+  const attribute = getJsxAttribute(attributes, ...names);
+  if (!attribute?.initializer) return false;
+  const literalValue = getJsxAttributeLiteralValue(attribute);
+  return literalValue === null || literalValue.trim().length > 0;
+}
 function hasAccessibleLabel(attributes, textContent) {
   return Boolean(
-    getJsxAttribute(attributes, "aria-label", "aria-labelledby", "title") || textContent.trim().length > 0
+    hasNonEmptyJsxAttribute(attributes, "aria-label", "aria-labelledby", "title") || textContent.trim().length > 0
   );
 }
 function isNonSemanticInteractiveTag(tagName) {
@@ -7693,6 +7705,18 @@ function collectLabelForIds(root) {
   walk(root);
   return ids;
 }
+function collectElementIds(root) {
+  const ids = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (ts6.isJsxSelfClosingElement(node) || ts6.isJsxOpeningElement(node)) {
+      const idValue = getJsxAttributeLiteralValue(getJsxAttribute(node.attributes, "id"));
+      if (idValue?.trim()) ids.add(idValue.trim());
+    }
+    ts6.forEachChild(node, walk);
+  };
+  walk(root);
+  return ids;
+}
 function isWrappedInJsxLabel(node) {
   let current = node.parent;
   while (current) {
@@ -7715,21 +7739,37 @@ function hasAncestorJsxTag(node, tagName) {
 }
 function isLabelableFormControl(tagName, attributes) {
   if (!tagName) return false;
-  if (tagName === "select" || tagName === "textarea") return true;
-  if (tagName !== "input") return false;
+  const normalizedTagName = tagName.toLowerCase();
+  if (normalizedTagName === "select" || normalizedTagName === "textarea") return true;
+  if (normalizedTagName !== "input" && !isLikelyProjectFormControlTag(tagName)) return false;
   const inputType = (getJsxAttributeLiteralValue(getJsxAttribute(attributes, "type")) ?? "text").toLowerCase();
   return !["hidden", "submit", "reset", "button"].includes(inputType);
 }
+function isLikelyProjectFormControlTag(tagName) {
+  if (tagName === tagName.toLowerCase()) return false;
+  const normalizedTagName = tagName.toLowerCase();
+  return /(?:^|(?:text|email|password|search|number|tel|url|date))input$/.test(normalizedTagName) || /^(?:textarea|textArea|select|combobox|comboBox|checkbox|radio|switch)$/i.test(tagName);
+}
 function getNormalizedInputType(attributes) {
   return (getJsxAttributeLiteralValue(getJsxAttribute(attributes, "type")) ?? "text").trim().toLowerCase();
 }
-function hasFormControlLabel(node, tagName, attributes, labelForIds, textContent) {
+function hasFormControlLabel(node, tagName, attributes, labelForIds, elementIds, textContent) {
   if (!isLabelableFormControl(tagName, attributes)) return true;
-  if (hasAccessibleLabel(attributes, textContent)) return true;
+  if (hasNonEmptyJsxAttribute(attributes, "aria-label", "title")) return true;
+  if (hasAriaLabelledByReference(attributes, elementIds)) return true;
+  if (textContent.trim().length > 0) return true;
   if (isWrappedInJsxLabel(node)) return true;
   const idValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, "id"));
   return Boolean(idValue && labelForIds.has(idValue));
 }
+function hasAriaLabelledByReference(attributes, elementIds) {
+  const attribute = getJsxAttribute(attributes, "aria-labelledby");
+  if (!attribute?.initializer) return false;
+  const literalValue = getJsxAttributeLiteralValue(attribute);
+  if (literalValue === null) return true;
+  const references = literalValue.trim().split(/\s+/).filter(Boolean);
+  return references.some((reference) => elementIds.has(reference));
+}
 function isExternalLinkTargetBlankWithoutRel(attributes) {
   const targetValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, "target"));
   if (targetValue !== "_blank") return false;
@@ -9414,7 +9454,7 @@ function countAuthAnonymousRedirectSignals(code) {
   ];
   return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
 }
-var OPEN_REDIRECT_QUERY_KEY_PATTERN = String.raw`next|redirect(?:To|[_-]to)?|return(?:To|[_-]to)?|callback(?:Url|[_-]url)?|continue(?:Url|[_-]url)?|from`;
+var OPEN_REDIRECT_QUERY_KEY_PATTERN = "next|redirect(?:To|[_-]to)?|return(?:To|[_-]to)?|callback(?:Url|[_-]url)?|continue(?:Url|[_-]url)?|from";
 var OPEN_REDIRECT_SOURCE_PATTERN = String.raw`\b(?:searchParams|(?:request|req)\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\b(?:router\.query|route\.query|query)\.(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})\b|\b(?:new\s+)?URLSearchParams\s*\(\s*(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:search|hash)(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\s*\)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\bnew\s+URL\(\s*(?:request|req)\.url\s*\)\.searchParams\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)`;
 var OPEN_REDIRECT_SOURCE_REGEX = new RegExp(OPEN_REDIRECT_SOURCE_PATTERN, "i");
 var OPEN_REDIRECT_QUERY_KEY_REGEX = new RegExp(`^(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})$`, "i");
@@ -13330,6 +13370,7 @@ function analyzeAstSignals(filePath, code) {
   const namedExpressionInitializers = collectNamedExpressionInitializers(sourceFile);
   const namedPropertyAliases = collectNamedPropertyAliases(sourceFile);
   const labelForIds = collectLabelForIds(sourceFile);
+  const elementIds = collectElementIds(sourceFile);
   let navigationLandmarkCount = 0;
   let unlabeledNavigationLandmarkCount = 0;
   const walk = (node) => {
@@ -13736,7 +13777,7 @@ function analyzeAstSignals(filePath, code) {
           signals.authInputWithoutNameCount += 1;
         }
       }
-      if (!hasFormControlLabel(node, tagName, node.attributes, labelForIds, "")) {
+      if (!hasFormControlLabel(node, tagName, node.attributes, labelForIds, elementIds, "")) {
         signals.formControlWithoutLabelCount += 1;
       }
     }
@@ -13851,6 +13892,7 @@ function analyzeAstSignals(filePath, code) {
         tagName,
         node.openingElement.attributes,
         labelForIds,
+        elementIds,
         textContent
       )) {
         signals.formControlWithoutLabelCount += 1;