@expressivecss/mcp-server 0.3.1 → 0.4.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.4.1 - 2026-10-14
+
+- The catalogue, guides and rules cover keypad and keyboard.
+- Bundled framework guidance: ExpressiveCSS 0.15.0.
+
+## 0.4.0 - 2026-10-11
+
+- Command-output redaction no longer stalls the server on long token runs.
+  160K characters of hex output took 6 s to redact; it now takes milliseconds.
+- New `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` setting limits which
+  directories a caller can pass as `projectRoot`. It is unset by default, which
+  keeps the current behavior.
+- Calls with a `projectRoot` are 3 to 5 times faster. The server resolves the
+  ExpressiveCSS version once per call and sizes file buffers to the file
+  instead of the read limit.
+- Tool results use compact JSON text, which is about a third smaller.
+- The catalogue, guides and rules cover map, confetti and particles.
+- Bundled framework guidance: ExpressiveCSS 0.14.1.
+
 ## 0.3.1 - 2026-10-08
 
 - Fix `npx @expressivecss/mcp-server`, which failed with "could not determine

package/README.md

@@ -619,6 +619,7 @@ network limits, evidence handling, and bounded repair workflow.
 - `EXPRESSIVECSS_MCP_QA_MAX_TOTAL_MB`
 - `EXPRESSIVECSS_MCP_COMMAND_TIMEOUT_MS`
 - `EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS`
+- `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS`
 - `SKIP_SETUP_EXPERT`
 - `SKIP_RULES_ENFORCER`
 - `SKIP_CREATIVE_DIRECTOR`
@@ -642,6 +643,8 @@ EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS=["/srv/projects/site-a","/srv/projects/s
 
 The real `projectRoot` must equal or be contained by one of those roots. A tool caller cannot expand this policy. Allowed commands receive only the executable path, system/temp/locale variables, `CI=1`, `NO_COLOR=1`, and `HOME`/`USERPROFILE` reset to the project root. API keys, tokens, passwords, cloud credentials, SSH agent variables, and other MCP-process environment values are not forwarded.
 
+Any tool accepts a `projectRoot` by default, and `quality_inspector` reports the existence, size and SHA-256 of files under it. To limit which directories a caller can name, set `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` in the same format. A `projectRoot` whose real path is outside every listed root fails with a tool error. An empty or invalid value denies every caller-supplied root. The default root, from `--project-root` or the working directory, is not checked.
+
 ## Sample client configuration
 
 ### `mcp/expressivecss/mcp.json`

package/capability-roadmap.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "frameworkVersion": "0.13.1",
-  "sourceRevision": "3ed93f73a1e5a5ab9d201993b132fd64d81478ca",
+  "frameworkVersion": "0.15.0",
+  "sourceRevision": "5cd5bde4379bebb7873249bd8948879ae76634d9",
   "basis": "Reviewed checkout snapshot, not proof of published package contents or target-browser conformance. Implemented means only the named scope. Full Material parity remains unassessed.",
   "browserRun": {
-    "recordedOn": "2026-10-08",
+    "recordedOn": "2026-10-10",
     "engine": "chromium",
     "engineVersion": "153.0.8010.12",
     "nodeVersion": "v24.21.0",
     "status": "passed",
     "inputsCurrent": false,
-    "reportSha256": "b2f7a499810474b2448e87bde25fa13c969ab79a096d7281b84990803d624c47",
+    "reportSha256": "901697c1476a6369682ffc54fd0de71c0eed9db9a738b7f16d2c1780956ea287",
     "collector": "scripts/record-capability-evidence.mjs"
   },
   "entries": [
@@ -487,9 +487,9 @@
       "slug": "stepper",
       "title": "Stepper",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-06",
       "scope": "Horizontal and vertical ordered lists with current, complete and invalid steps, supporting text, links back to finished steps and a content panel in vertical steps.",
       "adaptation": "An <ol> with aria-current=\"step\"; CSS alt text speaks the complete and invalid states from translatable tokens.",
@@ -1432,22 +1432,22 @@
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller follows output, keeps its place on prepend and anchors new turns",
           "scope": "Opening at the end, following streamed text, release on a wheel scroll up, the inert button and resuming from it, following kept through a click on a message, scrollToMessage with a peek and with a missing id, prepend preservation, an appended anchor at the peek with a spacer that clears as the reply grows, and destroy. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller opens saved transcripts at the requested position",
           "scope": "last-anchor on a long last turn, last-anchor falling back to the end, and start.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller jumps to a message inside a shadow root",
           "scope": "scrollToMessage called right after init finds a message in a shadow root and scrolls it one peek below the top; pressing the button from the keyboard there moves focus to the viewport as the button goes inert.",
-          "state": "not-recorded"
+          "state": "stale"
         }
       ],
-      "browserEvidence": "incomplete",
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -1508,9 +1508,9 @@
       "slug": "data-table",
       "title": "Data table",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-06",
       "scope": "Scrolling wrapper with an outline, sticky header row, numeric columns, dense rows, a sort arrow drawn from aria-sort and checkbox row selection.",
       "adaptation": "A plain div wraps a native <table>, so the table keeps its role; the page owns sorting, select-all and the scroll region name.",
@@ -1708,9 +1708,9 @@
       "slug": "line-chart",
       "title": "Line chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-06",
       "scope": "Smooth monotone lines drawn from a figure's data table, with area, stacked, fade and sparkline modifiers, dashed series, gaps, a fixed y range, x labels, a legend, and a pointer and keyboard tooltip.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the SVG is aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -1783,9 +1783,9 @@
       "slug": "column-chart",
       "title": "Column chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Columns drawn from zero from a figure's data table, grouped by row or stacked, with fade, track and sparkline modifiers, negative values, gaps, a fixed y range, x labels, a legend, and a pointer and keyboard tooltip with a highlight band.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the columns are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -1856,9 +1856,9 @@
       "slug": "bar-chart",
       "title": "Bar chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Horizontal bars drawn from zero from a figure's data table, grouped by row or stacked, with split, track, values and sparkline modifiers, negative values, gaps, a fixed value range, row labels, a legend, and a pointer and keyboard tooltip with a highlight band.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the bars and their values are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -1933,9 +1933,9 @@
       "slug": "pie-chart",
       "title": "Pie chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Slices drawn clockwise from the top from a figure's data table, with a legend of each row's cell and share, donut, values and sparkline modifiers, a <tfoot> total in the donut hole, further columns in the tooltip, and a pointer and keyboard tooltip that highlights the slice.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the slices, values, total and legend are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -2006,9 +2006,9 @@
       "slug": "heatmap-chart",
       "title": "Heatmap chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Every body cell of a figure's data table drawn as a shaded grid cell, with row headers beside the grid, column headers below, a scale naming the lowest and highest cells, values, data-label short or hidden labels, data-min and data-max, gaps, and a pointer and keyboard tooltip that moves cell by cell.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the grid, labels and scale are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -2079,9 +2079,9 @@
       "slug": "radar-chart",
       "title": "Radar chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Spokes drawn clockwise from the top from a figure's data table, one shape per series from zero in the middle to the scale's top at the rim, row labels past each spoke, a legend for several series, area, points, dashed and sparkline modifiers, data-min and data-max, and a pointer and keyboard tooltip with a cursor spoke.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the grid, shapes, labels and legend are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -2152,9 +2152,9 @@
       "slug": "radial-chart",
       "title": "Radial chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Rings drawn clockwise from the top from a figure's data table as a share of data-max, with tracks, a legend of each row's cell for more than one row, gauge and sparkline modifiers, a <tfoot> total in the middle, further columns in the tooltip, and a pointer and keyboard tooltip that highlights the ring.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the rings, total and legend are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -2225,9 +2225,9 @@
       "slug": "mixed-chart",
       "title": "Mixed chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Columns, smooth lines and areas drawn per series from a figure's data table by header class, with dashed lines, a second scale for end series with its own fixed range, x labels, a legend, a sparkline modifier, and a pointer and keyboard tooltip with points on the lines.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the columns and SVG are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -3242,10 +3242,118 @@
           "file": "tests/marquee-browser.test.js",
           "name": "chromium: marquee loops its two groups, pauses, follows direction and stops under reduced motion",
           "scope": "A short group filling the strip, the copy one gap after it, the half-cycle position horizontally, in RTL and vertically, reverse, pausing on hover, focus and .paused, one link per item in the accessibility tree and the reduced-motion stop with the copy hidden. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
         }
       ],
-      "browserEvidence": "incomplete",
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
+    {
+      "slug": "confetti",
+      "title": "Confetti",
+      "kind": "component",
+      "support": "implemented",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "source-reviewed",
+      "reviewedOn": "2026-10-09",
+      "scope": "Bursts from a button's center over the page, inside an authored canvas, or from script, with count, angle, spread, speed, decay, gravity, drift, lifetime, origin, colors, square, circle and star shapes, and size options, theme colors by default and a promise that resolves when the burst ends.",
+      "adaptation": "A canvas drawn with requestAnimationFrame. The page canvas is an aria-hidden manual popover with pointer events off, so it draws above modal dialogs without blocking clicks. Reduced motion draws nothing.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Keep the effect decorative and out of the accessibility tree, never block input, state the outcome in text and draw nothing when reduced motion is requested."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_confetti.scss",
+          "sha256": "0dc01d28e2bf26877ab57e5d5504b6dbd734b3ef64f593bf67e34753922a3d63"
+        },
+        {
+          "path": "src/ts/components/confetti.ts",
+          "sha256": "c5f6f8782548d71bce17e1f701b7f7c1376c2a88252fc3e07238699125c6503e"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "The burst origin on a button and on a canvas, theme colors, manualStart, the page canvas in the top layer above a modal dialog with pointer events off and aria-hidden, its removal when the burst ends, destroy and the reduced-motion skip are checked in a browser; frame rate on low-end devices and forced colors remain unverified.",
+          "nextStep": "Watch a burst on a low-end phone and in forced colors, and confirm a screen reader announces nothing for it."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/confetti-browser.test.js",
+          "name": "chromium: confetti bursts from its trigger in theme colors, on its own canvas, above a modal dialog and not under reduced motion",
+          "scope": "A canvas bursting at its center on init, manualStart waiting for fire(), a button bursting from its center in the theme primary color, the page canvas covering the viewport in the top layer with aria-hidden and no pointer events, fire() resolving after it is removed, a burst over an open modal dialog, destroy and the reduced-motion skip. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
+    {
+      "slug": "particles",
+      "title": "Particles",
+      "kind": "component",
+      "support": "unassessed",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "needs-review",
+      "reviewedOn": "2026-10-09",
+      "scope": "A canvas that covers its positioned ancestor with drifting dots that fade near the edges and lean toward the pointer, with quantity, staticity, ease, size, color and drift options and the theme on-surface color by default.",
+      "adaptation": "A canvas drawn with requestAnimationFrame, aria-hidden with pointer events off. The dot color comes from the canvas's CSS color, read each frame so theme changes apply. Reduced motion draws the dots once without motion.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Keep the effect decorative and out of the accessibility tree, never block input, keep text over it readable and stop motion when reduced motion is requested."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_particles.scss",
+          "sha256": "5d2d67515f7152d5b86d506e7fe42d9c66f058bd7b9e30a06a7b8fedc4738cc3"
+        },
+        {
+          "path": "src/ts/components/particles.ts",
+          "sha256": "7a22a1f580deb76e59bdeef75e8cfe432ee00743106a3348f5ad3c7f05e1f43b"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "The canvas covering its box, the on-surface default and the color option, following the pointer only while it is over the canvas, drift, refitting on resize, destroy and the still drawing under reduced motion are checked in a browser; frame rate on low-end devices, forced colors and contrast of text over the dots remain unverified.",
+          "nextStep": "Watch a full-width hero of particles on a low-end phone and in forced colors, and check text contrast over the densest area."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/particles-browser.test.js",
+          "name": "chromium: particles fill their box in the theme color, follow the pointer, drift, refit on resize and stay still under reduced motion",
+          "scope": "The canvas covering its positioned ancestor, a dot fading in where it was placed in the theme on-surface color, following the pointer inside the canvas and holding when it leaves, destroy clearing the canvas, vx drift, the color option, the pixel buffer after a resize and still dots under reduced motion. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -3360,6 +3468,66 @@
         "Google revises the linked guidance or before claiming a new release matches it"
       ]
     },
+    {
+      "slug": "map",
+      "title": "Map",
+      "kind": "component",
+      "support": "unassessed",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "needs-review",
+      "reviewedOn": "2026-10-09",
+      "scope": "MapLibre map with themed OpenFreeMap styles, markers with labels, tooltips, popups and dragging, routes, arcs, clusters, and zoom, compass, locate and full screen controls.",
+      "adaptation": "The page passes in the maplibre-gl module. Markers, popups and controls are authored HTML moved into MapLibre; routes, arcs and clusters are GeoJSON layers whose colors are read from theme tokens and redrawn when the theme changes.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Name the map region, make interactive markers named buttons, return focus when a popup closes, keep tile attribution visible and give the same information in text."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_map.scss",
+          "sha256": "3bc9d7ba4dcf2c8d632701d4a6d127dd0e83662b994591260a58581bc2f3d5de"
+        },
+        {
+          "path": "src/ts/components/mapView.ts",
+          "sha256": "eb0804b2b9368c8af1c9e6d6827c8bde42ceb4e01bdd9b3666d13a867bc67b03"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "Marker placement, the popup opened from its marker with aria-expanded, Escape and map-click closing with focus back on the marker, zoom limits, the compass bearing, theme-colored routes, arcs and clusters redrawn after a theme swap, removeOverlay and destroy are checked in a browser; the locate and full screen controls, marker dragging, spoken output, touch gestures and forced colors remain unverified.",
+          "nextStep": "Use the map with a screen reader and on a touch device, try locate and full screen with real permissions, drag a marker with the keyboard, and check forced colors."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/map-browser.test.js",
+          "name": "chromium: map places markers and popups, runs controls, themes overlays and restores its markup",
+          "scope": "Markers placed with the default dot, the popup without a marker open at init, a marker button opening its popup with aria-expanded, Escape and a map click closing it with focus back on the marker, zoom out disabled at the minimum zoom, zoom in, the compass bearing and reset, route, arcs and clusters in the theme primary color, no count layer without glyphs, all redrawn in the dark primary after a theme change, removeOverlay, destroy restoring the markup and controls, and a location arriving after destroy being ignored. No spoken-output assertion.",
+          "state": "stale"
+        },
+        {
+          "file": "tests/map-browser.test.js",
+          "name": "chromium: a map in a shadow root opens its marker popup",
+          "scope": "A marker button inside a shadow root finding its popup by id, then opening it with aria-expanded. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
     {
       "slug": "toolbars",
       "title": "Toolbars",
@@ -3660,16 +3828,16 @@
           "file": "tests/rich-text-editor-browser.test.js",
           "name": "chromium: rich text editor formats text, reflects state and keeps the textarea in sync",
           "scope": "Hidden textarea, textbox role and name from the label, starting HTML, label click focus, bold and heading commands with aria-pressed and .active, undo disabled state, textarea value and input event, empty value, and destroy. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/rich-text-editor-browser.test.js",
           "name": "chromium: rich text editor follows a disabled textarea",
           "scope": "A disabled textarea makes the editor read-only and disables every toolbar button.",
-          "state": "not-recorded"
+          "state": "stale"
         }
       ],
-      "browserEvidence": "incomplete",
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -3680,9 +3848,9 @@
       "slug": "drop-zone",
       "title": "Drop zone",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-06",
       "scope": "A label-sized native file input with a dragover state and a list of chosen file names and locale-formatted sizes.",
       "adaptation": "The native input covers the label, so clicks, keys and drops are the browser's; the shared Forms behavior marks the drag and fills the list.",
@@ -4512,6 +4680,65 @@
         "Google revises the linked guidance or before claiming a new release matches it"
       ]
     },
+    {
+      "slug": "keypad",
+      "title": "Keypad and Keyboard",
+      "kind": "component",
+      "support": "unassessed",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "needs-review",
+      "reviewedOn": "2026-10-11",
+      "scope": "A three-column keypad of round keys with two-cell wide keys and a keyboard of rows sized from a column count with an optional number row, typing into the field named by aria-controls with value keys, Backspace, Enter, a one-shot Shift, data-key keys inside the field's wrapper, dial-pad letters, styled call keys, an onKey callback and a pressed shape morph.",
+      "adaptation": "Keys are native buttons in a named group; edits go through the field's value and fire a composed input event, Enter uses requestSubmit() so validation runs, and inputmode=\"none\" on the field keeps the device keyboard closed. Browsers check minlength only on what a person types, so a minimum length is written as pattern.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-11",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Name the group and every icon key, keep keys from submitting the form, keep the field labelled and usable from a hardware keyboard, and keep keys at a usable target size."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_keypad.scss",
+          "sha256": "b530b6c62630f0bb86f146db24d4d7b363491355b2f2d3302a34b2274b42bf13"
+        },
+        {
+          "path": "src/ts/components/keypad.ts",
+          "sha256": "074900c8486ebcb978cb33bff7d51c47e1721e738eb593651768c3d17e768752"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "Typing at the caret, maxlength, pattern validation on Enter, Backspace including emoji, Enter submitting a form and adding a new line in a textarea, a one-shot Shift with capitals shown, number inputs, disabled fieldsets, in-field keys, shadow roots, focus staying in the field, the keypad grid and wide keys, keyboard key widths and the number row, the pressed shape and destroy are checked in a browser; screen reader output, forced colors, enlarged text and touch devices remain unverified.",
+          "nextStep": "Type a PIN and a message with a screen reader and on a touch device in each engine, and check forced colors and enlarged text."
+        },
+        {
+          "kind": "feature",
+          "description": "There is no caps lock, no symbol layer switching and no highlight of the key a hardware keyboard presses, and minlength does not apply to keypad edits.",
+          "nextStep": "Swap rows from onKey for a symbols key, add caps lock when a page needs it, and write a minimum length as pattern."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/keypad-browser.test.js",
+          "name": "chromium: keypad and keyboard type at the caret, edit, submit, shift and lay out their keys",
+          "scope": "Digits typed at the caret, maxlength, focus kept in the field on a pointer press, Backspace including emoji, Enter submitting once, a pattern mismatch blocking Enter, onKey values, composed input events from a shadow root, number, decimal and signed input, a disabled fieldset and its legend, a trailing Backspace in the field that runs once for two keypads, for a field inside its keyboard and for a field rendered after init, a password toggle that is not a key, a prefilled untouched field typed at the end, a caret placed at the start kept for keys activated from the keyboard, Shift showing capitals and releasing after one character, space and a textarea new line, three 72px round keypad columns, a two-cell wide key, a tenth-of-row letter key, the half-key indent, a one-and-a-half-key Shift, the space bar filling its row, a 40px number row that types and that hidden drops, the pressed corner, destroy, and the shared listeners leaving with the last keypad. No spoken-output assertion.",
+          "state": "not-recorded"
+        }
+      ],
+      "browserEvidence": "incomplete",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
     {
       "slug": "questionnaire",
       "title": "Questionnaire",