@markuplint/rules 5.3.0 → 5.5.0

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [5.5.0](https://github.com/markuplint/markuplint/compare/v5.4.0...v5.5.0) (2026-11-10)
+
+### Bug Fixes
+
+* **html-spec:** allow script-supporting elements in table sections, colgroup and dl ([197176a](https://github.com/markuplint/markuplint/commit/197176a7aae805e2949f9b96c6a27f39d478d261)), closes [#3591](https://github.com/markuplint/markuplint/issues/3591) [#4492](https://github.com/markuplint/markuplint/issues/4492)
+* report a main element that is not hierarchically correct ([b44c936](https://github.com/markuplint/markuplint/commit/b44c936cf2e40c8142f88fe6b503af6f437cd341))
+* **rules:** accept style as the first child in permitted-contents ([0523872](https://github.com/markuplint/markuplint/commit/05238722e9501b7758035d55293a178ab766001a)), closes [#x20](https://github.com/markuplint/markuplint/issues/x20)
+* **rules:** accept the interactive content that canvas allows ([095eb3a](https://github.com/markuplint/markuplint/commit/095eb3aeb16186b0f5cb3f4a3bd342360dae1c2c)), closes [#4491](https://github.com/markuplint/markuplint/issues/4491)
+* **rules:** count an element inside a conditional block as a label's descendant ([6ca1da5](https://github.com/markuplint/markuplint/commit/6ca1da545a903bec024f4418c3595f16d72365bc))
+* **rules:** do not judge an element that the framework moves to the head by its parent ([db28a20](https://github.com/markuplint/markuplint/commit/db28a20bc562233f0c55594077a15276ec9c113a)), closes [#4484](https://github.com/markuplint/markuplint/issues/4484) [#4484](https://github.com/markuplint/markuplint/issues/4484)
+* **rules:** do not look for an ancestor across the boundary of template content ([b660c8b](https://github.com/markuplint/markuplint/commit/b660c8bc5d2b4cbcc16f592ad536db9a2b8bdaaa))
+* **rules:** do not treat template content as an accessible name ([0d004ef](https://github.com/markuplint/markuplint/commit/0d004efd84e6cd201cdcdc66163b89c4b0a714d2))
+* **rules:** ignore comment nodes in permitted-contents ([38881eb](https://github.com/markuplint/markuplint/commit/38881eb71e80bfef45832a8f2378d336e5bfbe09)), closes [#4488](https://github.com/markuplint/markuplint/issues/4488)
+* **rules:** judge an id and a structure in the tree that it is in ([#4489](https://github.com/markuplint/markuplint/issues/4489)) ([b17db6d](https://github.com/markuplint/markuplint/commit/b17db6d813012e127beb2c2b9e3fc21a393e2d4d))
+* **rules:** require as to satisfy every matched link destination ([b4dbea2](https://github.com/markuplint/markuplint/commit/b4dbea2a08d761c90c98098102d7af40cf485849))
+
+### Features
+
+* **rules:** judge an attribute by what the framework renders ([3beee5a](https://github.com/markuplint/markuplint/commit/3beee5ad51e96fc3033b7930fec2889ea5bf18e6))
+
+
+# [5.4.0](https://github.com/markuplint/markuplint/compare/v5.3.0...v5.4.0) (2026-10-29)
+
+### Bug Fixes
+
+* **rules:** do not report descendant attributes that take part in a text alternative ([46002a7](https://github.com/markuplint/markuplint/commit/46002a75e06f877938d134ce0958a625e5d989d3)), closes [#4408](https://github.com/markuplint/markuplint/issues/4408)
+
+
 # [5.3.0](https://github.com/markuplint/markuplint/compare/v5.2.0...v5.3.0) (2026-10-21)
 
 ### Bug Fixes

package/CLAUDE.md

@@ -65,10 +65,11 @@ broken description and detonate in someone else's PR. Run `yarn site:build` befo
 
 ## Citing a specification
 
-A README, a source comment, `meta.ts` and `schema.json` cite the passage that justifies a rule. `yarn spec-citations` checks every citation against the live specification (what it checks and why: the module comment of `scripts/spec-citations/cli.ts`), and `scripts/spec-citations/citations-policy.spec.ts` holds the conventions below offline. After editing a citation, run `yarn spec-citations` (read-only) and fix what it reports. Its lock file is refreshed by the scheduled workflow's PR, never by hand.
+A README, a source comment, `meta.ts` and `schema.json` cite the passage that justifies a rule; so do the comments in the `src` of every package (the algorithms of `ml-spec`, the value grammars of `types`, the DOM of `ml-core`, the declarations of how a framework renders a literal in `*-spec` and `*-parser`), the `html-spec` data and the website's pages. The monitor reads the whole `src` of each package, so a citation that moves with its code to another package stays watched. `yarn spec-citations` checks every citation against the live specification, the documentation or the source of a framework (what it checks and why: the module comment of `scripts/spec-citations/cli.ts`), and `scripts/spec-citations/citations-policy.spec.ts` holds the conventions below offline. After editing a citation, run `yarn spec-citations` (read-only) and fix what it reports. Its lock file is refreshed by the scheduled workflow's PR, never by hand.
 
-- Quote a spec sentence verbatim, as a blockquote in a README or as `>` lines in a source comment, and name its source: in a README the `Cite: [..](url)` line after the quote (`[..](url)より引用` in Japanese), in a comment an `@see` URL in the same comment. Never quote inline in double quotes: the monitor cannot check it. `[…]` marks what the quote leaves out.
-- Cite a section by its fragment. A `§4.10.7` beside the link is compared with the section the fragment is in; the number of an ancestor section is accepted.
+- Quote a spec sentence verbatim, as a blockquote in a README or as `>` lines in a source comment, and name its source: in a README the `Cite: [..](url)` line after the quote (`[..](url)より引用` in Japanese), in a comment an `@see` URL in the same comment. A `>` is read only at the start of a comment line (not after a list marker), and each quote is a paragraph of its own. Never quote inline in double quotes: the monitor cannot check it. `[…]` marks what the quote leaves out, and a quote is looked up in the sections the comment cites, in the order that it writes it in.
+- Cite a section by its fragment. A `§4.10.7` beside the link is compared with the section the fragment is in (one before the link belongs to the link that follows it, one after a link on the same line, as in `@see <url> — Name §4.3.2`, to that link); the number of an ancestor section is accepted. Prefer the id of a heading to a text fragment (`#:~:text=`) alone: a text fragment with no `#fragment` is searched in the whole page, and stops matching when the passage is reworded (HTML-AAM's tables were rebuilt into one section per element, and `#:~:text=Comments-,article,-aside` went with them).
+- A source file of a framework is cited by `https://github.com/<owner>/<repo>/blob/<default branch>/<path>#<name>`, where `<name>` is a top-level declaration of the file (a function, a variable, a class, a type, or `exports.<name> =`). It is compared as the declaration alone, so an edit elsewhere in the file reports nothing and a renamed declaration is `anchor-missing`. Only the repositories listed in `scripts/spec-citations/collect.ts` are monitored, and a link without a name or with a line range (`#L11-L52`) is not checked.
 - `README.ja.md` cites the HTML Living Standard through its translation (`https://momdo.github.io/html/…`, the same page and anchor as the English README) and quotes the translation's own text. That text stays English where the translation is behind the original, and the monitor reports it once the translation catches up. For WCAG, the translation is waic.jp's.
 - Cite W3C specs at an edition-less URL (`https://w3c.github.io/accname/`, `https://w3c.github.io/aria/`, `https://www.w3.org/TR/WCAG/`, `https://www.w3.org/TR/html-aria/`). WCAG's Techniques and Understanding pages have no edition-less URL; cite the latest edition (`https://www.w3.org/WAI/WCAG22/…`). Not `w3c.github.io/html-aria/`: that is unrendered ReSpec source whose anchors exist only after a browser builds them.
 

package/lib/aria-prop-requires-role/index.js

@@ -2,7 +2,7 @@ import { createRule, getComputedRole, ariaSpecs, getSpec } from '@markuplint/ml-
 import { ARIA_RECOMMENDED_VERSION } from '@markuplint/ml-spec';
 import { checkingNoGlobalProp } from '../wai-aria/checkings/no-global-prop.js';
 import { defaultOptions } from '../wai-aria/default-options.js';
-import { isAriaAttr } from '../helpers.js';
+import { getAriaAttrs } from '../helpers.js';
 import meta from './meta.js';
 export default createRule({
     meta,
@@ -14,7 +14,7 @@ export default createRule({
                 return;
             if (!elSpec.globalAttrs['#ARIAAttrs'])
                 return;
-            const propAttrs = el.attributes.filter(attr => isAriaAttr(attr));
+            const propAttrs = getAriaAttrs(el);
             if (propAttrs.length === 0)
                 return;
             const ariaVersion = el.rule.options?.version ?? document.ruleCommonSettings?.ariaVersion ?? ARIA_RECOMMENDED_VERSION;

package/lib/attr-eligibility.d.ts

@@ -41,8 +41,29 @@ export type AttrEligibility = {
  * @param attr - The attribute that is being resolved
  */
 export declare function resolveAttrEligibility<T extends RuleConfigValue, O extends PlainData>(name: string, node: Element<T, O>, attrSpecs: readonly Attribute[], attr?: Attr<T, O>): AttrEligibility;
+type PlainEnum = {
+    readonly enum: readonly [string, ...string[]];
+    readonly caseInsensitive?: boolean;
+    readonly disallowToSurroundBySpaces?: boolean;
+    readonly invalidValueDefault?: string;
+};
+/**
+ * `invalidValueDefault` is not carried over: a fallback of one set may be a
+ * value another set forbids. A case-sensitive spelling is kept when an earlier
+ * entry only has another case. Case and surrounding spaces follow the stricter
+ * side, because the value has to satisfy every entry.
+ *
+ * An empty intersection cannot be an enum (`enum` has at least one token).
+ * A pattern that matches nothing keeps every value invalid. That pattern is
+ * not a keyword list an author is meant to satisfy.
+ *
+ * @param enums - The enum entries that matched, in spec order. At least two
+ * @returns The intersection, or a pattern that matches nothing when the sets are disjoint
+ */
+export declare function intersectEnums(enums: readonly PlainEnum[]): Attribute['type'];
 /**
  * Formats the "did you mean" suffix shared by `no-unknown-attr`'s two typo
  * paths (spec-driven candidate, case-sensitivity mismatch).
  */
 export declare function suggestionSuffix(t: Translator, candidate: string | undefined): string;
+export {};

package/lib/attr-eligibility.js

@@ -1,5 +1,5 @@
 import { isConditionalAttributeTypeArray } from '@markuplint/ml-spec';
-import { getCandidate } from '@markuplint/types';
+import { check, getCandidate } from '@markuplint/types';
 import { attrMatches, conditionDependsOnDynamicAttr, findAttrSpec, namespaceKeyOf } from './helpers.js';
 /**
  * Attribute namespaces that are exempt from spec-based name/eligibility
@@ -43,14 +43,11 @@ attr) {
     }
     // Resolve ConditionalAttributeType[] to a concrete type based on element matching (#3598).
     if (isConditionalAttributeTypeArray(spec.type)) {
-        const matched = spec.type.find(entry => {
+        const matched = spec.type.filter(entry => {
             const cond = typeof entry.condition === 'string' ? entry.condition : entry.condition.join(',');
             return node.matches(cond);
         });
-        // Fallback to 'Any' when no condition matches: input types without an explicit
-        // entry (text, search, tel, password, hidden, checkbox, radio, file, submit,
-        // image, reset, button) have no value constraints per the HTML spec.
-        spec = { ...spec, type: matched ? matched.type : 'Any' };
+        spec = { ...spec, type: combineMatchedConditionalTypes(matched) };
     }
     if (spec.condition != null &&
         !node.hasSpreadAttr &&
@@ -60,6 +57,89 @@ attr) {
     }
     return { status: 'ok', spec };
 }
+/**
+ * Enum entries that match together are simultaneous constraints: `link[as]`
+ * has to be a preload destination and a module preload destination when `rel`
+ * contains both keywords. The message names that intersection and does not
+ * offer a keyword another entry forbids. Token order follows the entries:
+ * a spelling is kept from the earliest entry whose own token satisfies every
+ * entry, which is the first entry's order when that spelling is valid there.
+ *
+ * A non-enum overlap stays on the first match. Those entries are ordered
+ * alternatives: an empty `input[value]` other than `type=range` is
+ * unconstrained even though a later type-specific entry also matches, and
+ * `email` with `multiple` matches both the address-list type and the
+ * single-address type, of which the list is the requirement.
+ */
+function combineMatchedConditionalTypes(matched) {
+    const first = matched[0];
+    // No condition matched. Input types without an explicit entry (text, search,
+    // tel, password, hidden, checkbox, radio, file, submit, image, reset, button)
+    // have no value constraints per the HTML spec.
+    if (!first) {
+        return 'Any';
+    }
+    const enums = [];
+    for (const entry of matched) {
+        if (!isPlainEnum(entry.type)) {
+            return first.type;
+        }
+        enums.push(entry.type);
+    }
+    if (enums.length === 1) {
+        return first.type;
+    }
+    return intersectEnums(enums);
+}
+function isPlainEnum(type) {
+    if (typeof type === 'string' || Array.isArray(type)) {
+        return false;
+    }
+    return 'enum' in type && Array.isArray(type.enum) && type.enum.length > 0;
+}
+/**
+ * `invalidValueDefault` is not carried over: a fallback of one set may be a
+ * value another set forbids. A case-sensitive spelling is kept when an earlier
+ * entry only has another case. Case and surrounding spaces follow the stricter
+ * side, because the value has to satisfy every entry.
+ *
+ * An empty intersection cannot be an enum (`enum` has at least one token).
+ * A pattern that matches nothing keeps every value invalid. That pattern is
+ * not a keyword list an author is meant to satisfy.
+ *
+ * @param enums - The enum entries that matched, in spec order. At least two
+ * @returns The intersection, or a pattern that matches nothing when the sets are disjoint
+ */
+export function intersectEnums(enums) {
+    const caseInsensitive = enums.every(item => item.caseInsensitive !== false);
+    const tokens = [];
+    for (const item of enums) {
+        for (const token of item.enum) {
+            if (!enums.every(other => check(token, other).matched)) {
+                continue;
+            }
+            if (tokens.some(existing => sameToken(existing, token, caseInsensitive))) {
+                continue;
+            }
+            tokens.push(token);
+        }
+    }
+    const [head, ...rest] = tokens;
+    if (head === undefined) {
+        return { pattern: '/(?!)/' };
+    }
+    const result = {
+        enum: [head, ...rest],
+        ...(caseInsensitive ? {} : { caseInsensitive: false }),
+        ...(enums.every(item => item.disallowToSurroundBySpaces === false)
+            ? { disallowToSurroundBySpaces: false }
+            : {}),
+    };
+    return result;
+}
+function sameToken(a, b, caseInsensitive) {
+    return caseInsensitive ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
 /**
  * Formats the "did you mean" suffix shared by `no-unknown-attr`'s two typo
  * paths (spec-driven candidate, case-sensitivity mismatch).

package/lib/attr-order/index.js

@@ -229,7 +229,8 @@ export default createRule({
         let cachedValue;
         let cachedCompiled;
         await document.walkOn('Element', node => {
-            const attrs = node.getAttributeTokens();
+            // An attribute that a pretender made is not in the source, so it has no place in the order of it
+            const attrs = node.getAttributeTokens().filter(attr => !attr.isPretended);
             if (attrs.length <= 1) {
                 return;
             }

package/lib/attr-value-quotes/index.js

@@ -14,7 +14,7 @@ export default createRule({
     async verify({ document, report, t }) {
         await document.walkOn('Attr', attr => {
             const message = t('{0} is must {1} on {2}', 'Attribute value', 'quote', `${attr.rule.value} quotation mark`);
-            if (attr.isDynamicValue || attr.isDirective || !attr.equal || attr.equal?.raw === '') {
+            if (attr.isExpressionValue || attr.isDirective || !attr.equal || attr.equal?.raw === '') {
                 return;
             }
             const quote = attr.startQuote?.raw;

package/lib/consistent-table-row-length/index.js

@@ -18,7 +18,7 @@ export default createRule({
     meta,
     defaultSeverity: 'warning',
     verify({ document, report, t }) {
-        const tables = document.querySelectorAll('table');
+        const tables = document.deepQuerySelectorAll('table');
         for (const table of tables) {
             const grid = new Grid(table);
             if (grid.hasOverlapped()) {

package/lib/element-supports-aria-prop/index.js

@@ -2,7 +2,7 @@ import { createRule, getComputedRole, ariaSpecs, getSpec } from '@markuplint/ml-
 import { ARIA_RECOMMENDED_VERSION } from '@markuplint/ml-spec';
 import { checkingElementSupportsAriaProp } from '../wai-aria/checkings/element-supports-aria-prop.js';
 import { defaultOptions } from '../wai-aria/default-options.js';
-import { isAriaAttr } from '../helpers.js';
+import { getAriaAttrs } from '../helpers.js';
 import meta from './meta.js';
 /**
  * Split from the former `wai-aria-disallowed-props` rule (#3989): the ARIA in
@@ -25,7 +25,7 @@ export default createRule({
                 return;
             if (!elSpec.globalAttrs['#ARIAAttrs'])
                 return;
-            const propAttrs = el.attributes.filter(attr => isAriaAttr(attr));
+            const propAttrs = getAriaAttrs(el);
             if (propAttrs.length === 0)
                 return;
             const ariaVersion = el.rule.options?.version ?? document.ruleCommonSettings?.ariaVersion ?? ARIA_RECOMMENDED_VERSION;

package/lib/form-attr-references-form/index.js

@@ -1,4 +1,5 @@
 import { createRule } from '@markuplint/ml-core';
+import { getElementByIdInTree } from '../helpers.js';
 import meta from './meta.js';
 /**
  * Form-associated elements (HTML LS §4.10.2). Listed elements may carry
@@ -47,8 +48,7 @@ export default createRule({
                 return;
             if (formAttr.isDynamicValue)
                 return;
-            const targetId = formAttr.value;
-            const target = [...document.querySelectorAll('[id]')].find(candidate => candidate.getAttribute('id') === targetId);
+            const target = getElementByIdInTree(el, formAttr.value, formAttr.isExpressionValue);
             // Existence is checked by `no-refer-to-non-existent-id`. If the ID does not resolve
             // here, leave that diagnostic to the dedicated rule and stay silent.
             if (!target)

package/lib/helpers.d.ts

@@ -1,7 +1,36 @@
 import type { FixToken, IRuleFixer, PlainData, TextEdit } from '@markuplint/ml-config';
-import type { Attr, Element, RuleConfigValue, Document } from '@markuplint/ml-core';
+import type { Attr, Element, RuleConfigValue } from '@markuplint/ml-core';
 import type { Attribute } from '@markuplint/ml-spec';
 import type { WritableDeep } from 'type-fest';
+import { getDOMValue } from '@markuplint/ml-core';
+export { getDOMValue };
+/**
+ * The element that an id reference written in an attribute of `el` resolves to: the first element
+ * of the tree `el` is in whose id is the reference. The content of a `template` element and a
+ * declarative shadow root are trees of their own, so a reference there does not reach an id of the
+ * document, nor the other way around.
+ *
+ * The reference is compared with the character references in the markup resolved, as the id is.
+ *
+ * @template T - The rule configuration value type
+ * @template O - The rule options type
+ * @param el - The element that has the attribute
+ * @param reference - The value of the attribute, or one token of it, as written in the markup
+ * @param isExpression - Whether the value is written as code, which has no character reference in it
+ * @returns The element, or `null` when the tree has none, or `el` is in no tree
+ * @see https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute
+ */
+export declare function getElementByIdInTree<T extends RuleConfigValue, O extends PlainData>(el: Element<T, O>, reference: string, isExpression?: boolean): Element<T, O> | null;
+/**
+ * The elements that match the selector in the tree `el` is in (see {@link getElementByIdInTree}).
+ *
+ * @template T - The rule configuration value type
+ * @template O - The rule options type
+ * @param el - An element of the tree
+ * @param selectors - A selector
+ * @returns The elements in the order of the markup, none when `el` is in no tree
+ */
+export declare function querySelectorAllInTree<T extends RuleConfigValue, O extends PlainData>(el: Element<T, O>, selectors: string): readonly Element<T, O>[];
 /** A `null`/`undefined` condition means the attribute applies unconditionally. */
 export declare function attrMatches<T extends RuleConfigValue, O extends PlainData>(node: Element<T, O>, condition: Attribute['condition']): boolean;
 /**
@@ -60,6 +89,16 @@ export declare function namespaceKeyOf(attr: Pick<Attr<RuleConfigValue, PlainDat
         readonly elementType: string;
     };
 }): string;
+/**
+ * The `aria-*` attributes that the element has. An attribute that the framework does not output
+ * (`aria-label={null}`, `MLAttr#isAbsent`) is not one of them: the DOM does not have it, so what a rule
+ * says of an attribute of the element (it is unsupported, deprecated, redundant, or its value is
+ * invalid) is not said of it.
+ *
+ * @param el - The element
+ * @returns The `aria-*` attributes that are output
+ */
+export declare function getAriaAttrs<T extends RuleConfigValue, O extends PlainData>(el: Element<T, O>): Attr<T, O>[];
 /**
  * Whether the attribute is an `aria-*` one, told by {@link namespaceKeyOf}.
  *
@@ -117,7 +156,7 @@ export declare function match(needle: string, pattern: string): boolean;
  */
 export declare const rePCENChar: string;
 export declare function toNormalizedValue(value: string, spec: Attribute): string;
-export declare function accnameMayBeMutable(el: Element<any, any>, document: Document<any, any>): boolean;
+export declare function accnameMayBeMutable(el: Element<any, any>): boolean;
 /**
  * Whether the accessible name of `el` may be rendered by content the pretender
  * does not know: an unknown entry (`{ dynamic: true }`) in the `contents` of
@@ -129,9 +168,9 @@ export declare function accnameMayBeMutable(el: Element<any, any>, document: Doc
  * must stay checked (and reported as redundant by `no-redundant-accessible-name`).
  * Call it only once the static name has been computed and found empty.
  */
-export declare function accnameMayComeFromUnknownContent(el: Element<any, any>, document: Document<any, any>): boolean;
+export declare function accnameMayComeFromUnknownContent(el: Element<any, any>): boolean;
 export declare const labelable: string[];
-export declare function getOwnedLabel<V extends RuleConfigValue, O extends PlainData>(el: Element<V, O>, document: Document<V, O>): Element<V, O> | null;
+export declare function getOwnedLabel<V extends RuleConfigValue, O extends PlainData>(el: Element<V, O>): Element<V, O> | null;
 /** `null`/`undefined` items are silently dropped on add. */
 export declare class Collection<T> {
     #private;
@@ -181,4 +220,3 @@ export declare function createIgnoreFeaturesLookup(tagNameCaseSensitive: boolean
     /** Whether the attribute of the element is ignored. */
     isAttrIgnored<T extends RuleConfigValue, O extends PlainData>(elementOption: readonly string[] | undefined, elementName: string, attr: Attr<T, O>): boolean;
 };
-export {};

package/lib/helpers.js

@@ -1,5 +1,49 @@
-import { escapeCSS } from '@markuplint/ml-spec';
-import { asciiLowerCase } from '@markuplint/shared';
+import { getDOMValue, getRenderedChildNodes } from '@markuplint/ml-core';
+import { asciiLowerCase, decodeEntities } from '@markuplint/shared';
+export { getDOMValue };
+/**
+ * The element that an id reference written in an attribute of `el` resolves to: the first element
+ * of the tree `el` is in whose id is the reference. The content of a `template` element and a
+ * declarative shadow root are trees of their own, so a reference there does not reach an id of the
+ * document, nor the other way around.
+ *
+ * The reference is compared with the character references in the markup resolved, as the id is.
+ *
+ * @template T - The rule configuration value type
+ * @template O - The rule options type
+ * @param el - The element that has the attribute
+ * @param reference - The value of the attribute, or one token of it, as written in the markup
+ * @param isExpression - Whether the value is written as code, which has no character reference in it
+ * @returns The element, or `null` when the tree has none, or `el` is in no tree
+ * @see https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute
+ */
+export function getElementByIdInTree(
+// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+el, reference, isExpression = false) {
+    const root = el.getRootNode();
+    if (root.is(root.DOCUMENT_NODE) || root.is(root.DOCUMENT_FRAGMENT_NODE)) {
+        return root.getElementById(isExpression ? reference : decodeEntities(reference));
+    }
+    return null;
+}
+/**
+ * The elements that match the selector in the tree `el` is in (see {@link getElementByIdInTree}).
+ *
+ * @template T - The rule configuration value type
+ * @template O - The rule options type
+ * @param el - An element of the tree
+ * @param selectors - A selector
+ * @returns The elements in the order of the markup, none when `el` is in no tree
+ */
+export function querySelectorAllInTree(
+// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+el, selectors) {
+    const root = el.getRootNode();
+    if (root.is(root.DOCUMENT_NODE) || root.is(root.DOCUMENT_FRAGMENT_NODE)) {
+        return [...root.querySelectorAll(selectors)];
+    }
+    return [];
+}
 /** A `null`/`undefined` condition means the attribute applies unconditionally. */
 export function attrMatches(
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
@@ -30,9 +74,11 @@ node, condition) {
             }
         }
     }
-    // Whether the attribute is the one that the selector names is up to the attribute (`isNamedBy`)
+    // Whether the attribute is the one that the selector names is up to the attribute (`isNamedBy`).
+    // An attribute that the framework does not output (`type={null}`) is known not to be there, so the
+    // condition is decided: it is not met.
     const names = [...referencedNames];
-    return node.attributes.some(attr => attr.isDynamicValue && names.some(name => attr.isNamedBy(name)));
+    return node.attributes.some(attr => attr.isDynamicValue && !attr.isAbsent && names.some(name => attr.isNamedBy(name)));
 }
 /**
  * Memoizes `fn` by the identity of its argument. Use it for an object that is one object for every
@@ -118,6 +164,20 @@ attr) {
 export function namespaceKeyOf(attr) {
     return attr.ownerElement.elementType === 'authored' ? asciiLowerCase(attr.name) : attr.nameKey;
 }
+/**
+ * The `aria-*` attributes that the element has. An attribute that the framework does not output
+ * (`aria-label={null}`, `MLAttr#isAbsent`) is not one of them: the DOM does not have it, so what a rule
+ * says of an attribute of the element (it is unsupported, deprecated, redundant, or its value is
+ * invalid) is not said of it.
+ *
+ * @param el - The element
+ * @returns The `aria-*` attributes that are output
+ */
+export function getAriaAttrs(
+// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+el) {
+    return el.attributes.filter(attr => !attr.isAbsent && isAriaAttr(attr));
+}
 /**
  * Whether the attribute is an `aria-*` one, told by {@link namespaceKeyOf}.
  *
@@ -261,13 +321,11 @@ export function toNormalizedValue(value, spec) {
 }
 export function accnameMayBeMutable(
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-el, 
-// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-document) {
+el) {
     if (el.hasMutableAttributes() || el.hasMutableChildren(true)) {
         return true;
     }
-    const ownedLabel = getOwnedLabel(el, document);
+    const ownedLabel = getOwnedLabel(el);
     if (ownedLabel && (ownedLabel.hasMutableAttributes() || ownedLabel.hasMutableChildren(true))) {
         return true;
     }
@@ -286,31 +344,33 @@ document) {
  */
 export function accnameMayComeFromUnknownContent(
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-el, 
-// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-document) {
+el) {
     if (hasUnknownContent(el)) {
         return true;
     }
-    const labelledby = el.getAttribute('aria-labelledby');
+    const labelledbyAttr = el.getAttributeNode('aria-labelledby');
+    const labelledby = labelledbyAttr?.value;
     if (labelledby) {
         const referenced = labelledby
             .trim()
             .split(/\s+/)
-            .map(id => document.querySelector(`#${escapeCSS(id)}`));
+            .map(id => getElementByIdInTree(el, id, labelledbyAttr.isExpressionValue));
         if (referenced.some(target => target && hasUnknownContent(target))) {
             return true;
         }
     }
-    const ownedLabel = getOwnedLabel(el, document);
+    const ownedLabel = getOwnedLabel(el);
     return !!ownedLabel && hasUnknownContent(ownedLabel);
 }
 /**
- * Walks the same children the accname resolver of `@markuplint/ml-core` does:
- * for a pretended element, the children the component renders (`as.childNodes`,
- * placed into `contents`), so that a nested component contributes its own
- * `contents`; otherwise the children as written. A hidden child is skipped
- * because the name computation never reads it (`isHidden` in that resolver).
+ * Walks the children {@link getRenderedChildNodes} returns. A hidden child is
+ * skipped because the name computation never reads it (`isHidden` in that resolver).
+ *
+ * A `template` whose shadow root is only maybe attached returns `true` before
+ * that walk. Its content is omitted from the computed name, so an ancestor
+ * whose computed name is empty is not reported: the rule calls this only after
+ * the computed name is empty. Light DOM text that remains in the computed name
+ * is still a name, and the rule does not reach this function.
  */
 function hasUnknownContent(
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
@@ -319,8 +379,10 @@ el) {
     if (context?.type === 'pretender' && context.slotContent?.mutable) {
         return true;
     }
-    const given = context?.type === 'pretender' ? [...context.as.childNodes] : [...el.childNodes];
-    const children = context?.type === 'pretender' && context.slotContent ? context.slotContent.fill(given) : given;
+    if (context?.type !== 'pretender' && el.isHTMLTemplateElement && el.declarativeShadowRootAttachment === 'unknown') {
+        return true;
+    }
+    const children = [...getRenderedChildNodes(el)];
     return children.some(child => child.is(child.ELEMENT_NODE) &&
         child.getAttribute('aria-hidden') !== 'true' &&
         !child.hasAttribute('hidden') &&
@@ -329,17 +391,17 @@ el) {
 export const labelable = ['button', 'input:not([type=hidden])', 'meter', 'output', 'progress', 'select', 'textarea'];
 export function getOwnedLabel(
 // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-el, 
-// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-document) {
+el) {
     if (!labelable.some(cond => el.matches(cond))) {
         return null;
     }
     let ownedLabel = el.closest('label');
     if (!ownedLabel) {
-        const id = el.getAttribute('id');
+        const id = getDOMValue(el.getAttributeNode('id'));
         if (id) {
-            ownedLabel = document.querySelector(`label[for="${id}"]`);
+            // The label is looked for in the tree of the element, and the two values are compared as the DOM has them
+            ownedLabel =
+                querySelectorAllInTree(el, 'label[for]').find(label => getDOMValue(label.getAttributeNode('for')) === id) ?? null;
         }
     }
     return ownedLabel;

package/lib/input-list-references-datalist/index.js

@@ -1,4 +1,5 @@
 import { createRule } from '@markuplint/ml-core';
+import { getElementByIdInTree } from '../helpers.js';
 import meta from './meta.js';
 /**
  * Require the `list` attribute on an `<input>` element to reference an
@@ -28,8 +29,7 @@ export default createRule({
                 return;
             if (listAttr.isDynamicValue)
                 return;
-            const targetId = listAttr.value;
-            const target = [...document.querySelectorAll('[id]')].find(candidate => candidate.getAttribute('id') === targetId);
+            const target = getElementByIdInTree(el, listAttr.value, listAttr.isExpressionValue);
             // Existence is checked by `no-refer-to-non-existent-id`. If the ID does not resolve
             // here, leave that diagnostic to the dedicated rule and stay silent.
             if (!target)

package/lib/itemprop-requires-itemscope/index.js

@@ -1,4 +1,5 @@
 import { createRule } from '@markuplint/ml-core';
+import { getDOMValue } from '../helpers.js';
 import meta from './meta.js';
 /**
  * Rule that requires every `itemprop` to belong to an item.
@@ -28,21 +29,37 @@ export default createRule({
         // once and then check each `[itemprop]` against the union set.
         // `itemref="  "` (whitespace-only) yields zero tokens and contributes
         // no entries to the set; orphans referencing such a host stay orphans.
-        const itemrefIds = new Set();
-        const itemrefHosts = document.querySelectorAll('[itemscope][itemref]');
+        // The ids are collected by tree: the content of a `template` element and a declarative shadow
+        // root are trees of their own, which an `itemref` does not reach out of, and the elements of
+        // every tree are checked.
+        // An `itemref` that is not known until it is rendered may reach any element of its tree, so
+        // that tree is not checked.
+        const itemrefIdsOfTree = new Map();
+        const treesWithDynamicItemref = new Set();
+        const itemrefHosts = document.deepQuerySelectorAll('[itemscope][itemref]');
         for (const host of itemrefHosts) {
-            const value = host.getAttribute('itemref') ?? '';
-            for (const token of value.split(/\s+/)) {
-                if (token)
-                    itemrefIds.add(token);
+            const root = host.getRootNode();
+            let itemrefIds = itemrefIdsOfTree.get(root);
+            if (!itemrefIds) {
+                itemrefIds = new Set();
+                itemrefIdsOfTree.set(root, itemrefIds);
+            }
+            const itemref = host.getAttributeNode('itemref');
+            if (itemref?.isDynamicValue) {
+                treesWithDynamicItemref.add(root);
+            }
+            for (const token of itemref?.value.split(/\s+/) ?? []) {
+                const id = token ? getDOMValue(itemref, token) : null;
+                if (id != null)
+                    itemrefIds.add(id);
             }
         }
-        const itempropEls = document.querySelectorAll('[itemprop]');
+        const itempropEls = document.deepQuerySelectorAll('[itemprop]');
         for (const el of itempropEls) {
             const hasAncestorScope = el.closest('[itemscope]') != null;
-            const id = el.getAttribute('id');
-            const isItemrefTarget = id != null && id !== '' && itemrefIds.has(id);
-            if (!hasAncestorScope && !isItemrefTarget) {
+            const id = getDOMValue(el.getAttributeNode('id'));
+            const isItemrefTarget = id != null && id !== '' && !!itemrefIdsOfTree.get(el.getRootNode())?.has(id);
+            if (!hasAncestorScope && !isItemrefTarget && !treesWithDynamicItemref.has(el.getRootNode())) {
                 report({
                     scope: el,
                     message: t('{0} must {1}', t('the {0}', 'element'), 'belong to an item via an ancestor `itemscope` or be referenced by an `itemref`'),

package/lib/label-for-references-labelable/index.js

@@ -1,4 +1,5 @@
 import { createRule } from '@markuplint/ml-core';
+import { getElementByIdInTree } from '../helpers.js';
 import meta from './meta.js';
 /**
  * Labelable elements per HTML LS §4.10.2 *Categories: Labelable elements*.
@@ -51,8 +52,7 @@ export default createRule({
                 return;
             if (forAttr.isDynamicValue)
                 return;
-            const targetId = forAttr.value;
-            const target = [...document.querySelectorAll('[id]')].find(candidate => candidate.getAttribute('id') === targetId);
+            const target = getElementByIdInTree(el, forAttr.value, forAttr.isExpressionValue);
             // Existence is checked by `no-refer-to-non-existent-id`. If the ID does not resolve
             // here, leave that diagnostic to the dedicated rule and stay silent.
             if (!target)