@surea11y/core 1.0.0

package/src/checks/automatic/listbox-name-present.js

@@ -0,0 +1,236 @@
+'use strict';
+
+const id = 'listbox-name-present';
+
+const meta = {
+  title: 'Accessible name is present',
+  description: 'Checks that elements expose a non-empty accessible name.',
+  i18n: {
+    titleKey: 'listboxNamePresent_title',
+    descriptionKey: 'listboxNamePresent_description'
+  },
+  helpUrl: null,
+  tags: ["wcag2a", "wcag412", "forms", "atomic", "automatic", "name", "listbox"],
+  wcagSc: ['4.1.2'],
+  normativeMappings: [
+    { standard: 'WCAG', version: '2.2', requirement: '4.1.2', title: 'Name, Role, Value', conformanceLevel: 'A' }
+  ],
+  defaultSeverity: 'serious',
+  category: 'robust',
+  type: 'automatic',
+  defaultConfidence: 'high',
+  coverage: { facetsBySc: { '4.1.2': ['listbox-name-present'] } }
+};
+
+function runInPage(ctx) {
+  const { document, root, helpers, rule } = ctx;
+  const getEligibilityInfo = helpers && typeof helpers.getEligibilityInfo === 'function'
+      ? helpers.getEligibilityInfo
+      : null;
+  const safeRoot = root || document;
+
+
+  function normalizeWs(s) {
+    return String(s || '').replace(/\s+/g, ' ').trim();
+  }
+
+  function getAttr(el, name) {
+    try {
+      if (!el || !el.getAttribute) return '';
+      return normalizeWs(el.getAttribute(name));
+    } catch { return ''; }
+  }
+
+  function getConservativeSubtreeText(document, container) {
+    // "Name from content" — recurses into descendants and uses each one's
+    // own accessible name (img alt, aria-label/aria-labelledby, title) when
+    // it has one, not just literal text nodes. See getContentNameInfo's
+    // header comment in src/core/dom-helpers.js for the full rationale
+    // (this replaced a text-node-only TreeWalker that missed the common
+    // "<a><img alt='...'></a>" logo-link / "<button><img alt='...'></button>"
+    // icon-button pattern).
+    if (helpers.getContentNameInfo) {
+      const info = helpers.getContentNameInfo(container, ctx);
+      return info && info.present ? info.value : '';
+    }
+    const t = (container && container.textContent) ? String(container.textContent) : '';
+    return t.replace(/\s+/g, ' ').trim();
+  }
+
+  // A <label> contributes a name via its own aria-label/aria-labelledby
+  // (checked first, same ARIA-over-content precedence any element's
+  // accessible name gives — e.g. <label aria-label="Search"><svg
+  // aria-hidden="true">...</svg></label> names its control "Search" even
+  // though the label's only child content is aria-hidden) or, failing
+  // that, its rendered content (getConservativeSubtreeText).
+  function getLabelText(lab) {
+    if (helpers.getAriaNameInfo) {
+      try {
+        const aria = helpers.getAriaNameInfo(lab, ctx);
+        if (aria && aria.present && aria.value) return normalizeWs(aria.value);
+      } catch {}
+    }
+    const content = getConservativeSubtreeText(document, lab);
+    if (content) return content;
+    // Final fallback per the general accname text-alternative algorithm,
+    // which applies to any element being asked for its name regardless of
+    // why (own aria-label, an aria-labelledby reference, or — here — native
+    // <label for> association): title, when nothing else yields a name.
+    // Purely additive (only fills in a name where there was none before),
+    // so it carries no false-positive risk — see dialog-name-present.js's
+    // identical <iframe>-title-fallback fix for the concrete real-world
+    // trigger this same accname step covers elsewhere.
+    return getAttr(lab, 'title');
+  }
+
+  function resolveAriaLabelledbyText(document, el, maxRefs) {
+    const raw = getAttr(el, 'aria-labelledby');
+    if (!raw) return '';
+    // Delegates to the shared getTextFromIdRefs helper instead of computing
+    // name-from-content of the referenced element — see dialog-name-
+    // present.js's identical fix for the full rationale (an <iframe>
+    // aria-labelledby target's only name source is its title attribute,
+    // which name-from-content alone can never see).
+    if (helpers.getTextFromIdRefs) {
+      try {
+        const r = helpers.getTextFromIdRefs(raw, ctx, { maxRefs: maxRefs || 8 });
+        return normalizeWs(r && r.text);
+      } catch {}
+    }
+    return '';
+  }
+
+  function isEligibleAcc(helpers, el, ctx) {
+    const fn = helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+    if (!fn) return true;
+    try {
+      const r = fn(el, ctx);
+      if (typeof r === 'boolean') return r;
+      return !!(r && r.eligible);
+    } catch {
+      return true;
+    }
+  }
+
+  function buildLabelForMap(doc) {
+    const map = new Map(); // id -> label element (first)
+    try {
+      const labels = doc && doc.getElementsByTagName ? doc.getElementsByTagName('label') : [];
+      for (let i = 0; i < labels.length; i += 1) {
+        const lab = labels[i];
+        if (!lab || !lab.getAttribute) continue;
+        const f = normalizeWs(lab.getAttribute('for'));
+        if (!f) continue;
+        if (!map.has(f)) map.set(f, lab);
+      }
+    } catch {}
+    return map;
+  }
+
+
+  const occurrences = [];
+  let applicableCount = 0;
+
+  const selector = "[role=\"listbox\"]";
+  const nodes = helpers.queryAllSmart ? helpers.queryAllSmart(selector, safeRoot) : helpers.queryAll(selector, safeRoot);
+
+  // Precompute label[for] map for listbox elements that are labelable
+  // native form controls (e.g. <select multiple role="listbox">).
+  const labelForMap = buildLabelForMap(document);
+
+  function getNativeLabelText(el) {
+    try {
+      if ('labels' in el && el.labels && el.labels.length) {
+        const parts = [];
+        const max = Math.min(4, el.labels.length);
+        for (let i = 0; i < max; i += 1) {
+          const lab = el.labels[i];
+          const t = lab ? getLabelText(lab) : '';
+          if (t) parts.push(t);
+        }
+        const joined = normalizeWs(parts.join(' '));
+        if (joined) return joined;
+      }
+    } catch {}
+    try {
+      if (el.closest) {
+        const wrap = el.closest('label');
+        if (wrap) {
+          const t = getLabelText(wrap);
+          if (t) return t;
+        }
+      }
+    } catch {}
+    try {
+      const idAttr = getAttr(el, 'id');
+      if (idAttr && labelForMap.has(idAttr)) {
+        const lab = labelForMap.get(idAttr);
+        const t = lab ? getLabelText(lab) : '';
+        if (t) return t;
+      }
+    } catch {}
+    return '';
+  }
+
+  function hasName(el) {
+    const ariaLabel = getAttr(el, 'aria-label');
+    if (ariaLabel) return { ok: true, method: 'aria-label' };
+
+    const labelled = resolveAriaLabelledbyText(document, el, 8);
+    if (labelled) return { ok: true, method: 'aria-labelledby' };
+
+    const title = getAttr(el, 'title');
+    if (title) return { ok: true, method: 'title' };
+
+    // Native <label> association (e.g. <select multiple role="listbox">).
+    const lab = getNativeLabelText(el);
+    if (lab) return { ok: true, method: 'label' };
+
+    // role="listbox" is name-from-author-only per WAI-ARIA: it must NOT
+    // fall back to subtree content.
+    return { ok: false, method: 'none' };
+  }
+
+  for (const el of nodes) {
+    if (!el) continue;
+    if (!isEligibleAcc(helpers, el, ctx)) continue;
+
+    applicableCount += 1;
+
+    const res = hasName(el);
+    if (res.ok) continue;
+
+    const eligInfo = getEligibilityInfo
+        ? (() => { try { return getEligibilityInfo(el, ctx, { targetSet: 'acc' }); } catch { return null; } })()
+        : null;
+    const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
+    const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : (el.outerHTML || '');
+
+    occurrences.push({
+      selector: stableSelector,
+      html,
+      summary: 'This element has no accessible name.',
+      hint: 'Provide aria-label or aria-labelledby (preferred), or provide visible text that is not hidden from assistive technologies.',
+      i18n: {
+        summaryKey: 'listboxNamePresent_summary_fail',
+        hintKey: 'listboxNamePresent_hint_fail',
+        params: { controlType: 'listbox' }
+      },
+      data: {
+        details: { reasonCode: 'name_missing', controlType: 'listbox', methodTried: res.method },
+        visibilityFilter: eligInfo || { targetSet: 'acc', accEligible: null, reasons: [] }
+      }
+    });
+  }
+
+
+  if (applicableCount === 0) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+  if (occurrences.length) {
+    return { ruleId: rule.ruleId, outcome: 'fail', severity: rule.defaultSeverity || 'minor', occurrences };
+  }
+  return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
+}
+
+module.exports = { id, meta, runInPage };

package/src/checks/automatic/listitem-parent-valid.js

@@ -0,0 +1,118 @@
+'use strict';
+
+/**
+ * @check listitem-parent-valid
+ * @atomic true
+ * @summary <li> elements must be contained by a list container
+ * @standard WCAG 2.2
+ * @sc 1.3.1
+ * @applicability
+ *   Applies to <li> elements that have a parent element.
+ * @expectation
+ *   The parent is <ul>/<ol> with no role override, or an element with an
+ *   explicit role of "list", "presentation", or "none". An <li> used
+ *   outside a real list container (e.g. as a generic flex/grid item under
+ *   a <div>) is not exposed as a list item to assistive technologies.
+ * @implementation-notes
+ * - Distinct, atomic decision from list-children-valid (the
+ *   inverse relationship: does a given list container have valid
+ *   children).
+ * - Role check is scoped to the parent's first explicit role token only
+ *   (matching this engine's existing role-reading convention elsewhere,
+ *   e.g. aria-helpers.js getExplicitRole).
+ * - An explicit role on the parent WINS over its tag name, in either
+ *   direction: a <ul role="menu"> no longer exposes role "list" (its own
+ *   native role is fully replaced by the explicit one — the same "any
+ *   explicit role overrides the element's native role" ARIA principle
+ *   applied elsewhere in this engine), so an <li> inside it is invalid
+ *   despite the <ul> tag — found on a real site, Nike's desktop nav
+ *   dropdown (`<ul class="desktop-category" role="menu"><li>...`).
+ *   Conversely role="presentation"/"none" on the parent is still a valid
+ *   (list-semantics-suppressing) parent, matching a widely-used reference
+ *   engine's own `listitem` check (`['presentation', 'none', 'list'].includes(parentRole)`,
+ *   confirmed by reading its source directly).
+ */
+
+const id = 'listitem-parent-valid';
+
+const meta = {
+  title: 'List items must be inside a list container',
+  description: 'Checks that <li> elements are contained by <ul>, <ol>, or an element with role="list".',
+  i18n: {
+    titleKey: 'listitemParentValid_title',
+    descriptionKey: 'listitemParentValid_description'
+  },
+  helpUrl: null,
+  tags: ['wcag2a', 'wcag131', 'structure', 'atomic', 'automatic', 'list'],
+  wcagSc: ['1.3.1'],
+  normativeMappings: [
+    { standard: 'WCAG', version: '2.2', requirement: '1.3.1', title: 'Info and Relationships', conformanceLevel: 'A' }
+  ],
+  defaultSeverity: 'serious',
+  category: 'perceivable',
+  type: 'automatic',
+  defaultConfidence: 'high',
+  coverage: { facetsBySc: { '1.3.1': ['listitem-parent-valid'] } }
+};
+
+function runInPage(ctx) {
+  const { document, root, helpers, rule } = ctx;
+  const safeRoot = root || document;
+
+  const nodes = helpers.queryAllSmart ? helpers.queryAllSmart('li', safeRoot) : helpers.queryAll('li', safeRoot);
+
+  const occurrences = [];
+  let applicableCount = 0;
+
+  for (const el of nodes) {
+    if (!el) continue;
+    const parent = el.parentElement;
+    if (!parent) continue;
+
+    applicableCount += 1;
+
+    const parentTag = parent.tagName ? parent.tagName.toLowerCase() : '';
+
+    const roleAttr = parent.getAttribute ? String(parent.getAttribute('role') || '').trim() : '';
+    const explicitRole = roleAttr ? (roleAttr.split(/\s+/)[0] || '').toLowerCase() : '';
+
+    let valid;
+    if (explicitRole) {
+      // An explicit role always wins over the tag's native role, in either
+      // direction — see the header comment's Nike example.
+      valid = explicitRole === 'list' || explicitRole === 'presentation' || explicitRole === 'none';
+    } else {
+      valid = parentTag === 'ul' || parentTag === 'ol';
+    }
+
+    if (valid) continue;
+
+    const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
+    const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : (el.outerHTML || '');
+
+    occurrences.push({
+      selector: stableSelector,
+      html,
+      summary: 'This list item is not contained by a list container.',
+      hint: 'Place this <li> inside a <ul>/<ol>, or give its parent role="list".',
+      i18n: {
+        summaryKey: 'listitemParentValid_summary_fail',
+        hintKey: 'listitemParentValid_hint_fail',
+        params: { parentElement: parentTag }
+      },
+      data: {
+        details: { reasonCode: 'LISTITEM_INVALID_PARENT', parentElement: parentTag }
+      }
+    });
+  }
+
+  if (applicableCount === 0) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+  if (occurrences.length) {
+    return { ruleId: rule.ruleId, outcome: 'fail', severity: rule.defaultSeverity || 'serious', occurrences };
+  }
+  return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
+}
+
+module.exports = { id, meta, runInPage };

package/src/checks/automatic/menuitem-name-present.js

@@ -0,0 +1,201 @@
+'use strict';
+
+const id = 'menuitem-name-present';
+
+const meta = {
+  title: 'Menu items have an accessible name',
+  description: 'Checks that menu items (role="menuitem*", including checkbox/radio variants) expose a non-empty accessible name.',
+  i18n: {
+    titleKey: 'menuitemNamePresent_title',
+    descriptionKey: 'menuitemNamePresent_description'
+  },
+  helpUrl: null,
+  tags: ['wcag2a','wcag412','navigation','atomic','automatic','name','menuitem'],
+  wcagSc: ['4.1.2'],
+  normativeMappings: [
+    { standard: 'WCAG', version: '2.2', requirement: '4.1.2', title: 'Name, Role, Value', conformanceLevel: 'A' }
+  ],
+  defaultSeverity: 'serious',
+  category: 'robust',
+  type: 'automatic',
+  defaultConfidence: 'high',
+  coverage: { facetsBySc: { '4.1.2': ['menuitem-name-present'] } }
+};
+
+function runInPage(ctx) {
+  const { document, root, helpers, rule } = ctx;
+  const getEligibilityInfo = helpers && typeof helpers.getEligibilityInfo === 'function'
+      ? helpers.getEligibilityInfo
+      : null;
+  const safeRoot = root || document;
+
+
+  function normalizeWs(s) {
+    return String(s || '').replace(/\s+/g, ' ').trim();
+  }
+
+  function getAttr(el, name) {
+    try {
+      if (!el || !el.getAttribute) return '';
+      return normalizeWs(el.getAttribute(name));
+    } catch { return ''; }
+  }
+
+  function hasAttr(el, name) {
+    try { return !!(el && el.hasAttribute && el.hasAttribute(name)); } catch { return false; }
+  }
+
+  function isExplicitProgrammatic(el) {
+    // Programmatic name mechanisms we treat as authoritative (presence-only):
+    // - aria-label (non-empty)
+    // - aria-labelledby (non-empty)
+    // - title (non-empty) [weak but allowed for presence]
+    const al = getAttr(el, 'aria-label');
+    if (al) return true;
+    const alb = getAttr(el, 'aria-labelledby');
+    if (alb) return true;
+    const t = getAttr(el, 'title');
+    if (t) return true;
+    return false;
+  }
+
+  function buildLabelForMap(doc) {
+    const map = new Map(); // id -> label element (first)
+    try {
+      const labels = doc && doc.getElementsByTagName ? doc.getElementsByTagName('label') : [];
+      for (let i = 0; i < labels.length; i += 1) {
+        const lab = labels[i];
+        if (!lab || !lab.getAttribute) continue;
+        const f = normalizeWs(lab.getAttribute('for'));
+        if (!f) continue;
+        if (!map.has(f)) map.set(f, lab);
+      }
+    } catch {}
+    return map;
+  }
+
+  function getConservativeSubtreeText(document, container) {
+    // "Name from content" — recurses into descendants and uses each one's
+    // own accessible name (img alt, aria-label/aria-labelledby, title) when
+    // it has one, not just literal text nodes. See getContentNameInfo's
+    // header comment in src/core/dom-helpers.js for the full rationale
+    // (this replaced a text-node-only TreeWalker that missed the common
+    // "<a><img alt='...'></a>" logo-link / "<button><img alt='...'></button>"
+    // icon-button pattern).
+    if (helpers.getContentNameInfo) {
+      const info = helpers.getContentNameInfo(container, ctx);
+      return info && info.present ? info.value : '';
+    }
+    const t = (container && container.textContent) ? String(container.textContent) : '';
+    return t.replace(/\s+/g, ' ').trim();
+  }
+
+  function resolveAriaLabelledbyText(document, el, maxRefs) {
+    const raw = getAttr(el, 'aria-labelledby');
+    if (!raw) return '';
+    // Delegates to the shared getTextFromIdRefs helper instead of computing
+    // name-from-content of the referenced element — see dialog-name-
+    // present.js's identical fix for the full rationale (an <iframe>
+    // aria-labelledby target's only name source is its title attribute,
+    // which name-from-content alone can never see).
+    if (helpers.getTextFromIdRefs) {
+      try {
+        const r = helpers.getTextFromIdRefs(raw, ctx, { maxRefs: maxRefs || 8 });
+        return normalizeWs(r && r.text);
+      } catch {}
+    }
+    return '';
+  }
+
+  function getInputValueName(el) {
+    try {
+      const type = getAttr(el, 'type').toLowerCase();
+      if (type !== 'button' && type !== 'submit' && type !== 'reset') return '';
+      const v = getAttr(el, 'value');
+      return v;
+    } catch { return ''; }
+  }
+
+  function isEligibleAcc(helpers, el, ctx) {
+    const fn = helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+    if (!fn) return true;
+    try {
+      const r = fn(el, ctx);
+      if (typeof r === 'boolean') return r;
+      return !!(r && r.eligible);
+    } catch {
+      return true;
+    }
+  }
+
+
+  const occurrences = [];
+  let applicableCount = 0;
+
+  const selector = '[role="menuitem"],[role="menuitemcheckbox"],[role="menuitemradio"]';
+  const nodes = helpers.queryAllSmart ? helpers.queryAllSmart(selector, safeRoot) : helpers.queryAll(selector, safeRoot);
+
+
+  function evaluate(el) {
+    const ariaLabel = getAttr(el, 'aria-label');
+    if (ariaLabel) return { ok: true, method: 'aria-label' };
+
+    const ariaLabelledby = resolveAriaLabelledbyText(document, el, 8);
+    if (ariaLabelledby) return { ok: true, method: 'aria-labelledby' };
+
+    const title = getAttr(el, 'title');
+    if (title) return { ok: true, method: 'title' };
+
+    // Menuitem name is commonly from content.
+    const t = getConservativeSubtreeText(document, el);
+    if (t) return { ok: true, method: 'content' };
+
+    return { ok: false, method: 'none' };
+  }
+
+  for (const el of nodes) {
+    if (!el) continue;
+    if (!isEligibleAcc(helpers, el, ctx)) continue;
+
+    const role = getAttr(el, 'role').toLowerCase();
+    if (role !== 'menuitem' && role !== 'menuitemcheckbox' && role !== 'menuitemradio') continue;
+
+    applicableCount += 1;
+
+    const res = evaluate(el);
+    if (res.ok) continue;
+
+    const eligInfo = getEligibilityInfo
+        ? (() => { try { return getEligibilityInfo(el, ctx, { targetSet: 'acc' }); } catch { return null; } })()
+        : null;
+    const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
+    const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : (el.outerHTML || '');
+
+    occurrences.push({
+      selector: stableSelector,
+      html,
+      summary: 'This menu item has no accessible name.',
+      hint: 'Provide visible text that is not hidden from assistive technologies, or provide aria-label or aria-labelledby.',
+      i18n: {
+        summaryKey: 'menuitemNamePresent_summary_fail',
+        hintKey: 'menuitemNamePresent_hint_fail',
+        params: { role }
+      },
+      data: {
+        details: { reasonCode: 'name_missing', controlType: role, methodTried: res.method },
+        visibilityFilter: eligInfo || { targetSet: 'acc', accEligible: null, reasons: [] }
+      }
+    });
+  }
+
+
+  if (applicableCount === 0) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+  if (occurrences.length) {
+    return { ruleId: rule.ruleId, outcome: 'fail', severity: rule.defaultSeverity || 'minor', occurrences };
+  }
+  return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
+}
+
+module.exports = { id, meta, runInPage };

package/src/checks/automatic/meta-refresh-no-exceptions.js

@@ -0,0 +1,105 @@
+'use strict';
+
+/**
+ * @check meta-refresh-no-exceptions
+ * @atomic true
+ * @summary At the AAA level, a meta refresh must not be used at all
+ * @standard WCAG 2.2
+ * @sc 2.2.4, 3.2.5
+ * @applicability
+ *   Applies to any <meta http-equiv="refresh"> element with a non-empty
+ *   content attribute.
+ * @expectation
+ *   No meta refresh is present, regardless of delay. This is the
+ *   stricter AAA-level counterpart of meta-refresh-timing-absent
+ *   (the A-level rule, which only forbids a positive delay and allows
+ *   delay="0" as an immediate redirect). At AAA, WCAG 2.2.4
+ *   (Interruptions) and 3.2.5 (Change on Request) require that automatic
+ *   context changes — including an immediate meta-refresh redirect —
+ *   happen only at the user's request, with no exception for a zero
+ *   delay.
+ * @implementation-notes
+ * - Distinct, atomic decision from meta-refresh-timing-absent:
+ *   that rule's delay="0" pass case is this rule's fail case.
+ * - A <meta> nested inside <noscript> is excluded: it only ever takes
+ *   effect when scripting is disabled, which is never the case for any
+ *   context capable of running accessibility tooling in the first place
+ *   (confirmed 2026-07-21 via a real-world false positive: Slack's
+ *   homepage has a <noscript><meta http-equiv="refresh" content="0;
+ *   URL=/?nojsmode=1"></noscript> JS-disabled fallback — a widely-used
+ *   reference engine's own same-named check correctly doesn't flag it either).
+ */
+
+const id = 'meta-refresh-no-exceptions';
+
+const meta = {
+  title: 'Page must not use a meta refresh at all (AAA)',
+  description: 'Checks that <meta http-equiv="refresh"> is not present at all, regardless of delay — the stricter AAA-level counterpart of the A-level positive-delay-only check.',
+  i18n: {
+    titleKey: 'metaRefreshNoExceptions_title',
+    descriptionKey: 'metaRefreshNoExceptions_description'
+  },
+  helpUrl: null,
+  tags: ['wcag2aaa', 'wcag224', 'wcag325', 'structure', 'atomic', 'automatic'],
+  wcagSc: ['2.2.4', '3.2.5'],
+  normativeMappings: [
+    { standard: 'WCAG', version: '2.2', requirement: '2.2.4', title: 'Interruptions', conformanceLevel: 'AAA' },
+    { standard: 'WCAG', version: '2.2', requirement: '3.2.5', title: 'Change on Request', conformanceLevel: 'AAA' }
+  ],
+  defaultSeverity: 'moderate',
+  category: 'operable',
+  type: 'automatic',
+  defaultConfidence: 'high',
+  coverage: {
+    facetsBySc: {
+      '2.2.4': ['meta-refresh-no-exceptions'],
+      '3.2.5': ['meta-refresh-no-exceptions']
+    }
+  }
+};
+
+function runInPage(ctx) {
+  const { document, helpers, rule } = ctx;
+
+  const nodes = document.querySelectorAll ? document.querySelectorAll('meta[http-equiv="refresh" i]') : [];
+
+  const occurrences = [];
+  let applicableCount = 0;
+
+  for (const el of nodes) {
+    if (!el || !el.getAttribute) continue;
+    if (el.closest && el.closest('noscript')) continue; // never applies with scripting enabled
+    const raw = String(el.getAttribute('content') || '').trim();
+    if (!raw) continue;
+
+    applicableCount += 1;
+
+    const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
+    const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : (el.outerHTML || '');
+
+    occurrences.push({
+      selector: stableSelector,
+      html,
+      summary: 'This page uses a meta refresh, which is an automatic context change not initiated by the user.',
+      hint: 'Remove the meta refresh; trigger the redirect/refresh only in response to a user action instead.',
+      i18n: {
+        summaryKey: 'metaRefreshNoExceptions_summary_fail',
+        hintKey: 'metaRefreshNoExceptions_hint_fail',
+        params: {}
+      },
+      data: {
+        details: { reasonCode: 'META_REFRESH_PRESENT' }
+      }
+    });
+  }
+
+  if (applicableCount === 0) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+  if (occurrences.length) {
+    return { ruleId: rule.ruleId, outcome: 'fail', severity: rule.defaultSeverity || 'moderate', occurrences };
+  }
+  return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
+}
+
+module.exports = { id, meta, runInPage };