@surea11y/core 1.3.0 → 1.4.0

package/src/checks/automatic/iframe-focusable-content.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -62,10 +64,141 @@ const meta = {
 };
 
 function runInPage(ctx) {
-  const { helpers, rule } = ctx;
+  const { helpers, rule, document } = ctx;
+
+  // Self-contained rendering check for the embedded document (a distinct
+  // realm — see this rule's own header comment on why the outer
+  // document's shared eligibility helpers can't be reused here).
+  // Deliberately checks only genuine non-rendering (display:none,
+  // visibility:hidden, the hidden attribute) via the ancestor chain, NOT
+  // aria-hidden: aria-hidden alone does not remove an element from a real
+  // browser's native tab order (the same anti-pattern this engine's own
+  // aria-hidden-focus rule exists to catch), so an aria-hidden-but-
+  // visually-rendered focusable element inside the frame is still
+  // genuinely reachable by keyboard and must stay flagged.
+  function isRenderedInDoc(doc, el) {
+    try {
+      const view = doc.defaultView;
+      if (!view || typeof view.getComputedStyle !== 'function') return true;
+      let node = el;
+      while (node && node.nodeType === 1) {
+        if (node.hasAttribute && node.hasAttribute('hidden')) return false;
+        const cs = view.getComputedStyle(node);
+        if (cs) {
+          if (cs.display === 'none') return false;
+          if (cs.visibility === 'hidden' || cs.visibility === 'collapse') return false;
+        }
+        node = node.parentElement;
+      }
+      return true;
+    } catch {
+      return true;
+    }
+  }
+
+  function getDeepActiveElement(docRef) {
+    let cur = docRef && docRef.activeElement ? docRef.activeElement : null;
+    let guard = 0;
+    while (cur && cur.shadowRoot && cur.shadowRoot.activeElement && guard++ < 20) {
+      cur = cur.shadowRoot.activeElement;
+    }
+    return cur;
+  }
+
+  function focusElementSafe(el) {
+    if (!el || typeof el.focus !== 'function') return false;
+    try {
+      el.focus({ preventScroll: true });
+      return true;
+    } catch {
+      try {
+        el.focus();
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  }
+
+  function runFocusObservationWindow(win, fn) {
+    if (!win || typeof fn !== 'function') return;
+    const originalSetTimeout =
+      typeof win.setTimeout === 'function' ? win.setTimeout.bind(win) : null;
+    const originalRequestAnimationFrame =
+      typeof win.requestAnimationFrame === 'function' ? win.requestAnimationFrame.bind(win) : null;
+    const originalQueueMicrotask =
+      typeof win.queueMicrotask === 'function' ? win.queueMicrotask.bind(win) : null;
+
+    const queuedMicrotasks = [];
+    const queuedRaf = [];
+    const queuedTimers = [];
+    let fakeTimerId = 1;
+
+    const patchedSetTimeout = function (cb, delay) {
+      const d = Number.isFinite(Number(delay)) ? Number(delay) : 0;
+      if (typeof cb === 'function' && d <= 200) {
+        const args = [];
+        for (let i = 2; i < arguments.length; i++) args.push(arguments[i]);
+        queuedTimers.push({ delay: d, cb: () => cb.apply(win, args) });
+        return fakeTimerId++;
+      }
+      if (originalSetTimeout) return originalSetTimeout.apply(win, arguments);
+      return fakeTimerId++;
+    };
+
+    const patchedRaf = function (cb) {
+      if (typeof cb === 'function') {
+        queuedRaf.push(cb);
+        return fakeTimerId++;
+      }
+      if (originalRequestAnimationFrame) return originalRequestAnimationFrame.apply(win, arguments);
+      return fakeTimerId++;
+    };
+
+    const patchedQueueMicrotask = function (cb) {
+      if (typeof cb === 'function') queuedMicrotasks.push(cb);
+    };
+
+    try {
+      if (originalSetTimeout) win.setTimeout = patchedSetTimeout;
+      if (originalRequestAnimationFrame) win.requestAnimationFrame = patchedRaf;
+      if (originalQueueMicrotask) win.queueMicrotask = patchedQueueMicrotask;
+      fn();
 
-  function hasFocusableCandidate(doc) {
-    if (!doc || !doc.querySelectorAll) return false;
+      let guard = 0;
+      while (
+        (queuedMicrotasks.length || queuedRaf.length || queuedTimers.length) &&
+        guard++ < 100
+      ) {
+        while (queuedMicrotasks.length) {
+          const mt = queuedMicrotasks.shift();
+          try {
+            mt();
+          } catch {}
+        }
+        while (queuedRaf.length) {
+          const rf = queuedRaf.shift();
+          try {
+            rf(16);
+          } catch {}
+        }
+        if (queuedTimers.length) {
+          queuedTimers.sort((a, b) => a.delay - b.delay);
+          const tt = queuedTimers.shift();
+          try {
+            tt.cb();
+          } catch {}
+        }
+      }
+    } finally {
+      if (originalSetTimeout) win.setTimeout = originalSetTimeout;
+      if (originalRequestAnimationFrame) win.requestAnimationFrame = originalRequestAnimationFrame;
+      if (originalQueueMicrotask) win.queueMicrotask = originalQueueMicrotask;
+    }
+  }
+
+  function getFocusableCandidates(doc) {
+    if (!doc || !doc.querySelectorAll) return [];
     let els;
     try {
       els = doc.querySelectorAll(
@@ -73,8 +206,9 @@ function runInPage(ctx) {
           'select:not([disabled]), textarea:not([disabled]), iframe, [contenteditable="true"], [tabindex]'
       );
     } catch {
-      return false;
+      return [];
     }
+    const candidates = [];
     for (const el of els) {
       if (!el || !el.getAttribute) continue;
       const raw = el.getAttribute('tabindex');
@@ -82,9 +216,77 @@ function runInPage(ctx) {
         const n = Number(String(raw).trim());
         if (!Number.isNaN(n) && n < 0) continue; // explicitly removed from tab order
       }
-      return true;
+      if (!isRenderedInDoc(doc, el)) continue; // display:none/visibility:hidden/[hidden]: never reachable at all
+      candidates.push(el);
     }
-    return false;
+    return candidates;
+  }
+
+  function probeImmediateFocusRedirect(frameEl, embeddedDoc, candidate) {
+    if (!frameEl || !embeddedDoc || !candidate) return null;
+    const embeddedWindow = embeddedDoc.defaultView;
+    if (!embeddedWindow) return null;
+
+    let focusedByEvent = false;
+    const onFocusCapture = () => {
+      focusedByEvent = true;
+    };
+    try {
+      candidate.addEventListener('focus', onFocusCapture, true);
+    } catch {}
+
+    const innerFocusTrace = [];
+    const outerFocusTrace = [];
+    const onInnerFocusIn = (ev) => {
+      if (ev && ev.target) innerFocusTrace.push(ev.target);
+    };
+    const onOuterFocusIn = (ev) => {
+      if (ev && ev.target) outerFocusTrace.push(ev.target);
+    };
+    try {
+      embeddedDoc.addEventListener('focusin', onInnerFocusIn, true);
+      document.addEventListener('focusin', onOuterFocusIn, true);
+    } catch {}
+
+    const beforeInner = getDeepActiveElement(embeddedDoc);
+    const beforeOuter = getDeepActiveElement(document);
+    let focused = false;
+    runFocusObservationWindow(embeddedWindow, () => {
+      focused = focusElementSafe(candidate);
+    });
+    try {
+      embeddedDoc.removeEventListener('focusin', onInnerFocusIn, true);
+      document.removeEventListener('focusin', onOuterFocusIn, true);
+    } catch {}
+    try {
+      candidate.removeEventListener('focus', onFocusCapture, true);
+    } catch {}
+
+    if (!focused) return null;
+
+    const afterInner = getDeepActiveElement(embeddedDoc);
+    const afterOuter = getDeepActiveElement(document);
+    const sawRedirectedInnerTrace = innerFocusTrace.some((n) => n && n !== candidate);
+    const sawRedirectedOuterTrace = outerFocusTrace.some(
+      (n) => n && n !== frameEl && n !== candidate
+    );
+    const redirectedWithinFrame =
+      !!(afterInner && afterInner !== candidate) || sawRedirectedInnerTrace;
+    const redirectedOutOfFrame =
+      !!(afterOuter && afterOuter !== frameEl) || sawRedirectedOuterTrace;
+    const sawCandidateFocus = focusedByEvent || innerFocusTrace.some((n) => n === candidate);
+
+    if (beforeInner && beforeInner !== afterInner) focusElementSafe(beforeInner);
+    if (beforeOuter && beforeOuter !== afterOuter) focusElementSafe(beforeOuter);
+
+    if (!sawCandidateFocus) return null;
+    if (!redirectedWithinFrame && !redirectedOutOfFrame) return null;
+
+    return {
+      redirected: true,
+      redirectedWithinFrame,
+      redirectedOutOfFrame
+    };
   }
 
   function getNegativeTabIndex(el) {
@@ -98,7 +300,8 @@ function runInPage(ctx) {
     ? helpers.queryAllSmart('iframe, frame')
     : helpers.queryAll('iframe, frame');
 
-  const occurrences = [];
+  const failOccurrences = [];
+  const cantTellOccurrences = [];
   let applicableCount = 0;
 
   for (const el of nodes) {
@@ -115,13 +318,37 @@ function runInPage(ctx) {
 
     applicableCount += 1;
 
-    if (!hasFocusableCandidate(contentDoc)) continue;
+    const candidates = getFocusableCandidates(contentDoc);
+    if (!candidates.length) continue;
 
     const tag = el.tagName.toLowerCase();
     const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
     const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : el.outerHTML || '';
+    const shouldProbe = candidates.length === 1;
+    const runtimeProbe = shouldProbe
+      ? probeImmediateFocusRedirect(el, contentDoc, candidates[0])
+      : null;
+
+    if (runtimeProbe && runtimeProbe.redirected) {
+      cantTellOccurrences.push({
+        selector: stableSelector,
+        html,
+        summary:
+          'This frame has tabindex="-1" and a focusable candidate, but focus moves immediately to another target. Verify keyboard reachability in a real browser.',
+        hint: 'If this is an intentional focus handoff, ensure keyboard users cannot remain on hidden/intermediate frame content.',
+        i18n: null,
+        data: {
+          details: {
+            reasonCode: 'IFRAME_TABINDEX_NEGATIVE_CONTENT_RUNTIME_REDIRECT',
+            element: tag,
+            runtimeProbe
+          }
+        }
+      });
+      continue;
+    }
 
-    occurrences.push({
+    failOccurrences.push({
       selector: stableSelector,
       html,
       summary:
@@ -141,15 +368,16 @@ function runInPage(ctx) {
   if (applicableCount === 0) {
     return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
   }
-  if (occurrences.length) {
-    return {
-      ruleId: rule.ruleId,
-      outcome: 'fail',
-      severity: rule.defaultSeverity || 'moderate',
-      occurrences
-    };
-  }
-  return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
+  // helpers.resolveTieredOutcome is unconditionally provided by dom-helpers.js
+  // (see its own header comment) -- no fallback needed, matching the same
+  // cleanup already applied to aria-hidden-focus.js/aria-prohibited-attr.js/
+  // target-size-minimum.js.
+  const resolved = helpers.resolveTieredOutcome(
+    failOccurrences,
+    cantTellOccurrences,
+    rule.defaultSeverity || 'moderate'
+  );
+  return { ruleId: rule.ruleId, ...resolved };
 }
 
 module.exports = { id, meta, runInPage };

package/src/checks/automatic/iframe-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/iframe-title-unique.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -18,7 +20,7 @@
  *   a frame can have a non-empty title while still failing uniqueness.
  * - Compares the title ATTRIBUTE specifically, not the full computed
  *   accessible name (aria-label could legitimately differ in wording even
- *   when title happens to collide) — matches a widely-used reference engine's frame-title-unique.
+ *   when title happens to collide).
  * - Not rule-gated on isAccTreeEligible: duplicate titles are a static
  *   markup property. Engine-level hidden-subtree filtering still applies
  *   unless engineOptions.includeHiddenElements is true.

package/src/checks/automatic/img-alt-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -172,15 +174,11 @@ function runInPage(ctx) {
       if (ariaName && ariaName.present) continue;
     }
 
-    // A non-empty title attribute is HTML-AAM's own next fallback naming
-    // source for <img> once alt is entirely absent (not merely alt="",
-    // which explicitly marks decorative and stays excluded from this
-    // branch since hasAlt already short-circuited above) -- confirmed
-    // against a widely-used reference engine's own image-alt rule, which lists a non-empty
-    // title as one of its "any" satisfying conditions alongside has-alt/
-    // aria-label/aria-labelledby. Found via a real page (AliExpress's
-    // logo, 2026-07-23): <img src="..." title="...">, no alt attribute
-    // at all -- a real false positive, not a missing text alternative.
+    // A non-empty title attribute is HTML-AAM's next fallback naming source
+    // for <img> once alt is entirely absent (not merely alt="", which
+    // explicitly marks decorative and stays excluded from this branch since
+    // hasAlt already short-circuited above). An `<img src="..." title="...">`
+    // with no alt attribute at all is not missing a text alternative.
     const title = trim(el.getAttribute('title'));
     if (title) continue;
 

package/src/checks/automatic/input-image-alt-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -129,12 +131,8 @@ function runInPage(ctx) {
     }
 
     // A non-empty title attribute is HTML-AAM's own next fallback naming
-    // source once alt is entirely absent -- also accepted by a widely-used
-    // reference engine's equivalent input-image-alt rule (non-empty-title, same "any" list
-    // as non-empty-alt/aria-label/aria-labelledby). See img-alt-present's
-    // sibling fix (2026-07-23, AliExpress's title-only logo <img>) for
-    // the real page this was found via -- same gap, same fix, different
-    // element.
+    // source once alt is entirely absent. Same gap img-alt-present handles
+    // for <img title="..."> with no alt.
     const titleRaw = (() => {
       try {
         return el.getAttribute('title');

package/src/checks/automatic/label-in-name.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'label-in-name';
@@ -90,20 +92,13 @@ function runInPage(ctx) {
   }
 
   // Unlike isDomVisible above, this also excludes aria-hidden subtrees.
-  // Needed specifically for collectVisibleTextUnder's per-text-node check
-  // below: an aria-hidden icon-font glyph (e.g. Material Icons' ligature
-  // pattern, <mat-icon aria-hidden="true">format_color_fill</mat-icon>) is
-  // technically DOM-visible pixels, but is never perceived by a sighted or
-  // voice-control user as literal readable words the way real visible text
-  // is — a widely-used reference engine's own label-content-name-mismatch check reaches the same
-  // practical outcome via a canvas-based ligature-detection heuristic
-  // (measuring rendered glyph shapes), not replicable here since this rule
-  // runs against static markup with no real canvas/font rendering
-  // available; excluding aria-hidden content is a cheaper, static-markup
-  // signal that gets the common case (decorative icon fonts) right without
-  // needing one. Confirmed via a live-DOM cross-engine run 2026-07-21
-  // (Angular Material's theme-picker button, aria-label="Select a theme",
-  // aria-hidden icon rendering literally as "format_color_fill").
+  // Needed for collectVisibleTextUnder's per-text-node check below: an
+  // aria-hidden icon-font glyph (e.g. an <i aria-hidden="true"> ligature
+  // rendering as "format_color_fill") is DOM-visible pixels but is never
+  // perceived as literal readable words the way real visible text is.
+  // Excluding aria-hidden content is a cheap static-markup signal that gets
+  // the common case (decorative icon fonts) right — an icon-only button
+  // named via aria-label shouldn't have its glyph name counted as text.
   function isAccEligible(el) {
     if (!el) return false;
     const fn =
@@ -122,11 +117,12 @@ function runInPage(ctx) {
   // than referencing the global NodeFilter object directly: runInPage must
   // have zero free vars (see docs/RULE_AUTHORING.md's free-var footgun) and
   // NodeFilter is not itself present in the execution realm this function
-  // actually runs in, unlike window/document. Confirmed 2026-07-21 — this
-  // silently made createTreeWalker throw on every call, falling back to
-  // raw container.textContent (which respects none of isNonRenderedTag/
-  // isDomVisible/isAccEligible below, since that whole per-node loop is
-  // skipped in the fallback path). Same pattern already used correctly in
+  // actually runs in, unlike window/document. Referencing the global
+  // directly would silently make createTreeWalker throw on every call,
+  // falling back to raw container.textContent (which respects none of
+  // isNonRenderedTag/isDomVisible/isAccEligible below, since that whole
+  // per-node loop is skipped in the fallback path). Same pattern already
+  // used correctly in
   // region-manual.js's own createTreeWalker call.
   const SHOW_TEXT = 4;
 

package/src/checks/automatic/language-page-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/link-in-text-block.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/link-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'link-name-present';

package/src/checks/automatic/list-children-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -24,28 +26,17 @@
  *   inverse relationship: does a given <li> have a valid parent).
  * - Direct children that are not exposed to the accessibility tree (e.g.
  *   display:none, [hidden], aria-hidden="true") are excluded from
- *   consideration entirely — matching a widely-used reference engine's own
- *   `only-listitems` check, which likewise skips non-AT-visible children. Confirmed against
- *   two real sites: Spotify's newsroom has a stray `<input type="hidden">`
- *   as a direct <ul> child (UA-stylesheet display:none by spec for
- *   input[type=hidden]), and Stanford's main nav interleaves `<li>` with
- *   `<span style="display:none">` hydration markers. Neither is reachable
- *   by assistive technology, so neither breaks the list semantics a screen
- *   reader actually announces.
- * - The explicit-role-overrides-tag behavior above was added after reading
- *   a widely-used reference engine's ACTUAL `only-listitems` evaluate function
- *   directly (`invalidChildrenEvaluate`/`getInvalidSelector` — note this is a
- *   DIFFERENT function from the similarly-named, unused `onlyListitemsEvaluate`
- *   elsewhere in that engine's source; don't confuse the two when re-verifying). Its
- *   exact rule: if a child has an explicit role, only `validRoles` (here,
- *   `['listitem']`) is consulted — the tag name is never checked. Only
- *   without an explicit role does the tag name (`validNodeNames`) matter.
- *   Found via two real sites: Notion's footer nav lists include a
- *   `<li role="none">` used purely to host the list's own visually-hidden
- *   label (referenced by the `<ul>`'s `aria-labelledby`), and LinkedIn has
- *   both an all-`<li role="menuitem">` menu list and a footer list mixing
- *   real `<li>`s with one `<li role="presentation">` — that reference engine
- *   correctly flags all of these, surea11y's tag-only check missed them entirely.
+ *   consideration entirely — an element not reachable by assistive
+ *   technology can't break the list semantics a screen reader announces.
+ *   Common cases: a stray `<input type="hidden">` as a direct <ul> child
+ *   (UA-stylesheet display:none by spec), or `<span style="display:none">`
+ *   hydration markers interleaved with real `<li>`s.
+ * - Explicit-role-overrides-tag: if a child has an explicit role, only
+ *   `['listitem']` is consulted — the tag name is never checked. Only
+ *   without an explicit role does the tag name matter. Catches cases a
+ *   tag-only check misses: `<li role="none">` hosting a list's own
+ *   visually-hidden label, `<li role="menuitem">` menu items, or a real
+ *   `<li>` mixed with an `<li role="presentation">`.
  */
 
 const id = 'list-children-valid';
@@ -120,8 +111,7 @@ function runInPage(ctx) {
       const roleAttr = child.getAttribute ? String(child.getAttribute('role') || '').trim() : '';
       const explicitRole = roleAttr ? (roleAttr.split(/\s+/)[0] || '').toLowerCase() : '';
 
-      // An explicit role always wins over the tag — see the header
-      // comment's Notion/LinkedIn examples.
+      // An explicit role always wins over the tag — see header comment.
       const valid = explicitRole ? explicitRole === 'listitem' : ALLOWED_CHILD_TAGS.has(tag);
 
       if (!valid) invalidTags.push(tag);

package/src/checks/automatic/listbox-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'listbox-name-present';

package/src/checks/automatic/listitem-parent-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -25,12 +27,19 @@
  *   native role is fully replaced by the explicit one — the same "any
  *   explicit role overrides the element's native role" ARIA principle
  *   applied elsewhere in this engine), so an <li> inside it is invalid
- *   despite the <ul> tag — found on a real site, Nike's desktop nav
- *   dropdown (`<ul class="desktop-category" role="menu"><li>...`).
- *   Conversely role="presentation"/"none" on the parent is still a valid
- *   (list-semantics-suppressing) parent, matching a widely-used reference
- *   engine's own `listitem` check (`['presentation', 'none', 'list'].includes(parentRole)`,
- *   confirmed by reading its source directly).
+ *   despite the <ul> tag (e.g. `<ul role="menu"><li>...`). Conversely
+ *   role="presentation"/"none" on the parent is still a valid
+ *   (list-semantics-suppressing) parent — the accepted parent roles are
+ *   presentation, none, and list.
+ * - The SAME "explicit role wins" principle applies to the <li> ELEMENT
+ *   ITSELF: an <li role="tab">/role="menuitem">/role="presentation"> etc.
+ *   is exposed to AT with that role, never "listitem" — the whole point
+ *   of this check (list items need a valid list-container parent) doesn't
+ *   apply when the element isn't claiming listitem semantics in the first
+ *   place. Any `<li>` with an explicit `role` attribute is excluded from
+ *   candidacy. `role="listitem"` itself is a no-op restatement (not an
+ *   override), so it still falls through to the normal parent-validity
+ *   check below.
  */
 
 const id = 'listitem-parent-valid';
@@ -75,6 +84,20 @@ function runInPage(ctx) {
     const parent = el.parentElement;
     if (!parent) continue;
 
+    // An explicit role on the <li> ITSELF overrides its native "listitem"
+    // role entirely, the same "any explicit role wins over the tag's
+    // native role" principle this check already applies to the PARENT
+    // (see the header comment). An <li role="tab">/
+    // role="menuitem">/role="presentation"> etc. is exposed to AT with
+    // THAT role, never "listitem" -- so the "list item needs a valid list
+    // container parent" concern this rule exists for doesn't apply to it
+    // at all; there's no listitem semantics being claimed to validate.
+    // role="listitem" itself is a no-op restatement, not an override, so
+    // it still falls through to the normal parent check below.
+    const ownRoleAttr = el.getAttribute ? String(el.getAttribute('role') || '').trim() : '';
+    const ownExplicitRole = ownRoleAttr ? (ownRoleAttr.split(/\s+/)[0] || '').toLowerCase() : '';
+    if (ownExplicitRole && ownExplicitRole !== 'listitem') continue;
+
     applicableCount += 1;
 
     const parentTag = parent.tagName ? parent.tagName.toLowerCase() : '';
@@ -85,7 +108,7 @@ function runInPage(ctx) {
     let valid;
     if (explicitRole) {
       // An explicit role always wins over the tag's native role, in either
-      // direction — see the header comment's Nike example.
+      // direction — see the header comment.
       valid = explicitRole === 'list' || explicitRole === 'presentation' || explicitRole === 'none';
     } else {
       valid = parentTag === 'ul' || parentTag === 'ol';

package/src/checks/automatic/menuitem-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'menuitem-name-present';

package/src/checks/automatic/meta-refresh-no-exceptions.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -24,10 +26,8 @@
  * - A <meta> nested inside <noscript> is excluded: it only ever takes
  *   effect when scripting is disabled, which is never the case for any
  *   context capable of running accessibility tooling in the first place
- *   (confirmed 2026-07-21 via a real-world false positive: Slack's
- *   homepage has a <noscript><meta http-equiv="refresh" content="0;
- *   URL=/?nojsmode=1"></noscript> JS-disabled fallback — a widely-used
- *   reference engine's own same-named check correctly doesn't flag it either).
+ *   (e.g. a <noscript><meta http-equiv="refresh" content="0; URL=/?nojs=1">
+ *   </noscript> JS-disabled fallback).
  */
 
 const id = 'meta-refresh-no-exceptions';

package/src/checks/automatic/meta-refresh-timing-absent.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/meta-viewport-zoom-enabled.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/meter-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'meter-name-present';
@@ -96,9 +98,8 @@ function runInPage(ctx) {
     const title = getAttr(el, 'title');
     if (title) return { ok: true, method: 'title' };
 
-    // role="meter" is name-from-author-only per WAI-ARIA (verified against
-    // a widely-used reference engine's own aria-meter-name check: any: ['aria-label',
-    // 'aria-labelledby', title] — no content-based naming method at all).
+    // role="meter" is name-from-author-only per WAI-ARIA: aria-label,
+    // aria-labelledby, or title — no content-based naming method at all.
     // It must NOT fall back to subtree content — visible text near/inside a
     // custom meter widget is not reliably exposed as its accessible name.
     return { ok: false, method: 'none' };