@surea11y/core 1.6.0 → 1.8.0

package/src/coverage/wcag-version-map.js

@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * Canonical WCAG-version-introduction map for Success Criteria.
+ *
+ * PURPOSE
+ * -------
+ * WCAG 2.1 and 2.2 are each a superset of the version before them -- they add new
+ * Success Criteria, never remove or renumber existing ones, with the sole exception of
+ * 4.1.1 Parsing, removed in 2.2. This module lists exactly which SCs were newly
+ * introduced in each version; every SC not listed here is WCAG 2.0 baseline. The one
+ * removed SC is listed separately below, since a rule mapped to it is valid for a
+ * 2.0/2.1 conformance target and must not count against a 2.2 one.
+ *
+ * This is the single source of truth used by the rule-authoring consistency test
+ * (`tests/coverage/wcag-version-tags.test.js`) to verify every rule's `meta.tags`
+ * carries the version-correct `wcag2*`/`wcag21*`/`wcag22*` prefix for its `wcagSc`.
+ *
+ * `src/core/dom-runner.js`'s `buildCompositeDef` needs the identical list to compute
+ * composite tags, but has to keep its own literal copy rather than import this module --
+ * `runCore` is inlined into `core.js` via `Function.prototype.toString()`, so it cannot
+ * reference anything outside its own function body at runtime. If you change the lists
+ * below, update that literal too.
+ *
+ * SOURCE: W3C WCAG 2.1 and 2.2 "Success Criteria" tables (each SC's own "Introduced in
+ * version" note). Each SC belongs to exactly one origin version, which is the model
+ * this file encodes.
+ */
+
+// SCs newly introduced in WCAG 2.1 (not present in WCAG 2.0).
+const WCAG21_NEW_SCS = [
+  '1.3.4',  // Orientation (AA)
+  '1.3.5',  // Identify Input Purpose (AA)
+  '1.3.6',  // Identify Purpose (AAA)
+  '1.4.10', // Reflow (AA)
+  '1.4.11', // Non-text Contrast (AA)
+  '1.4.12', // Text Spacing (AA)
+  '1.4.13', // Content on Hover or Focus (AA)
+  '2.1.4',  // Character Key Shortcuts (A)
+  '2.2.6',  // Timeouts (AAA)
+  '2.3.3',  // Animation from Interactions (AAA)
+  '2.5.1',  // Pointer Gestures (A)
+  '2.5.2',  // Pointer Cancellation (A)
+  '2.5.3',  // Label in Name (A)
+  '2.5.4',  // Motion Actuation (A)
+  '2.5.5',  // Target Size -- Enhanced (AAA)
+  '2.5.6',  // Concurrent Input Mechanisms (AAA)
+  '4.1.3'   // Status Messages (AA)
+];
+
+// SCs newly introduced in WCAG 2.2 (not present in WCAG 2.0 or 2.1).
+const WCAG22_NEW_SCS = [
+  '2.4.11', // Focus Not Obscured (Minimum) (AA)
+  '2.4.12', // Focus Not Obscured (Enhanced) (AAA)
+  '2.4.13', // Focus Appearance (AAA)
+  '2.5.7',  // Dragging Movements (AA)
+  '2.5.8',  // Target Size (Minimum) (AA)
+  '3.2.6',  // Consistent Help (A)
+  '3.3.7',  // Redundant Entry (A)
+  '3.3.8',  // Accessible Authentication (Minimum) (AA)
+  '3.3.9'   // Accessible Authentication (Enhanced) (AAA)
+];
+
+// The only SC ever removed from WCAG: 4.1.1 Parsing, dropped in 2.2 because browsers
+// recover from the malformed markup it was written for. A rule mapped to it carries
+// the `wcag22-removed` tag alongside its `wcag2a` origin tag, so a 2.2 conformance run
+// can exclude it while a 2.0/2.1 run keeps it (see docs/ENGINE_OPTIONS.md).
+const WCAG22_REMOVED_SCS = ['4.1.1'];
+
+// The version an SC was removed in, or null if it is still current.
+function removedInVersion(sc) {
+  return WCAG22_REMOVED_SCS.includes(String(sc || '').trim()) ? '2.2' : null;
+}
+
+function introducedInVersion(sc) {
+  const s = String(sc || '').trim();
+  if (WCAG22_NEW_SCS.includes(s)) return '2.2';
+  if (WCAG21_NEW_SCS.includes(s)) return '2.1';
+  return '2.0';
+}
+
+// Given a rule/composite's wcagSc list, returns the runOnly.tags prefix
+// ('wcag2' | 'wcag21' | 'wcag22') it should be tagged with -- a 2.2-origin SC wins
+// over a 2.1-origin one if a rule/composite ever spans both (rare; none do today).
+function versionTagPrefixForScs(wcagScList) {
+  const list = Array.isArray(wcagScList) ? wcagScList.map(String) : [];
+  if (list.some((sc) => WCAG22_NEW_SCS.includes(sc))) return 'wcag22';
+  if (list.some((sc) => WCAG21_NEW_SCS.includes(sc))) return 'wcag21';
+  return 'wcag2';
+}
+
+module.exports = {
+  WCAG21_NEW_SCS,
+  WCAG22_NEW_SCS,
+  WCAG22_REMOVED_SCS,
+  introducedInVersion,
+  removedInVersion,
+  versionTagPrefixForScs
+};

package/src/earl.js

@@ -0,0 +1,144 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * Renders scan results as an EARL 1.0 report in JSON-LD (docs/EARL.md), the
+ * format the W3C ACT Rules community group accepts as an implementation
+ * report and the interchange format most accessibility tooling reads.
+ *
+ * The graph is grouped by TestSubject rather than being a flat list of
+ * assertions: one entry per scanned URL, each carrying the assertions made
+ * about it. That is what the ACT earl-context expects, and it is why this
+ * takes an array of results as readily as one -- a report covering many pages
+ * is the normal case, not an extension.
+ *
+ * Every rule that ran becomes an assertion, including `pass` and
+ * `notApplicable`. That is the opposite of the SARIF and HTML reporters,
+ * which carry violations only: an implementation report is a claim about what
+ * the engine decided everywhere, and a rule that was silent because it found
+ * nothing applicable is evidence, not noise.
+ */
+
+const EARL_CONTEXT = 'https://www.w3.org/WAI/content-assets/wcag-act-rules/earl-context.json';
+
+// The engine's four outcomes onto EARL's vocabulary. `earl:untested` has no
+// counterpart here: a rule that did not run produces no result to assert on.
+const OUTCOME_TO_EARL = {
+  pass: 'earl:passed',
+  fail: 'earl:failed',
+  cantTell: 'earl:cantTell',
+  notApplicable: 'earl:inapplicable'
+};
+
+/**
+ * A Success Criterion's own id, as WCAG publishes it: the slug of its title.
+ * Derived rather than tabulated so a rule added with a new SC needs no second
+ * edit here, and pinned by a test that lists every slug the catalog produces.
+ */
+function scSlug(title) {
+  return String(title || '')
+    .toLowerCase()
+    .replace(/[(),.:]/g, '')
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * `normativeMappings` also carries Understanding-document references and
+ * non-WCAG standards, which share `standard: 'WCAG'` and a `requirement` with
+ * the real thing. A Success Criterion is the entry that states a conformance
+ * level and claims no other document type.
+ */
+function wcagCriteria(check) {
+  const mappings = (check && check.meta && check.meta.normativeMappings) || [];
+  const slugs = new Set();
+
+  for (const m of mappings) {
+    if (!m || m.standard !== 'WCAG' || m.type || !m.conformanceLevel) continue;
+    const slug = scSlug(m.title);
+    if (slug) slugs.add(`WCAG2:${slug}`);
+  }
+
+  return [...slugs].sort();
+}
+
+function assertionFor(check, assertor, mode) {
+  const outcome = OUTCOME_TO_EARL[check.outcome];
+  if (!outcome) return null;
+
+  const test = { title: check.ruleId };
+  const isPartOf = wcagCriteria(check);
+  if (isPartOf.length) test.isPartOf = isPartOf;
+
+  const assertion = {
+    '@type': 'Assertion',
+    test,
+    result: { outcome }
+  };
+
+  if (assertor) assertion.assertedBy = assertor;
+  if (mode) assertion.mode = mode;
+
+  return assertion;
+}
+
+function normalizeAssertor(options) {
+  if (options.assertor === null) return null;
+
+  const supplied = options.assertor || {};
+  const assertor = { '@type': 'Assertor', name: supplied.name || 'surea11y' };
+  const revision = supplied.version || supplied.revision;
+  if (revision) assertor.release = { '@type': 'Version', revision: String(revision) };
+  return assertor;
+}
+
+/**
+ * @param {object|object[]} results one scan result, or several to report together
+ * @param {object} [options]
+ * @param {object|null} [options.assertor] `{ name, version }`; null omits it
+ * @param {string} [options.mode] an EARL test mode, e.g. `'earl:automatic'`
+ * @returns {object} the JSON-LD document
+ */
+function renderEarlReport(results, options = {}) {
+  const list = (Array.isArray(results) ? results : [results]).filter(
+    (r) => r && typeof r === 'object'
+  );
+
+  const assertor = normalizeAssertor(options);
+  const mode = typeof options.mode === 'string' && options.mode ? options.mode : null;
+
+  // Several results for one URL merge into a single subject: a caller scanning
+  // the same page under different engineOptions still describes one resource,
+  // and the context has no way to express two subjects with the same source.
+  const bySource = new Map();
+
+  for (const result of list) {
+    const source = typeof result.url === 'string' && result.url ? result.url : 'about:blank';
+    const checks = Array.isArray(result.checksResults) ? result.checksResults : [];
+
+    if (!bySource.has(source)) bySource.set(source, new Map());
+    const assertions = bySource.get(source);
+
+    for (const check of checks) {
+      if (!check || typeof check.ruleId !== 'string') continue;
+      const assertion = assertionFor(check, assertor, mode);
+      if (assertion) assertions.set(check.ruleId, assertion);
+    }
+  }
+
+  const graph = [...bySource.keys()]
+    .sort()
+    .map((source) => ({
+      '@type': 'TestSubject',
+      source,
+      assertions: [...bySource.get(source).keys()]
+        .sort()
+        .map((ruleId) => bySource.get(source).get(ruleId))
+    }))
+    .filter((subject) => subject.assertions.length);
+
+  return { '@context': EARL_CONTEXT, '@graph': graph };
+}
+
+module.exports = { renderEarlReport, EARL_CONTEXT, OUTCOME_TO_EARL, scSlug };

package/src/en301549.js

@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * The EN 301 549 chapter 9 clause for each WCAG Success Criterion, per
+ * version of the standard (docs/WCAG_CONFORMANCE.md#en-301-549). The same
+ * table the engine uses to add EN 301 549 entries to every result's
+ * `meta.normativeMappings`, published so tools can ask the reverse question:
+ * which criteria a given version requires, and which of them a scan never
+ * covered.
+ *
+ * The objects are frozen: they are the engine's own table, not copies.
+ */
+
+const {
+  EN301549_VERSIONS,
+  EN301549_CLAUSES,
+  en301549ClausesForSc
+} = require('./coverage/en301549-map.js');
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const v of Object.values(value)) deepFreeze(v);
+  }
+  return value;
+}
+
+deepFreeze(EN301549_VERSIONS);
+deepFreeze(EN301549_CLAUSES);
+
+module.exports = { EN301549_VERSIONS, EN301549_CLAUSES, en301549ClausesForSc };

package/src/junit.js

@@ -0,0 +1,321 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * Renders one scan result as a JUnit XML report (docs/JUNIT.md), the test
+ * report format CI dashboards read natively: GitLab's merge request widget,
+ * Azure DevOps' Tests tab, Jenkins, CircleCI.
+ *
+ * One <testsuite> per WCAG Success Criterion, one <testcase> per rule mapped
+ * to it. A criterion is the unit people track, and a rule rather than an
+ * occurrence keeps test counts stable when the same defect repeats. Suites
+ * come from each rule's own WCAG mappings rather than from the composites, so
+ * every rule that ran is reported even when composites were excluded; a rule
+ * mapped to no criterion goes into a final "Other checks" suite, and a rule
+ * mapped to two criteria appears in both.
+ *
+ * JUnit has no "could not tell". A cantTell rule is <skipped> by default:
+ * surfaced for review, never turning a build red, the same line the SARIF
+ * reporter draws with "warning". `cantTellAs: 'failure'` gates on it instead.
+ * notApplicable rules are left out unless `includeNotApplicable` is set, since
+ * a page has hundreds of them and none says anything.
+ *
+ * `baselineEntries` (docs/BASELINE.md) drops fail occurrences already
+ * recorded there, as SARIF does. A rule whose every failure is known is
+ * <skipped> with the count, not reported as passing: it did not pass.
+ *
+ * No timings are invented. `time` is "0" throughout, so the same scan always
+ * renders byte-identical XML, and `timestamp` appears only when the result
+ * carries one (the engine has no clock of its own).
+ */
+
+const { computeBaselineKey, getReasonCode } = require('./baseline.js');
+const { NORMATIVE_STANDARDS, standardOfEntry } = require('./coverage/standards.js');
+
+const OTHER_SUITE = 'Other checks';
+
+// XML 1.0 forbids most control characters, and lone surrogates, outright,
+// escaped or not, and markup scraped from a page can carry them.
+function isXmlChar(codePoint) {
+  return (
+    codePoint === 0x9 ||
+    codePoint === 0xa ||
+    codePoint === 0xd ||
+    (codePoint >= 0x20 && codePoint <= 0xd7ff) ||
+    (codePoint >= 0xe000 && codePoint <= 0xfffd) ||
+    codePoint >= 0x10000
+  );
+}
+
+function xmlText(value) {
+  let text = '';
+  for (const ch of String(value == null ? '' : value)) {
+    if (isXmlChar(ch.codePointAt(0))) text += ch;
+  }
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+function compareCriteria(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] || 0) - (pb[i] || 0);
+    if (diff) return diff;
+  }
+  return 0;
+}
+
+// Same test as src/sarif.js and src/report.js.
+function isWcagCriterion(m) {
+  return !!(m && m.requirement && (m.standard == null || m.standard === 'WCAG') && !m.type);
+}
+
+function mappingsOf(result) {
+  return (result && result.meta && result.meta.normativeMappings) || [];
+}
+
+function getOccurrenceOutcome(check, occurrence) {
+  const occurrenceOutcome =
+    occurrence &&
+    (occurrence.occurrenceOutcome === 'fail' || occurrence.occurrenceOutcome === 'cantTell'
+      ? occurrence.occurrenceOutcome
+      : occurrence.outcome === 'fail' || occurrence.outcome === 'cantTell'
+        ? occurrence.outcome
+        : null);
+  if (occurrenceOutcome) return occurrenceOutcome;
+  return check && (check.outcome === 'fail' || check.outcome === 'cantTell') ? check.outcome : null;
+}
+
+function buildRemainingBaselineMap(baselineEntries) {
+  const remaining = new Map();
+  for (const entry of Array.isArray(baselineEntries) ? baselineEntries : []) {
+    if (!entry) continue;
+    const key = computeBaselineKey(
+      entry.ruleId,
+      entry.reasonCode || 'DEFAULT',
+      typeof entry.html === 'string' ? entry.html : ''
+    );
+    remaining.set(key, (remaining.get(key) || 0) + 1);
+  }
+  return remaining;
+}
+
+// What one rule contributes, decided once so that a rule appearing in two
+// suites consumes its baseline entries only once.
+function classify(check, remaining, options) {
+  const occurrences = Array.isArray(check.occurrences) ? check.occurrences.filter(Boolean) : [];
+  const failing = [];
+  const undecided = [];
+  let baselined = 0;
+
+  if (check.outcome === 'fail' || check.outcome === 'cantTell') {
+    for (const occurrence of occurrences) {
+      const outcome = getOccurrenceOutcome(check, occurrence);
+      if (outcome === 'fail') {
+        const html = typeof occurrence.html === 'string' ? occurrence.html : '';
+        const key = computeBaselineKey(check.ruleId, getReasonCode(occurrence), html);
+        const left = remaining.get(key) || 0;
+        if (left > 0) {
+          remaining.set(key, left - 1);
+          baselined++;
+          continue;
+        }
+        failing.push(occurrence);
+      } else if (outcome === 'cantTell') {
+        undecided.push(occurrence);
+      }
+    }
+  }
+
+  let status;
+  if (failing.length) status = 'failure';
+  else if (undecided.length) status = options.cantTellAs === 'failure' ? 'failure' : 'skipped';
+  else if (baselined) status = 'skipped';
+  else if (check.outcome === 'notApplicable') status = 'notApplicable';
+  else if (check.outcome === 'cantTell')
+    status = options.cantTellAs === 'failure' ? 'failure' : 'skipped';
+  else status = 'passed';
+
+  return { check, status, failing, undecided, baselined };
+}
+
+function describeOccurrence(occurrence) {
+  const lines = [];
+  const message = [occurrence.summary, occurrence.hint].filter(Boolean).join(' ');
+  lines.push(`- ${message || '(no message)'}`);
+  if (occurrence.selector) lines.push(`  selector: ${occurrence.selector}`);
+  if (typeof occurrence.html === 'string' && occurrence.html) {
+    lines.push(`  html: ${occurrence.html}`);
+  }
+  return lines.join('\n');
+}
+
+function plural(n, word) {
+  return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
+
+function needReview(n) {
+  return `${plural(n, 'occurrence')} ${n === 1 ? 'needs' : 'need'} manual review`;
+}
+
+function renderTestcase(entry, classname, indent) {
+  const { check, status, failing, undecided, baselined } = entry;
+  const open = `${indent}<testcase classname="${xmlText(classname)}" name="${xmlText(check.ruleId)}" time="0"`;
+  const inner = [];
+
+  if (status === 'failure' && failing.length) {
+    const message = `${plural(failing.length, 'failing occurrence')}: ${failing[0].summary || check.ruleId}`;
+    inner.push(
+      `${indent}  <failure type="fail" message="${xmlText(message)}">${xmlText(failing.map(describeOccurrence).join('\n'))}</failure>`
+    );
+  } else if (status === 'failure') {
+    const message = undecided.length ? needReview(undecided.length) : 'Needs manual review';
+    inner.push(
+      `${indent}  <failure type="cantTell" message="${xmlText(message)}">${xmlText(undecided.map(describeOccurrence).join('\n'))}</failure>`
+    );
+  } else if (status === 'skipped') {
+    const parts = [];
+    if (undecided.length) parts.push(needReview(undecided.length));
+    else if (check.outcome === 'cantTell' && !baselined) parts.push('Needs manual review');
+    if (baselined) parts.push(`${plural(baselined, 'known failure')} recorded in the baseline`);
+    inner.push(`${indent}  <skipped message="${xmlText(parts.join('; '))}"/>`);
+  } else if (status === 'notApplicable') {
+    inner.push(`${indent}  <skipped message="Not applicable"/>`);
+  }
+
+  // Undecided occurrences on a rule that also failed, or that were skipped,
+  // are still worth reading; they go where dashboards show test output.
+  if (undecided.length && !(status === 'failure' && !failing.length)) {
+    inner.push(
+      `${indent}  <system-out>${xmlText(['Needs manual review:', ...undecided.map(describeOccurrence)].join('\n'))}</system-out>`
+    );
+  }
+
+  return inner.length ? `${open}>\n${inner.join('\n')}\n${indent}</testcase>` : `${open}/>`;
+}
+
+function countStatus(entries, status) {
+  return entries.filter((e) => e.status === status).length;
+}
+
+function renderJunitReport(result, options = {}) {
+  const opts = {
+    cantTellAs: options.cantTellAs === 'failure' ? 'failure' : 'skipped',
+    includeNotApplicable: options.includeNotApplicable === true
+  };
+  const remaining = buildRemainingBaselineMap(options.baselineEntries);
+  const engine = (result && result.engine) || {};
+
+  // Composite title and outcome per criterion, where the composite ran.
+  const composites = new Map();
+  for (const composite of (result && result.rulesResults) || []) {
+    const sc = mappingsOf(composite).find(isWcagCriterion);
+    if (sc && !composites.has(sc.requirement)) composites.set(sc.requirement, composite);
+  }
+
+  const suites = new Map(); // criterion (or OTHER_SUITE) -> { entries, level, standards }
+  const checks = ((result && result.checksResults) || []).filter((c) => c && c.ruleId);
+  for (const check of checks) {
+    const entry = classify(check, remaining, opts);
+    if (entry.status === 'notApplicable' && !opts.includeNotApplicable) continue;
+
+    const mappings = mappingsOf(check);
+    const criteria = mappings.filter(isWcagCriterion);
+    const keys = criteria.length
+      ? [...new Set(criteria.map((m) => String(m.requirement)))]
+      : [OTHER_SUITE];
+    for (const key of keys) {
+      if (!suites.has(key)) suites.set(key, { entries: [], level: null, standards: new Map() });
+      const suite = suites.get(key);
+      suite.entries.push(entry);
+      const own = criteria.find((m) => String(m.requirement) === key);
+      if (own && !suite.level) suite.level = own.conformanceLevel || own.level || null;
+      // Another standard's entry goes under the criteria it corresponds to
+      // (its `wcagSc`); one that names none (no field, or an empty list, for a
+      // requirement outside WCAG) belongs to every criterion of its rule, and
+      // a rule with no criterion keeps all of its entries.
+      for (const m of mappings) {
+        const standard = standardOfEntry(m);
+        if (!standard) continue;
+        const named = Array.isArray(m.wcagSc) && m.wcagSc.length ? m.wcagSc.map(String) : null;
+        if (key !== OTHER_SUITE && named && !named.includes(key)) continue;
+        if (!suite.standards.has(standard.key)) suite.standards.set(standard.key, new Set());
+        suite.standards.get(standard.key).add(String(m.requirement));
+      }
+    }
+  }
+
+  const keys = [...suites.keys()].sort((a, b) => {
+    if (a === OTHER_SUITE) return 1;
+    if (b === OTHER_SUITE) return -1;
+    return compareCriteria(a, b);
+  });
+
+  const runProperties = [
+    ['engine', engine.tag],
+    ['schemaVersion', engine.schemaVersion],
+    ['wcagVersion', engine.wcagVersion],
+    ['profile', engine.profile],
+    ['optInRules', Array.isArray(engine.optInRules) ? engine.optInRules.join(',') : null],
+    ['locale', engine.locale && engine.locale.resolved],
+    ['url', result && result.url]
+  ].filter(([, v]) => v != null && v !== '');
+
+  const totals = { tests: 0, failures: 0, skipped: 0 };
+  const suiteXml = keys.map((key) => {
+    const suite = suites.get(key);
+    const entries = suite.entries
+      .slice()
+      .sort((a, b) => a.check.ruleId.localeCompare(b.check.ruleId));
+    const composite = key === OTHER_SUITE ? null : composites.get(key);
+    const name =
+      key === OTHER_SUITE
+        ? OTHER_SUITE
+        : `WCAG ${key}${composite && composite.title ? ` ${composite.title}` : ''}`;
+    const classname = key === OTHER_SUITE ? 'other' : `wcag-${key}`;
+    const failures = countStatus(entries, 'failure');
+    const skipped = countStatus(entries, 'skipped') + countStatus(entries, 'notApplicable');
+    totals.tests += entries.length;
+    totals.failures += failures;
+    totals.skipped += skipped;
+
+    const properties = [
+      ...(key === OTHER_SUITE ? [] : [['wcagCriterion', key]]),
+      ...(suite.level ? [['wcagLevel', suite.level]] : []),
+      ...NORMATIVE_STANDARDS.flatMap((standard) =>
+        [...(suite.standards.get(standard.key) || [])]
+          .sort((a, b) => compareCriteria(a, b) || a.localeCompare(b))
+          .map((requirement) => [standard.key, requirement])
+      ),
+      ...(composite && composite.outcome ? [['criterionOutcome', composite.outcome]] : []),
+      ...runProperties
+    ];
+
+    const timestamp = result && result.timestamp ? ` timestamp="${xmlText(result.timestamp)}"` : '';
+    return [
+      `  <testsuite name="${xmlText(name)}" tests="${entries.length}" failures="${failures}" errors="0" skipped="${skipped}" time="0"${timestamp}>`,
+      '    <properties>',
+      ...properties.map(([k, v]) => `      <property name="${xmlText(k)}" value="${xmlText(v)}"/>`),
+      '    </properties>',
+      ...entries.map((entry) => renderTestcase(entry, classname, '    ')),
+      '  </testsuite>'
+    ].join('\n');
+  });
+
+  const name = typeof options.name === 'string' && options.name ? options.name : 'surea11y';
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    `<testsuites name="${xmlText(name)}" tests="${totals.tests}" failures="${totals.failures}" errors="0" skipped="${totals.skipped}" time="0">`,
+    ...suiteXml,
+    '</testsuites>',
+    ''
+  ].join('\n');
+}
+
+module.exports = { renderJunitReport };