pour-engine 1.21.0 → 1.23.0

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.21.0',
+    version: '1.23.0',
   },
 };

package/engine/AUDIT.html

@@ -684,7 +684,7 @@
 <p>What to trust and how much: the ten headline defects were re-verified line by line in the source by a second pass and are safe to act on. Per-rule ratings are judgments, not measurements; the boundary between "minor gaps" and "under-tests" is taste. Over-violation claims describe constructible scenarios, not measured frequency on real pages: an over-flag that fires on rare markup matters less in practice than the rating implies, and the lab benchmark, not this audit, is the source of truth for how often each fires. Two flagged behaviours (subtitles-as-captions, the auth-field both-attributes fail) are pinned by spec cases, meaning they are standing policy: this report flags them as spec deviations, and changing them is a product decision, not a bug fix.</p>
 <p>Timeline: the audit ran against a clean tree with 140 pinned cases, changing nothing. The same day, the proposed batch was implemented (eight rules, four catalog flips), adversarially audited, corrected, and re-pinned: 176 cases now pass, along with all testbeds, frame checks, and the four-surface smoke; the mass lab gate was not run. Coverage was regenerated and site plus extension bundles rebuilt with the new engine. The pre-existing confirmed defects in the findings above are deliberately untouched: fixing them is the proposed next batch, and a separate decision from adding rules.</p>
 
-<p class="foot">Pour engine spec sweep, 10 August 2026. Catalog verified against the W3C Recommendation of 12 December 2024 and its errata. This report lives at src/engine/AUDIT.html and is regenerated by running the spec-sweep skill; it is the only home of the audit, never published externally.</p>
+<p class="foot">Pour engine spec sweep, 10 August 2026. Catalog verified against the W3C Recommendation of 12 December 2024 and its errata. This report lives at src/engine/AUDIT.html and is regenerated by running the spec-sweep skill; it ships alongside the engine source (the engine mirror repo includes it), so it is written to be read.</p>
 </main>
 </body>
 </html>

package/engine/rules/wcag/1.1.1-svg-img-alt.js

@@ -1,4 +1,6 @@
 // WCAG SC 1.1.1 Non-text Content (Level A)
+import { labelledByName } from '../../lib/accessible-name.js';
+
 export default {
   id: 'svg-img-alt',
   impact: 'serious',
@@ -10,6 +12,21 @@ export default {
   // because browsers expose it to AT as a graphic even without a role.
   selector: 'svg[role="img"], svg[role="graphics-document"], svg[role="graphics-symbol"], [role="img"]:not(img):not(svg), svg:not([role])',
   evaluate(element, { accessibleName }) {
+    // A non-svg role="img" host names from author only, and the role makes
+    // its subtree presentational (ARIA: children presentational) — so a
+    // descendant <svg><title> or text content never reaches AT as a name,
+    // even though a generic contents walk would find it.
+    if (element.tagName.toLowerCase() !== 'svg' && element.getAttribute('role') === 'img') {
+      const authorName = labelledByName(element)
+        || element.getAttribute('aria-label')?.trim()
+        || element.getAttribute('title')?.trim();
+      if (authorName) return { status: 'pass' };
+      return {
+        status: 'fail',
+        message: 'This element is marked as an image but has no accessible name — for role="img", content inside it (including an inner SVG’s <title>) does not count as a name.',
+        fix: 'Add aria-label="…" or aria-labelledby pointing at visible text.',
+      };
+    }
     if (accessibleName(element)) return { status: 'pass' };
     if (!element.getAttribute('role') && element.tagName.toLowerCase() === 'svg') {
       if (element.parentNode instanceof SVGElement) return { status: 'pass' }; // nested svg: part of the outer graphic

package/engine/rules/wcag/1.3.1-aria-required-parent.js

@@ -38,7 +38,19 @@ export default {
         ?? IMPLICIT_CONTAINER[owner.tagName.toLowerCase()]);
       if (ownerRole && containers.includes(ownerRole)) return { status: 'pass' };
     }
-    for (let parent = element.parentElement; parent; parent = parent.parentElement) {
+    // FLAT-TREE ancestry, not light-DOM ancestry: assistive technology sees
+    // the composed tree, so a slotted role="listitem" whose role="list"
+    // container lives inside the host component's shadow root IS inside a
+    // list (Adobe Spectrum's sidenav is exactly this — a light-DOM walk was
+    // 11 false asserts on one page). An element assigned to a slot continues
+    // through the slot's shadow-side ancestors; an element at a shadow root's
+    // top continues through the host.
+    const flatParent = (node) => node.assignedSlot
+      ?? node.parentElement
+      ?? (node.getRootNode() instanceof ShadowRoot ? node.getRootNode().host : null);
+    for (let parent = flatParent(element); parent; parent = flatParent(parent)) {
+      // A <slot> is rendering plumbing with no tree presence of its own.
+      if (parent.tagName === 'SLOT' && !parent.hasAttribute('role')) continue;
       const parentRole =
         parent.getAttribute('role')?.trim().split(/\s+/)[0]?.toLowerCase() ??
         IMPLICIT_CONTAINER[parent.tagName.toLowerCase()];

package/engine/rules/wcag/2.4.4-link-text-generic.js

@@ -24,12 +24,15 @@
 // already fixed, and must not be flagged. That also means an aria-label
 // which is itself generic is caught, which is the more common mistake.
 //
-// English only, deliberately. A phrase list cannot be quietly extended to
-// other languages without a speaker of each checking it, and a wrong entry
-// would fail correct links. Non-English pages get no findings here rather
-// than bad ones.
+// The list grows one language at a time, and only with a speaker of that
+// language checking every entry — a wrong entry would fail correct links.
+// English and French are covered; pages in other languages get no findings
+// here rather than bad ones. Entries are stored in NORMALIZED form (see
+// normalizeName below): apostrophes become spaces, so "plus d informations"
+// is how "plus d'informations" — straight or typographic — must be listed.
 
 const GENERIC = new Set([
+  // English
   'read more', 'read more about this', 'more', 'much more', 'learn more',
   'click here', 'click', 'click this', 'tap here', 'press here',
   'here', 'this', 'this link', 'link', 'this page', 'go', 'go here',
@@ -37,6 +40,13 @@ const GENERIC = new Set([
   'see more', 'view more', 'show more', 'find out more', 'discover more',
   'continue', 'continue reading', 'keep reading', 'full story', 'full article',
   'details', 'see details', 'view details', 'more details',
+  // French — contributed and checked by a native speaker
+  'en savoir plus', 'savoir plus', 'lire la suite', 'lire plus', 'plus',
+  'cliquez ici', 'cliquer ici', 'clique ici', 'ici', 'ce lien', 'lien',
+  'cette page', 'voir plus', 'en voir plus', 'afficher plus', 'afficher',
+  'voir', 'voir le détail', 'voir les détails', 'plus de détails',
+  'plus d informations', 'plus d infos',
+  'en savoir davantage', 'découvrir', 'découvrez', 'continuer', 'suite',
 ]);
 
 /** Lowercased, punctuation and arrows dropped, spaces collapsed, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",