pour-engine 1.35.0 → 1.35.2

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.35.0',
+    version: '1.35.2',
   },
 };

package/engine/lib/contrast.js

@@ -903,7 +903,36 @@ export function paintedBackdrop(element) {
     overlays.push(own);
   }
   if (start === -1) return 'unresolved';
+  // Ancestors the hit-test cannot see. pointer-events: none is inherited
+  // and takes an element (and, unless they opt back in, its descendants)
+  // out of every hit-test stack, but it paints exactly as before. A white
+  // title inside a fixed black header with pointer-events: none, the title
+  // itself set back to auto, hit-tests as [title, page, body]: the black
+  // layer is skipped and the walk below composites the page colour under
+  // the glyphs (business.hsbc.com, 2026-08-27, asserted 1.10:1 white on
+  // #f3f3f3 under a black bar). So the painting ancestors missing from the
+  // stack are folded back in, each at its place in paint order: an
+  // ancestor paints beneath all of its descendants, so its turn comes when
+  // the next stack layer is no longer inside it. Only ancestors whose box
+  // holds the sample point count; a parent the text has been positioned
+  // out of paints nowhere under it and is rightly absent.
+  const missing = [];
+  const inStack = new Set(stack);
+  for (let a = element.parentElement ?? element.getRootNode()?.host; a && a.nodeType === 1; a = a.parentElement ?? a.getRootNode()?.host) {
+    if (inStack.has(a)) continue;
+    const box = a.getBoundingClientRect();
+    if (point.x < box.left || point.x >= box.right || point.y < box.top || point.y >= box.bottom) continue;
+    const st = getComputedStyle(a);
+    const c = parseColor(st.backgroundColor);
+    if ((c && c.a > 0) || (st.backgroundImage !== 'none' && !paintsNothing(st.backgroundImage))) missing.push(a);
+  }
+  const layers = [];
   for (const layer of stack.slice(start + 1)) {
+    while (missing.length && !missing[0].contains(layer)) layers.push(missing.shift());
+    layers.push(layer);
+  }
+  layers.push(...missing);
+  for (const layer of layers) {
     // Replaced elements paint their content, not a background — a photo or
     // video in the stack is an image backdrop whatever its styles say.
     if (/^(img|video|canvas|svg|picture|object|embed|iframe)$/i.test(layer.tagName)) {

package/engine/rules/wcag/1.3.1-aria-required-children.js

@@ -31,17 +31,29 @@ const roleOf = (element) =>
  * as empty (2026-08-25 overnight audit; same reasoning as
  * aria-required-parent's flat-tree walk). Closed roots stay invisible, as
  * everywhere else in the engine.
+ *
+ * The walk also follows <slot>s downward: a container rendered inside a
+ * shadow root (a design system's <div role="list"> holding only a <slot>)
+ * owns the light-DOM items projected into it, which is what Chromium
+ * exposes as list > listitem. Reading the shadow tree alone reported the
+ * list as empty (spectrum.adobe.com, 2026-08-27 disagreement crawl).
  */
 function composedDescendants(element) {
   const found = [];
   const pending = [element];
+  const seen = new Set();
+  const enter = (el) => {
+    if (seen.has(el)) return;
+    seen.add(el);
+    found.push(el);
+    if (el.shadowRoot) pending.push(el.shadowRoot);
+    if (el.tagName === 'SLOT') for (const assigned of el.assignedElements({ flatten: true })) { enter(assigned); pending.push(assigned); }
+  };
   for (let i = 0; i < pending.length; i++) {
     const scope = pending[i];
     if (scope.shadowRoot) pending.push(scope.shadowRoot);
-    for (const el of scope.querySelectorAll('*')) {
-      found.push(el);
-      if (el.shadowRoot) pending.push(el.shadowRoot);
-    }
+    if (scope.tagName === 'SLOT') for (const assigned of scope.assignedElements({ flatten: true })) { enter(assigned); pending.push(assigned); }
+    for (const el of scope.querySelectorAll('*')) enter(el);
   }
   return found;
 }

package/engine/rules/wcag/1.3.1-listitem-parent.js

@@ -1,4 +1,6 @@
 // WCAG SC 1.3.1 Info and Relationships (Level A)
+import { ROLE_ARIA } from '../../lib/roles.js';
+
 export default {
   id: 'listitem-parent',
   name: 'List item placement',
@@ -28,8 +30,16 @@ export default {
     // cannot own listitems and its <li> children are orphaned exactly as if
     // the <ul> were a <div>. Matching the tag alone waved those through
     // (found on ar.wikipedia.org: portal links in <ul role="navigation">).
+    //
+    // The role that counts is the first token the browser knows. An unknown
+    // token (<ol role="breadcrumbs">, seen on a design-system home) is
+    // dropped by every user agent (ARIA 1.2 §7.1, fallback roles), so the
+    // native list role stands and its <li>s are owned as usual; valid-role
+    // reports the misspelling on its own. Reading the raw attribute made
+    // the rule blame the list's items for a token that changed nothing.
     const listContainer = (el) => {
-      const role = el.getAttribute('role');
+      const tokens = (el.getAttribute('role') ?? '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+      const role = tokens.find((t) => ROLE_ARIA[t]) ?? null;
       if (el.matches('ul, ol, menu')) return !role || ['list', 'presentation', 'none'].includes(role);
       return role === 'list';
     };

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -52,14 +52,25 @@ export default {
     // When the element's role is modelled and does not support the attribute
     // at all, the value is moot and aria-allowed-attr already reviews the
     // attribute; reporting the value too would be the same finding twice.
+    //
+    // An EMPTY value is a third thing. ARIA defines the empty string as the
+    // default for aria-current (absent, empty and undefined all mean false),
+    // so aria-current="" is a correct way to say "not current" and nothing
+    // is lost (a design-system home writes it that way on every non-active
+    // link). For the other enumerated states an empty value is one the
+    // browser drops, which is the unknown-name situation again: nothing
+    // exposed wrongly, possibly a state the author meant. Review, not fail.
     const unknown = [];
     const invalid = [];
+    const empty = [];
     let role;
     for (const { name, value } of element.attributes) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       if (!KNOWN.has(attr)) {
         unknown.push(name);
+      } else if (ENUMS[name] && value.trim() === '') {
+        if (name !== 'aria-current') empty.push(name);
       } else if (ENUMS[name] && !ENUMS[name].includes(value.trim().toLowerCase())) {
         if (!GLOBAL_ARIA.has(attr)) {
           role ??= effectiveRole(element);
@@ -75,6 +86,13 @@ export default {
         fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
       };
     }
+    if (empty.length) {
+      return {
+        status: 'incomplete',
+        message: `${empty.join(', ')} is empty, so the browser ignores it and no state is exposed. Was a value intended here? If a real state was meant (${empty.map((n) => ENUMS[n].slice(0, 3).join(', ')).join('; ')}, ...), it is missing and this is a 4.1.2 failure; if the attribute is a template leftover, no one is affected.`,
+        fix: 'Give the attribute one of its allowed values, or remove it.',
+      };
+    }
     if (unknown.length) {
       return {
         status: 'incomplete',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.35.0",
+  "version": "1.35.2",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",