pour-engine 1.35.1 → 1.35.3

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.35.1',
+    version: '1.35.3',
   },
 };

package/engine/rules/wcag/1.3.1-aria-required-children.js

@@ -31,17 +31,29 @@ const roleOf = (element) =>
  * as empty (2026-08-25 overnight audit; same reasoning as
  * aria-required-parent's flat-tree walk). Closed roots stay invisible, as
  * everywhere else in the engine.
+ *
+ * The walk also follows <slot>s downward: a container rendered inside a
+ * shadow root (a design system's <div role="list"> holding only a <slot>)
+ * owns the light-DOM items projected into it, which is what Chromium
+ * exposes as list > listitem. Reading the shadow tree alone reported the
+ * list as empty (spectrum.adobe.com, 2026-08-27 disagreement crawl).
  */
 function composedDescendants(element) {
   const found = [];
   const pending = [element];
+  const seen = new Set();
+  const enter = (el) => {
+    if (seen.has(el)) return;
+    seen.add(el);
+    found.push(el);
+    if (el.shadowRoot) pending.push(el.shadowRoot);
+    if (el.tagName === 'SLOT') for (const assigned of el.assignedElements({ flatten: true })) { enter(assigned); pending.push(assigned); }
+  };
   for (let i = 0; i < pending.length; i++) {
     const scope = pending[i];
     if (scope.shadowRoot) pending.push(scope.shadowRoot);
-    for (const el of scope.querySelectorAll('*')) {
-      found.push(el);
-      if (el.shadowRoot) pending.push(el.shadowRoot);
-    }
+    if (scope.tagName === 'SLOT') for (const assigned of scope.assignedElements({ flatten: true })) { enter(assigned); pending.push(assigned); }
+    for (const el of scope.querySelectorAll('*')) enter(el);
   }
   return found;
 }

package/engine/rules/wcag/1.3.1-listitem-parent.js

@@ -1,4 +1,6 @@
 // WCAG SC 1.3.1 Info and Relationships (Level A)
+import { ROLE_ARIA } from '../../lib/roles.js';
+
 export default {
   id: 'listitem-parent',
   name: 'List item placement',
@@ -28,8 +30,16 @@ export default {
     // cannot own listitems and its <li> children are orphaned exactly as if
     // the <ul> were a <div>. Matching the tag alone waved those through
     // (found on ar.wikipedia.org: portal links in <ul role="navigation">).
+    //
+    // The role that counts is the first token the browser knows. An unknown
+    // token (<ol role="breadcrumbs">, seen on a design-system home) is
+    // dropped by every user agent (ARIA 1.2 §7.1, fallback roles), so the
+    // native list role stands and its <li>s are owned as usual; valid-role
+    // reports the misspelling on its own. Reading the raw attribute made
+    // the rule blame the list's items for a token that changed nothing.
     const listContainer = (el) => {
-      const role = el.getAttribute('role');
+      const tokens = (el.getAttribute('role') ?? '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+      const role = tokens.find((t) => ROLE_ARIA[t]) ?? null;
       if (el.matches('ul, ol, menu')) return !role || ['list', 'presentation', 'none'].includes(role);
       return role === 'list';
     };

package/engine/rules/wcag/1.4.3-color-contrast.js

@@ -1014,6 +1014,47 @@ export function createContrastRule({ id, tags, help, helpUrl, thresholds }) {
           message: 'This text overlaps a coloured block that isn’t its DOM ancestor, so its real background is ambiguous — check contrast by eye.',
         };
       }
+      // The panel scan keeps to positioned and floated paint because only
+      // those cross sibling boundaries. The TEXT can be the one crossing:
+      // an absolutely positioned floating label sits on the static <input>
+      // beside it, and the walk, which never leaves the label's ancestors,
+      // read the grey section behind the form (worldbank.org sign-up,
+      // 2026-08-27, asserted 4.44:1 against the wrapper while the glyphs
+      // sit on the input's white, 4.67:1; the same label passed once
+      // scrolled into view and hit-tested). When the text or an ancestor
+      // up to its containing block is out of flow, the static opaque
+      // boxes inside that containing block are candidates too. Bounded by
+      // the containing block's subtree; a huge one keeps the walk-only
+      // behaviour rather than paying a full-page style pass per element.
+      if (!blindOnly) {
+        let outOfFlow = false;
+        let block = null;
+        for (let node = element; node && node.nodeType === 1 && node !== doc.body; node = node.parentElement ?? node.getRootNode()?.host) {
+          const position = getComputedStyle(node).position;
+          if (node !== element && position !== 'static') { block = node; break; }
+          if (position === 'absolute' || position === 'fixed') outOfFlow = true;
+        }
+        if (outOfFlow && block) {
+          const inside = block.querySelectorAll('*');
+          if (inside.length <= 2000) {
+            for (const sibling of inside) {
+              if (sibling === element || sibling.contains(element) || element.contains(sibling)) continue;
+              const siblingStyle = getComputedStyle(sibling);
+              if (siblingStyle.position !== 'static' || siblingStyle.visibility === 'hidden') continue;
+              const paint = parseColor(siblingStyle.backgroundColor);
+              if (!paint || paint.a < 1) continue;
+              const siblingRect = sibling.getBoundingClientRect();
+              if (siblingRect.width < 24 || siblingRect.height < 12 || !near(siblingRect) || !textIntersects(element, siblingRect)) continue;
+              if ((contrastRatio(foreground, paint) >= required) !== (direction === 'pass')) {
+                return {
+                  status: 'incomplete',
+                  message: 'This text is positioned over a coloured box that isn’t its DOM ancestor, so its real background is ambiguous — check contrast by eye.',
+                };
+              }
+            }
+          }
+        }
+      }
       return null;
     };
 

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -52,14 +52,25 @@ export default {
     // When the element's role is modelled and does not support the attribute
     // at all, the value is moot and aria-allowed-attr already reviews the
     // attribute; reporting the value too would be the same finding twice.
+    //
+    // An EMPTY value is a third thing. ARIA defines the empty string as the
+    // default for aria-current (absent, empty and undefined all mean false),
+    // so aria-current="" is a correct way to say "not current" and nothing
+    // is lost (a design-system home writes it that way on every non-active
+    // link). For the other enumerated states an empty value is one the
+    // browser drops, which is the unknown-name situation again: nothing
+    // exposed wrongly, possibly a state the author meant. Review, not fail.
     const unknown = [];
     const invalid = [];
+    const empty = [];
     let role;
     for (const { name, value } of element.attributes) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       if (!KNOWN.has(attr)) {
         unknown.push(name);
+      } else if (ENUMS[name] && value.trim() === '') {
+        if (name !== 'aria-current') empty.push(name);
       } else if (ENUMS[name] && !ENUMS[name].includes(value.trim().toLowerCase())) {
         if (!GLOBAL_ARIA.has(attr)) {
           role ??= effectiveRole(element);
@@ -75,6 +86,13 @@ export default {
         fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
       };
     }
+    if (empty.length) {
+      return {
+        status: 'incomplete',
+        message: `${empty.join(', ')} is empty, so the browser ignores it and no state is exposed. Was a value intended here? If a real state was meant (${empty.map((n) => ENUMS[n].slice(0, 3).join(', ')).join('; ')}, ...), it is missing and this is a 4.1.2 failure; if the attribute is a template leftover, no one is affected.`,
+        fix: 'Give the attribute one of its allowed values, or remove it.',
+      };
+    }
     if (unknown.length) {
       return {
         status: 'incomplete',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.35.1",
+  "version": "1.35.3",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",