pour-engine 1.35.2 → 1.35.4

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.35.2',
+    version: '1.35.4',
   },
 };

package/engine/lib/dom.js

@@ -96,13 +96,25 @@ export function cssPath(element) {
   return path;
 }
 
+/** An element's attributes read through the prototype, not the instance:
+ *  a form whose control is named "attributes" shadows the property with
+ *  that control (byggmax.se, 2026-08-30), and the same goes for any named
+ *  form control. Anything that is not a NamedNodeMap is looked up on the
+ *  prototype the element was born with. */
+const attributesGetter = typeof Element !== 'undefined' ? Object.getOwnPropertyDescriptor(Element.prototype, 'attributes')?.get : null;
+export function attributesOf(element) {
+  const own = element.attributes;
+  if (own && typeof own.length === 'number' && typeof own.item === 'function') return own;
+  return attributesGetter ? attributesGetter.call(element) : [];
+}
+
 /** Element's opening markup (attributes) plus a snippet of its own text —
  *  enough to recognise it in a table. Built WITHOUT element.outerHTML, which
  *  serializes the whole subtree and turns audits quadratic on huge pages
  *  (container divs would each stringify most of the document). */
 export function htmlSnippet(element, maxLength = 300) {
   let html = `<${element.tagName.toLowerCase()}`;
-  for (const { name, value } of element.attributes) {
+  for (const { name, value } of attributesOf(element)) {
     if (html.length >= maxLength) break;
     html += ` ${name}="${value}"`;
   }

package/engine/rules/wcag/1.4.12-text-spacing.js

@@ -4,7 +4,14 @@
 // The override is injected and removed inside one synchronous pass — the
 // engine only yields to the renderer between rules, so the page never
 // paints the probed state.
-const OVERRIDE = `* {
+// The probe reflows the whole page for a moment. Two guards keep that
+// invisible to the user: scroll anchoring is disabled while the override
+// is in (or Chrome re-anchors during the inflated layout and leaves the
+// page scrolled somewhere else when the probe lifts — measured at 884px
+// of drift on a long report page), and the window scroll is restored
+// after removal in case the browser clamped it anyway.
+const OVERRIDE = `html { overflow-anchor: none !important; }
+* {
   line-height: 1.5 !important;
   letter-spacing: 0.12em !important;
   word-spacing: 0.16em !important;
@@ -44,6 +51,9 @@ export default {
     if (!candidates.some(Boolean)) return elements.map(() => ({ status: 'pass' }));
 
     const before = candidates.map((element) => element && clipped(element));
+    const win = doc.defaultView;
+    const scrollX = win?.scrollX ?? 0;
+    const scrollY = win?.scrollY ?? 0;
     const probe = doc.createElement('style');
     probe.dataset.pourAudit = 'probe';
     probe.textContent = OVERRIDE;
@@ -55,6 +65,10 @@ export default {
       after = candidates.map((element) => element && clipped(element));
     } finally {
       probe.remove();
+      // The audit must never move the page: put the scroll back exactly
+      // where the user had it, after the removal's own reflow settles.
+      void doc.documentElement.offsetHeight;
+      if (win && (win.scrollX !== scrollX || win.scrollY !== scrollY)) win.scrollTo(scrollX, scrollY);
     }
 
     return elements.map((element, i) => {

package/engine/rules/wcag/1.4.3-color-contrast.js

@@ -1014,6 +1014,47 @@ export function createContrastRule({ id, tags, help, helpUrl, thresholds }) {
           message: 'This text overlaps a coloured block that isn’t its DOM ancestor, so its real background is ambiguous — check contrast by eye.',
         };
       }
+      // The panel scan keeps to positioned and floated paint because only
+      // those cross sibling boundaries. The TEXT can be the one crossing:
+      // an absolutely positioned floating label sits on the static <input>
+      // beside it, and the walk, which never leaves the label's ancestors,
+      // read the grey section behind the form (worldbank.org sign-up,
+      // 2026-08-27, asserted 4.44:1 against the wrapper while the glyphs
+      // sit on the input's white, 4.67:1; the same label passed once
+      // scrolled into view and hit-tested). When the text or an ancestor
+      // up to its containing block is out of flow, the static opaque
+      // boxes inside that containing block are candidates too. Bounded by
+      // the containing block's subtree; a huge one keeps the walk-only
+      // behaviour rather than paying a full-page style pass per element.
+      if (!blindOnly) {
+        let outOfFlow = false;
+        let block = null;
+        for (let node = element; node && node.nodeType === 1 && node !== doc.body; node = node.parentElement ?? node.getRootNode()?.host) {
+          const position = getComputedStyle(node).position;
+          if (node !== element && position !== 'static') { block = node; break; }
+          if (position === 'absolute' || position === 'fixed') outOfFlow = true;
+        }
+        if (outOfFlow && block) {
+          const inside = block.querySelectorAll('*');
+          if (inside.length <= 2000) {
+            for (const sibling of inside) {
+              if (sibling === element || sibling.contains(element) || element.contains(sibling)) continue;
+              const siblingStyle = getComputedStyle(sibling);
+              if (siblingStyle.position !== 'static' || siblingStyle.visibility === 'hidden') continue;
+              const paint = parseColor(siblingStyle.backgroundColor);
+              if (!paint || paint.a < 1) continue;
+              const siblingRect = sibling.getBoundingClientRect();
+              if (siblingRect.width < 24 || siblingRect.height < 12 || !near(siblingRect) || !textIntersects(element, siblingRect)) continue;
+              if ((contrastRatio(foreground, paint) >= required) !== (direction === 'pass')) {
+                return {
+                  status: 'incomplete',
+                  message: 'This text is positioned over a coloured box that isn’t its DOM ancestor, so its real background is ambiguous — check contrast by eye.',
+                };
+              }
+            }
+          }
+        }
+      }
       return null;
     };
 

package/engine/rules/wcag/4.1.2-aria-allowed-attr.js

@@ -31,6 +31,7 @@
 // and was narrowed in 1.2 (narrowed again in the 1.3 draft). Markup written
 // against 1.1 is not conforming under 1.2, and a tool on the older baseline
 // stays silent on it. Neither reading is a bug; they are different editions.
+import { attributesOf } from '../../lib/dom.js';
 import { GLOBAL_ARIA, ROLE_ARIA, KNOWN_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // aria-label/labelledby misuse on generic elements has its own rule
@@ -50,7 +51,7 @@ export default {
     // Plain loop, no intermediate arrays: this runs on every element of the
     // page, and nearly all have no aria-* attributes at all.
     const ariaAttrs = [];
-    for (const { name } of element.attributes) {
+    for (const { name } of attributesOf(element)) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       // Unknown/misspelled attributes are aria-attr-valid's finding — judging

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -1,6 +1,7 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
 // ARIA 1.2 attribute names (shared vocabulary in lib/roles.js), and the
 // allowed values for enumerated ones.
+import { attributesOf } from '../../lib/dom.js';
 import { KNOWN_ARIA as KNOWN, GLOBAL_ARIA, ROLE_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // Note: "undefined" is a legal token for the tristate/undefinable attributes
@@ -64,7 +65,7 @@ export default {
     const invalid = [];
     const empty = [];
     let role;
-    for (const { name, value } of element.attributes) {
+    for (const { name, value } of attributesOf(element)) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       if (!KNOWN.has(attr)) {

package/engine/rules/wcag/4.1.2-valid-role.js

@@ -1,4 +1,5 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
+import { attributesOf } from '../../lib/dom.js';
 // Concrete, usable roles — abstract roles are invalid in markup.
 const VALID_ROLES = new Set([
   'alert', 'alertdialog', 'application', 'article', 'banner', 'blockquote', 'button',
@@ -95,7 +96,7 @@ export default {
     const genericFallback = tag === 'div' || tag === 'span' || tag === 'svg';
     const focusable = element.tabIndex >= 0
       || element.matches('a[href], button, input, select, textarea, summary');
-    const hasAriaProps = [...element.attributes].some(
+    const hasAriaProps = [...attributesOf(element)].some(
       (attr) => attr.name.startsWith('aria-') && attr.name !== 'aria-hidden');
     if (genericFallback && !focusable && !hasAriaProps) return { status: 'pass' };
     // The same two triggers decide for EVERY tag (2026-08-25 overnight

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.35.2",
+  "version": "1.35.4",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",