pour-engine 1.35.3 → 1.35.5

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.35.3',
+    version: '1.35.5',
   },
 };

package/engine/lib/dom.js

@@ -96,13 +96,25 @@ export function cssPath(element) {
   return path;
 }
 
+/** An element's attributes read through the prototype, not the instance:
+ *  a form whose control is named "attributes" shadows the property with
+ *  that control (byggmax.se, 2026-08-30), and the same goes for any named
+ *  form control. Anything that is not a NamedNodeMap is looked up on the
+ *  prototype the element was born with. */
+const attributesGetter = typeof Element !== 'undefined' ? Object.getOwnPropertyDescriptor(Element.prototype, 'attributes')?.get : null;
+export function attributesOf(element) {
+  const own = element.attributes;
+  if (own && typeof own.length === 'number' && typeof own.item === 'function') return own;
+  return attributesGetter ? attributesGetter.call(element) : [];
+}
+
 /** Element's opening markup (attributes) plus a snippet of its own text —
  *  enough to recognise it in a table. Built WITHOUT element.outerHTML, which
  *  serializes the whole subtree and turns audits quadratic on huge pages
  *  (container divs would each stringify most of the document). */
 export function htmlSnippet(element, maxLength = 300) {
   let html = `<${element.tagName.toLowerCase()}`;
-  for (const { name, value } of element.attributes) {
+  for (const { name, value } of attributesOf(element)) {
     if (html.length >= maxLength) break;
     html += ` ${name}="${value}"`;
   }

package/engine/rules/wcag/1.1.1-image-alt.js

@@ -1,10 +1,14 @@
 // WCAG SC 1.1.1 Non-text Content (Level A)
 // alt="" (exactly empty) is the CONFORMING decorative marker (H67) — it
 // hides the image from screen readers on purpose and passes. A
-// whitespace-only alt is neither a text alternative nor that marker:
-// assistive technology handles it inconsistently (some announce the file
-// name, some skip it) — that fails. Filename/generic alts technically
-// satisfy presence but tell the user nothing (F30/F39) — flagged for eyes.
+// whitespace-only alt is neither a text alternative nor that marker by the
+// letter of the spec, but the accessible name computes to empty and current
+// screen readers skip the image as if it were alt="", and a single space
+// was once a documented workaround for old JAWS reading the file name. Its
+// authorship is ambiguous rather than a proven barrier, so since 2026-09-01
+// it is flagged for eyes, not failed at critical alongside a missing alt.
+// Filename/generic alts technically satisfy presence but tell the user
+// nothing (F30/F39) — flagged for eyes.
 const FILENAME_ALT = /\.(png|jpe?g|gif|webp|svg|avif|bmp|ico)([?#].*)?$/i;
 const GENERIC_ALT = /^(image|img|photo|photograph|picture|graphic|icon|untitled|placeholder|spacer|\d+)$/i;
 
@@ -25,9 +29,8 @@ export default {
       if (alt === '') return { status: 'pass' };
       if (!alt.trim()) {
         return {
-          status: 'fail',
-          message: `alt="${alt}" is only whitespace — neither a text alternative nor the decorative marker (alt="" exactly); screen readers handle it unpredictably, some falling back to the file name.`,
-          fix: 'Use alt="" (nothing between the quotes) for decorative images, or write a real description.',
+          status: 'incomplete',
+          message: `alt="${alt}" is only whitespace — not a description, and not the decorative marker either (that is alt="" with nothing between the quotes). Screen readers skip it today, so check the image is really decorative; if it carries meaning, describe it, and either way use alt="".`,
         };
       }
       const trimmed = alt.trim();

package/engine/rules/wcag/1.4.12-text-spacing.js

@@ -4,7 +4,14 @@
 // The override is injected and removed inside one synchronous pass — the
 // engine only yields to the renderer between rules, so the page never
 // paints the probed state.
-const OVERRIDE = `* {
+// The probe reflows the whole page for a moment. Two guards keep that
+// invisible to the user: scroll anchoring is disabled while the override
+// is in (or Chrome re-anchors during the inflated layout and leaves the
+// page scrolled somewhere else when the probe lifts — measured at 884px
+// of drift on a long report page), and the window scroll is restored
+// after removal in case the browser clamped it anyway.
+const OVERRIDE = `html { overflow-anchor: none !important; }
+* {
   line-height: 1.5 !important;
   letter-spacing: 0.12em !important;
   word-spacing: 0.16em !important;
@@ -44,6 +51,9 @@ export default {
     if (!candidates.some(Boolean)) return elements.map(() => ({ status: 'pass' }));
 
     const before = candidates.map((element) => element && clipped(element));
+    const win = doc.defaultView;
+    const scrollX = win?.scrollX ?? 0;
+    const scrollY = win?.scrollY ?? 0;
     const probe = doc.createElement('style');
     probe.dataset.pourAudit = 'probe';
     probe.textContent = OVERRIDE;
@@ -55,6 +65,10 @@ export default {
       after = candidates.map((element) => element && clipped(element));
     } finally {
       probe.remove();
+      // The audit must never move the page: put the scroll back exactly
+      // where the user had it, after the removal's own reflow settles.
+      void doc.documentElement.offsetHeight;
+      if (win && (win.scrollX !== scrollX || win.scrollY !== scrollY)) win.scrollTo(scrollX, scrollY);
     }
 
     return elements.map((element, i) => {

package/engine/rules/wcag/4.1.2-aria-allowed-attr.js

@@ -31,6 +31,7 @@
 // and was narrowed in 1.2 (narrowed again in the 1.3 draft). Markup written
 // against 1.1 is not conforming under 1.2, and a tool on the older baseline
 // stays silent on it. Neither reading is a bug; they are different editions.
+import { attributesOf } from '../../lib/dom.js';
 import { GLOBAL_ARIA, ROLE_ARIA, KNOWN_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // aria-label/labelledby misuse on generic elements has its own rule
@@ -50,7 +51,7 @@ export default {
     // Plain loop, no intermediate arrays: this runs on every element of the
     // page, and nearly all have no aria-* attributes at all.
     const ariaAttrs = [];
-    for (const { name } of element.attributes) {
+    for (const { name } of attributesOf(element)) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       // Unknown/misspelled attributes are aria-attr-valid's finding — judging

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -1,6 +1,7 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
 // ARIA 1.2 attribute names (shared vocabulary in lib/roles.js), and the
 // allowed values for enumerated ones.
+import { attributesOf } from '../../lib/dom.js';
 import { KNOWN_ARIA as KNOWN, GLOBAL_ARIA, ROLE_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // Note: "undefined" is a legal token for the tristate/undefinable attributes
@@ -64,7 +65,7 @@ export default {
     const invalid = [];
     const empty = [];
     let role;
-    for (const { name, value } of element.attributes) {
+    for (const { name, value } of attributesOf(element)) {
       if (!name.startsWith('aria-')) continue;
       const attr = name.slice(5);
       if (!KNOWN.has(attr)) {

package/engine/rules/wcag/4.1.2-valid-role.js

@@ -1,4 +1,5 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
+import { attributesOf } from '../../lib/dom.js';
 // Concrete, usable roles — abstract roles are invalid in markup.
 const VALID_ROLES = new Set([
   'alert', 'alertdialog', 'application', 'article', 'banner', 'blockquote', 'button',
@@ -95,7 +96,7 @@ export default {
     const genericFallback = tag === 'div' || tag === 'span' || tag === 'svg';
     const focusable = element.tabIndex >= 0
       || element.matches('a[href], button, input, select, textarea, summary');
-    const hasAriaProps = [...element.attributes].some(
+    const hasAriaProps = [...attributesOf(element)].some(
       (attr) => attr.name.startsWith('aria-') && attr.name !== 'aria-hidden');
     if (genericFallback && !focusable && !hasAriaProps) return { status: 'pass' };
     // The same two triggers decide for EVERY tag (2026-08-25 overnight

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.35.3",
+  "version": "1.35.5",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",