shadscan-vue 0.1.2 → 0.2.1

package/dist/index.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { cac } from "cac";
 import { glob } from "tinyglobby";
 import { parse } from "@vue/compiler-sfc";
-import { NodeTypes } from "@vue/compiler-dom";
+import { ElementTypes, NodeTypes } from "@vue/compiler-dom";
 import ts from "typescript";
 import { parse as parse$1 } from "jsonc-parser";
 import pc from "picocolors";
@@ -736,6 +736,19 @@ const collectText = (children) => {
 };
 const visibleText = (element) => collectText(element.children).trim();
 /**
+* True when the element projects caller-supplied content through a `<slot>`.
+* The name then lives at the call site, so the component itself cannot be
+* judged nameless — `<a><slot /></a>` is a wrapper, not an anonymous link.
+*/
+const projectsSlotContent = (element) => {
+	for (const child of element.children) {
+		if (child.type !== NodeTypes.ELEMENT) continue;
+		if (child.tagType === ElementTypes.SLOT) return true;
+		if (projectsSlotContent(child)) return true;
+	}
+	return false;
+};
+/**
 * True when the element carries an explicit accessible name via ARIA,
 * a title, or visually-hidden text.
 */
@@ -771,6 +784,145 @@ const hasScreenReaderText = (element) => {
 };
 const elementChildren = (element) => element.children.filter((child) => child.type === NodeTypes.ELEMENT);
 //#endregion
+//#region src/rules/accessibility/custom-controls-have-labels.ts
+/**
+* Controls that render no intrinsic text, so a screen reader has nothing to
+* announce unless the author supplies a name. SelectTrigger is included rather
+* than Select because the trigger is the focusable control.
+*/
+const CUSTOM_CONTROL_TAGS = /* @__PURE__ */ new Set([
+	"checkbox",
+	"combobox",
+	"input-otp",
+	"radio-group",
+	"select-trigger",
+	"slider",
+	"switch",
+	"toggle"
+]);
+const LABEL_TAGS = /* @__PURE__ */ new Set([
+	"label",
+	"form-label",
+	"field-label"
+]);
+const isCustomControl = (tag) => CUSTOM_CONTROL_TAGS.has(pascalToKebab(tag));
+const customControlsHaveLabels = {
+	id: "custom-controls-have-labels",
+	title: "Custom controls have accessible labels",
+	description: "Controls such as Checkbox, Switch, Slider, and SelectTrigger render no text of their own, so each needs a label, an aria-label, or an aria-labelledby reference.",
+	category: "accessibility",
+	severity: "error",
+	confidence: "medium",
+	maxScore: 4,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const files = await sources();
+		const labelTargets = /* @__PURE__ */ new Map();
+		forEachElement$1(files, (element, file) => {
+			if (!LABEL_TAGS.has(pascalToKebab(element.tag))) return;
+			const target = findAttribute(element, "for")?.static;
+			if (target === void 0) return;
+			const targets = labelTargets.get(file.relPath) ?? /* @__PURE__ */ new Set();
+			targets.add(target);
+			labelTargets.set(file.relPath, targets);
+		});
+		const findings = [];
+		let evaluated = 0;
+		forEachElement$1(files, (element, file, ancestors) => {
+			if (!isCustomControl(element.tag) || isGeneratedUiPrimitive(file.relPath)) return;
+			evaluated += 1;
+			const id = findAttribute(element, "id")?.static;
+			const labelledByFor = id !== void 0 && labelTargets.get(file.relPath)?.has(id) === true;
+			const wrappedInLabel = ancestors.some((ancestor) => LABEL_TAGS.has(pascalToKebab(ancestor.tag)));
+			if (labelledByFor || wrappedInLabel || hasAriaName(element)) return;
+			findings.push({
+				message: `<${element.tag}> has no accessible name.`,
+				evidence: [{
+					path: file.relPath,
+					line: elementLine(element)
+				}],
+				remediation: "Associate a <Label for=\"…\"> with the control id, wrap the control in a label, or add aria-label / aria-labelledby."
+			});
+		});
+		if (evaluated === 0) return result.notApplicable();
+		return findings.length > 0 ? result.fail(findings) : result.pass();
+	}
+};
+//#endregion
+//#region src/rules/accessibility/dialog-focus-trap-works.ts
+const DIALOG_TAGS = /* @__PURE__ */ new Set([
+	"dialog",
+	"dialog-root",
+	"dialog-content",
+	"alert-dialog",
+	"alert-dialog-root",
+	"alert-dialog-content",
+	"drawer",
+	"drawer-content",
+	"sheet",
+	"sheet-content"
+]);
+const DIALOG_ROLES = /* @__PURE__ */ new Set(["dialog", "alertdialog"]);
+/**
+* reka-ui is the headless layer shadcn-vue is built on, so its dialog
+* primitives already own focus containment and restoration. Vaul-vue is the
+* drawer equivalent.
+*/
+const FOCUS_MANAGED_DEPENDENCIES = [
+	"reka-ui",
+	"radix-vue",
+	"vaul-vue",
+	"@headlessui/vue"
+];
+const isDialogTag = (tag) => DIALOG_TAGS.has(pascalToKebab(tag));
+const findDialogSurface = (files) => {
+	for (const file of files) {
+		if (file.sfc?.templateAst === void 0 || isGeneratedUiPrimitive(file.relPath)) continue;
+		let found;
+		walkTemplate(file.sfc.templateAst, (element) => {
+			if (found !== void 0) return;
+			const role = findAttribute(element, "role")?.static;
+			if (isDialogTag(element.tag) || role !== void 0 && DIALOG_ROLES.has(role)) found = elementLine(element);
+		});
+		if (found !== void 0) return {
+			file,
+			line: found
+		};
+	}
+};
+const dialogFocusTrapWorks = {
+	id: "dialog-focus-trap-works",
+	title: "Dialogs trap and restore focus",
+	description: "Looks for a focus-managed primitive behind dialog-like surfaces. Focus containment and restoration cannot be proven statically, so this reports what backs the dialog rather than scoring it.",
+	category: "accessibility",
+	severity: "warning",
+	confidence: "low",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, discovery, result }) => {
+		const files = await sources();
+		const surface = findDialogSurface(files);
+		if (surface === void 0) return result.notApplicable();
+		if (FOCUS_MANAGED_DEPENDENCIES.find((dependency) => discovery.dependencies[dependency] !== void 0) !== void 0) return result.pass();
+		return result.advisory([{
+			message: "A dialog surface was found with no focus-managed primitive behind it.",
+			evidence: [{
+				path: surface.file.relPath,
+				line: surface.line
+			}],
+			remediation: "Build the dialog on reka-ui (the layer shadcn-vue uses) or another focus-managed primitive, then verify initial focus, Tab containment, Escape, and focus return in a browser."
+		}]);
+	}
+};
+//#endregion
 //#region src/rules/accessibility/dialogs-have-accessible-names.ts
 /**
 * shadcn-vue dialog surfaces wrap reka-ui primitives. Both the shadcn wrapper
@@ -839,6 +991,130 @@ const dialogsHaveAccessibleNames = {
 	}
 };
 //#endregion
+//#region src/rules/accessibility/keyboard-navigation-works.ts
+const COMPOSITE_WIDGET_TAGS = /* @__PURE__ */ new Set([
+	"accordion",
+	"accordion-root",
+	"combobox",
+	"combobox-root",
+	"command",
+	"dropdown-menu",
+	"dropdown-menu-root",
+	"listbox",
+	"menu",
+	"menubar",
+	"navigation-menu",
+	"select",
+	"select-root",
+	"tabs",
+	"tabs-root",
+	"tree"
+]);
+const COMPOSITE_ROLES = /* @__PURE__ */ new Set([
+	"grid",
+	"listbox",
+	"menu",
+	"menubar",
+	"tablist",
+	"tree"
+]);
+const KEYBOARD_PRIMITIVE_DEPENDENCIES = [
+	"reka-ui",
+	"radix-vue",
+	"@headlessui/vue",
+	"@ariakit/vue",
+	"@zag-js/vue"
+];
+const isCompositeTag = (tag) => COMPOSITE_WIDGET_TAGS.has(pascalToKebab(tag));
+const findCompositeWidget = (files) => {
+	for (const file of files) {
+		if (file.sfc?.templateAst === void 0 || isGeneratedUiPrimitive(file.relPath)) continue;
+		let found;
+		walkTemplate(file.sfc.templateAst, (element) => {
+			if (found !== void 0) return;
+			const role = findAttribute(element, "role")?.static;
+			if (isCompositeTag(element.tag) || role !== void 0 && COMPOSITE_ROLES.has(role)) found = elementLine(element);
+		});
+		if (found !== void 0) return {
+			file,
+			line: found
+		};
+	}
+};
+const keyboardNavigationWorks = {
+	id: "keyboard-navigation-works",
+	title: "Composite widgets support keyboard navigation",
+	description: "Looks for a keyboard-aware primitive behind composite widgets such as menus, tabs, and listboxes. Arrow-key, Home/End, and focus behaviour cannot be proven statically, so this reports what backs the widget rather than scoring it.",
+	category: "accessibility",
+	severity: "warning",
+	confidence: "low",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, discovery, result }) => {
+		const files = await sources();
+		const widget = findCompositeWidget(files);
+		if (widget === void 0) return result.notApplicable();
+		if (Object.keys(discovery.dependencies).find((dependency) => dependency.startsWith("@zag-js/") || KEYBOARD_PRIMITIVE_DEPENDENCIES.includes(dependency)) !== void 0) return result.pass();
+		return result.advisory([{
+			message: "A composite widget was found with no keyboard-aware primitive behind it.",
+			evidence: [{
+				path: widget.file.relPath,
+				line: widget.line
+			}],
+			remediation: "Build composite widgets on reka-ui (the layer shadcn-vue uses), or implement and test the widget's arrow-key, Home/End, Enter, Escape, and focus behaviour."
+		}]);
+	}
+};
+//#endregion
+//#region src/rules/accessibility/status-messages-announced.ts
+/**
+* `error.statusMessage` is Nuxt's static field on a full-page error view, not
+* a status update pushed into an already-rendered page, so the leading
+* boundary excludes a property access.
+*/
+const DYNAMIC_STATUS_PATTERN = /(?<![.\w])(?:statusMessage|successMessage|errorMessage|progressMessage|setStatus|setMessage)\b|(?<![.\w])(?:pending|isPending|isLoading|loading)\s*\?/u;
+const ANNOUNCEMENT_PATTERN = /role\s*=\s*["'](?:status|alert)["']|aria-live\s*=|<(?:Toaster|ToastProvider|Sonner)\b|\btoast(?:\.|\s*\()/u;
+const lineOf$5 = (text, pattern) => {
+	const index = text.search(pattern);
+	if (index < 0) return 1;
+	return text.slice(0, index).split("\n").length;
+};
+const statusMessagesAnnounced = {
+	id: "status-messages-announced",
+	title: "Status messages are announced",
+	description: "Dynamic status messages should reach assistive technology through a live region or an accessible toast channel, otherwise a sighted user sees the update and a screen reader user does not.",
+	category: "accessibility",
+	severity: "warning",
+	confidence: "medium",
+	maxScore: 3,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const candidates = (await sources()).filter((file) => file.kind === "vue" && !isGeneratedUiPrimitive(file.relPath) && DYNAMIC_STATUS_PATTERN.test(file.text));
+		if (candidates.length === 0) return result.notApplicable();
+		const findings = [];
+		for (const file of candidates) {
+			if (ANNOUNCEMENT_PATTERN.test(file.text)) continue;
+			findings.push({
+				message: "A dynamic status message has no live region or accessible toast channel.",
+				evidence: [{
+					path: file.relPath,
+					line: lineOf$5(file.text, DYNAMIC_STATUS_PATTERN)
+				}],
+				remediation: "Render the update inside role=\"status\" or role=\"alert\" (or an aria-live region), or deliver it through a mounted toast provider."
+			});
+		}
+		return findings.length > 0 ? result.fail(findings) : result.pass();
+	}
+};
+//#endregion
 //#region src/rules/accessibility/heading-structure-sane.ts
 const HEADING_TAG = /^h([1-6])$/u;
 const isRoutableSurface = (relPath) => relPath.startsWith("pages/") || relPath.startsWith("app/pages/") || relPath.startsWith("src/views/") || relPath.startsWith("layouts/") || relPath.startsWith("app/layouts/") || relPath === "app.vue" || relPath === "app/app.vue" || relPath === "App.vue" || relPath === "src/App.vue";
@@ -971,7 +1247,7 @@ const iconButtonsHaveLabels = {
 			const children = elementChildren(element);
 			if (!(children.length > 0 && children.every((child) => isIconTag$1(child.tag)) || findAttribute(element, "size")?.static === "icon")) return;
 			if (visibleText(element).length > 0) return;
-			if (hasAriaName(element) || hasScreenReaderText(element)) return;
+			if (hasAriaName(element) || hasScreenReaderText(element) || projectsSlotContent(element)) return;
 			findings.push({
 				message: `Icon-only <${element.tag}> has no accessible name.`,
 				evidence: [{
@@ -1176,7 +1452,7 @@ const linksHaveAccessibleNames = {
 			if (!LINK_TAGS$2.has(element.tag)) return;
 			if (visibleText(element).length > 0) return;
 			if (hasAriaName(element) || hasScreenReaderText(element)) return;
-			if (hasLabelledImage(element)) return;
+			if (hasLabelledImage(element) || projectsSlotContent(element)) return;
 			findings.push({
 				message: `<${element.tag}> has no accessible name.`,
 				evidence: [{
@@ -1948,7 +2224,7 @@ const FOCUS_REPLACEMENT_CLASS_PATTERN = /\bfocus(?:-visible)?:(?:ring|outline|bo
 const isExcludedPath = (relPath) => /(?:^|\/)components\/ui\//u.test(relPath);
 const CSS_OUTLINE_NONE_PATTERN = /outline\s*:\s*none/giu;
 const FOCUS_VISIBLE_RULE_PATTERN = /:focus(?:-visible)?\b[^{]*\{[^}]*(?:outline|box-shadow|border|ring)[^}]*\}/u;
-const lineOf$1 = (text, index) => text.slice(0, index).split("\n").length;
+const lineOf$4 = (text, index) => text.slice(0, index).split("\n").length;
 const scanTemplate = (file) => {
 	if (file.kind !== "vue" || file.sfc?.templateAst === void 0) return [];
 	const findings = [];
@@ -1976,7 +2252,7 @@ const scanStyle = (style) => {
 			message: `A CSS rule in ${style.relPath} sets \`outline: none\` without a visible :focus-visible replacement.`,
 			evidence: [{
 				path: style.relPath,
-				line: lineOf$1(style.text, match.index)
+				line: lineOf$4(style.text, match.index)
 			}],
 			remediation: "Add a `:focus-visible` rule that restores a visible outline, box-shadow, or border."
 		});
@@ -2029,7 +2305,7 @@ const TYPING_GUARD_PATTERN$1 = /\b(?:INPUT|TEXTAREA|SELECT)\b|isContentEditable|
 const PRINTABLE_SINGLE_KEY_PATTERN = /\.key\s*===\s*['"][a-z0-9]['"]/iu;
 const MODIFIER_PATTERN = /metaKey|ctrlKey|altKey/u;
 const isSourceFile$1 = (file) => file.kind === "vue" || file.kind === "ts" || file.kind === "js";
-const lineOf = (text, index) => text.slice(0, index).split("\n").length;
+const lineOf$3 = (text, index) => text.slice(0, index).split("\n").length;
 const globalHotkeysAreSafe = {
 	id: "global-hotkeys-are-safe",
 	title: "Global keyboard shortcuts are registered safely",
@@ -2055,7 +2331,7 @@ const globalHotkeysAreSafe = {
 				message: `A global keydown listener in ${file.relPath} is never removed, leaking across unmounts.`,
 				evidence: [{
 					path: file.relPath,
-					line: lineOf(text, matches[0].index)
+					line: lineOf$3(text, matches[0].index)
 				}],
 				remediation: "Remove the listener in onUnmounted/onBeforeUnmount, or use VueUse `useEventListener`/`onKeyStroke` which clean up automatically."
 			});
@@ -2063,7 +2339,7 @@ const globalHotkeysAreSafe = {
 				message: `A bare printable single-key shortcut in ${file.relPath} has no typing-target guard.`,
 				evidence: [{
 					path: file.relPath,
-					line: lineOf(text, matches[0].index)
+					line: lineOf$3(text, matches[0].index)
 				}],
 				remediation: "Guard the handler so it ignores events whose target is an INPUT, TEXTAREA, SELECT, or contenteditable element, or gate the shortcut behind a modifier key."
 			});
@@ -2303,6 +2579,72 @@ const themeHotkeyPresent = {
 	}
 };
 //#endregion
+//#region src/rules/interaction/typing-target-guard.ts
+const GLOBAL_KEY_BINDING = /addEventListener\s*\(\s*['"]keydown['"]|onKeyStroke\s*\(|useEventListener\s*\([^,]*,\s*['"]keydown['"]/u;
+const MAGIC_KEYS_SINGLE_LETTER = /\{\s*[^}]*\b(?<!meta_)(?<!ctrl_)(?<!alt_)(?<!shift_)[a-z]\b[^}]*\}\s*=\s*useMagicKeys/u;
+/**
+* A shortcut that fires while the user is typing steals the keystroke. The
+* guard is a check that the event target is not a field: tagName against
+* INPUT/TEXTAREA/SELECT, an instanceof against the matching element type, a
+* closest()/matches() selector, or isContentEditable.
+*/
+const TYPING_GUARD = /\b(?:INPUT|TEXTAREA|SELECT)\b|HTML(?:Input|TextArea|Select)Element|(?:closest|matches)\s*\(\s*['"][^'"]*(?:input|textarea|select)|isContentEditable|contenteditable/iu;
+const MODIFIER = /metaKey|ctrlKey|altKey|\b(?:meta|ctrl|alt)_/u;
+/**
+* Escape, Enter, Tab and the arrows are expected to work while a field has
+* focus — Escape closing a dialog is correct behaviour, not a stolen
+* keystroke. A handler that only reacts to those needs no typing guard.
+*/
+const NAVIGATION_KEYS = /^(?:Escape|Enter|Tab|Arrow[A-Za-z]+|Home|End|Page[A-Za-z]+)$/u;
+const reactsOnlyToNavigationKeys = (text) => {
+	const compared = [...text.matchAll(/\.key\s*===\s*['"]([^'"]+)['"]/gu)].map((match) => match[1]);
+	return compared.length > 0 && compared.every((key) => NAVIGATION_KEYS.test(key));
+};
+const lineOf$2 = (text, pattern) => {
+	const index = text.search(pattern);
+	if (index < 0) return 1;
+	return text.slice(0, index).split("\n").length;
+};
+const typingTargetGuard = {
+	id: "typing-target-guard",
+	title: "Global shortcuts ignore keystrokes aimed at a field",
+	description: "A global single-key shortcut should not fire while the user is typing. Handlers bound to the document need a check that the event target is not an input, textarea, select, or contenteditable element.",
+	category: "interaction",
+	severity: "warning",
+	confidence: "medium",
+	maxScore: 3,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const files = await sources();
+		const findings = [];
+		let evaluated = 0;
+		for (const file of files) {
+			if (file.kind !== "vue" && file.kind !== "ts" && file.kind !== "js") continue;
+			const bindsGlobalKey = GLOBAL_KEY_BINDING.test(file.text);
+			const bindsBareLetter = MAGIC_KEYS_SINGLE_LETTER.test(file.text);
+			if (!bindsGlobalKey && !bindsBareLetter) continue;
+			if (!bindsBareLetter && MODIFIER.test(file.text) && !GLOBAL_KEY_BINDING.test(file.text)) continue;
+			if (reactsOnlyToNavigationKeys(file.text)) continue;
+			evaluated += 1;
+			if (TYPING_GUARD.test(file.text)) continue;
+			findings.push({
+				message: "A global key handler has no guard for keystrokes aimed at a field.",
+				evidence: [{
+					path: file.relPath,
+					line: lineOf$2(file.text, bindsGlobalKey ? GLOBAL_KEY_BINDING : MAGIC_KEYS_SINGLE_LETTER)
+				}],
+				remediation: "Return early when the event target is an input, textarea, select, or contenteditable element before acting on the key."
+			});
+		}
+		if (evaluated === 0) return result.notApplicable();
+		return findings.length > 0 ? result.fail(findings) : result.pass();
+	}
+};
+//#endregion
 //#region src/rules/forms/forms-shared.ts
 const VALIDATION_PACKAGES = [
 	"vee-validate",
@@ -2559,6 +2901,68 @@ const groupedControlsHaveLegend = {
 	}
 };
 //#endregion
+//#region src/rules/forms/input-group-composition.ts
+const INPUT_GROUP_TAG = "input-group";
+const GROUP_PARTS = /* @__PURE__ */ new Set([
+	"input-group-input",
+	"input-group-textarea",
+	"input-group-addon"
+]);
+const RAW_CONTROLS = /* @__PURE__ */ new Set(["input", "textarea"]);
+const inputGroupComposition = {
+	id: "input-group-composition",
+	title: "InputGroup uses its own parts",
+	description: "An InputGroup wired with a raw input or textarea loses the padding, focus ring, and addon alignment its own parts provide, so the group renders correctly only by accident.",
+	category: "forms",
+	severity: "warning",
+	confidence: "medium",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const files = await sources();
+		const findings = [];
+		let instances = 0;
+		for (const file of files) {
+			if (file.sfc?.templateAst === void 0 || isGeneratedUiPrimitive(file.relPath)) continue;
+			const groups = /* @__PURE__ */ new Map();
+			walkTemplate(file.sfc.templateAst, (element, ancestors) => {
+				const tag = pascalToKebab(element.tag);
+				if (tag === INPUT_GROUP_TAG) {
+					groups.set(element, {
+						line: elementLine(element),
+						usesParts: false
+					});
+					return;
+				}
+				const owner = ancestors.find((ancestor) => pascalToKebab(ancestor.tag) === INPUT_GROUP_TAG);
+				if (owner === void 0) return;
+				const entry = groups.get(owner);
+				if (entry === void 0) return;
+				if (GROUP_PARTS.has(tag)) {
+					entry.usesParts = true;
+					return;
+				}
+				if (RAW_CONTROLS.has(tag)) entry.rawControl ??= tag;
+			});
+			instances += groups.size;
+			for (const entry of groups.values()) if (entry.rawControl !== void 0 && !entry.usesParts) findings.push({
+				message: `<InputGroup> wraps a raw <${entry.rawControl}> instead of its own part.`,
+				evidence: [{
+					path: file.relPath,
+					line: entry.line
+				}],
+				remediation: "Use InputGroupInput or InputGroupTextarea inside InputGroup, with InputGroupAddon for leading and trailing content."
+			});
+		}
+		if (instances === 0) return result.notApplicable();
+		return findings.length > 0 ? result.advisory(findings) : result.pass();
+	}
+};
+//#endregion
 //#region src/rules/forms/invalid-fields-associated-with-errors.ts
 const ERROR_COMPONENT = /^(?:form-message|error-message|field-error)$/u;
 const isFormControlWrapper = (tag) => pascalToKebab(tag) === "form-control";
@@ -3114,6 +3518,119 @@ const toastProviderPresent = {
 	}
 };
 //#endregion
+//#region src/rules/states/toast-runtime.ts
+const TOAST_CALL = /\btoast(?:\.(?:success|error|info|warning|promise|custom|message))?\s*\(/u;
+/**
+* The Vue toast runtimes shadcn-vue projects use. vue-sonner is what
+* shadcn-vue's own Sonner block installs; the others cover the common
+* alternatives.
+*/
+const TOAST_DEPENDENCIES = [
+	"vue-sonner",
+	"sonner",
+	"@nuxt/ui",
+	"vue-toastification",
+	"vue3-toastify",
+	"primevue"
+];
+const lineOf$1 = (text, pattern) => {
+	const index = text.search(pattern);
+	if (index < 0) return 1;
+	return text.slice(0, index).split("\n").length;
+};
+const toastRuntime = {
+	id: "toast-runtime",
+	title: "Toast calls have a runtime behind them",
+	description: "Code that calls toast() needs a toast library installed, otherwise the call resolves to nothing at runtime and the notification silently never appears.",
+	category: "states",
+	severity: "error",
+	confidence: "high",
+	maxScore: 3,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, discovery, result }) => {
+		const caller = (await sources()).find((file) => !isGeneratedUiPrimitive(file.relPath) && TOAST_CALL.test(file.text));
+		if (caller === void 0) return result.notApplicable();
+		if (TOAST_DEPENDENCIES.find((dependency) => discovery.dependencies[dependency] !== void 0) !== void 0) return result.pass();
+		return result.fail([{
+			message: "toast() is called but no toast runtime is installed.",
+			evidence: [{
+				path: caller.relPath,
+				line: lineOf$1(caller.text, TOAST_CALL)
+			}],
+			remediation: "Install a toast runtime (shadcn-vue ships the Sonner block backed by vue-sonner) and mount its provider in the app shell."
+		}]);
+	}
+};
+//#endregion
+//#region src/rules/production-polish/alert-anatomy.ts
+const ALERT_TAG = "alert";
+const ALERT_TITLE_TAG = "alert-title";
+const ALERT_DESCRIPTION_TAG = "alert-description";
+const ICON_TAG$1 = /(?:^|-)icon$/u;
+const isIcon = (tag) => {
+	const normalized = pascalToKebab(tag);
+	return ICON_TAG$1.test(normalized) || normalized === "svg";
+};
+const alertAnatomy = {
+	id: "alert-anatomy",
+	title: "Alert matches its anatomy",
+	description: "An Alert should carry an AlertTitle and at most one icon. A title-less alert announces as an unlabelled region, and a second icon competes with the first for meaning.",
+	category: "production-polish",
+	severity: "warning",
+	confidence: "medium",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const files = await sources();
+		const findings = [];
+		let instances = 0;
+		for (const file of files) {
+			if (file.sfc?.templateAst === void 0 || isGeneratedUiPrimitive(file.relPath)) continue;
+			const alerts = /* @__PURE__ */ new Map();
+			walkTemplate(file.sfc.templateAst, (element, ancestors) => {
+				if (pascalToKebab(element.tag) === ALERT_TAG) {
+					alerts.set(element, {
+						line: elementLine(element),
+						titles: 0,
+						icons: 0
+					});
+					return;
+				}
+				const owner = ancestors.find((ancestor) => pascalToKebab(ancestor.tag) === ALERT_TAG);
+				if (owner === void 0) return;
+				const entry = alerts.get(owner);
+				if (entry === void 0) return;
+				if (pascalToKebab(element.tag) === ALERT_TITLE_TAG) entry.titles += 1;
+				if (isIcon(element.tag)) entry.icons += 1;
+			});
+			instances += alerts.size;
+			for (const entry of alerts.values()) {
+				const problems = [];
+				if (entry.titles === 0) problems.push("no AlertTitle");
+				if (entry.icons > 1) problems.push(`${entry.icons} icons`);
+				if (problems.length > 0) findings.push({
+					message: `<Alert> has ${problems.join(" and ")}.`,
+					evidence: [{
+						path: file.relPath,
+						line: entry.line
+					}],
+					remediation: `Compose Alert from its parts: one AlertTitle, an optional ${ALERT_DESCRIPTION_TAG.replace("-", "")}, and at most one leading icon.`
+				});
+			}
+		}
+		if (instances === 0) return result.notApplicable();
+		return findings.length > 0 ? result.advisory(findings) : result.pass();
+	}
+};
+//#endregion
 //#region src/rules/production-polish/polish-shared.ts
 const SHELL_FILES = /* @__PURE__ */ new Set([
 	"app.vue",
@@ -3242,10 +3759,67 @@ const buttonIconsHaveDataIcon = {
 	}
 };
 //#endregion
+//#region src/rules/production-polish/color-contrast-passes.ts
+const COLOR_STYLE_PATTERN = /(?:color|background(?:-color)?|border-color|fill|stroke)\s*:|\b(?:bg|border|fill|stroke|text)-(?:accent|background|card|destructive|foreground|input|muted|popover|primary|ring|secondary|[a-z]+-\d{2,3})\b|#[\da-f]{3,8}\b|(?:hsl|oklch|rgb)a?\s*\(/iu;
+const lineOf = (text, pattern) => {
+	const index = text.search(pattern);
+	if (index < 0) return 1;
+	return text.slice(0, index).split("\n").length;
+};
+const colorContrastPasses = {
+	id: "color-contrast-passes",
+	title: "Rendered colour contrast meets accessibility thresholds",
+	description: "Marks styled colour pairs for browser verification. Computed contrast depends on cascade, theme, and opacity, none of which can be resolved from source, so this reports where to look rather than scoring it.",
+	category: "production-polish",
+	severity: "warning",
+	confidence: "low",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const styled = (await sources()).find((file) => !isGeneratedUiPrimitive(file.relPath) && COLOR_STYLE_PATTERN.test(file.text));
+		if (styled === void 0) return result.notApplicable();
+		return result.advisory([{
+			message: "Colour styling is present, but computed foreground and background contrast cannot be established from source.",
+			evidence: [{
+				path: styled.relPath,
+				line: lineOf(styled.text, COLOR_STYLE_PATTERN)
+			}],
+			remediation: "Check rendered states in every theme and viewport: 4.5:1 for body text, 3:1 for large text, and 3:1 for meaningful UI graphics and boundaries."
+		}]);
+	}
+};
+//#endregion
 //#region src/rules/production-polish/metadata-title-description-complete.ts
 const TITLE_PATTERN = /\b(?:title|titleTemplate)\s*:/u;
 const DESCRIPTION_PATTERN = /\bdescription\s*:/u;
 const HEAD_CALL_PATTERN = /\b(?:useSeoMeta|useHead)\s*\(/u;
+const COMPOSABLE_PATH = /(?:^|\/)composables\//u;
+const EXPORTED_COMPOSABLE = /export\s+(?:const|function|async\s+function)\s+(use[A-Z]\w*)/gu;
+/**
+* A page that redirects during setup never renders, so a crawler follows the
+* redirect and reads the destination's metadata instead. Demanding a title and
+* description for it reports a failure with nothing to fix.
+*/
+const REDIRECT_ONLY = /await\s+navigateTo\s*\(|definePageMeta\s*\(\s*\{[^}]*\bredirect\s*:/su;
+/**
+* Extracting the head call into a `usePageSeo`-style composable is the
+* documented Nuxt pattern, so a page that calls one of those wrappers has
+* declared its metadata just as surely as one calling useSeoMeta inline.
+* Collect every project composable that reaches a head call, then treat a call
+* to it as a metadata declaration.
+*/
+const seoComposableNames = (files) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		if (!COMPOSABLE_PATH.test(file.relPath) || !HEAD_CALL_PATTERN.test(file.text)) continue;
+		for (const match of file.text.matchAll(EXPORTED_COMPOSABLE)) names.add(match[1]);
+	}
+	return names;
+};
 const metadataTitleDescriptionComplete = {
 	id: "metadata-title-description-complete",
 	title: "Routable pages declare a title and description",
@@ -3260,11 +3834,15 @@ const metadataTitleDescriptionComplete = {
 		"generic-vue"
 	],
 	run: async ({ sources, result }) => {
-		const pages = (await sources()).filter((file) => file.kind === "vue" && isPageFile(file.relPath));
+		const files = await sources();
+		const pages = files.filter((file) => file.kind === "vue" && isPageFile(file.relPath));
 		if (pages.length === 0) return result.notApplicable();
+		const wrappers = seoComposableNames(files);
+		const wrapperCall = wrappers.size > 0 ? new RegExp(`\\b(?:${[...wrappers].join("|")})\\s*\\(`, "u") : void 0;
 		const findings = [];
 		for (const page of pages) {
-			if (!HEAD_CALL_PATTERN.test(page.text)) {
+			if (REDIRECT_ONLY.test(page.text)) continue;
+			if (!(HEAD_CALL_PATTERN.test(page.text) || wrapperCall?.test(page.text) === true)) {
 				findings.push({
 					message: "Page does not declare its own metadata.",
 					evidence: [{ path: page.relPath }],
@@ -3560,6 +4138,72 @@ const responsiveShellPresent = {
 	}
 };
 //#endregion
+//#region src/rules/production-polish/responsive-visibility.ts
+/**
+* `hidden md:block` shows an element from the md breakpoint up. A sibling that
+* is `md:hidden` covers the smaller range. When only one half of the pair
+* exists on a surface, one viewport range renders nothing at all.
+*/
+const HIDE_AT_BREAKPOINT = /\b(?:sm|md|lg|xl|2xl):hidden\b/u;
+const SHOW_FROM_BREAKPOINT = /\bhidden\b[^"']*\b(?:sm|md|lg|xl|2xl):(?:block|flex|grid|inline)/u;
+const classOf = (element) => {
+	const values = [];
+	for (const prop of element.props) {
+		const candidate = prop;
+		if (candidate.name === "class" && typeof candidate.value?.content === "string") values.push(candidate.value.content);
+	}
+	return values.join(" ");
+};
+const responsiveVisibility = {
+	id: "responsive-visibility",
+	title: "Responsive show and hide pairs cover every viewport",
+	description: "A surface that hides an element at a breakpoint should present the alternative at the complementary range, otherwise one viewport shows nothing where content is expected.",
+	category: "production-polish",
+	severity: "warning",
+	confidence: "low",
+	maxScore: 0,
+	adapters: [
+		"nuxt",
+		"vite-vue",
+		"generic-vue"
+	],
+	run: async ({ sources, result }) => {
+		const files = await sources();
+		const findings = [];
+		let evaluated = 0;
+		for (const file of files) {
+			if (file.sfc?.templateAst === void 0 || isGeneratedUiPrimitive(file.relPath)) continue;
+			let hides = 0;
+			let shows = 0;
+			let firstHideLine;
+			walkTemplate(file.sfc.templateAst, (element) => {
+				const classes = classOf(element);
+				if (classes === "") return;
+				if (SHOW_FROM_BREAKPOINT.test(classes)) {
+					shows += 1;
+					return;
+				}
+				if (HIDE_AT_BREAKPOINT.test(classes)) {
+					hides += 1;
+					firstHideLine ??= elementLine(element);
+				}
+			});
+			if (hides === 0 && shows === 0) continue;
+			evaluated += 1;
+			if (hides > 0 && shows === 0) findings.push({
+				message: "This surface hides content at a breakpoint without a counterpart shown at the complementary range.",
+				evidence: [{
+					path: file.relPath,
+					line: firstHideLine ?? 1
+				}],
+				remediation: "Pair each breakpoint-hidden element with the alternative for the other range (for example `md:hidden` beside `hidden md:block`), or confirm the omission is deliberate."
+			});
+		}
+		if (evaluated === 0) return result.notApplicable();
+		return findings.length > 0 ? result.advisory(findings) : result.pass();
+	}
+};
+//#endregion
 //#region src/rules/production-polish/social-preview-present.ts
 const OG_IMAGE_PATTERN = /(?:og:image|ogImage|twitter:image|twitterImage)/u;
 const OG_TITLE_PATTERN = /(?:og:title|ogTitle|twitter:title|twitterCard|twitter:card)/u;
@@ -3588,8 +4232,10 @@ const defaultRules = [
 	focusVisibleNotSuppressed,
 	itemsBelongToGroups,
 	destructiveActionsConfirmed,
+	typingTargetGuard,
 	toastProviderPresent,
 	toastProviderMounted,
+	toastRuntime,
 	routeLoadingBoundaryPresent,
 	suspenseFallbackUseful,
 	emptyStatePresent,
@@ -3607,6 +4253,10 @@ const defaultRules = [
 	iframesHaveTitle,
 	interactiveElementsAreSemantic,
 	noNestedInteractiveControls,
+	customControlsHaveLabels,
+	statusMessagesAnnounced,
+	dialogFocusTrapWorks,
+	keyboardNavigationWorks,
 	formsHaveLabels,
 	fieldErrorsRendered,
 	invalidFieldsAssociatedWithErrors,
@@ -3614,6 +4264,7 @@ const defaultRules = [
 	groupedControlsHaveLegend,
 	personalDataAutocompletePresent,
 	validationWiredToForm,
+	inputGroupComposition,
 	noStarterCopy,
 	metadataTitleDescriptionComplete,
 	{
@@ -3649,7 +4300,10 @@ const defaultRules = [
 	mobileOverflowAbsent,
 	animationsRespectReducedMotion,
 	pointerTargetSizePasses,
-	buttonIconsHaveDataIcon
+	buttonIconsHaveDataIcon,
+	alertAnatomy,
+	responsiveVisibility,
+	colorContrastPasses
 ];
 //#endregion
 //#region src/scan.ts