ultra11y 2.22.0

package/src/rules/mandatory.ts

@@ -0,0 +1,173 @@
+// Theme 8 — Mandatory elements (the statically-checkable slice).
+import type { Doc, El, HNode } from "../parse/html.js";
+import { attr, hasAttr, visibleText, allIds, elementsByTag } from "../parse/html.js";
+import { isDisplayHidden } from "../name.js";
+import { type Rule, type RuleFinding, shellHeadInjected } from "./rule.js";
+
+// Next.js App Router sets the document <title> via `export const metadata = { title }`
+// or `generateMetadata`, not a literal <title> in JSX — invisible to source analysis.
+// When that API is present in a JSX/TSX file, the title is managed by the framework, so
+// title-missing-empty must not assert a (false) non-conformity.
+const NEXT_METADATA = /export\s+(const\s+metadata\b|(async\s+)?function\s+generateMetadata\b)/;
+function titleSetByFramework(doc: Doc): boolean {
+  if (doc.kind === "html") return false;
+  return NEXT_METADATA.test(doc.source) && /\btitle\s*:/.test(doc.source);
+}
+
+const htmlLangMissing: Rule = {
+  id: "html-lang-missing",
+  criteria: ["3.1.1"],
+  severity: "bloquant",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    const html = elementsByTag(doc, "html")[0];
+    if (!html) return [];
+    const lang = (attr(html, "lang") ?? attr(html, "xml:lang") ?? "").trim();
+    if (lang) return [];
+    return [
+      {
+        criteriaId: "3.1.1",
+        el: html,
+        msgId: "html-lang-missing",
+      },
+    ];
+  },
+};
+
+const titleMissingEmpty: Rule = {
+  id: "title-missing-empty",
+  criteria: ["2.4.2"],
+  severity: "bloquant",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    const titles = elementsByTag(doc, "title");
+    const hasNonEmpty = titles.some((t) => visibleText(t).length > 0);
+    if (hasNonEmpty) return [];
+    // <title> injected by the Next.js metadata API, or by a framework shell placeholder
+    // in <head> (e.g. SvelteKit `%sveltekit.head%`, `<%= title %>`).
+    if (titleSetByFramework(doc) || shellHeadInjected(doc)) return [];
+    const anchor: El | undefined = elementsByTag(doc, "head")[0] ?? elementsByTag(doc, "html")[0] ?? doc.elements[0];
+    if (!anchor) return [];
+    return [
+      {
+        criteriaId: "2.4.2",
+        el: anchor,
+        msgId: "title-missing-empty",
+        params: { titleState: titles.length ? "empty" : "absent" },
+      },
+    ];
+  },
+};
+
+// Two elements are mutually exclusive at runtime when their JSX conditional-arm paths
+// (tagged by the parser: "/c0T" vs "/c0F" for a ternary's two arms, "/c1R" for the
+// right operand of an && / ||) first diverge INSIDE THE SAME conditional — only one of
+// the two arms is ever rendered. Independent conditionals ("/c0R" vs "/c1R") and any
+// unconditional element (no arm) can co-render, so they are NOT exclusive. HTML/SFC docs
+// never set branchArm, so this always returns false there (behaviour unchanged).
+function armsExclusive(a: string | undefined, b: string | undefined): boolean {
+  if (!a || !b) return false;
+  const sa = a.split("/").filter(Boolean);
+  const sb = b.split("/").filter(Boolean);
+  const n = Math.min(sa.length, sb.length);
+  for (let i = 0; i < n; i++) {
+    if (sa[i] === sb[i]) continue;
+    const ca = /^c(\d+)/.exec(sa[i]!)?.[1];
+    const cb = /^c(\d+)/.exec(sb[i]!)?.[1];
+    return ca !== undefined && ca === cb; // same conditional, different arm → exclusive
+  }
+  return false; // one path is a prefix of the other → they can co-render
+}
+
+const duplicateId: Rule = {
+  id: "duplicate-id",
+  criteria: ["4.1.2"],
+  severity: "majeur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    const byId = new Map<string, El[]>();
+    for (const { id, el } of allIds(doc)) {
+      if (id.includes("{")) continue; // dynamic id (id={`x-${i}`}/id="x-{id}") — unique per instance at runtime
+      const prior = byId.get(id);
+      if (!prior) {
+        byId.set(id, [el]);
+        continue;
+      }
+      // A real collision only when this element can co-render with an earlier one of the
+      // same id. Ids reused across mutually-exclusive JSX conditional arms never coexist.
+      if (prior.some((p) => !armsExclusive(p.branchArm, el.branchArm))) {
+        out.push({ criteriaId: "4.1.2", el, msgId: "duplicate-id", params: { id } });
+      }
+      prior.push(el);
+    }
+    return out;
+  },
+};
+
+const inlineLangChangeMissing: Rule = {
+  id: "inline-lang-change-missing",
+  criteria: ["3.1.2"],
+  severity: "mineur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (el.tag === "html") continue;
+      if (!hasAttr(el, "lang")) continue;
+      if ((attr(el, "lang") ?? "").trim() === "") {
+        out.push({
+          criteriaId: "3.1.2",
+          el,
+          msgId: "inline-lang-change-missing",
+          params: { tag: el.tag },
+        });
+      }
+    }
+    return out;
+  },
+};
+
+// BCP47 primary subtag + optional subtags (syntactic validity only). The primary
+// subtag is a 2-3 alpha language code, OR the `x`/`i` singleton that starts a
+// private-use (`x-klingon`) or grandfathered (`i-navajo`) tag — those legitimate
+// singletons must not be flagged invalid (the old /^[A-Za-z]{2,3}…/ rejected them).
+const BCP47 = /^([A-Za-z]{2,3}|[xXiI])(-[A-Za-z0-9]{1,8})*$/;
+
+/** Does this element govern any rendered text of its own — text that is neither hidden nor
+ *  re-declared by a descendant's own `lang`? */
+function governsText(el: El): boolean {
+  const walk = (n: HNode): boolean => {
+    if (n.type === "text") return n.data.trim() !== "";
+    if (hasAttr(n, "lang")) return false; // the descendant declares its own language
+    if (isDisplayHidden(n)) return false;
+    return n.children.some(walk);
+  };
+  return el.children.some(walk);
+}
+
+const langInvalid: Rule = {
+  id: "lang-invalid",
+  criteria: ["3.1.1", "3.1.2"],
+  severity: "mineur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      const lang = (attr(el, "lang") ?? "").trim();
+      if (!lang) continue; // empty handled by inline-lang-change-missing / html-lang-missing
+      if (BCP47.test(lang)) continue;
+      // A malformed `lang` only misdeclares something if it actually GOVERNS text. On
+      // <html> that is the whole document; elsewhere, text sitting under a descendant with
+      // its own `lang`, or inside a hidden subtree, is not governed by this attribute — and
+      // an element governing no text at all declares a language for nobody.
+      if (el.tag !== "html" && !governsText(el)) continue;
+      out.push({
+        criteriaId: el.tag === "html" ? "3.1.1" : "3.1.2",
+        el,
+        msgId: "lang-invalid",
+        params: { lang, tag: el.tag },
+      });
+    }
+    return out;
+  },
+};
+
+export const mandatoryRules: Rule[] = [htmlLangMissing, titleMissingEmpty, duplicateId, inlineLangChangeMissing, langInvalid];

package/src/rules/multimedia.ts

@@ -0,0 +1,77 @@
+// Theme 4 / 13 — Auto-starting media + missing captions track (statically-checkable slice).
+import type { Doc, El } from "../parse/html.js";
+import { attr, hasAttr, descendants } from "../parse/html.js";
+import type { Rule, RuleFinding } from "./rule.js";
+
+// `muted` is statically TRUE only as a bare boolean attr, a literal "muted"/"true", or the
+// JSX literal `{true}`. A JSX expression like `muted={isMuted}` or `muted={false}` is NOT
+// statically muted — an audit must not assume silence from it (avoids a captions false
+// negative on a sound-bearing video).
+function mutedStatically(el: El): boolean {
+  if (!hasAttr(el, "muted")) return false;
+  const v = (attr(el, "muted") ?? "").trim().toLowerCase();
+  return v === "" || v === "muted" || v === "true" || v === "{true}";
+}
+
+const autoplayMedia: Rule = {
+  id: "autoplay-media",
+  criteria: ["1.4.2", "2.2.2"],
+  severity: "majeur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (el.tag !== "audio" && el.tag !== "video") continue;
+      if (!hasAttr(el, "autoplay")) continue;
+      // `controls` IS the mechanism 1.4.2 asks for (pause/stop/volume), so autoplay with
+      // native controls conforms — reporting it would be inventing a non-conformity.
+      if (hasAttr(el, "controls")) continue;
+      // muted video has no sound → it falls under moving content (13.8), audio always 4.10.
+      // Whether the movement lasts the 5 seconds 2.2.2 requires is not knowable from the
+      // source, so this is a recommendation to check, never an asserted failure.
+      if (el.tag === "video" && mutedStatically(el)) {
+        out.push({
+          criteriaId: "2.2.2",
+          el,
+          msgId: "autoplay-media.muted-video",
+          advisory: true,
+        });
+        continue;
+      }
+      out.push({
+        criteriaId: el.tag === "audio" ? "1.4.2" : "2.2.2",
+        el,
+        msgId: "autoplay-media.audible",
+        params: { tag: el.tag },
+      });
+    }
+    return out;
+  },
+};
+
+// A <video> that carries audio (not muted) but ships no <track> element. The absence is
+// worth surfacing, but it is NOT proof of a 1.2.2 failure: captions can be embedded in the
+// media container itself, and the audio track may be silent. Neither is knowable from
+// source, so this is a NON-NORMATIVE recommendation — 1.2.2 stays a judgment criterion the
+// agent adjudicates against the real media, rather than being flipped to NC on a guess.
+const mediaNoTrack: Rule = {
+  id: "media-no-track",
+  criteria: ["1.2.2"],
+  severity: "majeur",
+  advisory: true,
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (el.tag !== "video") continue;
+      if (mutedStatically(el)) continue; // statically-muted video carries no audio to caption
+      if (descendants(el).some((d) => d.tag === "track")) continue;
+      out.push({
+        criteriaId: "1.2.2",
+        el,
+        msgId: "media-no-track",
+      });
+    }
+    return out;
+  },
+};
+
+export const multimediaRules: Rule[] = [autoplayMedia, mediaNoTrack];

package/src/rules/navigation.ts

@@ -0,0 +1,190 @@
+// Theme 12 — Navigation + page landmarks (statically-checkable slice).
+import type { Doc, El } from "../parse/html.js";
+import { attr, descendants, elementsByTag, hasAttr, hasBoundAttr, hasDynamicSpread } from "../parse/html.js";
+import { isIntrinsic } from "../parse/jsx-bridge.js";
+import { type Rule, type RuleFinding, shellBodyInjected } from "./rule.js";
+
+// JSX/SFC: a child component or a `{children}`/`{expr}` child may inject the <main> at
+// runtime (a Next.js layout supplies <main> via {children}). Never assert "no main" then.
+function contentMaybeInjected(doc: Doc): boolean {
+  if (doc.kind === "html") return false;
+  return doc.elements.some((e) => e.tag === "slot" || (e.tag !== "#fragment" && !isIntrinsic(e.tag)));
+}
+
+/** Visible <main>/role="main" landmarks (aria-hidden ones don't count). */
+function mainLandmarks(doc: Doc): El[] {
+  return doc.elements.filter((e) => {
+    if (attr(e, "aria-hidden") === "true") return false;
+    if (e.tag === "main") return true;
+    return (attr(e, "role") ?? "").trim().toLowerCase() === "main";
+  });
+}
+
+/** Visible <nav>/role="navigation" landmarks (aria-hidden ones don't count). */
+function navLandmarks(doc: Doc): El[] {
+  return doc.elements.filter((e) => {
+    if (attr(e, "aria-hidden") === "true") return false;
+    if (e.tag === "nav") return true;
+    return (attr(e, "role") ?? "").trim().toLowerCase() === "navigation";
+  });
+}
+
+/** A <nav> carries a distinguishing accessible name (literal or dynamically bound). */
+function navIsNamed(el: El): boolean {
+  if ((attr(el, "aria-label") ?? "").trim() || hasAttr(el, "aria-labelledby")) return true;
+  if (hasBoundAttr(el, "aria-label") || hasBoundAttr(el, "aria-labelledby")) return true; // value injected at runtime
+  return hasDynamicSpread(el); // a spread may inject aria-label — can't prove it unnamed
+}
+
+const skipLinkTargetMissing: Rule = {
+  id: "skip-link-target-missing",
+  criteria: ["2.4.1"],
+  severity: "majeur",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    const hasName = (id: string): boolean => doc.byId.has(id) || doc.elements.some((e) => attr(e, "name") === id);
+    for (const el of doc.elements) {
+      if (el.tag !== "a") continue;
+      const href = attr(el, "href") ?? "";
+      if (!href.startsWith("#") || href === "#") continue;
+      let id = href.slice(1);
+      try {
+        id = decodeURIComponent(id);
+      } catch {
+        /* keep raw */
+      }
+      if (hasName(id)) continue;
+      out.push({
+        criteriaId: "2.4.1",
+        el,
+        msgId: "skip-link-target-missing",
+        params: { href, id },
+        // In a JSX/SFC component the target id often lives in a sibling/parent component
+        // resolved at composition time (or via --graph). Single-file source can't prove it
+        // missing, so flag it provisional rather than a hard NC. Full HTML pages stay firm.
+        preliminary: doc.kind !== "html",
+      });
+    }
+    return out;
+  },
+};
+
+const positiveTabindex: Rule = {
+  id: "positive-tabindex",
+  criteria: ["2.4.3"],
+  severity: "majeur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (!hasAttr(el, "tabindex")) continue;
+      // HTML parses tabindex with integer rules (parseInt), so "1.5" is a positive 1.
+      const ti = Number.parseInt((attr(el, "tabindex") ?? "").trim(), 10);
+      if (ti > 0) {
+        out.push({
+          criteriaId: "2.4.3",
+          el,
+          msgId: "positive-tabindex",
+          params: { value: ti },
+        });
+      }
+    }
+    return out;
+  },
+};
+
+// A full page must expose its primary content in a <main> landmark so AT users can jump
+// to it (and skip links have a target). Page-scoped: never runs on fragments/components.
+const missingMainLandmark: Rule = {
+  id: "missing-main-landmark",
+  criteria: ["1.3.1"],
+  severity: "majeur",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    if (mainLandmarks(doc).length > 0) return [];
+    if (contentMaybeInjected(doc) || shellBodyInjected(doc)) return []; // <main> may be injected at runtime
+    const anchor = elementsByTag(doc, "body")[0] ?? elementsByTag(doc, "html")[0];
+    if (!anchor) return [];
+    return [
+      {
+        criteriaId: "1.3.1",
+        el: anchor,
+        msgId: "missing-main-landmark",
+      },
+    ];
+  },
+};
+
+const multipleMainLandmark: Rule = {
+  id: "multiple-main-landmark",
+  criteria: ["1.3.1"],
+  severity: "majeur",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    const mains = mainLandmarks(doc);
+    if (mains.length <= 1) return [];
+    return mains.slice(1).map((el) => ({
+      criteriaId: "1.3.1",
+      el,
+      msgId: "multiple-main-landmark",
+      params: { count: mains.length },
+    }));
+  },
+};
+
+// A full content page whose navigation links sit in a header/aside cluster with NO
+// <nav>/role="navigation" landmark anywhere — AT users cannot reach a "navigation" region
+// (RGAA 9.2/12.6). Conservative to stay precise: requires a real content page (<main>), a
+// DENSE link cluster (≥4 links) inside a single <header>/<aside>, and ZERO nav landmarks.
+const NAV_CLUSTER_MIN = 4;
+
+const navLandmarkMissing: Rule = {
+  id: "nav-landmark-missing",
+  criteria: ["1.3.1"],
+  severity: "majeur",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    if (navLandmarks(doc).length > 0) return []; // a navigation region already exists
+    if (mainLandmarks(doc).length === 0) return []; // not a real content page — don't assert
+    if (contentMaybeInjected(doc) || shellBodyInjected(doc)) return []; // <nav> may be injected at runtime
+    for (const el of doc.elements) {
+      if (el.tag !== "header" && el.tag !== "aside") continue;
+      const links = descendants(el).filter((d) => d.tag === "a" && hasAttr(d, "href"));
+      if (links.length >= NAV_CLUSTER_MIN) {
+        return [
+          {
+            criteriaId: "1.3.1",
+            el,
+            msgId: "nav-landmark-missing",
+            params: { count: links.length, region: el.tag },
+          },
+        ];
+      }
+    }
+    return [];
+  },
+};
+
+// ≥2 navigation regions where at least one lacks a distinguishing accessible name — AT
+// users cannot tell them apart (RGAA 12.6). Fires only on the unnamed landmark(s); a
+// single unnamed <nav> is fine (nothing to disambiguate) and never fires.
+const navLandmarkUnnamed: Rule = {
+  id: "nav-landmark-unnamed",
+  criteria: ["1.3.1"],
+  severity: "mineur",
+  scope: "page",
+  run(doc: Doc): RuleFinding[] {
+    const navs = navLandmarks(doc);
+    if (navs.length < 2) return [];
+    return navs.filter((n) => !navIsNamed(n)).map((el) => ({ criteriaId: "1.3.1", el, msgId: "nav-landmark-unnamed" }));
+  },
+};
+
+export const navigationRules: Rule[] = [
+  skipLinkTargetMissing,
+  positiveTabindex,
+  missingMainLandmark,
+  multipleMainLandmark,
+  navLandmarkMissing,
+  navLandmarkUnnamed,
+];

package/src/rules/presentation.ts

@@ -0,0 +1,75 @@
+// Theme 10 — Presentation: the statically-checkable slice of zoom support.
+// 10.4 (text legible at 200%) generally needs rendering, but a viewport meta that
+// blocks zooming is a DEFINITE failure detectable from the markup alone.
+import type { Doc } from "../parse/html.js";
+import { attr, textContent } from "../parse/html.js";
+import type { Rule, RuleFinding } from "./rule.js";
+
+const metaViewportZoomBlock: Rule = {
+  id: "meta-viewport-zoom-block",
+  criteria: ["1.4.4"],
+  severity: "majeur",
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (el.tag !== "meta" || (attr(el, "name") ?? "").toLowerCase() !== "viewport") continue;
+      const content = (attr(el, "content") ?? "").toLowerCase();
+      const pairs = new Map<string, string>();
+      for (const part of content.split(/[,;]/)) {
+        const [k, v] = part.split("=").map((s) => s.trim());
+        if (k) pairs.set(k, v ?? "");
+      }
+      const userScalable = pairs.get("user-scalable");
+      const maxScale = pairs.get("maximum-scale");
+      // Only a real, finite maximum-scale < 2 blocks zoom. An empty (`maximum-scale=`)
+      // or malformed value must NOT be treated as 0 (Number("") === 0) and falsely flagged.
+      const maxScaleNum = maxScale !== undefined && maxScale.trim() !== "" ? Number(maxScale) : Number.NaN;
+      // A maximum-scale of 0 or less is invalid: browsers discard it, so zoom is NOT
+      // blocked (`maximum-scale=-1` is a W3C ACT "passed" example).
+      const blocked = userScalable === "no" || userScalable === "0" || (Number.isFinite(maxScaleNum) && maxScaleNum > 0 && maxScaleNum < 2);
+      if (!blocked) continue;
+      out.push({
+        criteriaId: "1.4.4",
+        el,
+        msgId: "meta-viewport-zoom-block",
+        params: { blockedBy: userScalable === "no" || userScalable === "0" ? "user-scalable" : "maximum-scale", maxScale: maxScale ?? "" },
+      });
+    }
+    return out;
+  },
+};
+
+// ADVISORY (10.2-adjacent): CSS generated content that carries informative WORDS
+// (`content: "…"`) is invisible to assistive technologies. Recommendation: move the text
+// into the DOM. Conservative — only inline <style> text, only quoted values with a run of
+// ≥3 letters (skips icon-font glyph escapes, punctuation, counters, quotes, attr()).
+const CSS_CONTENT = /content\s*:\s*(["'])((?:\\.|(?!\1).)*)\1/gi;
+const INFORMATIVE_WORD = /\p{L}{3,}/u;
+
+const cssGeneratedContentInformative: Rule = {
+  id: "css-generated-content-informative",
+  criteria: ["1.3.1"],
+  severity: "mineur",
+  advisory: true,
+  run(doc: Doc): RuleFinding[] {
+    const out: RuleFinding[] = [];
+    for (const el of doc.elements) {
+      if (el.tag !== "style") continue;
+      const css = textContent(el);
+      const seen = new Set<string>();
+      CSS_CONTENT.lastIndex = 0;
+      let m: RegExpExecArray | null;
+      while ((m = CSS_CONTENT.exec(css))) {
+        const value = m[2] ?? "";
+        if (value.startsWith("\\")) continue; // a glyph escape like "\f001" (icon font) — not text
+        if (!INFORMATIVE_WORD.test(value)) continue; // punctuation / symbol / separator only
+        if (seen.has(value)) continue;
+        seen.add(value);
+        out.push({ criteriaId: "1.3.1", el, msgId: "css-generated-content-informative", params: { text: value.slice(0, 40) }, advisory: true });
+      }
+    }
+    return out;
+  },
+};
+
+export const presentationRules: Rule[] = [metaViewportZoomBlock, cssGeneratedContentInformative];

package/src/rules/registry.ts

@@ -0,0 +1,57 @@
+// The rule registry: the complete static surface of the engine. runRules walks
+// every applicable rule over a parsed Doc and returns normalised Findings,
+// sorted by source position. Page-scoped rules skip fragments/components.
+import type { Doc } from "../parse/html.js";
+import type { Finding } from "../types.js";
+import { type Rule, toFinding, isFullDocument } from "./rule.js";
+import { imagesRules } from "./images.js";
+import { framesRules } from "./frames.js";
+import { scriptsAriaRules } from "./scripts-aria.js";
+import { mandatoryRules } from "./mandatory.js";
+import { headingsRules } from "./headings.js";
+import { tablesRules } from "./tables.js";
+import { linksRules } from "./links.js";
+import { formsRules } from "./forms.js";
+import { navigationRules } from "./navigation.js";
+import { multimediaRules } from "./multimedia.js";
+import { presentationRules } from "./presentation.js";
+import { colorsRules } from "./colors.js";
+import { timingRules } from "./timing.js";
+
+export const ALL_RULES: Rule[] = [
+  ...colorsRules,
+  ...imagesRules,
+  ...framesRules,
+  ...scriptsAriaRules,
+  ...mandatoryRules,
+  ...headingsRules,
+  ...tablesRules,
+  ...linksRules,
+  ...formsRules,
+  ...navigationRules,
+  ...multimediaRules,
+  ...presentationRules,
+  ...timingRules,
+];
+
+const SEVERITY_ORDER: Record<string, number> = { bloquant: 0, majeur: 1, mineur: 2 };
+
+export function ruleById(id: string): Rule | undefined {
+  return ALL_RULES.find((r) => r.id === id);
+}
+
+export function ruleIds(): string[] {
+  return ALL_RULES.map((r) => r.id);
+}
+
+export function runRules(doc: Doc, only?: Set<string>): Finding[] {
+  const out: Finding[] = [];
+  const fullDoc = isFullDocument(doc);
+  for (const rule of ALL_RULES) {
+    if (only && !only.has(rule.id)) continue;
+    if (rule.scope === "page" && !fullDoc) continue;
+    for (const rf of rule.run(doc)) out.push(toFinding(doc, rule.id, rule.severity, rf, rule.advisory));
+  }
+  out.sort((a, b) => a.line - b.line || a.col - b.col || SEVERITY_ORDER[a.severity]! - SEVERITY_ORDER[b.severity]!);
+  return out;
+}