@surea11y/core 1.3.0 → 1.4.1

package/src/checks/automatic/aria-prohibited-children.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -20,86 +22,54 @@
  *   owned set. Nothing else is a structurally valid direct child of a
  *   composite/container role.
  * @implementation-notes
- * - A distinct atomic decision from aria-required-children (see
- *   that rule): "does at least one required child exist" vs "is every
- *   owned child one of the allowed roles." A widely-used reference engine
- *   bundles both under one check (`aria-required-children`); this repo's
- *   "one rule = one normative decision" principle splits them, matching
- *   the established pattern elsewhere of surea11y rules mapping
- *   many-to-one against a single check in that reference engine.
- * - The "allowed owned roles" set is exactly REQUIRED_OWNED_ROLES — not
- *   a separately authored, broader list. Verified directly against a
- *   widely-used reference engine's own ariaRequiredChildren/getOwnedRoles
- *   algorithm: an owned element is only considered allowed if its role is
- *   literally in the container's required set; that engine does not
- *   define a superset "allowed but not required" list for this purpose.
- *   Found and verified via a real page (Red Cross's homepage: a
- *   <nav role="region"> nested inside a <ul role="menubar"> through a
- *   role="none" <li> wrapper — a real violation that reference engine
- *   caught that aria-required-children's own scope (documented
- *   there as "can only under-report, never over-report") does not).
- * - Widened 2026-07-21 to also flag a ROLELESS descendant that has any
- *   global WAI-ARIA attribute or is focusable, matching a widely-used
- *   reference engine's own `getOwnedRoles` exactly (verified directly
- *   against its source: `hasGlobalAriaOrFocusable =
- *   !!globalAriaAttr || _isFocusable(vNode)` — such a descendant is
- *   pushed as an owned entry with `role: null`, which can never match a
- *   container's required-owned-roles set, so it's always "unallowed").
- *   Previously left out as riskier to replicate — re-evaluated given
- *   direct access to that engine's exact algorithm (not a guess) plus this
- *   engine's own already-existing, shared `helpers.getFocusableInfo` for
- *   the focusability half. Both signals (global-attribute presence,
- *   focusability) are static, declarative markup facts with no live-DOM/
- *   hydration risk, unlike e.g. `aria-checked-state-mismatch`'s DOM-
- *   property comparison.
- * - Fixed 2026-07-30: a roleless-but-focusable descendant's message and
- *   `data.details.attr` used to always claim "carries tabindex" even when
- *   the element had no tabindex attribute at all and was only focusable
- *   natively (e.g. an <a href> link). `helpers.getFocusableInfo`'s
- *   `mechanism` field ('tabindex' | 'native' | ...) is now used to tell
- *   the two apart, with a distinct `nativeFocusable` attr/message for the
- *   native case. Found via a real Angular app: a routerLink <a> inside a
- *   role="list" was reported as "carries tabindex" though the rendered
- *   markup had no such attribute.
- * - Recursion stops at the first non-transparent role boundary, same as
- *   that reference engine: a nested container with its own real role (e.g. a
- *   <div role="listbox"> inside a menubar) is evaluated as ITS OWN
- *   owned-role entry against the outer container (and, separately, gets
- *   its own applicability pass as a container in the same rule run) —
- *   its descendants are never misattributed to the outer container.
- * - Fixed 2026-07-31: child-role resolution used `ariaHelpers.getExplicitRole`
- *   (explicit role="" attribute only), unlike aria-required-children's
- *   descendant matching which uses `ariaHelpers.getContainmentRole` (explicit
+ * - A distinct atomic decision from aria-required-children (see that
+ *   rule): "does at least one required child exist" vs "is every owned
+ *   child one of the allowed roles" — split per this repo's "one rule =
+ *   one normative decision" principle.
+ * - The "allowed owned roles" set is exactly REQUIRED_OWNED_ROLES, not a
+ *   separately authored, broader list: an owned element is allowed only if
+ *   its role is literally in the container's required set.
+ * - A ROLELESS descendant that has any global WAI-ARIA attribute or is
+ *   focusable is also flagged: it's treated as an owned entry with
+ *   `role: null`, which can never match a container's required-owned-roles
+ *   set, so it's always "unallowed". Both signals
+ *   (global-attribute presence, focusability via the shared
+ *   `helpers.getFocusableInfo`) are static, declarative markup facts with
+ *   no live-DOM/hydration risk, unlike e.g.
+ *   `aria-checked-state-mismatch`'s DOM-property comparison.
+ *   `helpers.getFocusableInfo`'s `mechanism` field ('tabindex' | 'native' |
+ *   ...) distinguishes an explicit `tabindex` attribute from native
+ *   focusability (e.g. an `<a href>`), so the reported `data.details.attr`
+ *   and message correctly say `nativeFocusable` rather than claiming a
+ *   tabindex attribute that isn't actually present in the markup.
+ * - Recursion stops at the first non-transparent role boundary: a nested
+ *   container with its own real role
+ *   (e.g. a `<div role="listbox">` inside a menubar) is evaluated as its
+ *   own owned-role entry against the outer container (and, separately,
+ *   gets its own applicability pass as a container in the same rule run)
+ *   — its descendants are never misattributed to the outer container.
+ * - Child-role resolution uses `ariaHelpers.getContainmentRole` (explicit
  *   role, falling back to the native-tag map — li/tr/td/th/tbody/ul/ol/
- *   table/select/input[type=radio] — see that helper's own header comment).
- *   A bare `<li>` with no role="" attribute — the common CSS-reset
- *   workaround `<ul role="list"><li>...</li></ul>` that getContainmentRole
- *   exists specifically to handle — was therefore read as roleless here,
- *   making it structurally transparent: the walk recursed straight through
- *   the listitem boundary into its subtree and could report a focusable
- *   descendant several levels down as a disallowed owned child of the list,
- *   instead of stopping at the (implicit) listitem the way
- *   aria-required-children already does. Switched to getContainmentRole so
- *   both rules resolve an owned child's role identically. This is a general
- *   fix, not list/listitem-specific: it applies to every container role in
- *   REQUIRED_OWNED_ROLES whose native-tag counterpart the child map covers
- *   (e.g. a bare `<tr>`/`<td>` under a role="table"/"grid"/"row" container
- *   with no explicit role="" was subject to the same flattening bug). Found
- *   via a real Angular Material-style component library: an `<a routerlink>`
- *   several DOM levels inside a bare `<li>` under `<ul role="list">` was
- *   reported as an unallowed owned child of the list.
- * - Gated on isAccTreeEligible for the container itself, matching the fix
- *   applied to aria-required-children (see that rule's header): the
- *   original "not gated" note here just cited that rule's reasoning
- *   without re-deriving it, and that reasoning turned out not to hold —
- *   a closed dialog/flyout menu populated on open is a real false-positive
- *   shape. In this rule specifically the descendant-level eligibility gate
- *   already made the container-level gate redundant for correctness (an
- *   ineligible container has no eligible descendants either, so `owned`
- *   ends up empty and nothing fails) — but skipping the container up front
- *   reports `notApplicable` instead of a vacuous `pass`, which is the more
- *   accurate outcome for a container that isn't currently exposed at all,
- *   and avoids walking a subtree whose result is already known.
+ *   table/select/input[type=radio]), the same resolution
+ *   aria-required-children's descendant matching uses — not
+ *   `getExplicitRole`, which only sees an explicit role="" attribute. A
+ *   bare `<li>` with no role="" (the common CSS-reset workaround
+ *   `<ul role="list"><li>...</li></ul>`) must still resolve to the
+ *   implicit listitem role so the walk stops at that boundary instead of
+ *   recursing straight through it into the listitem's own subtree; the
+ *   same applies to every container role in REQUIRED_OWNED_ROLES whose
+ *   native-tag counterpart the child map covers (e.g. a bare
+ *   `<tr>`/`<td>` under a role="table"/"grid"/"row" container).
+ * - Gated on isAccTreeEligible for the container itself, matching
+ *   aria-required-children: a closed dialog/flyout menu populated on open
+ *   is a real false-positive shape otherwise. The descendant-level
+ *   eligibility gate alone would make the container-level gate redundant
+ *   for correctness (an ineligible container has no eligible descendants
+ *   either, so `owned` ends up empty and nothing fails), but skipping the
+ *   container up front reports `notApplicable` instead of a vacuous
+ *   `pass` — the more accurate outcome for a container that isn't
+ *   currently exposed at all — and avoids walking a subtree whose result
+ *   is already known.
  * - No aria-busy exemption here (unlike aria-required-children): the
  *   WAI-ARIA spec's aria-busy escape hatch is specifically about a
  *   container missing its required owned elements while loading, not
@@ -161,7 +131,7 @@ function runInPage(ctx) {
   // aria-allowed-attr.js's GLOBAL_ATTRS — duplicated, not imported, since
   // runInPage must be self-contained per scripts/build-core.js). A
   // roleless descendant carrying any of these is a real accessible-tree
-  // node a widely-used reference engine's getOwnedRoles also flags, not a transparent wrapper.
+  // node, not a transparent wrapper.
   const GLOBAL_ARIA_ATTRS = [
     'aria-atomic',
     'aria-braillelabel',
@@ -205,13 +175,12 @@ function runInPage(ctx) {
   // non-transparent role boundary otherwise — see header comment. A
   // roleless descendant is ALSO a non-transparent boundary (an owned
   // entry with role: null, which can never satisfy a required-role set)
-  // when it carries a global aria-* attribute or is focusable — matches
-  // a widely-used reference engine's own getOwnedRoles exactly (see header comment).
-  // kidRole comes from getContainmentRole, not getExplicitRole (see header
-  // comment's 2026-07-31 fix): "roleless" here means neither an explicit
-  // role="" NOR one of the native containment tags (li, tr, td, ...), so a
-  // bare <li>/<tr>/... is a real listitem/row boundary, not a transparent
-  // wrapper the walk should pass through.
+  // when it carries a global aria-* attribute or is focusable.
+  // kidRole comes from getContainmentRole, not getExplicitRole: "roleless"
+  // here means neither an explicit role="" NOR one of the native
+  // containment tags (li, tr, td, ...), so a bare <li>/<tr>/... is a real
+  // listitem/row boundary, not a transparent wrapper the walk should pass
+  // through.
   function collectOwnedRoles(el, requiredSet, out, depth) {
     if (depth > MAX_DEPTH) return;
     const kids = el.children ? Array.prototype.slice.call(el.children) : [];

package/src/checks/automatic/aria-required-attr.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -18,13 +20,10 @@
  * - Deliberately scoped to REQUIRED_PROPS_BY_ROLE in src/core/aria-helpers.js,
  *   which only lists a required property when the spec is unambiguous and
  *   context-independent — see that file's header for the rationale.
- * - Widened 2026-07-21 to add `meter` (`aria-valuenow`), verified against
- *   a widely-used reference engine's own `requiredAttrs` table. Deliberately
- *   did NOT add two other entries from that same table: `progressbar`'s
- *   `aria-valuenow` (a legitimately indeterminate progressbar omits it —
- *   that engine itself excludes progressbar from its own table for this reason)
- *   and `combobox`'s `aria-controls` (confirmed via MDN's combobox role
- *   page to be conditional — only required once the popup is actually
+ * - `meter`'s `aria-valuenow` is required. Deliberately NOT required:
+ *   `progressbar`'s `aria-valuenow` (a legitimately indeterminate
+ *   progressbar omits it) and `combobox`'s `aria-controls` (conditional per
+ *   MDN's combobox role page — only required once the popup is actually
  *   displayed, not unconditionally). See src/core/aria-helpers.js's
  *   REQUIRED_PROPS_BY_ROLE comment for the full reasoning.
  * - Gated on isAccTreeEligible for the element itself: unlike a syntax-

package/src/checks/automatic/aria-required-children.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -42,9 +44,7 @@
  *   widget is missing required owned elements due to script execution or
  *   loading, authors MUST mark a containing element with aria-busy equal
  *   to true." A container carrying aria-busy="true" is skipped the same
- *   way — only the exact string "true" counts (absent/"false" do not),
- *   matching a widely-used reference engine's own aria-required-children
- *   behavior.
+ *   way — only the exact string "true" counts (absent/"false" do not).
  * - Descendant search tries a fast native querySelectorAll(CANDIDATE_
  *   SELECTOR) first (covers the light-DOM-only common case with no added
  *   cost); only when that finds nothing AND the container has a <slot>
@@ -53,8 +53,7 @@
  *   querySelectorAll only sees a <slot>'s unrendered fallback content, never
  *   what's actually distributed into it. Deliberately scoped to slot
  *   expansion only, not a general "also descend into any nested custom
- *   element's own shadow root" walk — no confirmed real-world case needs
- *   that yet.
+ *   element's own shadow root" walk — no known case needs that yet.
  */
 
 const id = 'aria-required-children';
@@ -133,17 +132,15 @@ function runInPage(ctx) {
   // <slot></slot>, with the actual role="listitem" elements living in the
   // light DOM and projected in) would never find them there — same class
   // of bug as aria-required-parent's ancestor search, just in the opposite
-  // (descendant) direction. Found via Adobe Spectrum Web Components'
-  // sp-sidenav-item: its shadow root's role="list" div owns its listitems
-  // only through slot projection.
+  // (descendant) direction.
   //
   // Deliberately scoped to slot expansion only — does NOT separately
   // descend into an unrelated nested custom element's own shadow root
   // (e.g. a <my-widget> child with no <slot> involvement at all). That's a
   // qualitatively different question (does an arbitrary component's own
   // internal structure count as this container's "owned children"?) with
-  // no confirmed real-world case driving it yet; slot projection is the
-  // shape actually observed.
+  // no known case driving it yet; slot projection is the shape that
+  // actually comes up.
   function collectComposedDescendants(node, out, seen, limit) {
     if (!node || !node.children) return;
     for (const child of Array.from(node.children)) {

package/src/checks/automatic/aria-required-parent.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -94,24 +96,20 @@ function runInPage(ctx) {
   }
 
   // Roles that may host a nested listitem/treeitem group without breaking
-  // the required-context chain (verified against a widely-used reference
-  // engine's own getMissingContext, which special-cases exactly these two
-  // roles via its ownGroupRoles option).
+  // the required-context chain — the group role is transparent for exactly
+  // these two roles.
   const GROUP_TRANSPARENT_FOR_ROLES = new Set(['listitem', 'treeitem']);
 
   // A real ancestor role — not "no role at all" and not the two roles that
   // strip an element from the accessibility tree's parent/child chain
-  // entirely (presentation/none) — stops the search, matching that reference
-  // engine's getMissingContext. This is stricter than "any ancestor with the right
-  // role anywhere up the tree": the required-context relationship is about
-  // the accessibility tree's actual PARENT, so an intervening ancestor with
-  // its OWN distinct real role (e.g. a plain <li>'s native "listitem" role)
-  // blocks the search even if a further-up ancestor has the correct role.
-  // Found via a real page — Le Monde's review-carousel tablist, where each
-  // <button role="tab"> sits inside a plain <li> (native listitem) inside
-  // <ul role="tablist">: that reference engine correctly fails this (the tablist is never the
-  // tab's accessible-tree parent, listitem is), which the old "walk every
-  // ancestor" version here missed entirely.
+  // entirely (presentation/none) — stops the search. This is stricter than
+  // "any ancestor with the right role anywhere up the tree": the
+  // required-context relationship is about the accessibility tree's actual
+  // PARENT, so an intervening ancestor with its OWN distinct real role
+  // (e.g. a plain <li>'s native "listitem" role) blocks the search even if
+  // a further-up ancestor has the correct role. E.g. a <button role="tab">
+  // inside a plain <li> (native listitem) inside <ul role="tablist"> fails:
+  // the tablist is never the tab's accessible-tree parent, the listitem is.
   function getRealContextRole(el) {
     const role = ariaHelpers.getContainmentRole(el);
     if (!role || role === 'presentation' || role === 'none') return '';
@@ -121,13 +119,11 @@ function runInPage(ctx) {
   // Flat-tree ancestor walk (ctx.helpers.composedParent — assignedSlot wins
   // over parentNode, then shadow host). A slotted light-DOM element's real
   // rendered ancestor is whatever the shadow tree wraps its <slot> in (e.g.
-  // a role="list" container), not its own light-DOM parentElement — found
-  // via Adobe Spectrum Web Components' <sp-sidenav-item role="listitem">,
-  // distributed via slot="descendant" into its parent's shadow root, which
-  // wraps that slot in a <div role="list">. composedParent can return a
-  // non-Element node (a ShadowRoot, nodeType 11) when climbing out of a
-  // shadow tree that has no further light-DOM parent — skip those and keep
-  // climbing rather than treating them as a (roleless) context.
+  // a role="list" container), not its own light-DOM parentElement.
+  // composedParent can return a non-Element node (a ShadowRoot, nodeType
+  // 11) when climbing out of a shadow tree that has no further light-DOM
+  // parent — skip those and keep climbing rather than treating them as a
+  // (roleless) context.
   const getComposedParent =
     helpers && typeof helpers.composedParent === 'function'
       ? helpers.composedParent
@@ -142,10 +138,9 @@ function runInPage(ctx) {
     // Mutable working copy: passing a transparent "group" ancestor also
     // makes the element's OWN role an acceptable context from that point on
     // (a nested treeitem-under-group-under-treeitem chain is a normal,
-    // arbitrarily-deep ARIA tree/list, not just one level) — mirroring that
-    // reference engine's getMissingContext, which pushes explicitRole into
-    // reqContext at the same point. Cloned lazily so the caller's Set (built
-    // once per element in runInPage) is never mutated.
+    // arbitrarily-deep ARIA tree/list, not just one level). Cloned lazily
+    // so the caller's Set (built once per element in runInPage) is never
+    // mutated.
     let roles = acceptableRoles;
     while (cur && guard++ < 200) {
       if (cur.nodeType !== 1) {

package/src/checks/automatic/aria-role-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/aria-roles-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -65,19 +67,44 @@ function runInPage(ctx) {
   const occurrences = [];
   let applicableCount = 0;
 
+  // Programmatically hidden per the ACT glossary: display:none, visibility not
+  // visible, or aria-hidden on the element or an ancestor.
+  function isHidden(el) {
+    try {
+      if (typeof helpers.isDomVisibleEligible === 'function') {
+        if (!helpers.isDomVisibleEligible(el, ctx)) return true;
+      }
+      for (let n = el; n && n.getAttribute; n = n.parentElement) {
+        if (String(n.getAttribute('aria-hidden') || '').toLowerCase() === 'true') return true;
+      }
+    } catch {
+      return false;
+    }
+    return false;
+  }
+
   for (const el of nodes) {
     if (!el || !el.getAttribute) continue;
 
-    const role = ariaHelpers.getExplicitRole(el);
-    if (!role) continue; // role="" or whitespace-only: not this rule's concern
+    // ACT 674b10 is not applicable to a programmatically hidden element.
+    if (isHidden(el)) continue;
 
-    applicableCount += 1;
+    // role takes a fallback list and the first token the browser recognises
+    // wins, so role="searchfield searchbox" resolves to searchbox. The rule
+    // fails only when no token names a concrete role.
+    const tokens =
+      typeof ariaHelpers.getAllRoleTokens === 'function'
+        ? ariaHelpers.getAllRoleTokens(el)
+        : [ariaHelpers.getExplicitRole(el)].filter(Boolean);
+    if (!tokens.length) continue; // role="" or whitespace-only: not this rule's concern
 
-    const isAbstract = ariaHelpers.isAbstractRole(role);
-    const isKnown = ariaHelpers.isKnownRole(role);
+    applicableCount += 1;
 
-    if (isKnown && !isAbstract) continue;
+    const usable = tokens.find((t) => ariaHelpers.isKnownRole(t) && !ariaHelpers.isAbstractRole(t));
+    if (usable) continue;
 
+    const role = tokens[0];
+    const isKnown = tokens.some((t) => ariaHelpers.isKnownRole(t));
     const reasonCode = !isKnown ? 'ARIA_ROLE_INVALID' : 'ARIA_ROLE_ABSTRACT';
     const stableSelector = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
     const html = helpers.getOuterHtmlSnippet ? helpers.getOuterHtmlSnippet(el) : el.outerHTML || '';

package/src/checks/automatic/aria-valid-attr-value.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -13,25 +15,26 @@
  * @expectation
  *   Each attribute's value conforms to its WAI-ARIA-declared value type:
  *   boolean ("true"/"false"), tristate ("true"/"false"/"mixed"), a token
- *   from a fixed enumerated set, an integer, a real number, or a non-empty
- *   ID reference (list) that resolves to an existing element in the
- *   document.
+ *   from a fixed enumerated set, an integer, a real number, or an empty
+ *   value or ID reference (list) that resolves to an existing element in
+ *   the document.
  * @implementation-notes
  * - Not rule-gated on isAccTreeEligible: this remains a static-markup
  *   property, while engine-level hidden-subtree filtering still applies
  *   unless engineOptions.includeHiddenElements is true.
- * - ID-reference resolution (added 2026-07-20, see aria-helpers.js's
- *   idExists) only flags idref-list attributes (aria-labelledby,
- *   aria-describedby, aria-controls, aria-owns, etc.) when NONE of the
- *   space-separated ids resolve — a partially-dangling list (some ids
- *   exist, some don't) is left unflagged. Verified 2026-07-21 directly
- *   against a widely-used reference engine's own `validateAttrValue` source:
- *   this is not a conservative guess, it's an exact match for that engine's
- *   own behavior (`idrefs(vNode, attr).some(node => !!node)` — that engine
- *   itself only invalidates when every token fails to resolve). Single-idref
- *   attributes (aria-activedescendant, aria-errormessage) are flagged
- *   whenever their one id doesn't resolve, also matching that engine's `idref`
- *   case exactly.
+ * - ID-reference resolution (see aria-helpers.js's idExists) only flags
+ *   idref-list attributes (aria-labelledby, aria-describedby,
+ *   aria-controls, aria-owns, etc.) when NONE of the space-separated ids
+ *   resolve — a partially-dangling list (some ids exist, some don't) is
+ *   left unflagged (only invalidate when every token fails to resolve).
+ *   Single-idref attributes (aria-activedescendant, aria-errormessage) are
+ *   flagged whenever their one id doesn't resolve.
+ * - An explicitly-EMPTY idref/idref-list value (e.g.
+ *   `aria-describedby=""`) is valid, not a violation — `allowEmpty` holds
+ *   for every idref/idref-list ARIA attribute. A common, deliberate pattern
+ *   in templated markup (e.g. React conditionally rendering
+ *   `aria-describedby={hasError ? errorId : ''}`); flagging it would be a
+ *   false positive.
  */
 
 const id = 'aria-valid-attr-value';

package/src/checks/automatic/aria-valid-attr.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/autocomplete-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -128,7 +130,15 @@ function runInPage(ctx) {
     if (tokens[i] && tokens[i].startsWith('section-') && tokens[i].length > 'section-'.length)
       i += 1;
     if (tokens[i] === 'shipping' || tokens[i] === 'billing') i += 1;
-    if (CONTACT_MODALITY.has(tokens[i])) i += 1;
+    // A contact modality token is only allowed when the field that follows is
+    // a contact field, so "work photo" is invalid while "work email" is not.
+    if (CONTACT_MODALITY.has(tokens[i])) {
+      const next = tokens[i + 1];
+      const isContactField =
+        next === 'email' || next === 'impp' || next === 'tel' || (next || '').startsWith('tel-');
+      if (!isContactField) return false;
+      i += 1;
+    }
 
     let end = tokens.length;
     if (tokens[end - 1] === 'webauthn') end -= 1;
@@ -145,11 +155,39 @@ function runInPage(ctx) {
   const occurrences = [];
   let applicableCount = 0;
 
+  // ACT 73f2c2 exempts controls where the attribute cannot describe an input
+  // purpose: the on/off toggle, disabled controls, input types with a fixed
+  // value, and controls that take no input.
+  const FIXED_VALUE_TYPES = new Set([
+    'button',
+    'checkbox',
+    'file',
+    'image',
+    'radio',
+    'reset',
+    'submit'
+  ]);
+
+  function isExempt(el) {
+    const tag = String(el.tagName || '').toLowerCase();
+    if (tag === 'input') {
+      const type = String(el.getAttribute('type') || 'text').toLowerCase();
+      if (FIXED_VALUE_TYPES.has(type)) return true;
+    }
+    if (el.hasAttribute && el.hasAttribute('disabled')) return true;
+    if (String(el.getAttribute('aria-disabled') || '').toLowerCase() === 'true') return true;
+    return false;
+  }
+
   for (const el of nodes) {
     if (!el || !el.getAttribute) continue;
     const raw = String(el.getAttribute('autocomplete') || '').trim();
     if (!raw) continue;
 
+    const tokens = raw.toLowerCase().split(/\s+/).filter(Boolean);
+    if (tokens.length === 1 && (tokens[0] === 'on' || tokens[0] === 'off')) continue;
+    if (isExempt(el)) continue;
+
     applicableCount += 1;
 
     if (isValidAutocomplete(raw)) continue;