pour-engine 1.38.0 → 1.41.0

package/engine/rules/wcag/4.1.2-nested-interactive.js

@@ -1,4 +1,5 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
+import { isInert } from '../../lib/dom.js';
 // Deliberately excludes bare [tabindex]: a focusable container (e.g. a
 // scrollable region with tabindex="0") holding links is correct markup.
 const INTERACTIVE =
@@ -16,8 +17,7 @@ export default {
   selector: INTERACTIVE,
   evaluate(element, { isRendered }) {
     // Only descendants a user can actually reach count: hidden inputs,
-    // disabled controls, display:none templates, and tabindex="-1" nodes
-    // inside a control are inert markup, not competing tab stops.
+    // disabled controls and display:none templates are excluded.
     // Two more shapes are unreachable by the same principle: aria-hidden
     // content (AT ignores it wholesale — a decorative svg role="button"
     // aria-hidden="true" inside a play button competes with nothing; if it
@@ -26,16 +26,28 @@ export default {
     // role="button" with no tabindex is not in the tab order — keyboard
     // users cannot reach it, so it cannot be a competing stop).
     const NATIVE = 'a[href], button, input, select, textarea, summary, audio[controls], video[controls]';
-    // Any negative tabindex is unreachable by Tab (HTML: "a negative
-    // integer"), not only the literal "-1"; hasAttribute guards the default
-    // -1 Chromium reports for attribute-less contenteditable elements.
-    // 2026-08-25 overnight audit.
-    const nested = [...element.querySelectorAll(INTERACTIVE)].find((el) =>
-      !el.matches(':disabled') && !(el.hasAttribute('tabindex') && el.tabIndex < 0)
+    // Negative tabindex removes sequential focus navigation, not focusability.
+    // https://html.spec.whatwg.org/multipage/interaction.html#attr-tabindex
+    const candidates = [...element.querySelectorAll(INTERACTIVE)].filter((el) =>
+      !el.matches(':disabled') && !isInert(el)
       && !(el.tagName === 'INPUT' && el.type === 'hidden') && isRendered(el)
       && !el.closest('[aria-hidden="true"]')
       && (el.matches(NATIVE) || el.hasAttribute('tabindex')));
+    // A child requiring review must not conceal a later definite finding.
+    const nested = candidates.find((el) => !(el.hasAttribute('tabindex') && el.tabIndex < 0)) ?? candidates[0];
     if (!nested) return { status: 'pass' };
+    // A programmatically focusable child must not silently pass. In an
+    // ARIA widget its name and role can survive presentational-descendant
+    // processing, so nesting alone does not prove a 4.1.2 failure.
+    // Native links/buttons separately forbid interactive descendants.
+    // https://www.w3.org/TR/wai-aria-1.2/#tree_exclusion
+    if (nested.hasAttribute('tabindex') && nested.tabIndex < 0
+      && !element.matches('a[href], button')) {
+      return {
+        status: 'incomplete',
+        message: `This control contains an element (<${nested.tagName.toLowerCase()}>) with a negative tabindex. It can still receive focus. Check that both controls expose the intended name and role, and that focusing and activating the child works correctly.`,
+      };
+    }
     // <summary> is the one outer control HTML does not forbid this on: its
     // content model is phrasing content with no "no interactive content
     // descendant" clause (a and button both carry one), it maps to no ARIA

package/engine/rules/wcag/4.1.2-valid-role.js

@@ -1,5 +1,6 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
 import { attributesOf } from '../../lib/dom.js';
+import { implicitRole } from '../../lib/roles.js';
 // Concrete, usable roles — abstract roles are invalid in markup.
 export const VALID_ROLES = new Set([
   'alert', 'alertdialog', 'application', 'article', 'banner', 'blockquote', 'button',
@@ -108,7 +109,11 @@ export default {
     // this is a question, not an assertion. Focusable or state-bearing
     // elements keep failing: a focusable element left generic, or a state
     // riding on a role the browser threw away, is the real 4.1.2 harm.
-    if (!focusable && !hasAriaProps) {
+    // An invalid role does not erase a native control's semantics. A
+    // misspelling on a button is a review question; its actual missing
+    // name or state, if any, belongs to the corresponding semantic rule.
+    const nativeRole = implicitRole(element);
+    if ((!focusable && !hasAriaProps) || (nativeRole && nativeRole !== 'generic')) {
       return {
         status: 'incomplete',
         message: `role="${element.getAttribute('role')}" is not a valid ARIA role${hint}, so assistive technology ignores it and exposes the element's native <${tag}> semantics. Nothing is announced wrongly, but the author reached for a role that does not exist. Is the native <${tag}> role the right one here? If a different role was intended, that role is missing.`,

package/engine/wcag22.js

@@ -4,8 +4,8 @@
 //
 // `automation` is an honest assessment:
 //   'auto'    — rules can meaningfully test this
-//   'partial' — rules catch some failures; humans must still review
-//   'manual'  — requires human judgment (most of the spec!)
+//   'partial' — rules check aspects or nominate review candidates; humans still review
+//   'manual'  — no active rule; assessed through the human checklist
 // The coverage report (scripts/wcag-coverage.js → src/engine/COVERAGE.md) joins
 // this catalog with the rule registry to show real coverage.
 
@@ -37,11 +37,11 @@ export default [
   sc('1.3.1', 'Info and Relationships', 'A', 'partial'),
   sc('1.3.2', 'Meaningful Sequence', 'A', 'partial'), // partial: CSS-reorder divergence is measurable; whether meaning survives is the reader's call
   sc('1.3.3', 'Sensory Characteristics', 'A', 'manual'),
-  sc('1.3.4', 'Orientation', 'AA', 'partial', '2.1'), // orientation-lock (2026-08-01) proves CSS root hides/rotations; script locks stay a human check
-  sc('1.3.5', 'Identify Input Purpose', 'AA', 'partial', '2.1'), // partial: wrong tokens are provable; MISSING autocomplete on identity fields needs judgment
+  sc('1.3.4', 'Orientation', 'AA', 'partial', '2.1'), // orientation-lock asserts CSS root hides/rotations as ACT b33eff does, essential exception assumed absent; script locks stay a human check
+  sc('1.3.5', 'Identify Input Purpose', 'AA', 'partial', '2.1'), // partial: wrong tokens are asserted as ACT 73f2c2 does (search boxes asked); MISSING autocomplete on identity fields needs judgment
   sc('1.3.6', 'Identify Purpose', 'AAA', 'manual', '2.1'),
   sc('1.4.1', 'Use of Color', 'A', 'partial'), // link-in-text-block automates the link case
-  sc('1.4.2', 'Audio Control', 'A', 'partial'), // partial: declarative autoplay is provable; JS-initiated audio is not
+  sc('1.4.2', 'Audio Control', 'A', 'partial'), // declarative autoplay identifies candidates; audibility and alternative controls need review
   sc('1.4.3', 'Contrast (Minimum)', 'AA', 'partial'),
   sc('1.4.4', 'Resize Text', 'AA', 'partial'),
   sc('1.4.5', 'Images of Text', 'AA', 'manual'),
@@ -75,9 +75,9 @@ export default [
   sc('2.4.6', 'Headings and Labels', 'AA', 'manual'),
   sc('2.4.7', 'Focus Visible', 'AA', 'partial'), // partial: focus-visible flags outline suppression; the indicator itself needs eyes
   sc('2.4.8', 'Location', 'AAA', 'manual'),
-  sc('2.4.9', 'Link Purpose (Link Only)', 'AAA', 'partial'), // partial: contentless link names are provable; whether a real name describes its destination needs a reader
+  sc('2.4.9', 'Link Purpose (Link Only)', 'AAA', 'partial'), // generic wording nominates candidates; whether wording explains the destination needs a reader
   sc('2.4.10', 'Section Headings', 'AAA', 'manual'),
-  sc('2.4.11', 'Focus Not Obscured (Minimum)', 'AA', 'partial', '2.2'), // partial: focus-not-obscured catches fully-covered targets at rest
+  sc('2.4.11', 'Focus Not Obscured (Minimum)', 'AA', 'partial', '2.2'), // covered resting targets are candidates; actual focus/scroll behavior needs review
   sc('2.4.12', 'Focus Not Obscured (Enhanced)', 'AAA', 'manual', '2.2'),
   sc('2.4.13', 'Focus Appearance', 'AAA', 'manual', '2.2'),
   sc('2.5.1', 'Pointer Gestures', 'A', 'manual', '2.1'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.38.0",
+  "version": "1.41.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",