pour-engine 1.5.0 → 1.6.0

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.5.0',
+    version: '1.6.0',
   },
 };

package/engine/README.md

@@ -108,7 +108,7 @@ Nothing in the spec is silently skipped — that claim is the product.
 
 ## Honest current state
 
-72 rules, hardened on real sites and the `testbeds/` pages. Audits walk into
+74 rules, hardened on real sites and the `testbeds/` pages. Audits walk into
 open shadow roots (targets come back as `host >>> inner` selector chains);
 iframe traversal is the host's job, and the extension does it. Known gaps:
 the full accname spec (ours is a close approximation) and the language

package/engine/lib/accessible-name.js

@@ -2,19 +2,45 @@
 // the ARIA accname spec: aria-labelledby → aria-label → native labelling
 // (alt, <label>, text content, value) → title/placeholder fallbacks.
 //
-// Deliberately simpler than the full spec (no recursion into referenced
-// hidden subtrees, no CSS content). Good enough for name-presence rules;
-// grow it as rules need more.
+// Deliberately simpler than the full spec. Good enough for name-presence
+// rules; grow it as rules need more.
+
+/** Input types whose `.value` is user-entered text rather than a state. */
+const TEXT_INPUT = new Set(['text', 'search', 'url', 'tel', 'email', 'password', 'number', 'date',
+  'datetime-local', 'month', 'time', 'week', '']);
 
 export function accessibleName(element) {
-  const labelledby = element.getAttribute('aria-labelledby');
-  if (labelledby) {
-    const text = labelledby
-      .split(/\s+/)
-      .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
-      .join(' ')
-      .trim();
-    if (text) return text;
+  return computeName(element, false);
+}
+
+/** The name aria-labelledby contributes, resolved the way accname requires:
+ *  each referenced element's NAME, not its raw text. A reference whose target
+ *  is named by an img alt, an aria-label or a control value names the referrer
+ *  too, and reading textContent instead reports those elements as nameless.
+ *  Rules that only need "is it labelled?" call this directly. */
+export function labelledByName(element) {
+  const refs = element.getAttribute?.('aria-labelledby');
+  if (!refs) return '';
+  const root = element.getRootNode();
+  return refs
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((id) => {
+      const target = root.getElementById?.(id);
+      return target ? computeName(target, true) : '';
+    })
+    .join(' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function computeName(element, inLabelledBy) {
+  // accname step 2B: a referenced element's own aria-labelledby is not
+  // followed a second time. That is also what stops <p id="a"
+  // aria-labelledby="a"> recursing forever.
+  if (!inLabelledBy) {
+    const fromLabelledBy = labelledByName(element);
+    if (fromLabelledBy) return fromLabelledBy;
   }
 
   const ariaLabel = element.getAttribute('aria-label')?.trim();
@@ -42,6 +68,14 @@ export function accessibleName(element) {
       const alt = element.getAttribute('alt')?.trim();
       if (alt) return alt;
     }
+    // accname step 2E: an embedded control contributes its value, so
+    // aria-labelledby pointing at a filled text box names the referrer with
+    // what the user typed. Text-like fields only: a checkbox's `.value` is
+    // the string "on", which is a state, not a name.
+    if (inLabelledBy && (tag === 'textarea' || TEXT_INPUT.has(element.type))) {
+      const value = (element.value ?? '').trim();
+      if (value) return value;
+    }
     // HTML-AAM: value-less submit/reset buttons get a UA-default name —
     // browsers announce "Submit"/"Reset button" without any author text.
     if (element.type === 'submit') return 'Submit';
@@ -51,18 +85,21 @@ export function accessibleName(element) {
   // Buttons, links, headings etc. — name from contents, including image
   // alts, but EXCLUDING hidden content: text inside aria-hidden or
   // display:none/visibility:hidden subtrees does not name an element
-  // (per the accname spec).
-  const fromContents = visibleContentText(element).replace(/\s+/g, ' ').trim();
+  // (per the accname spec). The one exception is a subtree reached THROUGH
+  // aria-labelledby, where accname ignores the hidden state.
+  const fromContents = visibleContentText(element, inLabelledBy).replace(/\s+/g, ' ').trim();
   if (fromContents) return fromContents;
 
   return (element.getAttribute('title') ?? element.getAttribute('placeholder') ?? '').trim();
 }
 
-function visibleContentText(element) {
+function visibleContentText(element, includeHidden) {
   // A custom element with a shadow root renders its shadow content — name
   // from contents follows the FLAT tree (slots inside pull light DOM back).
   const nodes = element.shadowRoot ? element.shadowRoot.childNodes : element.childNodes;
-  return generatedContent(element, '::before') + textFromNodes(nodes) + generatedContent(element, '::after');
+  return generatedContent(element, '::before')
+    + textFromNodes(nodes, includeHidden)
+    + generatedContent(element, '::after');
 }
 
 /** CSS generated content contributes to name-from-contents per the accname
@@ -75,7 +112,10 @@ function generatedContent(element, pseudo) {
   return match ? match[1].replace(/\\(.)/g, '$1') : '';
 }
 
-function textFromNodes(nodes) {
+/** `includeHidden` is set while resolving an aria-labelledby target: accname
+ *  ignores the hidden state of referenced content, which is what makes the
+ *  visually-hidden label span (and the display:none one) work in browsers. */
+function textFromNodes(nodes, includeHidden) {
   let text = '';
   for (const node of nodes) {
     if (node.nodeType === 3 /* TEXT_NODE */) {
@@ -89,15 +129,17 @@ function textFromNodes(nodes) {
     // on, and sites can override the UA's display:none (seen in the wild
     // with lazy-load <noscript> fallbacks leaking "<img …>" into names).
     if (tag === 'script' || tag === 'style' || tag === 'noscript' || tag === 'template') continue;
-    if (node.getAttribute('aria-hidden') === 'true' || node.hasAttribute('hidden')) continue;
-    const style = getComputedStyle(node);
-    if (style.display === 'none' || style.visibility === 'hidden') continue;
+    if (!includeHidden) {
+      if (node.getAttribute('aria-hidden') === 'true' || node.hasAttribute('hidden')) continue;
+      const style = getComputedStyle(node);
+      if (style.display === 'none' || style.visibility === 'hidden') continue;
+    }
     // A slot renders its assigned light-DOM nodes (fallback children when
     // nothing is slotted) — a shadow <button><slot></slot></button> is named
     // by the text the page slots in.
     if (tag === 'slot') {
       const assigned = node.assignedNodes?.() ?? [];
-      text += textFromNodes(assigned.length ? assigned : node.childNodes);
+      text += textFromNodes(assigned.length ? assigned : node.childNodes, includeHidden);
       continue;
     }
     if (tag === 'img' || tag === 'area') {
@@ -111,7 +153,7 @@ function textFromNodes(nodes) {
     }
     // Flat-tree descent: shadow content renders in place of a host's
     // light children (archive.org-style nested web components).
-    const fromSubtree = textFromNodes(node.shadowRoot ? node.shadowRoot.childNodes : node.childNodes);
+    const fromSubtree = textFromNodes(node.shadowRoot ? node.shadowRoot.childNodes : node.childNodes, includeHidden);
     if (fromSubtree.trim()) {
       text += fromSubtree;
       continue;

package/engine/lib/roles.js

@@ -24,57 +24,98 @@ export const GLOBAL_ARIA = new Set([
   'live', 'owns', 'relevant', 'roledescription', 'braillelabel', 'brailleroledescription',
 ]);
 
-/** Attributes each role supports IN ADDITION to the globals. */
+/** Attributes each role supports IN ADDITION to the globals.
+ *
+ *  Includes the four attributes ARIA 1.2 removed from the GLOBAL set
+ *  (aria-disabled, aria-errormessage, aria-haspopup, aria-invalid). The spec
+ *  still lists them on every role that used to inherit them, marked deprecated
+ *  on that role. Deprecated is not forbidden: the markup conforms and browsers
+ *  map it, so rejecting it reports a fault on a correct page. Leaving them out
+ *  cost 74 of the 81 roles here at least one false rejection. If deprecated
+ *  usage is ever worth surfacing, it belongs in best-practice, not in a
+ *  critical 4.1.2 failure. */
 export const ROLE_ARIA = {
-  link: ['disabled', 'expanded', 'haspopup'],
-  button: ['disabled', 'expanded', 'haspopup', 'pressed'],
-  checkbox: ['checked', 'disabled', 'errormessage', 'expanded', 'invalid', 'readonly', 'required'],
-  switch: ['checked', 'disabled', 'errormessage', 'expanded', 'invalid', 'readonly', 'required'],
-  radio: ['checked', 'disabled', 'posinset', 'setsize'],
-  option: ['selected', 'checked', 'disabled', 'posinset', 'setsize'],
-  tab: ['selected', 'disabled', 'expanded', 'haspopup', 'posinset', 'setsize'],
-  menuitem: ['disabled', 'expanded', 'haspopup', 'posinset', 'setsize'],
-  menuitemcheckbox: ['checked', 'disabled', 'expanded', 'haspopup', 'posinset', 'setsize'],
-  menuitemradio: ['checked', 'disabled', 'expanded', 'haspopup', 'posinset', 'setsize'],
+  link: ['disabled', 'errormessage', 'expanded', 'haspopup', 'invalid'],
+  button: ['disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'pressed'],
+  checkbox: ['checked', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required'],
+  switch: ['checked', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required'],
+  radio: ['checked', 'disabled', 'errormessage', 'haspopup', 'invalid', 'posinset', 'setsize'],
+  option: ['checked', 'disabled', 'errormessage', 'haspopup', 'invalid', 'posinset', 'selected', 'setsize'],
+  tab: ['disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'posinset', 'selected', 'setsize'],
+  menuitem: ['disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'posinset', 'setsize'],
+  menuitemcheckbox: ['checked', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'posinset', 'setsize'],
+  menuitemradio: ['checked', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'posinset', 'setsize'],
   textbox: ['activedescendant', 'autocomplete', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiline', 'placeholder', 'readonly', 'required'],
   searchbox: ['activedescendant', 'autocomplete', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiline', 'placeholder', 'readonly', 'required'],
   combobox: ['activedescendant', 'autocomplete', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required'],
-  listbox: ['activedescendant', 'disabled', 'errormessage', 'expanded', 'invalid', 'multiselectable', 'orientation', 'readonly', 'required'],
+  listbox: ['activedescendant', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'multiselectable', 'orientation', 'readonly', 'required'],
   slider: ['disabled', 'errormessage', 'haspopup', 'invalid', 'orientation', 'readonly', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  spinbutton: ['activedescendant', 'disabled', 'errormessage', 'invalid', 'readonly', 'required', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  progressbar: ['valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  meter: ['valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  scrollbar: ['disabled', 'orientation', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  heading: ['level'],
-  list: [],
-  listitem: ['level', 'posinset', 'setsize'],
-  row: ['colindex', 'disabled', 'expanded', 'level', 'posinset', 'rowindex', 'selected', 'setsize'],
-  rowgroup: [],
-  cell: ['colindex', 'colspan', 'rowindex', 'rowspan'],
-  gridcell: ['colindex', 'colspan', 'rowindex', 'rowspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'selected'],
-  columnheader: ['colindex', 'colspan', 'rowindex', 'rowspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'selected', 'sort'],
-  rowheader: ['colindex', 'colspan', 'rowindex', 'rowspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'selected', 'sort'],
-  table: ['colcount', 'rowcount'],
-  grid: ['activedescendant', 'colcount', 'disabled', 'multiselectable', 'readonly', 'rowcount'],
-  treegrid: ['activedescendant', 'colcount', 'disabled', 'errormessage', 'invalid', 'multiselectable', 'orientation', 'readonly', 'required', 'rowcount'],
-  tablist: ['activedescendant', 'disabled', 'multiselectable', 'orientation'],
-  menu: ['activedescendant', 'disabled', 'orientation'],
-  menubar: ['activedescendant', 'disabled', 'orientation'],
-  tree: ['activedescendant', 'disabled', 'errormessage', 'invalid', 'multiselectable', 'orientation', 'required'],
-  treeitem: ['checked', 'disabled', 'expanded', 'haspopup', 'level', 'posinset', 'selected', 'setsize'],
-  radiogroup: ['activedescendant', 'disabled', 'errormessage', 'invalid', 'orientation', 'readonly', 'required'],
-  group: ['activedescendant', 'disabled'],
-  separator: ['disabled', 'orientation', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
-  toolbar: ['activedescendant', 'disabled', 'orientation'],
-  dialog: ['modal'],
-  alertdialog: ['modal'],
-  application: ['activedescendant', 'disabled', 'expanded', 'haspopup'],
-  article: ['posinset', 'setsize'],
-  img: [], figure: [], document: [], feed: [], math: [], note: [], presentation: [], none: [],
-  banner: [], complementary: [], contentinfo: [], form: [], main: [], navigation: [], region: [], search: [],
-  alert: [], log: [], marquee: [], status: [], timer: [], tabpanel: [], tooltip: [],
-  definition: [], term: [], paragraph: [], generic: [], blockquote: [], caption: [], code: [],
-  emphasis: [], strong: [], time: [], deletion: [], insertion: [], subscript: [], superscript: [],
+  spinbutton: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'readonly', 'required', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
+  progressbar: ['disabled', 'errormessage', 'haspopup', 'invalid', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
+  meter: ['disabled', 'errormessage', 'haspopup', 'invalid', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
+  scrollbar: ['disabled', 'errormessage', 'haspopup', 'invalid', 'orientation', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
+  heading: ['disabled', 'errormessage', 'haspopup', 'invalid', 'level'],
+  list: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  listitem: ['disabled', 'errormessage', 'haspopup', 'invalid', 'level', 'posinset', 'setsize'],
+  row: ['activedescendant', 'colindex', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'level', 'posinset', 'rowindex', 'selected', 'setsize'],
+  rowgroup: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  cell: ['colindex', 'colspan', 'disabled', 'errormessage', 'haspopup', 'invalid', 'rowindex', 'rowspan'],
+  gridcell: ['colindex', 'colspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'rowindex', 'rowspan', 'selected'],
+  columnheader: ['colindex', 'colspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'rowindex', 'rowspan', 'selected', 'sort'],
+  rowheader: ['colindex', 'colspan', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'readonly', 'required', 'rowindex', 'rowspan', 'selected', 'sort'],
+  table: ['colcount', 'disabled', 'errormessage', 'haspopup', 'invalid', 'rowcount'],
+  grid: ['activedescendant', 'colcount', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiselectable', 'readonly', 'rowcount'],
+  treegrid: ['activedescendant', 'colcount', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiselectable', 'orientation', 'readonly', 'required', 'rowcount'],
+  tablist: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiselectable', 'orientation'],
+  menu: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'orientation'],
+  menubar: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'orientation'],
+  tree: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'multiselectable', 'orientation', 'required'],
+  treeitem: ['checked', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid', 'level', 'posinset', 'selected', 'setsize'],
+  radiogroup: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'orientation', 'readonly', 'required'],
+  group: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid'],
+  separator: ['disabled', 'errormessage', 'haspopup', 'invalid', 'orientation', 'valuemax', 'valuemin', 'valuenow', 'valuetext'],
+  toolbar: ['activedescendant', 'disabled', 'errormessage', 'haspopup', 'invalid', 'orientation'],
+  dialog: ['disabled', 'errormessage', 'haspopup', 'invalid', 'modal'],
+  alertdialog: ['disabled', 'errormessage', 'haspopup', 'invalid', 'modal'],
+  application: ['activedescendant', 'disabled', 'errormessage', 'expanded', 'haspopup', 'invalid'],
+  article: ['disabled', 'errormessage', 'haspopup', 'invalid', 'posinset', 'setsize'],
+  img: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  figure: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  document: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  feed: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  math: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  note: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  presentation: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  none: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  banner: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  complementary: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  contentinfo: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  form: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  main: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  navigation: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  region: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  search: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  alert: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  log: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  marquee: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  status: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  timer: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  tabpanel: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  tooltip: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  definition: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  term: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  paragraph: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  generic: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  blockquote: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  caption: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  code: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  emphasis: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  strong: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  time: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  deletion: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  insertion: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  subscript: ['disabled', 'errormessage', 'haspopup', 'invalid'],
+  superscript: ['disabled', 'errormessage', 'haspopup', 'invalid'],
 };
 
 const INPUT_ROLES = {

package/engine/rules/best-practice/landmark-unique.js

@@ -2,6 +2,7 @@
 // labels, and banner / contentinfo / main must be unique per page outright
 // (two "banners" are ambiguous however well they're labelled).
 import { implicitRole } from '../../lib/roles.js';
+import { labelledByName } from '../../lib/accessible-name.js';
 
 const SINGLETON = new Set(['banner', 'contentinfo', 'main']);
 
@@ -13,18 +14,11 @@ const landmarkRole = (element) =>
 
 // Landmarks are not name-from-content roles: only author-provided labels
 // distinguish them (the text inside a nav is its content, not its name).
-const landmarkName = (element) => {
-  const labelledby = element.getAttribute('aria-labelledby');
-  if (labelledby) {
-    const text = labelledby
-      .split(/\s+/)
-      .map((id) => element.ownerDocument.getElementById(id)?.textContent ?? '')
-      .join(' ')
-      .trim();
-    if (text) return text;
-  }
-  return element.getAttribute('aria-label')?.trim() || element.getAttribute('title')?.trim() || '';
-};
+const landmarkName = (element) =>
+  labelledByName(element)
+  || element.getAttribute('aria-label')?.trim()
+  || element.getAttribute('title')?.trim()
+  || '';
 
 export default {
   id: 'landmark-unique',

package/engine/rules/wcag/1.3.1-form-label.js

@@ -2,6 +2,8 @@
 // Instructions (Level A) · SC 4.1.2 Name, Role, Value (Level A)
 // 3.3.2 mapping: a field with no label at all, or only a vanishing
 // placeholder, is failure F82 — the classic 3.3.2 pattern.
+import { labelledByName } from '../../lib/accessible-name.js';
+
 export default {
   id: 'form-label',
   impact: 'critical',
@@ -30,12 +32,7 @@ export default {
       .join(' ')
       .trim();
     const ariaLabel = element.getAttribute('aria-label')?.trim();
-    const labelledby = (element.getAttribute('aria-labelledby') ?? '')
-      .split(/\s+/)
-      .filter(Boolean)
-      .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
-      .join(' ')
-      .trim();
+    const labelledby = labelledByName(element);
     if (labelsText || ariaLabel || labelledby) return { status: 'pass' };
 
     const id = element.id ? ` (it already has id="${element.id}")` : ' (give it an id first)';

package/engine/rules/wcag/1.4.11-non-text-contrast.js

@@ -22,7 +22,10 @@ export default {
   visibility: 'visual',
   evaluate(element) {
     // Inactive controls are exempt (same carve-out 1.4.3 makes).
-    if (element.disabled || element.closest('[aria-disabled="true"]')) return { status: 'pass' };
+    // `:disabled`, not `element.disabled`: the property misses a control
+    // disabled by an ancestor <fieldset disabled>, which 1.4.11 exempts as an
+    // inactive user interface component.
+    if (element.closest(':disabled, [aria-disabled="true"]')) return { status: 'pass' };
     // Zero-area controls (JS-widget hidden duplicates) paint no boundary
     // to judge.
     const ownRect = element.getBoundingClientRect();

package/engine/rules/wcag/1.4.3-control-contrast.js

@@ -20,7 +20,10 @@ export default {
   visibility: 'visual',
   evaluate(element) {
     // 1.4.3 exempts inactive controls.
-    if (element.disabled || element.closest('[aria-disabled="true"]')) return { status: 'pass' };
+    // `:disabled`, not `element.disabled`: the property reflects only the
+    // element's own attribute, so a control inside <fieldset disabled> reads
+    // false while the browser has it inactive and 1.4.3 exempts it.
+    if (element.closest(':disabled, [aria-disabled="true"]')) return { status: 'pass' };
     // Zero-area controls (JS-widget hidden duplicates) present no text.
     const rect = element.getBoundingClientRect();
     if (rect.width <= 1 || rect.height <= 1) return { status: 'pass' };

package/engine/rules/wcag/2.4.11-focus-not-obscured.js

@@ -76,7 +76,9 @@ export default {
       && rect.top >= overlay.top && rect.bottom <= overlay.bottom;
 
     return elements.map((element) => {
-      if (element.disabled) return { status: 'pass' };
+      // `:disabled` catches controls disabled by an ancestor fieldset, which
+      // the `disabled` property does not reflect — those never take focus.
+      if (element.matches(':disabled')) return { status: 'pass' };
       const rect = element.getBoundingClientRect();
       if (!rect.width || !rect.height) return { status: 'pass' };
       // Only in-viewport geometry is trustworthy (or cheap).

package/engine/rules/wcag/4.1.2-aria-field-name.js

@@ -5,20 +5,16 @@
 // Spec note (accname): input-like roles are NOT "name from content" — the
 // text inside a listbox/textbox does not name it, only author-provided
 // naming counts. Toggle roles (checkbox/radio/switch) DO name from content.
+import { labelledByName } from '../../lib/accessible-name.js';
+
 const AUTHOR_ONLY = ['textbox', 'searchbox', 'combobox', 'listbox', 'spinbutton', 'slider'];
 const FROM_CONTENT = ['checkbox', 'radio', 'switch'];
 
 function authorName(element) {
-  const labelledby = element.getAttribute('aria-labelledby');
-  if (labelledby) {
-    const text = labelledby
-      .split(/\s+/)
-      .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
-      .join(' ')
-      .trim();
-    if (text) return text;
-  }
-  return element.getAttribute('aria-label')?.trim() || element.getAttribute('title')?.trim() || '';
+  return labelledByName(element)
+    || element.getAttribute('aria-label')?.trim()
+    || element.getAttribute('title')?.trim()
+    || '';
 }
 
 export default {

package/engine/rules/wcag/4.1.2-aria-hidden-focus.js

@@ -23,7 +23,7 @@ export default {
     // property, so a faded WRAPPER (the standard off-canvas drawer) leaves
     // every control inside it computing opacity: 1 while none of them paint.
     const focusable = [element, ...element.querySelectorAll(FOCUSABLE)].filter(
-      (el) => el.matches?.(FOCUSABLE) && el.getAttribute('tabindex') !== '-1' && !el.disabled
+      (el) => el.matches?.(FOCUSABLE) && el.getAttribute('tabindex') !== '-1' && !el.matches(':disabled')
         // `inert` removes focusability outright — aria-hidden + inert is
         // the CORRECT modern pattern for off-canvas content, not a defect.
         && !el.closest('[inert]')

package/engine/rules/wcag/4.1.2-dialog-name.js

@@ -4,6 +4,8 @@
 // name. An open, unnamed modal announces as just "dialog", leaving
 // screen-reader users with no idea what interrupted them (cookie-consent
 // modals are the canonical offender).
+import { labelledByName } from '../../lib/accessible-name.js';
+
 export default {
   id: 'dialog-name',
   impact: 'serious',
@@ -14,15 +16,7 @@ export default {
   // dialogs the user can actually encounter are judged.
   selector: 'dialog, [role="dialog"], [role="alertdialog"]',
   evaluate(element) {
-    const labelledby = element.getAttribute('aria-labelledby');
-    if (labelledby) {
-      const text = labelledby
-        .split(/\s+/)
-        .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
-        .join(' ')
-        .trim();
-      if (text) return { status: 'pass' };
-    }
+    if (labelledByName(element)) return { status: 'pass' };
     if (element.getAttribute('aria-label')?.trim() || element.getAttribute('title')?.trim()) {
       return { status: 'pass' };
     }

package/engine/rules/wcag/4.1.2-nested-interactive.js

@@ -18,7 +18,7 @@ export default {
     // disabled controls, display:none templates, and tabindex="-1" nodes
     // inside a control are inert markup, not competing tab stops.
     const nested = [...element.querySelectorAll(INTERACTIVE)].find((el) =>
-      !el.disabled && el.getAttribute('tabindex') !== '-1'
+      !el.matches(':disabled') && el.getAttribute('tabindex') !== '-1'
       && !(el.tagName === 'INPUT' && el.type === 'hidden') && isRendered(el));
     if (!nested) return { status: 'pass' };
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",