pour-engine 1.7.0 → 1.8.0

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.7.0',
+    version: '1.8.0',
   },
 };

package/engine/lib/roles.js

@@ -150,6 +150,15 @@ export function implicitRole(element) {
   if (tag === 'img') return element.getAttribute('alt') === '' ? 'presentation' : 'img';
   if (tag === 'header') return element.closest('article, aside, main, nav, section') ? 'generic' : 'banner';
   if (tag === 'footer') return element.closest('article, aside, main, nav, section') ? 'generic' : 'contentinfo';
+  // HTML-AAM: an aside inside sectioning content is complementary only when
+  // it carries an accessible name; unnamed it is generic. Verified against
+  // Chromium's accessibility tree, which demotes exactly that case and keeps
+  // a top-level aside complementary whether named or not.
+  if (tag === 'aside') {
+    const sectioned = element.parentElement?.closest('article, aside, nav, section');
+    const named = element.hasAttribute('aria-label') || element.hasAttribute('aria-labelledby');
+    return sectioned && !named ? 'generic' : 'complementary';
+  }
   if (tag === 'section') {
     return element.hasAttribute('aria-label') || element.hasAttribute('aria-labelledby') ? 'region' : 'generic';
   }

package/engine/rules/wcag/4.1.2-aria-allowed-attr.js

@@ -1,7 +1,26 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
-// ARIA attributes must be supported by the element's role — aria-selected
-// on a plain link, aria-checked on a heading, etc. are ignored (or worse,
-// misreported) by assistive technology.
+// An ARIA attribute the role does not support is INERT. Measured in Chromium:
+// aria-expanded on a button exposes expanded=false, and the same attribute on
+// a complementary landmark exposes no state at all. It is dropped, not
+// misreported, so the old "announces the wrong state" wording was wrong.
+//
+// Which is why this REVIEWS rather than fails. ARIA 1.2 §5.2.3 says authors
+// MAY provide supported states and user agents MUST map them; "prohibited"
+// (§5.2.5) is a separate category this rule does not cover. An unsupported
+// attribute is therefore not a spec violation, and name, role and value are
+// all still conveyed correctly, so no success criterion provably fails.
+//
+// The 4.1.2 tag stays because there IS a real failure hiding here: if the
+// element genuinely has the state the author was reaching for, that state is
+// now invisible to assistive technology. Whether it does is exactly what the
+// DOM cannot establish, so it is a question for a person. Same reasoning that
+// put aria-label-misuse in best-practice.
+//
+// Worth knowing when comparing against other tools: aria-expanded WAS
+// inherited into complementary, banner, heading, img and list under ARIA 1.1,
+// and was narrowed in 1.2 (narrowed again in the 1.3 draft). Markup written
+// against 1.1 is not conforming under 1.2, and a tool on the older baseline
+// stays silent on it.
 import { GLOBAL_ARIA, ROLE_ARIA, KNOWN_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // aria-label/labelledby misuse on generic elements has its own rule
@@ -10,7 +29,7 @@ const HANDLED_ELSEWHERE = new Set(['label', 'labelledby']);
 
 export default {
   id: 'aria-allowed-attr',
-  impact: 'critical',
+  impact: 'moderate',
   tags: ['wcag2a', 'wcag412'],
   help: 'ARIA attributes must be allowed for the element’s role',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
@@ -35,10 +54,11 @@ export default {
 
     const disallowed = ariaAttrs.filter((name) => !GLOBAL_ARIA.has(name) && !allowed.includes(name));
     if (!disallowed.length) return { status: 'pass' };
+    const names = disallowed.map((n) => `aria-${n}`);
     return {
-      status: 'fail',
-      message: `${disallowed.map((n) => `aria-${n}`).join(', ')} is not supported on role "${role}" — assistive technology ignores it or announces the wrong state.`,
-      fix: `Use a role that supports ${disallowed.map((n) => `aria-${n}`).join('/')}, or remove the attribute(s).`,
+      status: 'incomplete',
+      message: `${names.join(', ')} is not supported on role "${role}", so the browser drops it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. If this element really does have that state, it is currently invisible: check whether it needs conveying another way.`,
+      fix: `Move ${names.join('/')} to the element whose role supports it, usually the control that toggles this one, or remove it if the element has no such state.`,
     };
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",