pour-engine 1.8.0 → 1.9.0

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.8.0',
+    version: '1.9.0',
   },
 };

package/engine/COVERAGE.md

@@ -111,7 +111,7 @@ meaning that only a person can settle, even where a rule decides most real pages
 
 | SC | Name | Level | Coverage | Rules |
 |---|---|---|---|---|
-| 4.1.2 | [Name, Role, Value](https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html) | A | Partially automated | input-image-alt, form-label, link-name, aria-allowed-attr, aria-attr-valid, aria-field-name, aria-hidden-focus, aria-valid-refs, button-name, dialog-name, frame-title, label-for-valid, nested-interactive, role-required-aria, valid-role |
+| 4.1.2 | [Name, Role, Value](https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html) | A | Partially automated | input-image-alt, form-label, link-name, aria-attr-valid, aria-field-name, aria-hidden-focus, aria-valid-refs, button-name, dialog-name, frame-title, label-for-valid, nested-interactive, role-required-aria, valid-role |
 | 4.1.3 | [Status Messages](https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html) | AA | Manual review | — |
 
 **Totals:** 30 partially automated · 56 manual — with 74 rules.

package/engine/rules/{wcag/4.1.2-aria-allowed-attr.js → best-practice/aria-allowed-attr.js}

@@ -1,26 +1,30 @@
-// WCAG SC 4.1.2 Name, Role, Value (Level A)
-// An ARIA attribute the role does not support is INERT. Measured in Chromium:
-// aria-expanded on a button exposes expanded=false, and the same attribute on
-// a complementary landmark exposes no state at all. It is dropped, not
-// misreported, so the old "announces the wrong state" wording was wrong.
+// ARIA 1.2 §8.6, repeated verbatim in the 1.3 draft: "authors MUST only use
+// non-global states and properties on elements with a role supporting the
+// state or property". An unsupported attribute breaks that MUST, so this is a
+// real, provable authoring error and the rule asserts it.
 //
-// Which is why this REVIEWS rather than fails. ARIA 1.2 §5.2.3 says authors
-// MAY provide supported states and user agents MUST map them; "prohibited"
-// (§5.2.5) is a separate category this rule does not cover. An unsupported
-// attribute is therefore not a spec violation, and name, role and value are
-// all still conveyed correctly, so no success criterion provably fails.
+// It is NOT a WCAG failure, which is why it lives here rather than under
+// 4.1.2. An unsupported attribute is INERT, measured in Chromium:
+// aria-expanded on a button exposes expanded=false, while the same attribute
+// on a complementary landmark exposes no state at all. It is dropped, not
+// misreported. So the role is still exposed, the name is still computed, and
+// nothing is announced incorrectly. Name, role and value all survive, which
+// is all 4.1.2 asks for.
 //
-// The 4.1.2 tag stays because there IS a real failure hiding here: if the
-// element genuinely has the state the author was reaching for, that state is
-// now invisible to assistive technology. Whether it does is exactly what the
-// DOM cannot establish, so it is a question for a person. Same reasoning that
-// put aria-label-misuse in best-practice.
+// What CAN fail 4.1.2 is the thing underneath: if the element genuinely has
+// the state the author reached for, that state is now invisible. Whether it
+// does is exactly what the DOM cannot establish, so the message asks rather
+// than asserts. Reporting the ARIA error as a WCAG violation would have been
+// asserting a criterion failure off the back of a question.
+//
+// Note "unsupported" is distinct from "prohibited" (§5.2.5), a separate
+// category about naming that this rule does not cover.
 //
 // Worth knowing when comparing against other tools: aria-expanded WAS
 // inherited into complementary, banner, heading, img and list under ARIA 1.1,
 // and was narrowed in 1.2 (narrowed again in the 1.3 draft). Markup written
 // against 1.1 is not conforming under 1.2, and a tool on the older baseline
-// stays silent on it.
+// stays silent on it. Neither reading is a bug; they are different editions.
 import { GLOBAL_ARIA, ROLE_ARIA, KNOWN_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // aria-label/labelledby misuse on generic elements has its own rule
@@ -30,9 +34,9 @@ const HANDLED_ELSEWHERE = new Set(['label', 'labelledby']);
 export default {
   id: 'aria-allowed-attr',
   impact: 'moderate',
-  tags: ['wcag2a', 'wcag412'],
-  help: 'ARIA attributes must be allowed for the element’s role',
-  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  tags: ['best-practice'],
+  help: 'ARIA attributes must be supported by the element’s role',
+  helpUrl: 'https://www.w3.org/TR/wai-aria-1.2/#state_property_processing',
   selector: '*',
   visibleOnly: false,
   evaluate(element) {
@@ -56,9 +60,9 @@ export default {
     if (!disallowed.length) return { status: 'pass' };
     const names = disallowed.map((n) => `aria-${n}`);
     return {
-      status: 'incomplete',
-      message: `${names.join(', ')} is not supported on role "${role}", so the browser drops it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. If this element really does have that state, it is currently invisible: check whether it needs conveying another way.`,
-      fix: `Move ${names.join('/')} to the element whose role supports it, usually the control that toggles this one, or remove it if the element has no such state.`,
+      status: 'fail',
+      message: `${names.join(', ')} is not supported on role "${role}", so the browser drops it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. If this element really does have that state, it is currently invisible to anyone using a screen reader.`,
+      fix: `Move ${names.join('/')} to the element whose role supports it, usually the control that toggles this one, or remove it if the element has no such state. Adding a role to this element to make the attribute legal is rarely right: the host language restricts which roles each element may take.`,
     };
   },
 };

package/engine/rules/index.js

@@ -42,7 +42,10 @@ import audioControl from './wcag/1.4.2-audio-control.js';
 import pauseStopHide from './wcag/2.2.2-pause-stop-hide.js';
 import mediaCaptions from './wcag/1.2.2-media-captions.js';
 import ariaAttrValid from './wcag/4.1.2-aria-attr-valid.js';
-import ariaAllowedAttr from './wcag/4.1.2-aria-allowed-attr.js';
+// Demoted to best-practice: an unsupported ARIA attribute breaks an ARIA
+// author MUST (1.2 §8.6) but is INERT, so name, role and value all survive
+// and no success criterion fails (see the note in the rule file).
+import ariaAllowedAttr from './best-practice/aria-allowed-attr.js';
 import ariaFieldName from './wcag/4.1.2-aria-field-name.js';
 // Demoted to best-practice: prohibited-but-inert ARIA on a generic element
 // fails no success criterion (see the note in the rule file).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",