pour-engine 1.42.0 → 1.42.2

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.42.0',
+    version: '1.42.2',
   },
 };

package/engine/COVERAGE.md

@@ -113,7 +113,7 @@ meaning that only a person can settle, even where a rule decides most real pages
 
 | SC | Name | Level | Coverage | Rules |
 |---|---|---|---|---|
-| 4.1.2 | [Name, Role, Value](https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html) | A | Partially automated | input-image-alt, form-label, link-name, aria-allowed-attr, aria-attr-valid, aria-field-name, aria-hidden-focus, aria-label-misuse, aria-valid-refs, button-name, composite-widget-name, dialog-name, frame-title, invoker-target, label-for-valid, nested-interactive, role-required-aria, summary-name, valid-role |
+| 4.1.2 | [Name, Role, Value](https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html) | A | Partially automated | input-image-alt, form-label, link-name, aria-allowed-attr, aria-attr-valid, aria-field-name, aria-hidden-focus, aria-label-misuse, aria-valid-refs, button-name, composite-widget-name, frame-title, invoker-target, label-for-valid, nested-interactive, role-required-aria, summary-name, valid-role |
 | 4.1.3 | [Status Messages](https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html) | AA | Manual review | — |
 
 **Totals:** 51 partially automated · 35 manual — with 98 rules.

package/engine/rules/{wcag/4.1.2-dialog-name.js → best-practice/dialog-name.js}

@@ -1,18 +1,18 @@
-// WCAG SC 4.1.2 Name, Role, Value (Level A)
-// ARIA 1.2 marks dialog/alertdialog as name-required roles, and dialogs are
-// NOT name-from-content — the body text is the dialog's content, never its
-// name. An open, unnamed modal announces as just "dialog", leaving
-// screen-reader users with no idea what interrupted them (cookie-consent
-// modals are the canonical offender).
+// A dialog with no accessible name is announced as just "dialog". ARIA 1.2
+// requires authors to name one, but WCAG 4.1.2 is written for user interface
+// components, defined as controls, and a dialog is a container of controls
+// whose own names 4.1.2 already covers. So the pattern is an ARIA authoring
+// failure, not a WCAG one: demoted from 4.1.2 to best practice on 2026-09-13
+// after rnib.org.uk's unnamed cookie banner was challenged.
 import { labelledByName } from '../../lib/accessible-name.js';
 
 export default {
   id: 'dialog-name',
   name: 'Dialog names',
   impact: 'serious',
-  tags: ['wcag2a', 'wcag412'],
-  help: 'Dialogs must have an accessible name',
-  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  tags: ['best-practice'],
+  help: 'Dialogs should have an accessible name',
+  helpUrl: 'https://www.w3.org/WAI/ARIA/apg/patterns/dialog-modal/',
   // Default visibility filter: a closed <dialog> is display:none, so only
   // dialogs the user can actually encounter are judged.
   selector: 'dialog, [role="dialog"], [role="alertdialog"]',

package/engine/rules/index.js

@@ -76,7 +76,9 @@ import scrollableRegionFocusable from './wcag/2.1.1-scrollable-region-focusable.
 import tableHeaders from './wcag/1.3.1-table-headers.js';
 import contrastEnhanced from './wcag/1.4.6-contrast-enhanced.js';
 import targetSizeEnhanced from './wcag/2.5.5-target-size-enhanced.js';
-import dialogName from './wcag/4.1.2-dialog-name.js';
+// Demoted to best-practice 2026-09-13: ARIA requires a dialog name, but 4.1.2
+// covers controls and a dialog is their container (see the rule file).
+import dialogName from './best-practice/dialog-name.js';
 import controlContrast from './wcag/1.4.3-control-contrast.js';
 import nonTextContrast from './wcag/1.4.11-non-text-contrast.js';
 import textSpacing from './wcag/1.4.12-text-spacing.js';

package/engine/rules/wcag/1.3.4-orientation.js

@@ -66,19 +66,19 @@ function quarterTurn(style, win) {
 /** Walk the sheet in cascade order, keeping the LAST relevant declaration
  *  per root, orientation and property, so a later declaration in the same
  *  orientation block undoes an earlier lock. */
-function scanRules(rules, orientationContext, active, state, doc) {
+function scanRules(rules, orientationContext, active, state, doc, query) {
   const win = doc.defaultView;
   for (const rule of rules ?? []) {
     if (rule.type === win.CSSRule.SUPPORTS_RULE) {
       // An unsupported branch cannot apply in either orientation.
-      if (win.CSS.supports(rule.conditionText)) scanRules(rule.cssRules, orientationContext, active, state, doc);
+      if (query.supports(rule.conditionText)) scanRules(rule.cssRules, orientationContext, active, state, doc, query);
       continue;
     }
     if (rule.type === win.CSSRule.MEDIA_RULE) {
       const condition = rule.conditionText ?? rule.media.mediaText;
       const orientation = /orientation\s*:\s*(portrait|landscape)/i.exec(condition)?.[1];
       const context = orientation ? { condition, orientation } : orientationContext;
-      scanRules(rule.cssRules, context, active && win.matchMedia(condition).matches, state, doc);
+      scanRules(rule.cssRules, context, active && query.media(condition), state, doc, query);
       continue;
     }
     if (orientationContext && rule.style) {
@@ -104,7 +104,7 @@ function scanRules(rules, orientationContext, active, state, doc) {
     // Layers and other grouping rules retain the surrounding media state.
     // Unknown conditional groups cannot establish an active restriction.
     if (rule.cssRules) scanRules(rule.cssRules, orientationContext,
-      active && rule.conditionText === undefined, state, doc);
+      active && rule.conditionText === undefined, state, doc, query);
   }
 }
 
@@ -121,13 +121,30 @@ export default {
     const doc = element.ownerDocument;
     const win = doc.defaultView;
     const state = new Map();
+    // Each media and supports condition is asked once per audit. Framework
+    // stylesheets repeat a handful of breakpoints thousands of times: ethz.ch
+    // carries 10,604 @media blocks over 98 distinct conditions, and asking
+    // matchMedia for every block cost this rule about half of its 10 ms there
+    // (measured 2026-09-13). The answers cannot change within one pass.
+    const mediaAnswers = new Map();
+    const supportsAnswers = new Map();
+    const query = {
+      media: (condition) => {
+        if (!mediaAnswers.has(condition)) mediaAnswers.set(condition, win.matchMedia(condition).matches);
+        return mediaAnswers.get(condition);
+      },
+      supports: (condition) => {
+        if (!supportsAnswers.has(condition)) supportsAnswers.set(condition, win.CSS.supports(condition));
+        return supportsAnswers.get(condition);
+      },
+    };
     for (const sheet of doc.styleSheets) {
       if (sheet.disabled) continue;
       const media = sheet.media?.mediaText;
-      if (media && !win.matchMedia(media).matches) continue;
+      if (media && !query.media(media)) continue;
       let rules;
       try { rules = sheet.cssRules; } catch { continue; } // cross-origin: unreadable, skip
-      scanRules(rules, null, true, state, doc);
+      scanRules(rules, null, true, state, doc, query);
     }
     const findings = [];
     for (const [key, entry] of state) {

package/engine/rules/wcag/4.1.2-nested-interactive.js

@@ -31,7 +31,14 @@ export default {
     const candidates = [...element.querySelectorAll(INTERACTIVE)].filter((el) =>
       !el.matches(':disabled') && !isInert(el)
       && !(el.tagName === 'INPUT' && el.type === 'hidden') && isRendered(el)
-      && !el.closest('[aria-hidden="true"]')
+      // aria-hidden content that Tab reaches is aria-hidden-focus's finding.
+      // aria-hidden content with a negative tabindex is not, yet a click or a
+      // script still moves focus onto it, and ARIA 1.2 says authors SHOULD NOT
+      // hide an element that "may receive focus, either directly via
+      // interaction with the user or indirectly via programmatic means", so
+      // it stays a candidate here.
+      // https://www.w3.org/TR/wai-aria-1.2/#aria-hidden
+      && !(el.closest('[aria-hidden="true"]') && !(el.hasAttribute('tabindex') && el.tabIndex < 0))
       && (el.matches(NATIVE) || el.hasAttribute('tabindex')));
     // A child requiring review must not conceal a later definite finding.
     const nested = candidates.find((el) => !(el.hasAttribute('tabindex') && el.tabIndex < 0)) ?? candidates[0];
@@ -45,7 +52,9 @@ export default {
       && !element.matches('a[href], button')) {
       return {
         status: 'incomplete',
-        message: `This control contains an element (<${nested.tagName.toLowerCase()}>) with a negative tabindex. It can still receive focus. Check that both controls expose the intended name and role, and that focusing and activating the child works correctly.`,
+        message: nested.closest('[aria-hidden="true"]')
+          ? `This control contains an element (<${nested.tagName.toLowerCase()}>) that is hidden from assistive technology but can still receive focus from a click or a script. Focus landing there lands on content a screen reader cannot see. Check whether it can take focus, and if it can, remove it from focus or from aria-hidden.`
+          : `This control contains an element (<${nested.tagName.toLowerCase()}>) with a negative tabindex. It can still receive focus. Check that both controls expose the intended name and role, and that focusing and activating the child works correctly.`,
       };
     }
     // <summary> is the one outer control HTML does not forbid this on: its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.42.0",
+  "version": "1.42.2",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",