pour-engine 1.42.1 → 1.42.2

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.42.1',
+    version: '1.42.2',
   },
 };

package/engine/rules/wcag/1.3.4-orientation.js

@@ -66,19 +66,19 @@ function quarterTurn(style, win) {
 /** Walk the sheet in cascade order, keeping the LAST relevant declaration
  *  per root, orientation and property, so a later declaration in the same
  *  orientation block undoes an earlier lock. */
-function scanRules(rules, orientationContext, active, state, doc) {
+function scanRules(rules, orientationContext, active, state, doc, query) {
   const win = doc.defaultView;
   for (const rule of rules ?? []) {
     if (rule.type === win.CSSRule.SUPPORTS_RULE) {
       // An unsupported branch cannot apply in either orientation.
-      if (win.CSS.supports(rule.conditionText)) scanRules(rule.cssRules, orientationContext, active, state, doc);
+      if (query.supports(rule.conditionText)) scanRules(rule.cssRules, orientationContext, active, state, doc, query);
       continue;
     }
     if (rule.type === win.CSSRule.MEDIA_RULE) {
       const condition = rule.conditionText ?? rule.media.mediaText;
       const orientation = /orientation\s*:\s*(portrait|landscape)/i.exec(condition)?.[1];
       const context = orientation ? { condition, orientation } : orientationContext;
-      scanRules(rule.cssRules, context, active && win.matchMedia(condition).matches, state, doc);
+      scanRules(rule.cssRules, context, active && query.media(condition), state, doc, query);
       continue;
     }
     if (orientationContext && rule.style) {
@@ -104,7 +104,7 @@ function scanRules(rules, orientationContext, active, state, doc) {
     // Layers and other grouping rules retain the surrounding media state.
     // Unknown conditional groups cannot establish an active restriction.
     if (rule.cssRules) scanRules(rule.cssRules, orientationContext,
-      active && rule.conditionText === undefined, state, doc);
+      active && rule.conditionText === undefined, state, doc, query);
   }
 }
 
@@ -121,13 +121,30 @@ export default {
     const doc = element.ownerDocument;
     const win = doc.defaultView;
     const state = new Map();
+    // Each media and supports condition is asked once per audit. Framework
+    // stylesheets repeat a handful of breakpoints thousands of times: ethz.ch
+    // carries 10,604 @media blocks over 98 distinct conditions, and asking
+    // matchMedia for every block cost this rule about half of its 10 ms there
+    // (measured 2026-09-13). The answers cannot change within one pass.
+    const mediaAnswers = new Map();
+    const supportsAnswers = new Map();
+    const query = {
+      media: (condition) => {
+        if (!mediaAnswers.has(condition)) mediaAnswers.set(condition, win.matchMedia(condition).matches);
+        return mediaAnswers.get(condition);
+      },
+      supports: (condition) => {
+        if (!supportsAnswers.has(condition)) supportsAnswers.set(condition, win.CSS.supports(condition));
+        return supportsAnswers.get(condition);
+      },
+    };
     for (const sheet of doc.styleSheets) {
       if (sheet.disabled) continue;
       const media = sheet.media?.mediaText;
-      if (media && !win.matchMedia(media).matches) continue;
+      if (media && !query.media(media)) continue;
       let rules;
       try { rules = sheet.cssRules; } catch { continue; } // cross-origin: unreadable, skip
-      scanRules(rules, null, true, state, doc);
+      scanRules(rules, null, true, state, doc, query);
     }
     const findings = [];
     for (const [key, entry] of state) {

package/engine/rules/wcag/4.1.2-nested-interactive.js

@@ -31,7 +31,14 @@ export default {
     const candidates = [...element.querySelectorAll(INTERACTIVE)].filter((el) =>
       !el.matches(':disabled') && !isInert(el)
       && !(el.tagName === 'INPUT' && el.type === 'hidden') && isRendered(el)
-      && !el.closest('[aria-hidden="true"]')
+      // aria-hidden content that Tab reaches is aria-hidden-focus's finding.
+      // aria-hidden content with a negative tabindex is not, yet a click or a
+      // script still moves focus onto it, and ARIA 1.2 says authors SHOULD NOT
+      // hide an element that "may receive focus, either directly via
+      // interaction with the user or indirectly via programmatic means", so
+      // it stays a candidate here.
+      // https://www.w3.org/TR/wai-aria-1.2/#aria-hidden
+      && !(el.closest('[aria-hidden="true"]') && !(el.hasAttribute('tabindex') && el.tabIndex < 0))
       && (el.matches(NATIVE) || el.hasAttribute('tabindex')));
     // A child requiring review must not conceal a later definite finding.
     const nested = candidates.find((el) => !(el.hasAttribute('tabindex') && el.tabIndex < 0)) ?? candidates[0];
@@ -45,7 +52,9 @@ export default {
       && !element.matches('a[href], button')) {
       return {
         status: 'incomplete',
-        message: `This control contains an element (<${nested.tagName.toLowerCase()}>) with a negative tabindex. It can still receive focus. Check that both controls expose the intended name and role, and that focusing and activating the child works correctly.`,
+        message: nested.closest('[aria-hidden="true"]')
+          ? `This control contains an element (<${nested.tagName.toLowerCase()}>) that is hidden from assistive technology but can still receive focus from a click or a script. Focus landing there lands on content a screen reader cannot see. Check whether it can take focus, and if it can, remove it from focus or from aria-hidden.`
+          : `This control contains an element (<${nested.tagName.toLowerCase()}>) with a negative tabindex. It can still receive focus. Check that both controls expose the intended name and role, and that focusing and activating the child works correctly.`,
       };
     }
     // <summary> is the one outer control HTML does not forbid this on: its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.42.1",
+  "version": "1.42.2",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",