axe-cuprite 0.2.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91d61bb330869ef24f40d7b9c09859daf23212f99dd8b6c14506238d48cfe9f2
-  data.tar.gz: 0d023ead7e8245bf03d428ef4912c093a32888c7528d0e95307ca3036a77db2b
+  metadata.gz: e56b57fadf23c8ab623bd1a3005d94ce158832160a9ec3bfd1591b070312d953
+  data.tar.gz: 2cdad2a18469b669266938df7476040d702b53419bb8a80076e918c282bf218e
 SHA512:
-  metadata.gz: b41901a481d94378f0945a89cc4e7e4d6c3f198d45e06737d910841657aaaba6b4f8ccb32538cfb7af45607ea25049787e8a47b85e6e63a45845af7744a1033c
-  data.tar.gz: 906bb0a2bc25c10140185a9385192c1f629ef3803447cf31862f96e0c9f9d41589da8cb317b8220c6d3ffa37390eb8fe33f1f72729e243c8034104df12e4ae6a
+  metadata.gz: 2262ff93c4a88cda10c54d650b74f9353d8d1ae98f0f0a4df82b1483cc755e6347e23be923dedee4fffa726de3229ae4f4e9a00d18f704750f21513038d2515e
+  data.tar.gz: 8f001777544278d53266271b66c9d93bb32e0ed2d9e8969fa2413d69342649028be46c78c40706ec526e863c2fa13106a451856b7dfa7db8d23e0852b3367a9f

data/CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-06-16
+
+First stable release. No functional changes since `0.2.0` — this tags the API as
+stable under [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The
+public API is the documented surface of `AxeCuprite`, `AxeCuprite::Configuration`,
+`AxeCuprite::Runner`, the result wrappers (`Results`/`Violation`/`Node`/
+`ContrastData`), the error classes, and the RSpec matcher DSL; classes such as
+`AxeCuprite::Injector` and `AxeCuprite::DeepFreeze` are internal and not covered
+by the stability guarantee.
+
+### Fixed
+- The packaged gem no longer ships the dev-only vendoring rake tasks
+  (`lib/axe/cuprite/tasks/*.rake` — `axe:update` / `axe:verify` / `axe:version`).
+  These operate on the gem's read-only, version-pinned `vendor/` directory and
+  `axe:verify` couldn't even run from an installed gem (its recorded checksum
+  isn't shipped), so they were broken for consumers. They remain available in a
+  repo checkout for development
+  ([#32](https://github.com/Guided-Rails/axe-cuprite/issues/32)).
+
+### Changed
+- Repositioned as **Cuprite-only**: the README, gemspec `description`, and
+  `AGENTS.md` no longer advertise support for "any real-browser Capybara driver."
+  Cuprite is the only supported and tested driver; the driver-neutral JS approach
+  is described as the implementation detail that makes the gem work on Cuprite
+  (and avoid Selenium internals), not a promise of broad driver support. The
+  best-effort non-Ferrum fallback in `Injector#evaluate_axe` is kept but is now
+  documented as unsupported/untested
+  ([#31](https://github.com/Guided-Rails/axe-cuprite/issues/31)).
+- Documented that `AxeCuprite::Results` (and its nested wrappers) takes ownership
+  of the hash passed in and deep-freezes it **in place** — so a caller
+  constructing `Results.new(hash)` shouldn't pass or reuse a hash they intend to
+  mutate afterward. No behavior change; clarifies the existing read-only contract
+  in the `Results` doc comment and the README runner section
+  ([#33](https://github.com/Guided-Rails/axe-cuprite/issues/33)).
+
+### Added
+- A unit test pinning the best-effort non-Ferrum fallback in
+  `Injector#evaluate_axe`: with no Ferrum page it routes through
+  `evaluate_async_script` under the explicit timeout rather than
+  `Capybara.default_max_wait_time`, so the path can't silently break
+  ([#31](https://github.com/Guided-Rails/axe-cuprite/issues/31)).
+
 ## [0.2.0] - 2026-06-10
 
 ### Added
@@ -97,3 +139,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   auto-inject toggle, and report-only mode.
 - `rake axe:update[VERSION]` to refresh the vendored axe-core engine and bump
   the `AXE_CORE_VERSION` constant.
+
+[Unreleased]: https://github.com/Guided-Rails/axe-cuprite/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/Guided-Rails/axe-cuprite/compare/v0.2.0...v1.0.0
+[0.2.0]: https://github.com/Guided-Rails/axe-cuprite/compare/v0.1.1...v0.2.0
+[0.1.1]: https://github.com/Guided-Rails/axe-cuprite/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/Guided-Rails/axe-cuprite/releases/tag/v0.1.0

data/README.md

@@ -1,5 +1,9 @@
 # axe-cuprite
 
+[![Gem Version](https://img.shields.io/gem/v/axe-cuprite)](https://rubygems.org/gems/axe-cuprite)
+[![CI](https://github.com/Guided-Rails/axe-cuprite/actions/workflows/ci.yml/badge.svg)](https://github.com/Guided-Rails/axe-cuprite/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE.txt)
+
 Run the [axe-core](https://github.com/dequelabs/axe-core) accessibility engine
 against pages in your **Capybara system/feature tests driven by
 [Cuprite](https://github.com/rubycdp/cuprite)** (the CDP/Ferrum headless-Chrome
@@ -23,13 +27,24 @@ they break.
 just a JavaScript file — a driver-agnostic engine — so we drive it exclusively
 through Capybara's **driver-neutral** JavaScript API (`execute_script`,
 `evaluate_async_script`), which Cuprite fully implements. That single decision is
-what makes this gem work where the official one doesn't. As a bonus it stays
-driver-agnostic (it works on any real-browser Capybara driver), but **Cuprite is
-the primary, must-pass target.**
+what makes this gem work where the official one doesn't.
+
+**Cuprite is the only supported and tested driver.** Driving axe through the
+driver-neutral JS API is what lets the gem avoid Selenium internals — not a promise
+of broad driver support. Other real-browser drivers may happen to work (a
+best-effort fallback exists), but they are unsupported and untested.
 
 There is no runtime dependency on Selenium, Cuprite, or Ferrum — the only runtime
 dependency is Capybara. You bring your own driver.
 
+## Requirements
+
+- **Ruby** >= 3.0
+- **Capybara** >= 3.0, < 4.0 (the only runtime dependency)
+- **[Cuprite](https://github.com/rubycdp/cuprite)** as the Capybara driver — the
+  only supported and tested driver
+- **Chrome or Chromium**, which Cuprite drives over CDP
+
 ## Installation
 
 ```ruby
@@ -146,6 +161,13 @@ on top of your configured defaults. Only `violations` and `incomplete` are
 carried back across the CDP boundary — the full results object (with
 `passes`/`inapplicable`) can be huge.
 
+`AxeCuprite::Results` is read-only: it **takes ownership of the hash it's given
+and deep-freezes it in place** (this backs the read-only `raw`/`to_h` contract).
+You normally get one straight from `Runner#run`, so this is transparent — but if
+you construct `Results.new(hash)` yourself, don't pass or keep a reference to a
+hash you intend to mutate afterward, or you'll hit a `FrozenError`. Dup it first
+if you need a mutable copy.
+
 ## Configuration
 
 ```ruby
@@ -197,10 +219,11 @@ page routinely exceeds.
 axe-cuprite avoids this trap: on Cuprite it calls Ferrum's
 `page.evaluate_async(script, explicit_wait, *args)` **directly**, with its own
 timeout (default **30s**, configurable) that is completely **decoupled from
-`default_max_wait_time`**. On non-Ferrum drivers it falls back to
-`evaluate_async_script` under a temporarily-raised wait time. If axe still
-doesn't finish, you get a clear `AxeCuprite::TimeoutError` telling you to raise
-the timeout or scope the run with `.within`.
+`default_max_wait_time`**. (On a non-Ferrum driver there is a best-effort,
+untested fallback to `evaluate_async_script` under a temporarily-raised wait time —
+but Cuprite is the only supported driver.) If axe still doesn't finish, you get a
+clear `AxeCuprite::TimeoutError` telling you to raise the timeout or scope the run
+with `.within`.
 
 Tune it globally (`c.timeout = 60`) or per assertion (`.with_timeout(60)`).
 
@@ -252,6 +275,22 @@ sha512 of the vendored engine is recorded in
 with `rake axe:verify` (CI does this on every run). Note the bump in
 `CHANGELOG.md`.
 
+## Versioning
+
+axe-cuprite follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+The **public API** covered by that guarantee is the documented surface:
+`AxeCuprite` (module methods), `AxeCuprite::Configuration`, `AxeCuprite::Runner`,
+the result wrappers (`Results` / `Violation` / `Node` / `ContrastData`), the error
+classes, and the RSpec matcher DSL (`be_axe_clean` / `be_accessible` and its
+chainers). Classes like `AxeCuprite::Injector` and `AxeCuprite::DeepFreeze` are
+internal implementation details and may change in any release. Breaking changes to
+the public API only land in a major version, and every release is noted in
+[`CHANGELOG.md`](CHANGELOG.md).
+
+Note that the **vendored axe-core version** can change in a minor release; axe may
+report new violations after an engine bump, which can turn a previously-green
+suite red. Such bumps are always called out in the changelog.
+
 ## Licensing
 
 - **axe-cuprite's own code** is licensed under the **MIT** license — see

data/lib/axe/cuprite/results.rb

@@ -26,6 +26,13 @@ module AxeCuprite
   #
   # The wrappers are read-only: `@raw` is deep-frozen at construction, so `raw`
   # and `to_h` expose the live underlying hash safely (callers cannot mutate it).
+  #
+  # Ownership note: `Results` (and the nested `Violation`/`Node`/`ContrastData`
+  # wrappers) **take ownership of the hash passed in and deep-freeze it in place**
+  # — they do not copy first. For the internal flow this is safe (the payload
+  # comes fresh off the CDP boundary), but if you construct `Results.new(hash)`
+  # yourself, don't pass — or hold onto — a hash you intend to mutate afterward,
+  # or you'll hit a `FrozenError`. Dup it first if you need a mutable copy.
   class Results
     attr_reader :raw
 

data/lib/axe/cuprite/runner.rb

@@ -73,11 +73,7 @@ module AxeCuprite
     # axe accepts a selector string, or {include:, exclude:}. Stringify hash
     # keys so Ferrum serializes them predictably across CDP.
     def normalize_context(context)
-      case context
-      when nil, String then context
-      when Hash then deep_stringify(context)
-      else context
-      end
+      context.is_a?(Hash) ? deep_stringify(context) : context
     end
 
     def deep_stringify(value)

data/lib/axe/cuprite/version.rb

@@ -2,7 +2,7 @@
 
 module AxeCuprite
   # Version of the axe-cuprite gem itself.
-  VERSION = "0.2.0"
+  VERSION = "1.0.0"
 
   # Version of the axe-core engine vendored under lib/axe/cuprite/vendor/axe.min.js.
   # Keep this in sync with the vendored file via `rake axe:update`.

data/lib/axe/cuprite.rb

@@ -8,8 +8,10 @@ require "axe/cuprite/injector"
 require "axe/cuprite/runner"
 
 # axe-cuprite drives the axe-core accessibility engine through Capybara's
-# driver-neutral JavaScript API, so it works with Cuprite (Ferrum/CDP) and any
-# other real-browser Capybara driver — without ever touching Selenium internals.
+# driver-neutral JavaScript API. That approach is what lets it avoid Selenium
+# internals and work on Cuprite (Ferrum/CDP) — the only supported and tested
+# driver. Other real-browser drivers may work via a best-effort, untested
+# fallback, but they are unsupported.
 #
 # Quick start:
 #

data/lib/axe-cuprite.rb

@@ -1,5 +1,3 @@
 # frozen_string_literal: true
 
-# Convenience entry point so `require "axe-cuprite"` works.
-# The canonical require path is "axe/cuprite".
 require "axe/cuprite"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: axe-cuprite
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Abdullah Hashim
@@ -29,165 +29,13 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4.0'
-- !ruby/object:Gem::Dependency
-  name: cuprite
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.17'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.17'
-- !ruby/object:Gem::Dependency
-  name: ferrum
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.17'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.17'
-- !ruby/object:Gem::Dependency
-  name: puma
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '9.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '9.0'
-- !ruby/object:Gem::Dependency
-  name: rack
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
-- !ruby/object:Gem::Dependency
-  name: rackup
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.86'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.86'
-- !ruby/object:Gem::Dependency
-  name: rubocop-rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.7'
-- !ruby/object:Gem::Dependency
-  name: rubocop-rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 description: |
   axe-cuprite runs the axe-core accessibility engine against pages rendered in
   Capybara system/feature tests and exposes the results as RSpec matchers
   (be_axe_clean / be_accessible). Unlike Deque's official axe-core-capybara gem,
   it never touches Selenium-specific driver internals: axe is driven entirely
-  through Capybara's driver-neutral JavaScript API, so it works with Cuprite
-  and any other real-browser driver.
+  through Capybara's driver-neutral JavaScript API, which is what makes it work
+  on Cuprite. Cuprite is the only supported and tested driver.
 email:
 - abdullah@guidedrails.com
 executables: []
@@ -207,7 +55,6 @@ files:
 - lib/axe/cuprite/rspec.rb
 - lib/axe/cuprite/rspec/matchers.rb
 - lib/axe/cuprite/runner.rb
-- lib/axe/cuprite/tasks/axe.rake
 - lib/axe/cuprite/vendor/axe-core-LICENSE.txt
 - lib/axe/cuprite/vendor/axe.min.js
 - lib/axe/cuprite/version.rb
@@ -217,6 +64,8 @@ licenses:
 metadata:
   source_code_uri: https://github.com/Guided-Rails/axe-cuprite
   changelog_uri: https://github.com/Guided-Rails/axe-cuprite/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/Guided-Rails/axe-cuprite/issues
+  documentation_uri: https://github.com/Guided-Rails/axe-cuprite/blob/main/README.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:

data/lib/axe/cuprite/tasks/axe.rake

@@ -1,169 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "fileutils"
-require "json"
-require "open-uri"
-require "rubygems/package"
-require "stringio"
-require "zlib"
-
-namespace :axe do
-  desc "Refresh the vendored axe-core engine. Usage: rake 'axe:update[4.12.0]' or VERSION=4.12.0 rake axe:update (default: latest)"
-  task :update, [:version] do |_task, args|
-    version = args[:version] || ENV["VERSION"] || AxeCupriteVendor.latest_version
-    AxeCupriteVendor.update!(version)
-  end
-
-  desc "Print the currently vendored axe-core version"
-  task :version do
-    puts AxeCupriteVendor.vendored_version
-  end
-
-  desc "Verify the vendored axe.min.js against its recorded sha512 checksum"
-  task :verify do
-    AxeCupriteVendor.verify_vendored!
-  end
-end
-
-# Helpers for vendoring axe-core. Kept in a module so the rake tasks stay thin
-# and the logic is easy to read. Never used at runtime — vendoring is a
-# development-time step; the engine ships in the gem.
-#
-# Supply-chain note: the vendored axe.min.js is the JavaScript this gem injects
-# into every consumer's browser session, so its integrity is the gem's most
-# important supply-chain property. We therefore download the *official npm
-# tarball* from registry.npmjs.org (not a CDN re-serving it), verify it against
-# the sha512 integrity the registry publishes in its metadata, and abort on any
-# mismatch before a single byte is written. The verified content hash of the
-# extracted axe.min.js is recorded next to it (axe.min.js.sha512) so reviewers
-# and CI can re-check the vendored artifact without re-downloading.
-module AxeCupriteVendor
-  VENDOR_DIR   = File.expand_path("../vendor", __dir__)
-  AXE_JS       = File.join(VENDOR_DIR, "axe.min.js")
-  AXE_SHA512   = File.join(VENDOR_DIR, "axe.min.js.sha512")
-  AXE_LICENSE  = File.join(VENDOR_DIR, "axe-core-LICENSE.txt")
-  VERSION_FILE = File.expand_path("../version.rb", __dir__)
-  REGISTRY     = "https://registry.npmjs.org/axe-core"
-
-  module_function
-
-  # A semver-ish version string: three dot-separated numbers with an optional
-  # prerelease suffix. Rejecting anything else keeps the value safe to splice
-  # into the registry URL and into version.rb, and catches honest typos before
-  # they corrupt the vendor directory.
-  VERSION_FORMAT = /\A\d+\.\d+\.\d+(-[\w.]+)?\z/
-
-  def update!(version)
-    abort "Invalid version: #{version.inspect}" unless version.match?(VERSION_FORMAT)
-
-    FileUtils.mkdir_p(VENDOR_DIR)
-
-    dist = registry_dist(version)
-    puts "Downloading #{dist.fetch("tarball")} ..."
-    tarball = download(dist.fetch("tarball"))
-    verify_tarball!(tarball, dist)
-
-    js, license = extract(tarball, "package/axe.min.js", "package/LICENSE")
-    verify_banner!(js, version)
-
-    File.write(AXE_JS, js)
-    File.write(AXE_LICENSE, license)
-    File.write(AXE_SHA512, "#{Digest::SHA512.hexdigest(js)}  axe.min.js\n")
-    bump_version_constant(version)
-
-    report(version, js)
-  end
-
-  def latest_version
-    JSON.parse(download("#{REGISTRY}/latest")).fetch("version")
-  end
-
-  def vendored_version
-    File.read(AXE_JS)[/axe v([0-9][0-9.]*)/, 1] || "unknown"
-  end
-
-  def verify_vendored!
-    abort "No recorded checksum at #{AXE_SHA512} — run rake axe:update first." unless File.exist?(AXE_SHA512)
-
-    expected = File.read(AXE_SHA512).split.first
-    actual   = Digest::SHA512.hexdigest(File.binread(AXE_JS))
-    unless actual == expected
-      abort <<~MSG
-        MISMATCH: #{AXE_JS} does not match its recorded sha512.
-          recorded: #{expected}
-          actual:   #{actual}
-      MSG
-    end
-
-    puts "OK: axe.min.js matches its recorded sha512."
-  end
-
-  def registry_dist(version)
-    puts "Fetching axe-core@#{version} metadata from #{REGISTRY} ..."
-    JSON.parse(download("#{REGISTRY}/#{version}")).fetch("dist")
-  end
-
-  # Abort unless the downloaded tarball matches the integrity values the npm
-  # registry publishes for it (dist.integrity sha512, plus legacy dist.shasum).
-  def verify_tarball!(tarball, dist)
-    integrity = dist["integrity"]
-    abort "Registry metadata has no sha512 integrity for the tarball — refusing to vendor." unless integrity&.start_with?("sha512-")
-
-    actual = "sha512-#{Digest::SHA512.base64digest(tarball)}"
-    unless actual == integrity
-      abort <<~MSG
-        Tarball integrity check FAILED — refusing to vendor.
-          expected (registry dist.integrity): #{integrity}
-          actual   (downloaded tarball):      #{actual}
-      MSG
-    end
-
-    shasum = dist["shasum"]
-    if shasum && Digest::SHA1.hexdigest(tarball) != shasum
-      abort "Tarball sha1 shasum mismatch (registry says #{shasum}) — refusing to vendor."
-    end
-
-    puts "  tarball integrity verified (#{integrity})"
-  end
-
-  # Secondary sanity check on the extracted engine itself; fatal on mismatch.
-  def verify_banner!(engine_js, version)
-    return if engine_js.match?(/axe v#{Regexp.escape(version)}\b/)
-
-    abort "Extracted axe.min.js banner does not mention v#{version} — refusing to vendor."
-  end
-
-  def extract(tarball, *paths)
-    found = {}
-    Zlib::GzipReader.wrap(StringIO.new(tarball)) do |gz|
-      Gem::Package::TarReader.new(gz) do |tar|
-        tar.each { |entry| found[entry.full_name] = entry.read if paths.include?(entry.full_name) }
-      end
-    end
-    missing = paths - found.keys
-    abort "Tarball is missing expected file(s): #{missing.join(", ")}" unless missing.empty?
-    found.values_at(*paths)
-  end
-
-  def download(url)
-    URI.parse(url).open("rb", &:read)
-  rescue OpenURI::HTTPError => e
-    abort "Failed to download #{url}: #{e.message}"
-  end
-
-  def bump_version_constant(version)
-    contents = File.read(VERSION_FILE)
-    updated = contents.sub(/(AXE_CORE_VERSION\s*=\s*)"[^"]*"/, %(\\1"#{version}"))
-    File.write(VERSION_FILE, updated)
-  end
-
-  def report(version, engine_js)
-    puts "Vendored axe-core #{version} (tarball integrity verified):"
-    puts "  #{AXE_JS} (#{engine_js.bytesize} bytes)"
-    puts "  #{AXE_SHA512}"
-    puts "  #{AXE_LICENSE}"
-    puts "  updated AXE_CORE_VERSION in #{VERSION_FILE}"
-    puts "Remember to note the version bump in CHANGELOG.md."
-  end
-end