ultra11y 2.22.0

package/scripts/import-pack.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+// DEV-ONLY (not in `bin`). The deterministic FAST-PATH scaffolder for the AI-assisted
+// pack ingestion workflow (see skills/ultra11y/references/packs.md). It reads a directory
+// of SocialGouv-style RGAA rule markdown files (frontmatter `title/impact/tags` + a
+// non-compliant ```html block + a compliant ```html block + a reference link to the
+// official criterion) and emits a DRAFT guidance dataset (src/data/guidance/<key>.json):
+// every machine-extractable field filled, and `criterionId` resolved from the rule's
+// reference link where unambiguous, else left null. It NEVER finalizes — the agent
+// resolves the remaining nulls / summaries, then `pack check --guidance` gates the result
+// (a null criterionId or a fabricated SC fails). This keeps the AI honest: it drafts, the
+// deterministic gate refuses fabrication.
+//
+//   node scripts/import-pack.mjs --from <dir-of-rules.md> [--pack rgaa] [--out src/data/guidance/rgaa.json]
+import { readFileSync, writeFileSync, readdirSync, existsSync, mkdirSync } from "node:fs";
+import { dirname, join, basename } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+function arg(name, def) {
+  const i = process.argv.indexOf(`--${name}`);
+  return i !== -1 && process.argv[i + 1] ? process.argv[i + 1] : def;
+}
+
+const fromDir = arg("from", null);
+const packKey = arg("pack", "rgaa");
+const outPath = arg("out", join(root, "src", "data", "guidance", `${packKey}.json`));
+
+if (!fromDir || !existsSync(fromDir)) {
+  console.error("import-pack: --from <dir-of-rule-markdown> is required (e.g. a clone of SocialGouv/skills/skills/rgaa-html-css/rules).");
+  process.exit(1);
+}
+
+// Load the standards pack so we can map a resolved criterion id → its WCAG SCs.
+const packPath = join(root, "src", "data", "standards", `${packKey}.json`);
+if (!existsSync(packPath)) {
+  console.error(`import-pack: standards pack not found: ${packPath}. Build it first (e.g. build:pack:${packKey}).`);
+  process.exit(1);
+}
+const pack = JSON.parse(readFileSync(packPath, "utf8"));
+const wcagByCriterion = new Map(pack.criteria.map((c) => [c.id, c.wcag]));
+
+// --- tiny markdown parsers (no deps) -------------------------------------------------
+function frontmatter(md) {
+  const m = /^---\n([\s\S]*?)\n---/.exec(md);
+  if (!m) return {};
+  const fm = {};
+  for (const line of m[1].split("\n")) {
+    const kv = /^([A-Za-z][\w-]*):\s*(.*)$/.exec(line.trim());
+    if (kv) fm[kv[1]] = kv[2].replace(/^["']|["']$/g, "");
+  }
+  return fm;
+}
+
+// First two fenced code blocks → { bad, good } (convention: non-compliant first).
+function codeBlocks(md) {
+  const blocks = [];
+  const re = /```[a-zA-Z]*\n([\s\S]*?)```/g;
+  let m;
+  while ((m = re.exec(md)) && blocks.length < 4) blocks.push(m[1].replace(/\n$/, ""));
+  return { bad: blocks[0], good: blocks[1] };
+}
+
+// Resolve an RGAA criterion id from a reference link or "Critère X.Y" mention.
+function criterionId(md) {
+  const hash = /criteres?-et-tests[^)\s]*#(\d+\.\d+)\b/i.exec(md) || /#(\d+\.\d+)\b/.exec(md);
+  if (hash && wcagByCriterion.has(hash[1])) return hash[1];
+  const crit = /crit[eè]re\s+(\d+\.\d+)\b/i.exec(md);
+  if (crit && wcagByCriterion.has(crit[1])) return crit[1];
+  return null;
+}
+
+const files = readdirSync(fromDir).filter((f) => f.endsWith(".md") && !f.startsWith("_"));
+const entries = [];
+let unresolved = 0;
+for (const f of files.sort()) {
+  const md = readFileSync(join(fromDir, f), "utf8");
+  const fm = frontmatter(md);
+  const { bad, good } = codeBlocks(md);
+  const id = criterionId(md);
+  if (!id) unresolved++;
+  const impact = (fm.impact || "").toLowerCase();
+  entries.push({
+    id: basename(f, ".md"),
+    criterionId: id, // null ⇒ the agent must resolve it; `pack check` fails until then
+    wcag: id ? wcagByCriterion.get(id) : [],
+    title: { fr: fm.title || basename(f, ".md") },
+    summary: { fr: fm.impactDescription || fm.title || "" },
+    ...(["high", "medium", "low"].includes(impact) ? { impact } : {}),
+    examples: bad || good ? [{ lang: "html", ...(bad ? { bad } : {}), ...(good ? { good } : {}) }] : [],
+    reference: (md.match(/https?:\/\/[^)\s]*criteres?-et-tests[^)\s]*/i) || [])[0] || "",
+  });
+}
+
+const dataset = {
+  pack: packKey,
+  source: `imported from ${fromDir}`,
+  license: pack.license,
+  attribution: pack.attribution,
+  entries,
+};
+
+mkdirSync(dirname(outPath), { recursive: true });
+writeFileSync(outPath, JSON.stringify(dataset, null, 2) + "\n");
+console.log(`import-pack: ${entries.length} draft entries → ${outPath}`);
+console.log(`import-pack: ${unresolved} entr${unresolved === 1 ? "y" : "ies"} have an unresolved criterionId (null) — resolve them, then run:`);
+console.log(`  node scripts/ultra11y.mjs pack check ${packPath} --guidance ${outPath}`);

package/scripts/sync-engine.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// Vendor the codeindex engine (https://github.com/maxgfr/codeindex) into
+// src/vendor/, pinned to a release tag. The engine is a self-contained
+// zero-dependency ESM bundle; tsup inlines it into scripts/ultra11y.mjs at
+// build time, so the skill still ships as one file.
+//
+//   node scripts/sync-engine.mjs --ref v2.0.1   # fetch + pin
+//   node scripts/sync-engine.mjs --check        # offline drift/tamper gate (CI)
+//
+// The fetched bytes are written UNMODIFIED (byte-identical to upstream) —
+// engine.meta.json carries the pin ({ tag, engineVersion, sha256, syncedAt }),
+// and --check re-hashes the vendored files against it.
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const vendorDir = join(root, "src", "vendor");
+const files = [
+  { remote: "scripts/engine.mjs", local: "codeindex-engine.mjs" },
+  { remote: "scripts/engine.d.mts", local: "codeindex-engine.d.mts" },
+];
+const metaPath = join(vendorDir, "engine.meta.json");
+
+const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+const args = process.argv.slice(2);
+if (args[0] === "--check") {
+  let meta;
+  try {
+    meta = JSON.parse(readFileSync(metaPath, "utf8"));
+  } catch {
+    console.error("sync-engine: no engine.meta.json — run `node scripts/sync-engine.mjs --ref <tag>` first");
+    process.exit(1);
+  }
+  let ok = true;
+  for (const f of files) {
+    const actual = sha256(readFileSync(join(vendorDir, f.local)));
+    if (actual !== meta.sha256[f.local]) {
+      console.error(`sync-engine: DRIFT in src/vendor/${f.local} — vendored bytes differ from the ${meta.tag} pin`);
+      ok = false;
+    }
+  }
+  if (!ok) process.exit(1);
+  console.log(`sync-engine: vendored engine matches the ${meta.tag} pin (${meta.engineVersion})`);
+  process.exit(0);
+}
+
+const refIdx = args.indexOf("--ref");
+const ref = refIdx !== -1 ? args[refIdx + 1] : undefined;
+if (!ref) {
+  console.error("usage: sync-engine.mjs --ref <tag>   |   sync-engine.mjs --check");
+  process.exit(1);
+}
+
+mkdirSync(vendorDir, { recursive: true });
+const sums = {};
+for (const f of files) {
+  const url = `https://raw.githubusercontent.com/maxgfr/codeindex/${ref}/${f.remote}`;
+  const res = await fetch(url);
+  if (!res.ok) {
+    console.error(`sync-engine: ${url} -> HTTP ${res.status}`);
+    process.exit(1);
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  writeFileSync(join(vendorDir, f.local), buf);
+  sums[f.local] = sha256(buf);
+  console.log(`sync-engine: src/vendor/${f.local} (${buf.length} bytes)`);
+}
+
+// The bundle embeds its version greppably — refuse a tag/content mismatch.
+const bundle = readFileSync(join(vendorDir, files[0].local), "utf8");
+const version = bundle.match(/ENGINE_VERSION = "([^"]+)"/)?.[1];
+if (!version || `v${version}` !== ref) {
+  console.error(`sync-engine: bundle says ENGINE_VERSION=${version ?? "?"} but the pinned ref is ${ref}`);
+  process.exit(1);
+}
+
+writeFileSync(
+  metaPath,
+  JSON.stringify({ tag: ref, engineVersion: version, sha256: sums, syncedAt: new Date().toISOString() }, null, 2) + "\n",
+);
+console.log(`sync-engine: pinned codeindex ${ref}`);

package/scripts/sync-version.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// Sync the release version across every place it lives, then let the caller
+// rebuild the bundle. Invoked by @semantic-release/exec (prepareCmd):
+//   node scripts/sync-version.mjs <version>
+//
+// The version is duplicated in package.json, src/types.ts (the value the bundle
+// embeds) and the skill's SKILL.md frontmatter; semantic-release computes it
+// from the Conventional Commits, so this keeps them all in lockstep. CHANGELOG.md
+// is owned by @semantic-release/changelog and is NOT touched here.
+import { readFileSync, writeFileSync } from "node:fs";
+
+const version = process.argv[2];
+if (!version || !/^\d+\.\d+\.\d+(?:-[\w.]+)?$/.test(version)) {
+  console.error(`sync-version: expected a semver version, got "${version ?? ""}"`);
+  process.exit(1);
+}
+
+function edit(path, transform) {
+  const before = readFileSync(path, "utf8");
+  const after = transform(before);
+  if (after === before) {
+    console.error(`sync-version: WARNING — no change applied to ${path}`);
+  }
+  writeFileSync(path, after);
+}
+
+const setVersionField = (s) => s.replace(/(\n[ \t]+version:[ \t]*)[^\n]+/, `$1${version}`);
+
+// package.json — the top-level "version" field.
+edit("package.json", (s) => s.replace(/("version":\s*")[^"]+(")/, `$1${version}$2`));
+
+// src/types.ts — the VERSION constant the CLI/bundle reports.
+edit("src/types.ts", (s) => s.replace(/(export const VERSION = ")[^"]+(";)/, `$1${version}$2`));
+
+// Each skill's SKILL.md — the indented `version:` under the `metadata:` block.
+// BOTH skills ship from this repo; forgetting one leaves its published
+// frontmatter (and, without the matching .releaserc asset, its bundle) stale.
+edit("skills/ultra11y/SKILL.md", setVersionField);
+edit("skills/review-a11y/SKILL.md", setVersionField);
+
+console.log(
+  `sync-version: set ${version} in package.json, src/types.ts, skills/ultra11y/SKILL.md, skills/review-a11y/SKILL.md`,
+);