ultra11y 2.26.0 → 2.27.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "2.26.0",
+      "version": "2.27.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "2.26.0",
+  "version": "2.27.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "2.26.0",
+  "version": "2.27.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join40, relative as relative3, sep as sep6, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.26.0";
+var VERSION = "2.27.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -1197,7 +1197,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-07-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-01 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -18887,9 +18887,9 @@ var EXTRACTOR_VERSION;
 var init_types = __esm({
   "src/types.ts"() {
     "use strict";
-    ENGINE_VERSION = "2.22.0";
+    ENGINE_VERSION = "2.24.2";
     SCHEMA_VERSION2 = 5;
-    EXTRACTOR_VERSION = 11;
+    EXTRACTOR_VERSION = 12;
   }
 });
 function sh(cmd, args2, opts = {}) {
@@ -19861,6 +19861,18 @@ var init_js_ts = __esm({
       { re: /^\s*module\.exports\.(?<name>[\w$]+)\s*=/, kind: "const", exported: true },
       // top-level const arrow function (not exported)
       { re: /^\s*(?:const|let)\s+(?<name>[\w$]+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=]+)?=>/, kind: "const", exported: false },
+      // A module constant bound to a VALUE, not exported: `const RE = /href=/g`.
+      // The AST tier indexes these (a top-level binding is a declaration, only an
+      // in-function one is a local), and a fallback tier that answers "no such
+      // symbol" for every module constant diverges from the engine it stands in for.
+      //
+      // Anchored at column 0, unlike every rule above it: a line scanner cannot see
+      // scope, so `^\s*` here would sweep in each `const x = 1` inside every function
+      // body — the locals-flood the AST tier's inFunctionBody filter exists to
+      // prevent, and the surplus this project criticises in a flat tags file. Column
+      // 0 is the one module-scope proxy a line can carry. Must stay AFTER the arrow
+      // and export rules: `scan()` keeps the first rule that matches a line.
+      { re: /^(?:const|let|var)\s+(?<name>[\w$]+)\s*[:=]/, kind: "const", exported: false },
       // `export default Foo;` — a class/const declared above and exported by reference.
       { re: /^\s*export\s+default\s+(?<name>[A-Za-z_$][\w$]*)\s*;?\s*$/, kind: "default", exported: true }
     ];
@@ -24974,7 +24986,15 @@ var init_specs = __esm({
         "arguments",
         "arrow_function",
         "function_expression",
-        "function"
+        "function",
+        // The IIFE's own link: `(function () { … })()` parses as
+        // expression_statement → call_expression → parenthesized_expression →
+        // function_expression, and without the parens listed the descent stopped one
+        // node short — the same break the statement containers above were added for.
+        // Whole categories of file are written inside one (browser scripts, UMD and
+        // loader bundles), so for those the index held no functions at all. Named by
+        // the ctags differential on a real loader script.
+        "parenthesized_expression"
       ]),
       exported: neverExport,
       // export is tracked structurally; see LangSpec.exportMarkers

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-07-31",
+  "fetchedAt": "2026-08-01",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-07-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-01 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 2.26.0
+  version: 2.27.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join40, relative as relative3, sep as sep6, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.26.0";
+var VERSION = "2.27.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -1197,7 +1197,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-07-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-01 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -18887,9 +18887,9 @@ var EXTRACTOR_VERSION;
 var init_types = __esm({
   "src/types.ts"() {
     "use strict";
-    ENGINE_VERSION = "2.22.0";
+    ENGINE_VERSION = "2.24.2";
     SCHEMA_VERSION2 = 5;
-    EXTRACTOR_VERSION = 11;
+    EXTRACTOR_VERSION = 12;
   }
 });
 function sh(cmd, args2, opts = {}) {
@@ -19861,6 +19861,18 @@ var init_js_ts = __esm({
       { re: /^\s*module\.exports\.(?<name>[\w$]+)\s*=/, kind: "const", exported: true },
       // top-level const arrow function (not exported)
       { re: /^\s*(?:const|let)\s+(?<name>[\w$]+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=]+)?=>/, kind: "const", exported: false },
+      // A module constant bound to a VALUE, not exported: `const RE = /href=/g`.
+      // The AST tier indexes these (a top-level binding is a declaration, only an
+      // in-function one is a local), and a fallback tier that answers "no such
+      // symbol" for every module constant diverges from the engine it stands in for.
+      //
+      // Anchored at column 0, unlike every rule above it: a line scanner cannot see
+      // scope, so `^\s*` here would sweep in each `const x = 1` inside every function
+      // body — the locals-flood the AST tier's inFunctionBody filter exists to
+      // prevent, and the surplus this project criticises in a flat tags file. Column
+      // 0 is the one module-scope proxy a line can carry. Must stay AFTER the arrow
+      // and export rules: `scan()` keeps the first rule that matches a line.
+      { re: /^(?:const|let|var)\s+(?<name>[\w$]+)\s*[:=]/, kind: "const", exported: false },
       // `export default Foo;` — a class/const declared above and exported by reference.
       { re: /^\s*export\s+default\s+(?<name>[A-Za-z_$][\w$]*)\s*;?\s*$/, kind: "default", exported: true }
     ];
@@ -24974,7 +24986,15 @@ var init_specs = __esm({
         "arguments",
         "arrow_function",
         "function_expression",
-        "function"
+        "function",
+        // The IIFE's own link: `(function () { … })()` parses as
+        // expression_statement → call_expression → parenthesized_expression →
+        // function_expression, and without the parens listed the descent stopped one
+        // node short — the same break the statement containers above were added for.
+        // Whole categories of file are written inside one (browser scripts, UMD and
+        // loader bundles), so for those the index held no functions at all. Named by
+        // the ctags differential on a real loader script.
+        "parenthesized_expression"
       ]),
       exported: neverExport,
       // export is tracked structurally; see LangSpec.exportMarkers

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD remediation backlog or GitHub issues; author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 2.26.0
+  version: 2.27.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join40, relative as relative3, sep as sep6, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.26.0";
+var VERSION = "2.27.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -1197,7 +1197,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-07-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-01 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -18887,9 +18887,9 @@ var EXTRACTOR_VERSION;
 var init_types = __esm({
   "src/types.ts"() {
     "use strict";
-    ENGINE_VERSION = "2.22.0";
+    ENGINE_VERSION = "2.24.2";
     SCHEMA_VERSION2 = 5;
-    EXTRACTOR_VERSION = 11;
+    EXTRACTOR_VERSION = 12;
   }
 });
 function sh(cmd, args2, opts = {}) {
@@ -19861,6 +19861,18 @@ var init_js_ts = __esm({
       { re: /^\s*module\.exports\.(?<name>[\w$]+)\s*=/, kind: "const", exported: true },
       // top-level const arrow function (not exported)
       { re: /^\s*(?:const|let)\s+(?<name>[\w$]+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=]+)?=>/, kind: "const", exported: false },
+      // A module constant bound to a VALUE, not exported: `const RE = /href=/g`.
+      // The AST tier indexes these (a top-level binding is a declaration, only an
+      // in-function one is a local), and a fallback tier that answers "no such
+      // symbol" for every module constant diverges from the engine it stands in for.
+      //
+      // Anchored at column 0, unlike every rule above it: a line scanner cannot see
+      // scope, so `^\s*` here would sweep in each `const x = 1` inside every function
+      // body — the locals-flood the AST tier's inFunctionBody filter exists to
+      // prevent, and the surplus this project criticises in a flat tags file. Column
+      // 0 is the one module-scope proxy a line can carry. Must stay AFTER the arrow
+      // and export rules: `scan()` keeps the first rule that matches a line.
+      { re: /^(?:const|let|var)\s+(?<name>[\w$]+)\s*[:=]/, kind: "const", exported: false },
       // `export default Foo;` — a class/const declared above and exported by reference.
       { re: /^\s*export\s+default\s+(?<name>[A-Za-z_$][\w$]*)\s*;?\s*$/, kind: "default", exported: true }
     ];
@@ -24974,7 +24986,15 @@ var init_specs = __esm({
         "arguments",
         "arrow_function",
         "function_expression",
-        "function"
+        "function",
+        // The IIFE's own link: `(function () { … })()` parses as
+        // expression_statement → call_expression → parenthesized_expression →
+        // function_expression, and without the parens listed the descent stopped one
+        // node short — the same break the statement containers above were added for.
+        // Whole categories of file are written inside one (browser scripts, UMD and
+        // loader bundles), so for those the index held no functions at all. Named by
+        // the ctags differential on a real loader script.
+        "parenthesized_expression"
       ]),
       exported: neverExport,
       // export is tracked structurally; see LangSpec.exportMarkers

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-07-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-01 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "2.26.0";
+export const VERSION = "2.27.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,

package/src/vendor/codeindex-engine.d.mts

@@ -1,6 +1,6 @@
-declare const ENGINE_VERSION = "2.22.0";
+declare const ENGINE_VERSION = "2.24.2";
 declare const SCHEMA_VERSION = 5;
-declare const EXTRACTOR_VERSION = 11;
+declare const EXTRACTOR_VERSION = 12;
 type FileKind = "code" | "doc" | "config" | "asset" | "other";
 type EdgeKind = "contains" | "doc-link" | "import" | "call" | "extends" | "implements" | "use" | "mention";
 type Tier = 0 | 1 | 2;
@@ -397,7 +397,7 @@ declare function tagsQueryStatus(key: string): TagsQueryStatus;
  */
 declare function extractTags(ext: string, content: string): TagDefinition[];
 
-declare const DEFAULT_GRAMMARS_URL = "https://github.com/maxgfr/codeindex/releases/download/v2.22.0/grammars-2.22.0.tar.gz";
+declare const DEFAULT_GRAMMARS_URL = "https://github.com/maxgfr/codeindex/releases/download/v2.24.2/grammars-2.24.2.tar.gz";
 interface GrammarsPullTarget {
     url: string;
     sha256Url?: string;

package/src/vendor/codeindex-engine.mjs

@@ -14,9 +14,9 @@ var ENGINE_VERSION, SCHEMA_VERSION, EXTRACTOR_VERSION;
 var init_types = __esm({
   "src/types.ts"() {
     "use strict";
-    ENGINE_VERSION = "2.22.0";
+    ENGINE_VERSION = "2.24.2";
     SCHEMA_VERSION = 5;
-    EXTRACTOR_VERSION = 11;
+    EXTRACTOR_VERSION = 12;
   }
 });
 
@@ -993,6 +993,18 @@ var init_js_ts = __esm({
       { re: /^\s*module\.exports\.(?<name>[\w$]+)\s*=/, kind: "const", exported: true },
       // top-level const arrow function (not exported)
       { re: /^\s*(?:const|let)\s+(?<name>[\w$]+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=]+)?=>/, kind: "const", exported: false },
+      // A module constant bound to a VALUE, not exported: `const RE = /href=/g`.
+      // The AST tier indexes these (a top-level binding is a declaration, only an
+      // in-function one is a local), and a fallback tier that answers "no such
+      // symbol" for every module constant diverges from the engine it stands in for.
+      //
+      // Anchored at column 0, unlike every rule above it: a line scanner cannot see
+      // scope, so `^\s*` here would sweep in each `const x = 1` inside every function
+      // body — the locals-flood the AST tier's inFunctionBody filter exists to
+      // prevent, and the surplus this project criticises in a flat tags file. Column
+      // 0 is the one module-scope proxy a line can carry. Must stay AFTER the arrow
+      // and export rules: `scan()` keeps the first rule that matches a line.
+      { re: /^(?:const|let|var)\s+(?<name>[\w$]+)\s*[:=]/, kind: "const", exported: false },
       // `export default Foo;` — a class/const declared above and exported by reference.
       { re: /^\s*export\s+default\s+(?<name>[A-Za-z_$][\w$]*)\s*;?\s*$/, kind: "default", exported: true }
     ];
@@ -6069,7 +6081,15 @@ var init_specs = __esm({
         "arguments",
         "arrow_function",
         "function_expression",
-        "function"
+        "function",
+        // The IIFE's own link: `(function () { … })()` parses as
+        // expression_statement → call_expression → parenthesized_expression →
+        // function_expression, and without the parens listed the descent stopped one
+        // node short — the same break the statement containers above were added for.
+        // Whole categories of file are written inside one (browser scripts, UMD and
+        // loader bundles), so for those the index held no functions at all. Named by
+        // the ctags differential on a real loader script.
+        "parenthesized_expression"
       ]),
       exported: neverExport,
       // export is tracked structurally; see LangSpec.exportMarkers

package/src/vendor/engine.meta.json

@@ -1,9 +1,9 @@
 {
-  "tag": "v2.22.0",
-  "engineVersion": "2.22.0",
+  "tag": "v2.24.2",
+  "engineVersion": "2.24.2",
   "sha256": {
-    "codeindex-engine.mjs": "97cf34f1fcee485a9163fab4f6357b2d8871a9bfa199f4527d28e02a3f8889cb",
-    "codeindex-engine.d.mts": "ee9589e36691679c854553e6f4e3fa158052da92c85501f34a8911834801f210"
+    "codeindex-engine.mjs": "209509d1e757d15cb0ac5c6b52a2e47c3f1cb17630c895a72140e0b3a8193ee6",
+    "codeindex-engine.d.mts": "0c744308646ec98c78afdbfcd9febf48532394101ace541a5c1f432549ad2397"
   },
-  "syncedAt": "2026-07-31T09:30:22.297Z"
+  "syncedAt": "2026-08-01T08:55:39.105Z"
 }