ultra11y 3.0.0 → 4.0.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "3.0.0",
+      "version": "4.0.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "3.0.0";
+const ULTRA11Y_PLUGIN_VERSION = "4.0.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -125,7 +125,7 @@ claude mcp add ultra11y -- npx -y ultra11y mcp
 **As a GitHub Action** — audits the PR diff and, optionally, the served pages:
 
 ```yaml
-- uses: maxgfr/ultra11y@v2
+- uses: maxgfr/ultra11y@v3
   with: { since: auto, standard: rgaa, fail-on: blocking }
 ```
 
@@ -429,7 +429,8 @@ Releases are cut automatically by **semantic-release** on push to `main` (GitHub
 npm publish via OIDC trusted publishing, plus the moving `v2` major tag). The version bump is
 decided by **Conventional Commits**: a commit whose subject carries no `feat:`/`fix:` prefix
 is analysed as *no release*, so a change that must ship needs at least one conventional commit
-in the range — otherwise `@v2` and npm keep serving the previous version while `main` moves on.
+in the range — otherwise the major alias and npm keep serving the previous version while `main`
+moves on.
 
 ## Data & licensing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-extension-icons.mjs

@@ -7,15 +7,22 @@
 // script produces — the same reproducibility contract the engine bundle is held to.
 //
 // The mark is an eye (the action's own branding icon), drawn as a filled lens with a pupil on
-// the purple the action already declares. Written with a hand-rolled PNG encoder because the
-// repo has no image dependency and is not about to grow one for four small files.
+// the purple the action already declares. The PNG encoder is the engine's own
+// (`src/pixel.ts`), imported through Node's type-stripping — the repo has no image dependency
+// and is not about to grow one for four small files.
+//
+// That import runs both ways: because these four icons are committed, `--check` re-encodes
+// them and proves `encodePng` still emits the exact bytes it emitted when they were drawn.
+// A decode/encode round-trip could only prove the pair is self-consistent; this proves the
+// encoder is PNG-correct against files a browser accepts. Keep `src/pixel.ts` a leaf (one
+// runtime import, `node:zlib`) or this import stops resolving.
 //
 //   node scripts/build-extension-icons.mjs           # write
 //   node scripts/build-extension-icons.mjs --check   # fail if the committed files differ
-import { deflateSync } from "node:zlib";
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { encodePng } from "../src/pixel.ts";
 
 const OUT = join(dirname(fileURLToPath(import.meta.url)), "..", "extension", "icons");
 const SIZES = [16, 32, 48, 128];
@@ -24,45 +31,6 @@ const SIZES = [16, 32, 48, 128];
 const BG = [107, 70, 193]; // #6b46c1
 const FG = [255, 255, 255];
 
-function crc32(buf) {
-  let c = ~0;
-  for (const b of buf) {
-    c ^= b;
-    for (let i = 0; i < 8; i++) c = (c >>> 1) ^ (0xedb88320 & -(c & 1));
-  }
-  return ~c >>> 0;
-}
-
-function chunk(type, data) {
-  const len = Buffer.alloc(4);
-  len.writeUInt32BE(data.length);
-  const body = Buffer.concat([Buffer.from(type, "latin1"), data]);
-  const crc = Buffer.alloc(4);
-  crc.writeUInt32BE(crc32(body));
-  return Buffer.concat([len, body, crc]);
-}
-
-/** An RGBA pixel buffer → a PNG. Colour type 6, 8-bit, one filter byte per row. */
-function png(size, rgba) {
-  const raw = Buffer.alloc(size * (size * 4 + 1));
-  for (let y = 0; y < size; y++) {
-    raw[y * (size * 4 + 1)] = 0; // filter: none — the images are tiny, filtering buys nothing
-    rgba.copy(raw, y * (size * 4 + 1) + 1, y * size * 4, (y + 1) * size * 4);
-  }
-  const ihdr = Buffer.alloc(13);
-  ihdr.writeUInt32BE(size, 0);
-  ihdr.writeUInt32BE(size, 4);
-  ihdr[8] = 8; // bit depth
-  ihdr[9] = 6; // RGBA
-  return Buffer.concat([
-    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-    chunk("IHDR", ihdr),
-    // level 9 so the bytes are a function of the pixels alone, not of zlib's default tuning.
-    chunk("IDAT", deflateSync(raw, { level: 9 })),
-    chunk("IEND", Buffer.alloc(0)),
-  ]);
-}
-
 /** The eye mark, supersampled 4× so the curves do not alias at 16px. */
 function draw(size) {
   const S = 4;
@@ -118,7 +86,7 @@ mkdirSync(OUT, { recursive: true });
 let stale = [];
 for (const size of SIZES) {
   const file = join(OUT, `icon-${size}.png`);
-  const bytes = png(size, draw(size));
+  const bytes = encodePng({ width: size, height: size, data: draw(size) });
   if (check) {
     let current = null;
     try {