ultra11y 5.0.1 → 5.1.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.0.1",
+      "version": "5.1.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.0.1",
+  "version": "5.1.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.0.1",
+  "version": "5.1.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.0.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.1.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-D0VQYlGS.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-B6NDkLYJ.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-D0VQYlGS.js';
-export { s as slugify } from './payload-D0VQYlGS.js';
+import { C as CheckOptions } from './payload-B6NDkLYJ.js';
+export { s as slugify } from './payload-B6NDkLYJ.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/cypress.mjs

@@ -120,6 +120,20 @@ function slugify(url) {
   const slug = path.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return slug || (path === "/" || path === "" ? "accueil" : "page");
 }
+function stayedOnPage(expected, actual) {
+  if (!expected || !actual) return true;
+  const path = (u) => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return void 0;
+    }
+  };
+  const a = path(expected);
+  const b = path(actual);
+  if (a === void 0 || b === void 0) return true;
+  return a === b;
+}
 function buildPayload(collected, url, runner, opts, screenshot) {
   const id = opts.as || slugify(url);
   return {
@@ -151,6 +165,11 @@ function registerUltra11yCommand() {
     return cy.window({ log: false }).then((win) => {
       const collected = win.eval(COLLECT_SNAPSHOT);
       const url = collected.url || win.location.href;
+      if (opts.expectPath && !stayedOnPage(opts.expectPath, url)) {
+        throw new Error(
+          `ultra11y: ${opts.expectPath} landed on ${url} \u2014 not recording it as "${opts.as ?? opts.name ?? "this page"}". The state that opens this route is not the one the test built; seed it first, or drop the page from the sample.`
+        );
+      }
       const payload = {
         ...buildPayload(collected, url, "cypress", opts),
         failOn: opts.failOn,

package/dist/payload-B6NDkLYJ.d.ts

@@ -0,0 +1,51 @@
+interface FindingLike {
+    ruleId: string;
+    criteriaId: string;
+    file: string;
+    line: number;
+    severity: string;
+    message: string;
+    advisory?: boolean;
+    origin?: {
+        sourceFile?: string;
+        sourceLine?: number;
+    };
+}
+interface AuditLike {
+    findings?: FindingLike[];
+}
+interface SnapshotPayload {
+    meta: Record<string, unknown>;
+    dom: string;
+    styles?: unknown;
+    boxes?: unknown;
+    css?: unknown;
+    screenshot?: string;
+}
+/** Same slug rule as the engine (src/snapshot.ts slugifyPageId): accent-folded URL path. */
+declare function slugify(url: string): string;
+interface CheckOptions {
+    /** The page id (directory name). Defaults to the slugified URL path. */
+    as?: string;
+    /** Human page name for the report. Defaults to the document title. */
+    name?: string;
+    /** Severity at which the check fails, or `false` to record without ever failing. */
+    failOn?: "blocking" | "major" | "minor" | false;
+    /** Mark the page as sitting behind authentication. */
+    auth?: boolean;
+    /** Source files that rendered it — findings are then reported against YOUR code. */
+    sources?: string[];
+    /** Reproduction notes carried into the auditor ticket. */
+    notes?: string;
+    /** Capture a viewport screenshot for the pixel tier (Playwright: on by default). */
+    screenshot?: boolean;
+    /** The path you NAVIGATED to. Given it, the fixture refuses to record a page the browser
+     *  did not stay on — a guarded route that redirected, a session that expired — instead of
+     *  filing that other screen under this page's `as`/`name`. Nothing about such a snapshot
+     *  looks wrong, which is what makes it the worst thing an accessibility report can carry.
+     *  Compared by path (a query or fragment the app appends to its own route is the same
+     *  page); a full URL works too. `scan --sample` applies the same rule. */
+    expectPath?: string;
+}
+
+export { type AuditLike as A, type CheckOptions as C, type FindingLike as F, type SnapshotPayload as S, slugify as s };

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-D0VQYlGS.js';
+import { C as CheckOptions, A as AuditLike } from './payload-B6NDkLYJ.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -143,6 +143,20 @@ function slugify(url) {
   const slug = path.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return slug || (path === "/" || path === "" ? "accueil" : "page");
 }
+function stayedOnPage(expected, actual) {
+  if (!expected || !actual) return true;
+  const path = (u) => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return void 0;
+    }
+  };
+  const a = path(expected);
+  const b = path(actual);
+  if (a === void 0 || b === void 0) return true;
+  return a === b;
+}
 function buildPayload(collected, url, runner, opts, screenshot) {
   const id = opts.as || slugify(url);
   return {
@@ -221,6 +235,11 @@ async function checkA11y(page, opts = {}) {
     }
   }
   const url = collected.url || page.url();
+  if (opts.expectPath && !stayedOnPage(opts.expectPath, url)) {
+    throw new Error(
+      `ultra11y: ${opts.expectPath} landed on ${url} \u2014 not recording it as "${opts.as ?? opts.name ?? "this page"}". The state that opens this route is not the one the test built; seed it first, or drop the page from the sample.`
+    );
+  }
   const payload = buildPayload(collected, url, "playwright", opts, shot);
   const result = auditSnapshot(payload);
   if (opts.report) writePagesReport(typeof opts.report === "object" ? opts.report : {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.0.1",
+  "version": "5.1.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.0.1";
+var VERSION = "5.1.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.0.1
+  version: 5.1.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.0.1";
+var VERSION = "5.1.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.0.1
+  version: 5.1.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/e2e.md

@@ -33,6 +33,27 @@ than restating them, and a test evaluates the generated `failingFindings` alongs
 one over the same findings. A fixture that gated differently from the published plugin would
 fail two projects differently while claiming to be the same tool.
 
+
+## A page the browser did not stay on (`expectPath`)
+
+`as`/`name` is the identity the report speaks, and the fixture applies it to whatever is on
+screen. So a route your test could not open — a guarded step, an expired session — gets filed
+under the requested page's name, and its sheet, screenshot and rate all describe another
+screen. Nothing about the document looks wrong.
+
+Pass the path you navigated to and the fixture refuses instead:
+
+```js
+await checkA11y(page, { as: "declaration-etape-4", expectPath: "/declaration/etape/4" });
+// throws: /declaration/etape/4 landed on /declaration/etape/1 — not recording it as
+// "declaration-etape-4". The state that opens this route is not the one the test built.
+```
+
+Opt-in, and path-only: a query or fragment the app appends to its own route is the same page.
+`scan --sample` applies the same rule without being asked, because there the URL *is* the
+instruction. A page reported missing is a bug in your seeding; a page reported under the wrong
+name is a false conformance claim.
+
 ## Playwright
 
 ```js

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.0.1";
+var VERSION = "5.1.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts

package/src/integrations/cypress.ts

@@ -10,7 +10,7 @@
 // must be wired in `cypress.config.js` too — Cypress test code cannot write to disk, so the
 // collected page round-trips through a task.
 import { COLLECT_SNAPSHOT } from "../collector.js";
-import { type CheckOptions, buildPayload, slugify } from "./payload.js";
+import { type CheckOptions, buildPayload, slugify, stayedOnPage } from "./payload.js";
 
 // Cypress's globals are not a dependency of this package; they exist at run time only.
 declare const Cypress: {
@@ -45,6 +45,14 @@ export function registerUltra11yCommand(): void {
     return cy.window({ log: false }).then((win: { eval(s: string): unknown; location: { href: string } }) => {
       const collected = win.eval(COLLECT_SNAPSHOT) as Parameters<typeof buildPayload>[0];
       const url = collected.url || win.location.href;
+      // Same refusal as the Playwright fixture: a page the browser did not stay on must not
+      // be filed under the requested page's identity. See CheckOptions.expectPath.
+      if (opts.expectPath && !stayedOnPage(opts.expectPath, url)) {
+        throw new Error(
+          `ultra11y: ${opts.expectPath} landed on ${url} — not recording it as "${opts.as ?? opts.name ?? "this page"}". ` +
+            `The state that opens this route is not the one the test built; seed it first, or drop the page from the sample.`,
+        );
+      }
       const payload = {
         ...buildPayload(collected, url, "cypress", opts),
         failOn: opts.failOn,

package/src/integrations/payload.ts

@@ -98,6 +98,30 @@ export interface CheckOptions {
   notes?: string;
   /** Capture a viewport screenshot for the pixel tier (Playwright: on by default). */
   screenshot?: boolean;
+  /** The path you NAVIGATED to. Given it, the fixture refuses to record a page the browser
+   *  did not stay on — a guarded route that redirected, a session that expired — instead of
+   *  filing that other screen under this page's `as`/`name`. Nothing about such a snapshot
+   *  looks wrong, which is what makes it the worst thing an accessibility report can carry.
+   *  Compared by path (a query or fragment the app appends to its own route is the same
+   *  page); a full URL works too. `scan --sample` applies the same rule. */
+  expectPath?: string;
+}
+
+/** Did the browser stay on the page the caller asked for? Path-only, trailing slash folded;
+ *  anything unparseable passes — this catches a redirect, it does not invent one. */
+export function stayedOnPage(expected: string, actual: string): boolean {
+  if (!expected || !actual) return true;
+  const path = (u: string): string | undefined => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return undefined;
+    }
+  };
+  const a = path(expected);
+  const b = path(actual);
+  if (a === undefined || b === undefined) return true;
+  return a === b;
 }
 
 /** Build the snapshot payload from a collected page. Shared so every runner stamps the

package/src/integrations/playwright.ts

@@ -18,7 +18,7 @@
 // criteria without booting the app, and how the report speaks page by page. Commit it.
 import { createRequire } from "node:module";
 import { COLLECT_SNAPSHOT } from "../collector.js";
-import { type AuditLike, type CheckOptions, auditSnapshot, buildPayload, gate, writePagesReport } from "./core.js";
+import { type AuditLike, type CheckOptions, auditSnapshot, buildPayload, gate, stayedOnPage, writePagesReport } from "./core.js";
 
 // Playwright's own types are not a dependency of this package (it is a peer of YOUR repo),
 // so the page object is structurally typed to exactly what is used.
@@ -52,6 +52,16 @@ export async function checkA11y(page: PlaywrightPage, opts: PlaywrightCheckOptio
   }
 
   const url = collected.url || page.url();
+  // Refuse a page the browser did not stay on, when the caller said where it went. The
+  // snapshot's identity is `as`/`name`, applied to whatever is on screen — so a guarded route
+  // that redirected would be filed under the requested page's name, and the resulting sheet,
+  // screenshot and rate would all describe another screen. Skipping loudly beats that.
+  if (opts.expectPath && !stayedOnPage(opts.expectPath, url)) {
+    throw new Error(
+      `ultra11y: ${opts.expectPath} landed on ${url} — not recording it as "${opts.as ?? opts.name ?? "this page"}". ` +
+        `The state that opens this route is not the one the test built; seed it first, or drop the page from the sample.`,
+    );
+  }
   const payload = buildPayload(collected, url, "playwright", opts, shot);
   const result = auditSnapshot(payload);
   if (opts.report) writePagesReport(typeof opts.report === "object" ? opts.report : {});

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.0.1";
+export const VERSION = "5.1.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,