ultra11y 5.11.1 → 5.11.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.11.1",
+      "version": "5.11.3",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.11.1",
+  "version": "5.11.3",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.11.1",
+  "version": "5.11.3",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.11.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.11.3";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/cypress.mjs

@@ -166,6 +166,16 @@ function buildPayload(collected, url, runner, opts, screenshot, probes) {
       runner,
       viewport: collected.viewport,
       capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      // `documentElement.outerHTML` starts at `<html>`, so the DOM alone drops the doctype and
+      // RGAA 8.1 — « chaque page web est-elle définie par un type de document ? » — has nothing
+      // to look at. The collector captures it separately; this is where it was being thrown
+      // away one step later. Measured: 105 of 106 criteria decided, and the one left was 8.1,
+      // whose brief read « this capture predates doctype recording ».
+      //
+      // `!== undefined`, never a truthiness test: an EMPTY doctype is a page that genuinely has
+      // none, which is the non-conformity itself. Collapsing it into "not recorded" would hide
+      // a failing page behind « à évaluer ».
+      ...collected.doctype !== void 0 ? { doctype: collected.doctype } : {},
       ...opts.auth !== void 0 ? { auth: opts.auth } : {},
       ...opts.sources ? { sources: opts.sources } : {},
       ...opts.notes ? { notes: opts.notes } : {}

package/dist/playwright.mjs

@@ -500,6 +500,16 @@ function buildPayload(collected, url, runner, opts, screenshot, probes) {
       runner,
       viewport: collected.viewport,
       capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      // `documentElement.outerHTML` starts at `<html>`, so the DOM alone drops the doctype and
+      // RGAA 8.1 — « chaque page web est-elle définie par un type de document ? » — has nothing
+      // to look at. The collector captures it separately; this is where it was being thrown
+      // away one step later. Measured: 105 of 106 criteria decided, and the one left was 8.1,
+      // whose brief read « this capture predates doctype recording ».
+      //
+      // `!== undefined`, never a truthiness test: an EMPTY doctype is a page that genuinely has
+      // none, which is the non-conformity itself. Collapsing it into "not recorded" would hide
+      // a failing page behind « à évaluer ».
+      ...collected.doctype !== void 0 ? { doctype: collected.doctype } : {},
       ...opts.auth !== void 0 ? { auth: opts.auth } : {},
       ...opts.sources ? { sources: opts.sources } : {},
       ...opts.notes ? { notes: opts.notes } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.11.1",
+  "version": "5.11.3",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.11.1";
+var VERSION = "5.11.3";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -2289,7 +2289,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-18 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -57953,11 +57953,20 @@ function applyAdjudication(audit2, adj, opts = {}) {
         decidedBy: "agent"
       });
     }
+    const alreadyDecided = new Set(
+      audit2.packAdjudication?.standard === adj.standard ? audit2.packAdjudication.criteria.filter((c2) => c2.status !== "manual").map((c2) => c2.id) : []
+    );
     for (const id of notFolded) {
       if (byId2.has(id) || !open.has(id)) continue;
+      if (alreadyDecided.has(id)) continue;
       decided.push({ id, status: "manual", reason: "undecidable", justification: rejectedWhy(id), findings: [] });
     }
-    next.packAdjudication = { standard: adj.standard, criteria: decided };
+    const carried = /* @__PURE__ */ new Map();
+    if (audit2.packAdjudication?.standard === adj.standard) {
+      for (const c2 of audit2.packAdjudication.criteria) carried.set(c2.id, c2);
+    }
+    for (const c2 of decided) carried.set(c2.id, c2);
+    next.packAdjudication = { standard: adj.standard, criteria: [...carried.values()] };
     next.findings = [...next.findings, ...newFindings];
     next.adjudicated = { date: adj.auditDate, applied, stillManual, ...rejectedCriteria.length ? { rejected: rejectedCriteria.length } : {} };
     return { ok: issues.length === 0, audit: next, issues, applied, stillManual, rejected: rejectedCriteria.length, rejectedCriteria, grounding };

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-08-18",
+  "fetchedAt": "2026-08-19",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-18 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-08-18",
+  "fetchedAt": "2026-08-19",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-08-18",
+  "fetchedAt": "2026-08-19",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.11.1
+  version: 5.11.3
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.11.1";
+var VERSION = "5.11.3";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -2289,7 +2289,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-18 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -57953,11 +57953,20 @@ function applyAdjudication(audit2, adj, opts = {}) {
         decidedBy: "agent"
       });
     }
+    const alreadyDecided = new Set(
+      audit2.packAdjudication?.standard === adj.standard ? audit2.packAdjudication.criteria.filter((c2) => c2.status !== "manual").map((c2) => c2.id) : []
+    );
     for (const id of notFolded) {
       if (byId2.has(id) || !open.has(id)) continue;
+      if (alreadyDecided.has(id)) continue;
       decided.push({ id, status: "manual", reason: "undecidable", justification: rejectedWhy(id), findings: [] });
     }
-    next.packAdjudication = { standard: adj.standard, criteria: decided };
+    const carried = /* @__PURE__ */ new Map();
+    if (audit2.packAdjudication?.standard === adj.standard) {
+      for (const c2 of audit2.packAdjudication.criteria) carried.set(c2.id, c2);
+    }
+    for (const c2 of decided) carried.set(c2.id, c2);
+    next.packAdjudication = { standard: adj.standard, criteria: [...carried.values()] };
     next.findings = [...next.findings, ...newFindings];
     next.adjudicated = { date: adj.auditDate, applied, stillManual, ...rejectedCriteria.length ? { rejected: rejectedCriteria.length } : {} };
     return { ok: issues.length === 0, audit: next, issues, applied, stillManual, rejected: rejectedCriteria.length, rejectedCriteria, grounding };

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.11.1
+  version: 5.11.3
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.11.1";
+var VERSION = "5.11.3";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -2289,7 +2289,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-18 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -57953,11 +57953,20 @@ function applyAdjudication(audit2, adj, opts = {}) {
         decidedBy: "agent"
       });
     }
+    const alreadyDecided = new Set(
+      audit2.packAdjudication?.standard === adj.standard ? audit2.packAdjudication.criteria.filter((c2) => c2.status !== "manual").map((c2) => c2.id) : []
+    );
     for (const id of notFolded) {
       if (byId2.has(id) || !open.has(id)) continue;
+      if (alreadyDecided.has(id)) continue;
       decided.push({ id, status: "manual", reason: "undecidable", justification: rejectedWhy(id), findings: [] });
     }
-    next.packAdjudication = { standard: adj.standard, criteria: decided };
+    const carried = /* @__PURE__ */ new Map();
+    if (audit2.packAdjudication?.standard === adj.standard) {
+      for (const c2 of audit2.packAdjudication.criteria) carried.set(c2.id, c2);
+    }
+    for (const c2 of decided) carried.set(c2.id, c2);
+    next.packAdjudication = { standard: adj.standard, criteria: [...carried.values()] };
     next.findings = [...next.findings, ...newFindings];
     next.adjudicated = { date: adj.auditDate, applied, stillManual, ...rejectedCriteria.length ? { rejected: rejectedCriteria.length } : {} };
     return { ok: issues.length === 0, audit: next, issues, applied, stillManual, rejected: rejectedCriteria.length, rejectedCriteria, grounding };

package/src/adjudicate.ts

@@ -1003,11 +1003,34 @@ export function applyAdjudication(
     // An OPEN criterion the file never mentioned — a coverage gap, or one the caller declared
     // uncovered — also has to say why it is still to assess; the loop above only walks the
     // items that exist.
+    const alreadyDecided = new Set(
+      audit.packAdjudication?.standard === adj.standard ? audit.packAdjudication.criteria.filter((c) => c.status !== "manual").map((c) => c.id) : [],
+    );
     for (const id of notFolded) {
       if (byId.has(id) || !open.has(id)) continue;
+      // …and never over a verdict an earlier pass already landed: this loop exists to explain
+      // an OPEN criterion, not to reopen a closed one.
+      if (alreadyDecided.has(id)) continue;
       decided.push({ id, status: "manual", reason: "undecidable", justification: rejectedWhy(id), findings: [] });
     }
-    next.packAdjudication = { standard: adj.standard, criteria: decided };
+    // MERGE, never replace. A fold used to write `packAdjudication` from the file it was
+    // given and nothing else, which is fine for one fold and wrong for two: a later pass
+    // re-derives its worklist from what is STILL open, so a criterion decided earlier is
+    // ABSENT from it by construction — and rewriting the set dropped it back to « à évaluer ».
+    //
+    // Measured on the first three-pass run: 47 criteria, 5 refused → 41 left; the next pass
+    // ruled those, 4 refused → and the third opened with 47 again. Each pass was undoing the
+    // one before it, so the tier could never converge however much it was allowed to spend.
+    //
+    // What the file rules wins for its own criteria — a pass that names a criterion decides it,
+    // even against an earlier verdict — and everything else it does not mention stays as it
+    // was. Only entries of the SAME standard carry over; a pack change starts a clean sheet.
+    const carried = new Map<string, PackCriterionAdjudication>();
+    if (audit.packAdjudication?.standard === adj.standard) {
+      for (const c of audit.packAdjudication.criteria) carried.set(c.id, c);
+    }
+    for (const c of decided) carried.set(c.id, c);
+    next.packAdjudication = { standard: adj.standard, criteria: [...carried.values()] };
     // The agent's findings still join the flat list so grounding, `check` and the reports can
     // resolve them — but they never touch a WCAG criterion's status.
     next.findings = [...next.findings, ...newFindings];

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-18 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/integrations/payload.ts

@@ -165,7 +165,7 @@ export function stayedOnPage(expected: string, actual: string): boolean {
  *  same metadata — a page recorded by Cypress and the same page recorded by Playwright must
  *  land on one identity, or the per-page grid grows a phantom column. */
 export function buildPayload(
-  collected: { dom: string; styles?: unknown; boxes?: unknown; css?: unknown; title?: string; url?: string; viewport?: unknown },
+  collected: { dom: string; styles?: unknown; boxes?: unknown; css?: unknown; title?: string; url?: string; viewport?: unknown; doctype?: string },
   url: string,
   runner: string,
   opts: CheckOptions,
@@ -182,6 +182,16 @@ export function buildPayload(
       runner,
       viewport: collected.viewport,
       capturedAt: new Date().toISOString(),
+      // `documentElement.outerHTML` starts at `<html>`, so the DOM alone drops the doctype and
+      // RGAA 8.1 — « chaque page web est-elle définie par un type de document ? » — has nothing
+      // to look at. The collector captures it separately; this is where it was being thrown
+      // away one step later. Measured: 105 of 106 criteria decided, and the one left was 8.1,
+      // whose brief read « this capture predates doctype recording ».
+      //
+      // `!== undefined`, never a truthiness test: an EMPTY doctype is a page that genuinely has
+      // none, which is the non-conformity itself. Collapsing it into "not recorded" would hide
+      // a failing page behind « à évaluer ».
+      ...(collected.doctype !== undefined ? { doctype: collected.doctype } : {}),
       ...(opts.auth !== undefined ? { auth: opts.auth } : {}),
       ...(opts.sources ? { sources: opts.sources } : {}),
       ...(opts.notes ? { notes: opts.notes } : {}),

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.11.1";
+export const VERSION = "5.11.3";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,