ultra11y 5.11.3 → 5.13.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.11.3",
+      "version": "5.13.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.11.3",
+  "version": "5.13.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.11.3",
+  "version": "5.13.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.11.3";
+const ULTRA11Y_PLUGIN_VERSION = "5.13.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-DzQb84Kw.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-DvcIA6VQ.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-DzQb84Kw.js';
-export { s as slugify } from './payload-DzQb84Kw.js';
+import { C as CheckOptions } from './payload-DvcIA6VQ.js';
+export { s as slugify } from './payload-DvcIA6VQ.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/cypress.mjs

@@ -155,7 +155,7 @@ function stayedOnPage(expected, actual) {
   if (a === void 0 || b === void 0) return true;
   return a === b;
 }
-function buildPayload(collected, url, runner, opts, screenshot, probes) {
+function buildPayload(collected, url, runner, opts, screenshot, probes, axe) {
   const id = opts.as || slugify(url);
   return {
     meta: {
@@ -188,7 +188,10 @@ function buildPayload(collected, url, runner, opts, screenshot, probes) {
     // What the live probes measured, when the caller asked for them. It rides in the payload
     // because `snapshot write` persists it beside the DOM — the audit that folds it runs later
     // and in another process, so a measurement kept in memory decides nothing.
-    ...probes ? { probes } : {}
+    ...probes ? { probes } : {},
+    // Same contract as the probes: it rides in the payload and `snapshot write` persists it
+    // beside the DOM, so the offline re-audit sees what the browser saw.
+    ...axe ? { axe } : {}
   };
 }
 

package/dist/payload-DvcIA6VQ.d.ts

@@ -0,0 +1,101 @@
+interface FindingLike {
+    ruleId: string;
+    criteriaId: string;
+    file: string;
+    line: number;
+    severity: string;
+    message: string;
+    advisory?: boolean;
+    origin?: {
+        sourceFile?: string;
+        sourceLine?: number;
+    };
+}
+interface AuditLike {
+    findings?: FindingLike[];
+}
+interface SnapshotPayload {
+    meta: Record<string, unknown>;
+    dom: string;
+    styles?: unknown;
+    boxes?: unknown;
+    css?: unknown;
+    screenshot?: string;
+    /** What the live probes measured, when the caller ran them. */
+    probes?: unknown;
+    /** What axe-core found on this page, when the caller ran it. */
+    axe?: unknown;
+}
+/** Same slug rule as the engine (src/snapshot.ts slugifyPageId): accent-folded URL path. */
+declare function slugify(url: string): string;
+interface CheckOptions {
+    /** The page id (directory name). Defaults to the slugified URL path. */
+    as?: string;
+    /** Human page name for the report. Defaults to the document title. */
+    name?: string;
+    /** Severity at which the check fails, or `false` to record without ever failing. */
+    failOn?: "blocking" | "major" | "minor" | false;
+    /** Mark the page as sitting behind authentication. */
+    auth?: boolean;
+    /** Source files that rendered it — findings are then reported against YOUR code. */
+    sources?: string[];
+    /** Reproduction notes carried into the auditor ticket. */
+    notes?: string;
+    /** Capture a viewport screenshot for the pixel tier (Playwright: on by default). */
+    screenshot?: boolean;
+    /** The path you NAVIGATED to. Given it, the fixture refuses to record a page the browser
+     *  did not stay on — a guarded route that redirected, a session that expired — instead of
+     *  filing that other screen under this page's `as`/`name`. Nothing about such a snapshot
+     *  looks wrong, which is what makes it the worst thing an accessibility report can carry.
+     *  Compared by path (a query or fragment the app appends to its own route is the same
+     *  page); a full URL works too. `scan --sample` applies the same rule. */
+    expectPath?: string;
+    /** Run the LIVE PROBES on this page after collecting it: 200% zoom, 320px reflow, the
+     *  text-spacing override, focus visibility and content-on-hover.
+     *
+     *  These are the measurements a recorded snapshot can never settle, because they are
+     *  properties of a page being acted on rather than of a page as it stands. `scan` runs them
+     *  in its own browser, which is exactly why they were undecidable on any screen behind a
+     *  login or a state machine — the scanner arrives cold and gets a redirect. Your suite has
+     *  the page in the right state; this is how it says so.
+     *
+     *  Off by default: the probes press Tab, hover, resize the viewport and inject a stylesheet,
+     *  and a suite should opt into that. Everything is restored before it returns, and the
+     *  snapshot has already been collected, so what they measure cannot alter what was recorded.
+     *  Pass an array to run only some of them (by criterion: "1.4.4", "1.4.10", "1.4.12",
+     *  "1.4.13", "2.4.7"), or an object to also set the bounds — how wide the reflow probe
+     *  narrows to, how many focusables are worth tabbing through, how many hits are worth
+     *  recording. 320px is normative and stays the default; the other two are judgements about
+     *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
+     *  quietly cut off at 120. */
+    probes?: boolean | string[] | ProbeTuning;
+    /** Run AXE-CORE on the page before recording it.
+     *
+     *  `scan` has always driven axe; your suite never did — and your suite is the only tier that
+     *  reaches a page behind a login and a state machine, which is exactly where the criteria
+     *  axe decides (computed contrast above all) were left « to assess » run after run.
+     *
+     *  Default `auto`: axe runs when `@axe-core/playwright` resolves from your project, and is
+     *  silently skipped when it does not — so adding this costs nothing to a repo that has not
+     *  installed it. `false` turns it off; `true` demands it and reports loudly if it cannot be
+     *  resolved, which is what you want in CI where a silent downgrade is indistinguishable from
+     *  a clean page. */
+    axe?: boolean | "auto";
+}
+/** The bounds a repository may put on the live probes. Stated once, here, because the same
+ *  list is read from `.ultra11yrc.json`, accepted at the call site and handed to the engine —
+ *  three copies of a field list is three chances for one of them to fall behind.
+ *
+ *  `budgetMs` and `actionTimeoutMs` are not tuning in the same sense as the others: they are
+ *  what stops a probe from spending SOMEBODY ELSE'S test timeout. See ProbeLimits. */
+interface ProbeTuning {
+    only?: string[];
+    reflowWidth?: number;
+    maxFocusables?: number;
+    maxHits?: number;
+    maxTriggers?: number;
+    actionTimeoutMs?: number;
+    budgetMs?: number;
+}
+
+export { type AuditLike as A, type CheckOptions as C, type FindingLike as F, type SnapshotPayload as S, slugify as s };

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-DzQb84Kw.js';
+import { C as CheckOptions, A as AuditLike } from './payload-DvcIA6VQ.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -489,7 +489,7 @@ function stayedOnPage(expected, actual) {
   if (a === void 0 || b === void 0) return true;
   return a === b;
 }
-function buildPayload(collected, url, runner, opts, screenshot, probes) {
+function buildPayload(collected, url, runner, opts, screenshot, probes, axe) {
   const id = opts.as || slugify(url);
   return {
     meta: {
@@ -522,7 +522,10 @@ function buildPayload(collected, url, runner, opts, screenshot, probes) {
     // What the live probes measured, when the caller asked for them. It rides in the payload
     // because `snapshot write` persists it beside the DOM — the audit that folds it runs later
     // and in another process, so a measurement kept in memory decides nothing.
-    ...probes ? { probes } : {}
+    ...probes ? { probes } : {},
+    // Same contract as the probes: it rides in the payload and `snapshot write` persists it
+    // beside the DOM, so the offline re-audit sees what the browser saw.
+    ...axe ? { axe } : {}
   };
 }
 function gate(result, pageName, failOn) {
@@ -588,6 +591,32 @@ function fromConfig() {
     return {};
   }
 }
+async function runAxe(page, mode) {
+  if (mode === false) return void 0;
+  const demanded = mode === true;
+  let AxeBuilder;
+  try {
+    const req = createRequire2(join(process.cwd(), "package.json"));
+    const mod = req("@axe-core/playwright");
+    AxeBuilder = mod.default ?? mod;
+  } catch (e) {
+    if (demanded) {
+      console.warn(
+        `ultra11y: axe was requested but @axe-core/playwright could not be resolved from ${process.cwd()} \u2014 ${e instanceof Error ? e.message : String(e)}. Install it, or set \`axe: false\`. The criteria axe decides stay to assess.`
+      );
+    }
+    return void 0;
+  }
+  try {
+    const res = await new AxeBuilder({ page }).analyze();
+    return { ran: true, violations: res.violations ?? [] };
+  } catch (e) {
+    console.warn(
+      `ultra11y: the axe pass failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria axe decides stay to assess.`
+    );
+    return void 0;
+  }
+}
 async function checkA11y(page, opts = {}) {
   const collected = await page.evaluate(COLLECT_SNAPSHOT);
   let shot;
@@ -613,7 +642,8 @@ async function checkA11y(page, opts = {}) {
       );
     }
   }
-  const payload = buildPayload(collected, url, "playwright", opts, shot, probes);
+  const axe = await runAxe(page, opts.axe ?? "auto");
+  const payload = buildPayload(collected, url, "playwright", opts, shot, probes, axe);
   const result = auditSnapshot(payload);
   if (opts.report) writePagesReport(typeof opts.report === "object" ? opts.report : {});
   gate(result, String(payload.meta.name), opts.failOn);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.11.3",
+  "version": "5.13.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",