ultra11y 5.26.0 → 5.28.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.26.0",
+      "version": "5.28.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.26.0",
+  "version": "5.28.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.26.0",
+  "version": "5.28.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.26.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.28.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -371,7 +371,7 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
   fills an input or resizes the viewport — otherwise the snapshot would record our own
   instrumentation instead of the site.
 - **Page by page** — RGAA is a per-page norm; the engine's verdict is scope-wide. `pages`
-  bridges the two: one row per criterion, one column per page, embedded in `report` and
+  bridges the two: one row per criterion, one column per page URL, embedded in `report` and
   rebuilt from a committed `audit.json` alone. The per-page status is not recomputed — a
   per-page *view* of the audit runs through the very same projection the report uses, so grid
   and report agree by construction. Two rules hold the line: a finding is attributed to a page

package/dist/playwright.mjs

@@ -287,14 +287,17 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   if (!count) return [];
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
+  let prevKey = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.key === prevKey) continue;
     if (seen.has(r.key)) break;
     seen.add(r.key);
+    prevKey = r.key;
     if (!r.changed) {
       hits.push({
         selector: r.selector,
@@ -306,11 +309,23 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   }
   return hits;
 }
+var NATIVE_SEGMENT_STOPS = {
+  date: 5,
+  time: 5,
+  "datetime-local": 8,
+  month: 4,
+  week: 4
+};
+function tabPressBudget(count, limits) {
+  return Math.min(count * 2 + 20, limits.maxFocusables * 2 + 20);
+}
 var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const e = document.activeElement;
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e) };
+  const stops = ${JSON.stringify(NATIVE_SEGMENT_STOPS)};
+  const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
+  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
 async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
@@ -318,7 +333,7 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
   let prev = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
@@ -326,8 +341,9 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
     if (!now) break;
     if (prev?.tagged && now.tagged && now.key === prev.key) {
+      const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
-      for (let k = 0; k < confirmPresses && stuck; k++) {
+      for (let k = 0; k < budget && stuck; k++) {
         if (deadline?.out()) break;
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
@@ -337,13 +353,15 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
         hits.push({
           selector: now.selector,
           html: now.html,
-          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + confirmPresses} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
+          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
         break;
       }
     }
-    if (seen.has(now.key)) break;
-    seen.add(now.key);
+    if (now.key !== prev?.key) {
+      if (seen.has(now.key)) break;
+      seen.add(now.key);
+    }
     prev = now;
   }
   return hits;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.26.0",
+  "version": "5.28.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -251,9 +251,16 @@ const RULE_TO_CRITERIA = {
   "error-not-associated": ["11.10"], "aria-invalid-no-description": ["11.10"],
   "axe:label": ["11.1"], "axe:form-field-multiple-labels": ["11.1"], "axe:select-name": ["11.1"], "axe:label-title-only": ["11.1"],
   "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"], "axe:input-button-name": ["11.9"], "axe:button-name": ["11.9"],
-  // Theme 12 — navigation (12.7 skip link, 12.8 tab order)
+  // Theme 12 — navigation (12.7 skip link, 12.8 tab order, 12.9 keyboard trap)
   "skip-link-target-missing": ["12.7"], "axe:skip-link": ["12.7"], "axe:bypass": ["12.7"],
   "positive-tabindex": ["12.8"], "axe:tabindex": ["12.8"],
+  // 12.9 « la navigation ne doit pas contenir de piège au clavier ». The probe that answers it
+  // has existed since `probeKeyboardTrap` landed, and it was mapped to WCAG 2.1.2 alone — so a
+  // trap the browser had just walked into raised a blocking WCAG non-conformity and left RGAA
+  // 12.9 « à évaluer », to be bought from a paid adjudicator on every run. The evidence was
+  // measured and then never delivered to the criterion it answers. No axe rule joins it: axe
+  // has none for keyboard traps, which is why the probe was written in the first place.
+  "dyn-keyboard-trap": ["12.9"],
   // Theme 13 — consultation (13.1 time limits, 13.8 moving/blinking)
   "meta-refresh-redirect": ["13.1"], "blink-marquee": ["13.8"], "autoplay-media": ["4.10", "13.8"],
   "axe:no-autoplay-audio": ["4.10"], "axe:blink": ["13.8"], "axe:marquee": ["13.8"],