ultra11y 5.35.1 → 5.35.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.35.1",
+      "version": "5.35.2",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.35.1",
+  "version": "5.35.2",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.35.1",
+  "version": "5.35.2",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.35.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.35.2";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.35.1",
+  "version": "5.35.2",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.35.1";
+var VERSION = "5.35.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -44713,10 +44713,18 @@ var PRESENTATIONAL_MARKUP_ATTRS = /* @__PURE__ */ new Set([
 ]);
 var DOWNLOAD_HREF = /\.(pdf|docx?|xlsx?)(?:[?#]|$)/i;
 var STATUS_CLASS = /(error|status|message|alert|notif|toast|feedback|live)/i;
+var TEMPORAL_MEDIA_VALUE = /(?:^|[/.?=&_-])(?:audio|video|player|podcast|mp[34]|webm|ogg|ogv|wav|m4a|mov|avi|mpeg)(?:$|[/.?=&_-])/i;
 var ROUTER_IMPORT = /['"](?:react-router(?:-dom)?|next\/(?:router|navigation)|vue-router|@remix-run\/[\w-]+|@tanstack\/[\w-]*router|@sveltejs\/kit|\$app\/(?:navigation|stores))['"]/;
 var FOREIGN_LEXICON = /\b(?:the|and|with|your|about|please|download|settings|welcome|dashboard|overview|read more|learn more|sign in|sign up|log in|get started|coming soon|powered by)\b/i;
 var CONTROL_TAGS = ["input", "select", "textarea"];
 var INTERACTIVE_TAGS = ["a", "button", "input", "select", "textarea", "summary", "details", "label"];
+function embeddedMediaKind(el) {
+  const type = (attr(el, "type") ?? "").toLowerCase();
+  const resource = `${attr(el, "src") ?? ""} ${attr(el, "data") ?? ""}`.toLowerCase();
+  if (/^(?:audio|video)\//.test(type) || TEMPORAL_MEDIA_VALUE.test(`${type} ${resource}`)) return "temporal";
+  if (/^image\//.test(type) || /\.(?:svg|png|jpe?g|webp|avif)(?:[?#]|$)/i.test(resource)) return "non-temporal";
+  return "unknown";
+}
 function labelFor(doc, el) {
   const id = attr(el, "id");
   const lbl = id ? elementsByTag(doc, "label").find((l) => attr(l, "for") === id) : void 0;
@@ -45099,6 +45107,66 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
+  // RGAA 4.11 — temporal players and the code that controls their consultation. This must
+  // not inherit WCAG 2.1.1/2.1.2's page-wide union of pointer handlers and focusables: an
+  // unrelated clickable card says nothing about whether an <audio> can be paused.
+  temporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "audio" || e.tag === "video" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "non-temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> temporal media \u2014 controls=${attr(e, "controls") !== void 0}, autoplay=${attr(e, "autoplay") !== void 0}; can play/pause/stop and sound be operated by keyboard and pointer?`,
+        `temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? ""}|controls=${attr(e, "controls") !== void 0}`
+      )
+    ),
+    ...linesOf(d, /\.(?:play|pause)\s*\(|\b(?:currentTime|muted|volume|playbackRate)\s*=|\bHTMLMediaElement\b/).map(
+      (l) => hAt(d, l.line, "media-control", `custom temporal-media control: ${l.text}`, `temporal-control|${l.text}`)
+    )
+  ]),
+  // RGAA 4.12 — non-temporal plug-in/SVG/canvas media. Static instances are included too:
+  // the adjudicator must first establish whether they expose consultation controls before it
+  // can legitimately answer NA. Temporal players and generic event handlers stay out.
+  nonTemporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "svg" || e.tag === "canvas" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> non-temporal media \u2014 inspect any pan/zoom/navigation/control function for keyboard and pointer operation`,
+        `non-temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...linesOf(d, /\b(?:svgPanZoom|panzoom|zoomIn|zoomOut|getContext)\b/i).map(
+      (l) => hAt(d, l.line, "media-control", `non-temporal media/control code: ${l.text}`, `non-temporal-control|${l.text}`)
+    )
+  ]),
+  // WCAG 2.3.1 / RGAA 13.7 — only things capable of a luminance flash. The old `motion`
+  // subject mixed autoplay audio and <marquee> into this criterion while omitting ordinary
+  // images, canvas, scripts and stylesheet animation rules. That gave the adjudicator lots of
+  // evidence and none of the evidence the three-flash test actually asks for.
+  flashes: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => ["video", "img", "svg", "canvas", "embed", "object", "blink"].includes(e.tag)).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> visual/animated content \u2014 does it flash, and if so is it at most 3 flashes/s or below the area threshold?`,
+        `flash-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...elementsByTag(d, "script").map(
+      (e) => h(d, e, `<script> \u2014 inspect for luminance/colour states toggled rapidly`, `flash-script|${attr(e, "src") ?? t(e, 80)}`)
+    ),
+    ...d.elements.filter((e) => /animation|transition/i.test(attr(e, "style") ?? "")).map((e) => h(d, e, `inline visual animation: ${(attr(e, "style") ?? "").slice(0, 100)}`, `flash-inline|${attr(e, "style") ?? ""}`)),
+    ...(d.signals?.css?.rules ?? []).filter((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0).map(
+      (r) => hAt(
+        d,
+        1,
+        `css:${r.selector}`,
+        `stylesheet animation: ${r.selector.slice(0, 60)} { ${declsText(r.decls)} } \u2014 inspect keyframes for rapid opposing luminance changes`,
+        `flash-css|${r.selector}|${declsText(r.decls)}`
+      )
+    ),
+    ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -45358,7 +45426,7 @@ var SC_SUBJECTS = {
   "2.1.4": ["shortcuts"],
   "2.2.1": ["timers"],
   "2.2.2": ["motion", "timers"],
-  "2.3.1": ["motion"],
+  "2.3.1": ["flashes"],
   "2.4.1": ["landmarks"],
   "2.4.3": ["focusOrder"],
   "2.4.4": ["links"],
@@ -45451,6 +45519,10 @@ var PACK_SUBJECTS = {
     // WCAG 1.4.2, which is `static` and therefore has no subject of its own — but the pack
     // flags 4.10 `judgment`, so judgmentGuard reopens it and it would arrive with nothing.
     "4.10": ["motion"],
+    // 4.11/4.12 map to the same keyboard SCs but ask about disjoint media populations.
+    // Inheriting the union handed both criteria every pointer handler and focusable in scope.
+    "4.11": ["temporalMediaControls"],
+    "4.12": ["nonTemporalMediaControls"],
     // Theme 3 — colour. The question is about what colour alone conveys, not the outline.
     "3.1": ["colourPairs", "links"],
     "3.2": ["colourPairs"],
@@ -45487,7 +45559,7 @@ var PACK_SUBJECTS = {
     "13.2": ["newWindow"],
     "13.3": ["downloadDocs"],
     "13.4": ["downloadDocs"],
-    "13.7": ["motion"],
+    "13.7": ["flashes"],
     "13.8": ["motion", "timers"],
     "13.9": ["readingOrder"],
     "13.10": ["pointerHandlers"],
@@ -49414,7 +49486,7 @@ var SUBJECT_MATTER = {
   "2.1.4": hasCharShortcut,
   "2.2.1": hasTimeLimit,
   "2.2.2": hasMovingContent,
-  "2.3.1": hasMovingContent,
+  "2.3.1": hasFlashCandidate,
   "2.5.1": hasGesture,
   "2.5.2": hasDownEventAction,
   "2.5.7": hasDrag
@@ -49459,6 +49531,14 @@ function hasMovingContent(d) {
   if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
   return /\b(?:carousel|autoplay|requestAnimationFrame|animation-iteration-count|\.gif["']|\bswiper\b)/i.test(d.source);
 }
+function hasFlashCandidate(d) {
+  if (has(d, "video", "img", "svg", "canvas", "embed", "object", "blink", "script")) return true;
+  if (d.elements.some((e) => /animation|transition/i.test(e.attribs.style ?? ""))) return true;
+  if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
+  return /\b(?:flash|flashing|strobe|blink|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i.test(
+    d.source
+  );
+}
 function hasFormControl(d) {
   if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;
   return d.elements.some((e) => {

package/skills/review-a11y/SKILL.md

@@ -3,7 +3,7 @@ name: review-a11y
 description: "Use to REVIEW changed frontend code for accessibility: staged files, a working diff, branch, or PR; prompts such as 'review a11y', 'is this accessible?', or 'anything to fix before merge?'; and hook or CI findings on a change. Run the bundled install-free engine with cross-file JSX/TSX analysis, then adjudicate candidates and return a severity-ranked WCAG 2.2 AA review with file:line fixes, residual rendering risks, and a verdict. Use `ultra11y` instead for whole-repo audits, dated conformance reports, country standards, PRD backlogs, or authoring accessible markup."
 license: MIT
 metadata:
-  version: 5.35.1
+  version: 5.35.2
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.35.1";
+var VERSION = "5.35.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -44713,10 +44713,18 @@ var PRESENTATIONAL_MARKUP_ATTRS = /* @__PURE__ */ new Set([
 ]);
 var DOWNLOAD_HREF = /\.(pdf|docx?|xlsx?)(?:[?#]|$)/i;
 var STATUS_CLASS = /(error|status|message|alert|notif|toast|feedback|live)/i;
+var TEMPORAL_MEDIA_VALUE = /(?:^|[/.?=&_-])(?:audio|video|player|podcast|mp[34]|webm|ogg|ogv|wav|m4a|mov|avi|mpeg)(?:$|[/.?=&_-])/i;
 var ROUTER_IMPORT = /['"](?:react-router(?:-dom)?|next\/(?:router|navigation)|vue-router|@remix-run\/[\w-]+|@tanstack\/[\w-]*router|@sveltejs\/kit|\$app\/(?:navigation|stores))['"]/;
 var FOREIGN_LEXICON = /\b(?:the|and|with|your|about|please|download|settings|welcome|dashboard|overview|read more|learn more|sign in|sign up|log in|get started|coming soon|powered by)\b/i;
 var CONTROL_TAGS = ["input", "select", "textarea"];
 var INTERACTIVE_TAGS = ["a", "button", "input", "select", "textarea", "summary", "details", "label"];
+function embeddedMediaKind(el) {
+  const type = (attr(el, "type") ?? "").toLowerCase();
+  const resource = `${attr(el, "src") ?? ""} ${attr(el, "data") ?? ""}`.toLowerCase();
+  if (/^(?:audio|video)\//.test(type) || TEMPORAL_MEDIA_VALUE.test(`${type} ${resource}`)) return "temporal";
+  if (/^image\//.test(type) || /\.(?:svg|png|jpe?g|webp|avif)(?:[?#]|$)/i.test(resource)) return "non-temporal";
+  return "unknown";
+}
 function labelFor(doc, el) {
   const id = attr(el, "id");
   const lbl = id ? elementsByTag(doc, "label").find((l) => attr(l, "for") === id) : void 0;
@@ -45099,6 +45107,66 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
+  // RGAA 4.11 — temporal players and the code that controls their consultation. This must
+  // not inherit WCAG 2.1.1/2.1.2's page-wide union of pointer handlers and focusables: an
+  // unrelated clickable card says nothing about whether an <audio> can be paused.
+  temporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "audio" || e.tag === "video" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "non-temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> temporal media \u2014 controls=${attr(e, "controls") !== void 0}, autoplay=${attr(e, "autoplay") !== void 0}; can play/pause/stop and sound be operated by keyboard and pointer?`,
+        `temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? ""}|controls=${attr(e, "controls") !== void 0}`
+      )
+    ),
+    ...linesOf(d, /\.(?:play|pause)\s*\(|\b(?:currentTime|muted|volume|playbackRate)\s*=|\bHTMLMediaElement\b/).map(
+      (l) => hAt(d, l.line, "media-control", `custom temporal-media control: ${l.text}`, `temporal-control|${l.text}`)
+    )
+  ]),
+  // RGAA 4.12 — non-temporal plug-in/SVG/canvas media. Static instances are included too:
+  // the adjudicator must first establish whether they expose consultation controls before it
+  // can legitimately answer NA. Temporal players and generic event handlers stay out.
+  nonTemporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "svg" || e.tag === "canvas" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> non-temporal media \u2014 inspect any pan/zoom/navigation/control function for keyboard and pointer operation`,
+        `non-temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...linesOf(d, /\b(?:svgPanZoom|panzoom|zoomIn|zoomOut|getContext)\b/i).map(
+      (l) => hAt(d, l.line, "media-control", `non-temporal media/control code: ${l.text}`, `non-temporal-control|${l.text}`)
+    )
+  ]),
+  // WCAG 2.3.1 / RGAA 13.7 — only things capable of a luminance flash. The old `motion`
+  // subject mixed autoplay audio and <marquee> into this criterion while omitting ordinary
+  // images, canvas, scripts and stylesheet animation rules. That gave the adjudicator lots of
+  // evidence and none of the evidence the three-flash test actually asks for.
+  flashes: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => ["video", "img", "svg", "canvas", "embed", "object", "blink"].includes(e.tag)).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> visual/animated content \u2014 does it flash, and if so is it at most 3 flashes/s or below the area threshold?`,
+        `flash-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...elementsByTag(d, "script").map(
+      (e) => h(d, e, `<script> \u2014 inspect for luminance/colour states toggled rapidly`, `flash-script|${attr(e, "src") ?? t(e, 80)}`)
+    ),
+    ...d.elements.filter((e) => /animation|transition/i.test(attr(e, "style") ?? "")).map((e) => h(d, e, `inline visual animation: ${(attr(e, "style") ?? "").slice(0, 100)}`, `flash-inline|${attr(e, "style") ?? ""}`)),
+    ...(d.signals?.css?.rules ?? []).filter((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0).map(
+      (r) => hAt(
+        d,
+        1,
+        `css:${r.selector}`,
+        `stylesheet animation: ${r.selector.slice(0, 60)} { ${declsText(r.decls)} } \u2014 inspect keyframes for rapid opposing luminance changes`,
+        `flash-css|${r.selector}|${declsText(r.decls)}`
+      )
+    ),
+    ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -45358,7 +45426,7 @@ var SC_SUBJECTS = {
   "2.1.4": ["shortcuts"],
   "2.2.1": ["timers"],
   "2.2.2": ["motion", "timers"],
-  "2.3.1": ["motion"],
+  "2.3.1": ["flashes"],
   "2.4.1": ["landmarks"],
   "2.4.3": ["focusOrder"],
   "2.4.4": ["links"],
@@ -45451,6 +45519,10 @@ var PACK_SUBJECTS = {
     // WCAG 1.4.2, which is `static` and therefore has no subject of its own — but the pack
     // flags 4.10 `judgment`, so judgmentGuard reopens it and it would arrive with nothing.
     "4.10": ["motion"],
+    // 4.11/4.12 map to the same keyboard SCs but ask about disjoint media populations.
+    // Inheriting the union handed both criteria every pointer handler and focusable in scope.
+    "4.11": ["temporalMediaControls"],
+    "4.12": ["nonTemporalMediaControls"],
     // Theme 3 — colour. The question is about what colour alone conveys, not the outline.
     "3.1": ["colourPairs", "links"],
     "3.2": ["colourPairs"],
@@ -45487,7 +45559,7 @@ var PACK_SUBJECTS = {
     "13.2": ["newWindow"],
     "13.3": ["downloadDocs"],
     "13.4": ["downloadDocs"],
-    "13.7": ["motion"],
+    "13.7": ["flashes"],
     "13.8": ["motion", "timers"],
     "13.9": ["readingOrder"],
     "13.10": ["pointerHandlers"],
@@ -49414,7 +49486,7 @@ var SUBJECT_MATTER = {
   "2.1.4": hasCharShortcut,
   "2.2.1": hasTimeLimit,
   "2.2.2": hasMovingContent,
-  "2.3.1": hasMovingContent,
+  "2.3.1": hasFlashCandidate,
   "2.5.1": hasGesture,
   "2.5.2": hasDownEventAction,
   "2.5.7": hasDrag
@@ -49459,6 +49531,14 @@ function hasMovingContent(d) {
   if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
   return /\b(?:carousel|autoplay|requestAnimationFrame|animation-iteration-count|\.gif["']|\bswiper\b)/i.test(d.source);
 }
+function hasFlashCandidate(d) {
+  if (has(d, "video", "img", "svg", "canvas", "embed", "object", "blink", "script")) return true;
+  if (d.elements.some((e) => /animation|transition/i.test(e.attribs.style ?? ""))) return true;
+  if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
+  return /\b(?:flash|flashing|strobe|blink|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i.test(
+    d.source
+  );
+}
 function hasFormControl(d) {
   if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;
   return d.elements.some((e) => {

package/skills/ultra11y/SKILL.md

@@ -3,7 +3,7 @@ name: ultra11y
 description: "Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 81 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR."
 license: MIT
 metadata:
-  version: 5.35.1
+  version: 5.35.2
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.35.1";
+var VERSION = "5.35.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -44713,10 +44713,18 @@ var PRESENTATIONAL_MARKUP_ATTRS = /* @__PURE__ */ new Set([
 ]);
 var DOWNLOAD_HREF = /\.(pdf|docx?|xlsx?)(?:[?#]|$)/i;
 var STATUS_CLASS = /(error|status|message|alert|notif|toast|feedback|live)/i;
+var TEMPORAL_MEDIA_VALUE = /(?:^|[/.?=&_-])(?:audio|video|player|podcast|mp[34]|webm|ogg|ogv|wav|m4a|mov|avi|mpeg)(?:$|[/.?=&_-])/i;
 var ROUTER_IMPORT = /['"](?:react-router(?:-dom)?|next\/(?:router|navigation)|vue-router|@remix-run\/[\w-]+|@tanstack\/[\w-]*router|@sveltejs\/kit|\$app\/(?:navigation|stores))['"]/;
 var FOREIGN_LEXICON = /\b(?:the|and|with|your|about|please|download|settings|welcome|dashboard|overview|read more|learn more|sign in|sign up|log in|get started|coming soon|powered by)\b/i;
 var CONTROL_TAGS = ["input", "select", "textarea"];
 var INTERACTIVE_TAGS = ["a", "button", "input", "select", "textarea", "summary", "details", "label"];
+function embeddedMediaKind(el) {
+  const type = (attr(el, "type") ?? "").toLowerCase();
+  const resource = `${attr(el, "src") ?? ""} ${attr(el, "data") ?? ""}`.toLowerCase();
+  if (/^(?:audio|video)\//.test(type) || TEMPORAL_MEDIA_VALUE.test(`${type} ${resource}`)) return "temporal";
+  if (/^image\//.test(type) || /\.(?:svg|png|jpe?g|webp|avif)(?:[?#]|$)/i.test(resource)) return "non-temporal";
+  return "unknown";
+}
 function labelFor(doc, el) {
   const id = attr(el, "id");
   const lbl = id ? elementsByTag(doc, "label").find((l) => attr(l, "for") === id) : void 0;
@@ -45099,6 +45107,66 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
+  // RGAA 4.11 — temporal players and the code that controls their consultation. This must
+  // not inherit WCAG 2.1.1/2.1.2's page-wide union of pointer handlers and focusables: an
+  // unrelated clickable card says nothing about whether an <audio> can be paused.
+  temporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "audio" || e.tag === "video" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "non-temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> temporal media \u2014 controls=${attr(e, "controls") !== void 0}, autoplay=${attr(e, "autoplay") !== void 0}; can play/pause/stop and sound be operated by keyboard and pointer?`,
+        `temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? ""}|controls=${attr(e, "controls") !== void 0}`
+      )
+    ),
+    ...linesOf(d, /\.(?:play|pause)\s*\(|\b(?:currentTime|muted|volume|playbackRate)\s*=|\bHTMLMediaElement\b/).map(
+      (l) => hAt(d, l.line, "media-control", `custom temporal-media control: ${l.text}`, `temporal-control|${l.text}`)
+    )
+  ]),
+  // RGAA 4.12 — non-temporal plug-in/SVG/canvas media. Static instances are included too:
+  // the adjudicator must first establish whether they expose consultation controls before it
+  // can legitimately answer NA. Temporal players and generic event handlers stay out.
+  nonTemporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "svg" || e.tag === "canvas" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> non-temporal media \u2014 inspect any pan/zoom/navigation/control function for keyboard and pointer operation`,
+        `non-temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...linesOf(d, /\b(?:svgPanZoom|panzoom|zoomIn|zoomOut|getContext)\b/i).map(
+      (l) => hAt(d, l.line, "media-control", `non-temporal media/control code: ${l.text}`, `non-temporal-control|${l.text}`)
+    )
+  ]),
+  // WCAG 2.3.1 / RGAA 13.7 — only things capable of a luminance flash. The old `motion`
+  // subject mixed autoplay audio and <marquee> into this criterion while omitting ordinary
+  // images, canvas, scripts and stylesheet animation rules. That gave the adjudicator lots of
+  // evidence and none of the evidence the three-flash test actually asks for.
+  flashes: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => ["video", "img", "svg", "canvas", "embed", "object", "blink"].includes(e.tag)).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> visual/animated content \u2014 does it flash, and if so is it at most 3 flashes/s or below the area threshold?`,
+        `flash-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...elementsByTag(d, "script").map(
+      (e) => h(d, e, `<script> \u2014 inspect for luminance/colour states toggled rapidly`, `flash-script|${attr(e, "src") ?? t(e, 80)}`)
+    ),
+    ...d.elements.filter((e) => /animation|transition/i.test(attr(e, "style") ?? "")).map((e) => h(d, e, `inline visual animation: ${(attr(e, "style") ?? "").slice(0, 100)}`, `flash-inline|${attr(e, "style") ?? ""}`)),
+    ...(d.signals?.css?.rules ?? []).filter((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0).map(
+      (r) => hAt(
+        d,
+        1,
+        `css:${r.selector}`,
+        `stylesheet animation: ${r.selector.slice(0, 60)} { ${declsText(r.decls)} } \u2014 inspect keyframes for rapid opposing luminance changes`,
+        `flash-css|${r.selector}|${declsText(r.decls)}`
+      )
+    ),
+    ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -45358,7 +45426,7 @@ var SC_SUBJECTS = {
   "2.1.4": ["shortcuts"],
   "2.2.1": ["timers"],
   "2.2.2": ["motion", "timers"],
-  "2.3.1": ["motion"],
+  "2.3.1": ["flashes"],
   "2.4.1": ["landmarks"],
   "2.4.3": ["focusOrder"],
   "2.4.4": ["links"],
@@ -45451,6 +45519,10 @@ var PACK_SUBJECTS = {
     // WCAG 1.4.2, which is `static` and therefore has no subject of its own — but the pack
     // flags 4.10 `judgment`, so judgmentGuard reopens it and it would arrive with nothing.
     "4.10": ["motion"],
+    // 4.11/4.12 map to the same keyboard SCs but ask about disjoint media populations.
+    // Inheriting the union handed both criteria every pointer handler and focusable in scope.
+    "4.11": ["temporalMediaControls"],
+    "4.12": ["nonTemporalMediaControls"],
     // Theme 3 — colour. The question is about what colour alone conveys, not the outline.
     "3.1": ["colourPairs", "links"],
     "3.2": ["colourPairs"],
@@ -45487,7 +45559,7 @@ var PACK_SUBJECTS = {
     "13.2": ["newWindow"],
     "13.3": ["downloadDocs"],
     "13.4": ["downloadDocs"],
-    "13.7": ["motion"],
+    "13.7": ["flashes"],
     "13.8": ["motion", "timers"],
     "13.9": ["readingOrder"],
     "13.10": ["pointerHandlers"],
@@ -49414,7 +49486,7 @@ var SUBJECT_MATTER = {
   "2.1.4": hasCharShortcut,
   "2.2.1": hasTimeLimit,
   "2.2.2": hasMovingContent,
-  "2.3.1": hasMovingContent,
+  "2.3.1": hasFlashCandidate,
   "2.5.1": hasGesture,
   "2.5.2": hasDownEventAction,
   "2.5.7": hasDrag
@@ -49459,6 +49531,14 @@ function hasMovingContent(d) {
   if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
   return /\b(?:carousel|autoplay|requestAnimationFrame|animation-iteration-count|\.gif["']|\bswiper\b)/i.test(d.source);
 }
+function hasFlashCandidate(d) {
+  if (has(d, "video", "img", "svg", "canvas", "embed", "object", "blink", "script")) return true;
+  if (d.elements.some((e) => /animation|transition/i.test(e.attribs.style ?? ""))) return true;
+  if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
+  return /\b(?:flash|flashing|strobe|blink|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i.test(
+    d.source
+  );
+}
 function hasFormControl(d) {
   if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;
   return d.elements.some((e) => {

package/src/adjudicate-subjects.ts

@@ -214,6 +214,7 @@ const PRESENTATIONAL_MARKUP_ATTRS = new Set([
 
 const DOWNLOAD_HREF = /\.(pdf|docx?|xlsx?)(?:[?#]|$)/i;
 const STATUS_CLASS = /(error|status|message|alert|notif|toast|feedback|live)/i;
+const TEMPORAL_MEDIA_VALUE = /(?:^|[/.?=&_-])(?:audio|video|player|podcast|mp[34]|webm|ogg|ogv|wav|m4a|mov|avi|mpeg)(?:$|[/.?=&_-])/i;
 const ROUTER_IMPORT =
   /['"](?:react-router(?:-dom)?|next\/(?:router|navigation)|vue-router|@remix-run\/[\w-]+|@tanstack\/[\w-]*router|@sveltejs\/kit|\$app\/(?:navigation|stores))['"]/;
 
@@ -226,6 +227,17 @@ const FOREIGN_LEXICON =
 const CONTROL_TAGS = ["input", "select", "textarea"] as const;
 const INTERACTIVE_TAGS = ["a", "button", "input", "select", "textarea", "summary", "details", "label"];
 
+/** An object/embed is ambiguous until its declared type or resource says what it carries.
+ * Unknown plug-in content stays in BOTH multimedia populations: narrowing uncertainty to one
+ * side can hide the exact temporal/non-temporal player the criterion was meant to inspect. */
+function embeddedMediaKind(el: El): "temporal" | "non-temporal" | "unknown" {
+  const type = (attr(el, "type") ?? "").toLowerCase();
+  const resource = `${attr(el, "src") ?? ""} ${attr(el, "data") ?? ""}`.toLowerCase();
+  if (/^(?:audio|video)\//.test(type) || TEMPORAL_MEDIA_VALUE.test(`${type} ${resource}`)) return "temporal";
+  if (/^image\//.test(type) || /\.(?:svg|png|jpe?g|webp|avif)(?:[?#]|$)/i.test(resource)) return "non-temporal";
+  return "unknown";
+}
+
 function labelFor(doc: Doc, el: El): string {
   const id = attr(el, "id");
   const lbl = id ? elementsByTag(doc, "label").find((l) => attr(l, "for") === id) : undefined;
@@ -736,6 +748,84 @@ export const SUBJECTS: Record<string, Subject> = {
       ),
     ]),
 
+  // RGAA 4.11 — temporal players and the code that controls their consultation. This must
+  // not inherit WCAG 2.1.1/2.1.2's page-wide union of pointer handlers and focusables: an
+  // unrelated clickable card says nothing about whether an <audio> can be paused.
+  temporalMediaControls: (docs) =>
+    docs.flatMap((d) => [
+      ...d.elements
+        .filter((e) => e.tag === "audio" || e.tag === "video" || (["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "non-temporal"))
+        .map((e) =>
+          h(
+            d,
+            e,
+            `<${e.tag}> temporal media — controls=${attr(e, "controls") !== undefined}, autoplay=${attr(e, "autoplay") !== undefined}; can play/pause/stop and sound be operated by keyboard and pointer?`,
+            `temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? ""}|controls=${attr(e, "controls") !== undefined}`,
+          ),
+        ),
+      ...linesOf(d, /\.(?:play|pause)\s*\(|\b(?:currentTime|muted|volume|playbackRate)\s*=|\bHTMLMediaElement\b/).map((l) =>
+        hAt(d, l.line, "media-control", `custom temporal-media control: ${l.text}`, `temporal-control|${l.text}`),
+      ),
+    ]),
+
+  // RGAA 4.12 — non-temporal plug-in/SVG/canvas media. Static instances are included too:
+  // the adjudicator must first establish whether they expose consultation controls before it
+  // can legitimately answer NA. Temporal players and generic event handlers stay out.
+  nonTemporalMediaControls: (docs) =>
+    docs.flatMap((d) => [
+      ...d.elements
+        .filter((e) => e.tag === "svg" || e.tag === "canvas" || (["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "temporal"))
+        .map((e) =>
+          h(
+            d,
+            e,
+            `<${e.tag}> non-temporal media — inspect any pan/zoom/navigation/control function for keyboard and pointer operation`,
+            `non-temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`,
+          ),
+        ),
+      ...linesOf(d, /\b(?:svgPanZoom|panzoom|zoomIn|zoomOut|getContext)\b/i).map((l) =>
+        hAt(d, l.line, "media-control", `non-temporal media/control code: ${l.text}`, `non-temporal-control|${l.text}`),
+      ),
+    ]),
+
+  // WCAG 2.3.1 / RGAA 13.7 — only things capable of a luminance flash. The old `motion`
+  // subject mixed autoplay audio and <marquee> into this criterion while omitting ordinary
+  // images, canvas, scripts and stylesheet animation rules. That gave the adjudicator lots of
+  // evidence and none of the evidence the three-flash test actually asks for.
+  flashes: (docs) =>
+    docs.flatMap((d) => [
+      ...d.elements
+        .filter((e) => ["video", "img", "svg", "canvas", "embed", "object", "blink"].includes(e.tag))
+        .map((e) =>
+          h(
+            d,
+            e,
+            `<${e.tag}> visual/animated content — does it flash, and if so is it at most 3 flashes/s or below the area threshold?`,
+            `flash-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`,
+          ),
+        ),
+      ...elementsByTag(d, "script").map((e) =>
+        h(d, e, `<script> — inspect for luminance/colour states toggled rapidly`, `flash-script|${attr(e, "src") ?? t(e, 80)}`),
+      ),
+      ...d.elements
+        .filter((e) => /animation|transition/i.test(attr(e, "style") ?? ""))
+        .map((e) => h(d, e, `inline visual animation: ${(attr(e, "style") ?? "").slice(0, 100)}`, `flash-inline|${attr(e, "style") ?? ""}`)),
+      ...(d.signals?.css?.rules ?? [])
+        .filter((r) => r.decls.animation !== undefined || r.decls.animationName !== undefined)
+        .map((r) =>
+          hAt(
+            d,
+            1,
+            `css:${r.selector}`,
+            `stylesheet animation: ${r.selector.slice(0, 60)} { ${declsText(r.decls)} } — inspect keyframes for rapid opposing luminance changes`,
+            `flash-css|${r.selector}|${declsText(r.decls)}`,
+          ),
+        ),
+      ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i)
+        .filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text))
+        .map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`)),
+    ]),
+
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -1056,7 +1146,7 @@ export const SC_SUBJECTS: Record<string, string[]> = {
   "2.1.4": ["shortcuts"],
   "2.2.1": ["timers"],
   "2.2.2": ["motion", "timers"],
-  "2.3.1": ["motion"],
+  "2.3.1": ["flashes"],
   "2.4.1": ["landmarks"],
   "2.4.3": ["focusOrder"],
   "2.4.4": ["links"],
@@ -1156,6 +1246,10 @@ export const PACK_SUBJECTS: Record<string, Record<string, string[]>> = {
     // WCAG 1.4.2, which is `static` and therefore has no subject of its own — but the pack
     // flags 4.10 `judgment`, so judgmentGuard reopens it and it would arrive with nothing.
     "4.10": ["motion"],
+    // 4.11/4.12 map to the same keyboard SCs but ask about disjoint media populations.
+    // Inheriting the union handed both criteria every pointer handler and focusable in scope.
+    "4.11": ["temporalMediaControls"],
+    "4.12": ["nonTemporalMediaControls"],
     // Theme 3 — colour. The question is about what colour alone conveys, not the outline.
     "3.1": ["colourPairs", "links"],
     "3.2": ["colourPairs"],
@@ -1192,7 +1286,7 @@ export const PACK_SUBJECTS: Record<string, Record<string, string[]>> = {
     "13.2": ["newWindow"],
     "13.3": ["downloadDocs"],
     "13.4": ["downloadDocs"],
-    "13.7": ["motion"],
+    "13.7": ["flashes"],
     "13.8": ["motion", "timers"],
     "13.9": ["readingOrder"],
     "13.10": ["pointerHandlers"],

package/src/audit.ts

@@ -143,7 +143,7 @@ const SUBJECT_MATTER: Record<string, (d: Doc) => boolean> = {
   "2.1.4": hasCharShortcut,
   "2.2.1": hasTimeLimit,
   "2.2.2": hasMovingContent,
-  "2.3.1": hasMovingContent,
+  "2.3.1": hasFlashCandidate,
   "2.5.1": hasGesture,
   "2.5.2": hasDownEventAction,
   "2.5.7": hasDrag,
@@ -235,6 +235,21 @@ function hasMovingContent(d: Doc): boolean {
   return /\b(?:carousel|autoplay|requestAnimationFrame|animation-iteration-count|\.gif["']|\bswiper\b)/i.test(d.source);
 }
 
+/** Anything that can produce opposing luminance changes over time (WCAG 2.3.1).
+ *
+ * Sound-only media and scrolling text are motion, not flashes. Conversely, an image, canvas,
+ * visual media, script or CSS animation can flash even when no carousel/autoplay keyword is
+ * present. Keep this deliberately wider than a detector: it decides applicability only; the
+ * agent or a dedicated analyser still decides the frequency and area thresholds. */
+function hasFlashCandidate(d: Doc): boolean {
+  if (has(d, "video", "img", "svg", "canvas", "embed", "object", "blink", "script")) return true;
+  if (d.elements.some((e) => /animation|transition/i.test(e.attribs.style ?? ""))) return true;
+  if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== undefined || r.decls.animationName !== undefined)) return true;
+  return /\b(?:flash|flashing|strobe|blink|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i.test(
+    d.source,
+  );
+}
+
 /** Any control that takes user input, native or delegated. Over-inclusive on purpose. */
 function hasFormControl(d: Doc): boolean {
   if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.35.1";
+export const VERSION = "5.35.2";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,