ultra11y 5.4.0 → 5.4.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.4.0",
+      "version": "5.4.1",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.4.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.4.1";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.4.0";
+var VERSION = "5.4.1";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -47435,8 +47435,19 @@ var SUBJECT_MATTER = {
   // Identify Input Purpose — about autocomplete on fields collecting user data.
   "1.3.5": hasFormControl
 };
+var MEDIA_HINT = /(youtube|youtu\.be|vimeo|dailymotion|soundcloud|spotify|twitch|wistia|brightcove|jwplayer|videopress|podcast|player|vid[eé]o|audio|baladodiffusion)/i;
+var MEDIA_EXT = /\.(mp4|webm|ogv|ogg|mov|m4v|avi|mpe?g|mp3|wav|flac|m4a|aac|opus|m3u8|mpd)(?:[?#]|$)/i;
 function hasMedia(d) {
-  return has(d, "audio", "video", "track", "source", "object", "embed", "iframe", "marquee", "canvas");
+  if (has(d, "audio", "video", "track", "source")) return true;
+  return d.elements.some((el) => {
+    if (el.tag === "object" || el.tag === "embed") {
+      const type = (el.attribs.type ?? "").toLowerCase();
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+    }
+    if (el.tag !== "iframe") return false;
+    const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
+    return MEDIA_HINT.test(hay) || MEDIA_EXT.test(el.attribs.src ?? "");
+  });
 }
 function hasMotionApi(d) {
   return /\b(?:devicemotion|deviceorientation|DeviceMotionEvent|DeviceOrientationEvent|Accelerometer|Gyroscope|requestPermission)\b/i.test(d.source);
@@ -47480,7 +47491,7 @@ function residualReason(automatability2, sc) {
 function subjectMatterReason(sc, files) {
   const scope = `nothing in the ${files} file(s) audited is concerned`;
   if (sc.startsWith("1.2."))
-    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track>, <object>, <embed>, <iframe> or <canvas> element was found.`;
+    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track> or <source> element, no <object>/<embed>, and no <iframe> pointing at media.`;
   if (sc === "2.5.4") return `No motion actuation in scope: ${scope} \u2014 no device-motion or device-orientation API is used.`;
   if (sc === "1.3.5" || sc.startsWith("3.3.")) return `No user input in scope: ${scope} \u2014 no form control (native, ARIA or contenteditable) was found.`;
   return `No element in scope is concerned by this success criterion (${scope}).`;

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.4.0
+  version: 5.4.1
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.4.0";
+var VERSION = "5.4.1";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -47435,8 +47435,19 @@ var SUBJECT_MATTER = {
   // Identify Input Purpose — about autocomplete on fields collecting user data.
   "1.3.5": hasFormControl
 };
+var MEDIA_HINT = /(youtube|youtu\.be|vimeo|dailymotion|soundcloud|spotify|twitch|wistia|brightcove|jwplayer|videopress|podcast|player|vid[eé]o|audio|baladodiffusion)/i;
+var MEDIA_EXT = /\.(mp4|webm|ogv|ogg|mov|m4v|avi|mpe?g|mp3|wav|flac|m4a|aac|opus|m3u8|mpd)(?:[?#]|$)/i;
 function hasMedia(d) {
-  return has(d, "audio", "video", "track", "source", "object", "embed", "iframe", "marquee", "canvas");
+  if (has(d, "audio", "video", "track", "source")) return true;
+  return d.elements.some((el) => {
+    if (el.tag === "object" || el.tag === "embed") {
+      const type = (el.attribs.type ?? "").toLowerCase();
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+    }
+    if (el.tag !== "iframe") return false;
+    const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
+    return MEDIA_HINT.test(hay) || MEDIA_EXT.test(el.attribs.src ?? "");
+  });
 }
 function hasMotionApi(d) {
   return /\b(?:devicemotion|deviceorientation|DeviceMotionEvent|DeviceOrientationEvent|Accelerometer|Gyroscope|requestPermission)\b/i.test(d.source);
@@ -47480,7 +47491,7 @@ function residualReason(automatability2, sc) {
 function subjectMatterReason(sc, files) {
   const scope = `nothing in the ${files} file(s) audited is concerned`;
   if (sc.startsWith("1.2."))
-    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track>, <object>, <embed>, <iframe> or <canvas> element was found.`;
+    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track> or <source> element, no <object>/<embed>, and no <iframe> pointing at media.`;
   if (sc === "2.5.4") return `No motion actuation in scope: ${scope} \u2014 no device-motion or device-orientation API is used.`;
   if (sc === "1.3.5" || sc.startsWith("3.3.")) return `No user input in scope: ${scope} \u2014 no form control (native, ARIA or contenteditable) was found.`;
   return `No element in scope is concerned by this success criterion (${scope}).`;

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.4.0
+  version: 5.4.1
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.4.0";
+var VERSION = "5.4.1";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -47435,8 +47435,19 @@ var SUBJECT_MATTER = {
   // Identify Input Purpose — about autocomplete on fields collecting user data.
   "1.3.5": hasFormControl
 };
+var MEDIA_HINT = /(youtube|youtu\.be|vimeo|dailymotion|soundcloud|spotify|twitch|wistia|brightcove|jwplayer|videopress|podcast|player|vid[eé]o|audio|baladodiffusion)/i;
+var MEDIA_EXT = /\.(mp4|webm|ogv|ogg|mov|m4v|avi|mpe?g|mp3|wav|flac|m4a|aac|opus|m3u8|mpd)(?:[?#]|$)/i;
 function hasMedia(d) {
-  return has(d, "audio", "video", "track", "source", "object", "embed", "iframe", "marquee", "canvas");
+  if (has(d, "audio", "video", "track", "source")) return true;
+  return d.elements.some((el) => {
+    if (el.tag === "object" || el.tag === "embed") {
+      const type = (el.attribs.type ?? "").toLowerCase();
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+    }
+    if (el.tag !== "iframe") return false;
+    const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
+    return MEDIA_HINT.test(hay) || MEDIA_EXT.test(el.attribs.src ?? "");
+  });
 }
 function hasMotionApi(d) {
   return /\b(?:devicemotion|deviceorientation|DeviceMotionEvent|DeviceOrientationEvent|Accelerometer|Gyroscope|requestPermission)\b/i.test(d.source);
@@ -47480,7 +47491,7 @@ function residualReason(automatability2, sc) {
 function subjectMatterReason(sc, files) {
   const scope = `nothing in the ${files} file(s) audited is concerned`;
   if (sc.startsWith("1.2."))
-    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track>, <object>, <embed>, <iframe> or <canvas> element was found.`;
+    return `No time-based media in scope: ${scope} \u2014 no <audio>, <video>, <track> or <source> element, no <object>/<embed>, and no <iframe> pointing at media.`;
   if (sc === "2.5.4") return `No motion actuation in scope: ${scope} \u2014 no device-motion or device-orientation API is used.`;
   if (sc === "1.3.5" || sc.startsWith("3.3.")) return `No user input in scope: ${scope} \u2014 no form control (native, ARIA or contenteditable) was found.`;
   return `No element in scope is concerned by this success criterion (${scope}).`;

package/src/audit.ts

@@ -81,10 +81,12 @@ const APPLICABLE: Record<string, (d: Doc) => boolean> = {
 // Three rules keep this honest, because a wrong NA is far worse than an honest « to assess » —
 // it is a non-conformity hidden inside a report someone signs:
 //
-//   1. OVER-INCLUSION IS THE SAFE DIRECTION. A predicate answers "could this criterion
-//      possibly apply here?", so it must say YES on anything ambiguous. `<object>`/`<embed>`/
-//      `<iframe>` are usually not media, and they are all listed anyway: their presence merely
-//      keeps a criterion open, which costs nothing but a line in the worklist.
+//   1. UNCERTAINTY RESOLVES TOWARDS "APPLICABLE". A predicate answers "could this criterion
+//      possibly apply here?", so it says YES whenever it genuinely cannot tell — an `<object>`
+//      with no declared `type`, for instance. That is not the same as saying yes to everything:
+//      a predicate that treats every embed as a video is not cautious, it is wrong, and it
+//      costs a human the work of re-deriving "nothing here". Measured: one analytics `<iframe>`
+//      once held all twelve RGAA multimedia criteria open on a codebase with no media at all.
 //   2. APPLICABILITY IS OR-FOLDED ACROSS THE WHOLE SCOPE (see `foldDoc`). One document with a
 //      `<video>` keeps the media criteria open for the entire audit. NA means "nothing,
 //      anywhere in what was audited" — never "nothing in this file".
@@ -119,9 +121,47 @@ const SUBJECT_MATTER: Record<string, (d: Doc) => boolean> = {
   "1.3.5": hasFormControl,
 };
 
-/** Media, and everything that could be carrying media. Over-inclusive on purpose (rule 1). */
+/** A URL or MIME type that looks like time-based media, or a player embedding one. */
+// Accented forms included on purpose: the standards this serves are read in French, so a
+// `title="Vidéo de présentation"` must count. `\bvideo\b` did not match it — the boundary falls
+// inside the word — and an accent is the last thing that should decide whether a criterion is
+// assessed.
+const MEDIA_HINT =
+  /(youtube|youtu\.be|vimeo|dailymotion|soundcloud|spotify|twitch|wistia|brightcove|jwplayer|videopress|podcast|player|vid[eé]o|audio|baladodiffusion)/i;
+const MEDIA_EXT = /\.(mp4|webm|ogv|ogg|mov|m4v|avi|mpe?g|mp3|wav|flac|m4a|aac|opus|m3u8|mpd)(?:[?#]|$)/i;
+
+/**
+ * Is there time-based media — the subject of WCAG 1.2.x — anywhere in this document?
+ *
+ * Split in two, because "over-inclusion is the safe direction" is a rule about UNCERTAINTY, not
+ * a licence to treat every embed as a video. Measured on a real audit: one `<iframe>` holding an
+ * analytics opt-out widget kept all 12 RGAA multimedia criteria « to assess » across a codebase
+ * with no audio and no video anywhere. That is not caution, it is a false positive with a cost —
+ * twelve criteria a human now has to read through to reach the same "nothing here" the engine
+ * could have proved.
+ *
+ * So:
+ *   - `<video>`, `<audio>`, `<track>`, `<source>` are media, full stop.
+ *   - `<object>`/`<embed>` are media unless their `type` says otherwise — an unknown type stays
+ *     applicable, since that is genuine uncertainty.
+ *   - an `<iframe>` counts only when its `src`/`title` actually points at media (a player host,
+ *     a media extension, the words video/audio/podcast). A widget iframe does not.
+ *   - `<canvas>` and `<marquee>` are NOT here. Neither can carry a caption or an audio
+ *     description, which is what 1.2.x is about; moving content is 2.2.2 and flashing is 2.3.1,
+ *     and those have their own criteria.
+ */
 function hasMedia(d: Doc): boolean {
-  return has(d, "audio", "video", "track", "source", "object", "embed", "iframe", "marquee", "canvas");
+  if (has(d, "audio", "video", "track", "source")) return true;
+  return d.elements.some((el) => {
+    if (el.tag === "object" || el.tag === "embed") {
+      const type = (el.attribs.type ?? "").toLowerCase();
+      // A declared non-media type rules it out; anything else is uncertain, so it counts.
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+    }
+    if (el.tag !== "iframe") return false;
+    const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
+    return MEDIA_HINT.test(hay) || MEDIA_EXT.test(el.attribs.src ?? "");
+  });
 }
 
 /** Device-motion input: the only thing WCAG 2.5.4 is about. */
@@ -194,7 +234,7 @@ function residualReason(automatability: string, sc?: string): string {
 function subjectMatterReason(sc: string, files: number): string {
   const scope = `nothing in the ${files} file(s) audited is concerned`;
   if (sc.startsWith("1.2."))
-    return `No time-based media in scope: ${scope} — no <audio>, <video>, <track>, <object>, <embed>, <iframe> or <canvas> element was found.`;
+    return `No time-based media in scope: ${scope} — no <audio>, <video>, <track> or <source> element, no <object>/<embed>, and no <iframe> pointing at media.`;
   if (sc === "2.5.4") return `No motion actuation in scope: ${scope} — no device-motion or device-orientation API is used.`;
   if (sc === "1.3.5" || sc.startsWith("3.3.")) return `No user input in scope: ${scope} — no form control (native, ARIA or contenteditable) was found.`;
   return `No element in scope is concerned by this success criterion (${scope}).`;

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.4.0";
+export const VERSION = "5.4.1";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,