ultra11y 5.42.0 → 5.42.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.42.0",
+      "version": "5.42.1",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.42.0",
+  "version": "5.42.1",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.42.0",
+  "version": "5.42.1",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.42.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.42.1";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-Bb1uQH1q.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-BMFQTm5s.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-Bb1uQH1q.js';
-export { s as slugify } from './payload-Bb1uQH1q.js';
+import { C as CheckOptions } from './payload-BMFQTm5s.js';
+export { s as slugify } from './payload-BMFQTm5s.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/{payload-Bb1uQH1q.d.ts → payload-BMFQTm5s.d.ts}

@@ -80,7 +80,10 @@ interface CheckOptions {
      *  for nothing but recording the sample and asserts nothing afterwards. `{ clicks: true }`
      *  additionally presses `button[type=button]` (destructive-sounding names skipped, navigation
      *  aborts the pass) — never the default on an authenticated session, where a server mutation
-     *  is invisible to any check this side of the network. */
+     *  is invisible to any check this side of the network.
+     *
+     *  PLAYWRIGHT ONLY, like `probes` beside it: the Cypress integration records a page and runs
+     *  no live probe at all, so both are inert there. Stated rather than left to be discovered. */
     liveRegion?: boolean | {
         clicks?: boolean;
     };

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-Bb1uQH1q.js';
+import { C as CheckOptions, A as AuditLike } from './payload-BMFQTm5s.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -133,6 +133,7 @@ var COLLECT_SNAPSHOT = `(() => {
 })()`;
 
 // src/probes.ts
+var PROBES_VERSION = 2;
 var PRELUDE = `
 const __sel = (e) => {
   if (!e || !e.tagName) return '\u2014';
@@ -240,8 +241,18 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
   // from it is not merely unmeasured -- it is silently cleared. A page whose only control is a
   // <summary> tagged nothing at all, so the count was zero, so the ring was "vacuously whole",
   // so 2.4.7 and 2.4.11 closed without a single Tab press.
+  //
+  // AND NOT iframe / audio[controls] / video[controls], which were here for one release and
+  // had to come back out. They are genuinely focusable, but their focus lives in another
+  // document: everything below reads the PARENT'S activeElement, which stays the host element
+  // press after press while the user tabs through the controls inside. The trap walk reads
+  // exactly that as a cage, so an ordinary page with a video player, a payment frame, a map or
+  // a support widget was reported as a bloquant 2.1.2 -- a blocker manufactured out of our own
+  // blindness, able to fail somebody else's gate. The measurement we cannot make is not a
+  // finding; Tab still crosses them, the walk still records that it crossed something it never
+  // measured, and the page is not cleared either.
   // (No backticks in this comment: it lives inside a template literal.)
-  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,iframe,audio[controls],video[controls],[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
+  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
   // A BOX THAT IS ANIMATING CANNOT BE COMPARED ACROSS TIME, so it contributes a constant.
   //
   // The snapshot is taken before Tab and re-read after it, and the properties compared include
@@ -587,6 +598,7 @@ async function runLiveProbes(page, opts = {}) {
   const size = canResize ? page.viewportSize() ?? null : null;
   const restore = size ?? { width: 1280, height: 900 };
   const out = {
+    v: PROBES_VERSION,
     focusVisible: [],
     hover: [],
     keyboardTrap: [],
@@ -703,6 +715,12 @@ async function runLiveProbes(page, opts = {}) {
       else skip("4.1.3", r.why ?? "the live-region pass did not exercise the whole page");
     }
   }
+  for (const [bucket, sc] of UNREADABLE_BY_OLDER) {
+    if (out[bucket]?.length) {
+      const at = out.probed.indexOf(sc);
+      if (at >= 0) out.probed.splice(at, 1);
+    }
+  }
   return out;
 }
 var DESTRUCTIVE_NAME_RE = "\\b(supprim|retir|effac|envoy|valid|confirm|pay|achet|command|delete|remove|eras|clear|send|submit|buy|order)";
@@ -856,6 +874,11 @@ var REMOVE_TEXT_SPACING_STEP = `(() => {
   }
   return true;
 })()`;
+var UNREADABLE_BY_OLDER = [
+  ["focusObscured", "2.4.11"],
+  ["keyboardTrap", "2.1.2"],
+  ["liveRegion", "4.1.3"]
+];
 
 // src/integrations/core.ts
 import { spawnSync } from "child_process";
@@ -1055,9 +1078,13 @@ async function checkA11y(page, opts = {}) {
     );
   }
   let probes;
-  if (opts.probes) {
+  if (opts.probes || opts.liveRegion) {
     try {
-      probes = await runLiveProbes(page, { ...probeOptions(opts.probes), ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {} });
+      probes = await runLiveProbes(page, {
+        ...probeOptions(opts.probes),
+        ...opts.probes ? {} : { only: ["4.1.3"] },
+        ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {}
+      });
     } catch (e) {
       console.warn(
         `ultra11y: the live probes failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria they decide stay to assess.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.42.0",
+  "version": "5.42.1",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",