ultra11y 5.42.0 → 5.43.0

package/.claude-plugin/marketplace.json

@@ -10,10 +10,10 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.42.0",
+      "version": "5.43.0",
       "author": { "name": "maxgfr" },
-      "homepage": "https://github.com/maxgfr/ultra11y",
-      "repository": "https://github.com/maxgfr/ultra11y",
+      "homepage": "https://github.com/SocialGouv/ultra11y",
+      "repository": "https://github.com/SocialGouv/ultra11y",
       "license": "MIT",
       "category": "quality",
       "keywords": ["accessibility", "a11y", "wcag", "rgaa", "code-review", "audit"]

package/.claude-plugin/plugin.json

@@ -1,9 +1,9 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.42.0",
+  "version": "5.43.0",
   "author": { "name": "maxgfr" },
-  "homepage": "https://github.com/maxgfr/ultra11y",
-  "repository": "https://github.com/maxgfr/ultra11y",
+  "homepage": "https://github.com/SocialGouv/ultra11y",
+  "repository": "https://github.com/SocialGouv/ultra11y",
   "license": "MIT"
 }

package/.codex-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.42.0",
+  "version": "5.43.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
-  "homepage": "https://github.com/maxgfr/ultra11y",
-  "repository": "https://github.com/maxgfr/ultra11y",
+  "homepage": "https://github.com/SocialGouv/ultra11y",
+  "repository": "https://github.com/SocialGouv/ultra11y",
   "license": "MIT",
   "keywords": ["accessibility", "a11y", "wcag", "rgaa", "code-review", "audit"],
   "skills": "./skills/",
@@ -15,7 +15,7 @@
     "developerName": "maxgfr",
     "category": "Productivity",
     "capabilities": ["Read", "Write"],
-    "websiteURL": "https://github.com/maxgfr/ultra11y",
+    "websiteURL": "https://github.com/SocialGouv/ultra11y",
     "defaultPrompt": "Review my staged changes for accessibility."
   }
 }

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.42.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.43.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -1,6 +1,6 @@
 # ultra11y
 
-[![CI](https://github.com/maxgfr/ultra11y/actions/workflows/ci.yml/badge.svg)](https://github.com/maxgfr/ultra11y/actions/workflows/ci.yml)
+[![CI](https://github.com/SocialGouv/ultra11y/actions/workflows/ci.yml/badge.svg)](https://github.com/SocialGouv/ultra11y/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/ultra11y?logo=npm)](https://www.npmjs.com/package/ultra11y)
 [![agent plugin](https://img.shields.io/badge/Claude_Code_·_Codex_·_OpenCode-plugin-6b46c1)](#add-to-your-coding-agent)
 [![node](https://img.shields.io/node/v/ultra11y)](https://nodejs.org)
@@ -13,12 +13,12 @@ pull request — you never type the skill's name:
 
 | | |
 |---|---|
-| **Claude Code** | `/plugin marketplace add maxgfr/ultra11y` then `/plugin install ultra11y@ultra11y` |
-| **OpenAI Codex CLI** | `codex plugin marketplace add maxgfr/ultra11y` then `codex plugin add ultra11y@ultra11y` |
+| **Claude Code** | `/plugin marketplace add SocialGouv/ultra11y` then `/plugin install ultra11y@ultra11y` |
+| **OpenAI Codex CLI** | `codex plugin marketplace add SocialGouv/ultra11y` then `codex plugin add ultra11y@ultra11y` |
 | **OpenCode** | `npx ultra11y install --opencode` — or pin `"plugin": ["ultra11y@latest"]` in `opencode.json` |
 | **Anything else** | `npx ultra11y install --agents-md` (no hook API: see the caveat below) |
 
-<sub>Prefer the skills only, without the automatic hook? `npx skills add maxgfr/ultra11y`
+<sub>Prefer the skills only, without the automatic hook? `npx skills add SocialGouv/ultra11y`
 (`--agent codex`, `--agent opencode`, …). Already on npm and just want the gate?
 `npx ultra11y install --all`, and `npx ultra11y status` to check what is actually wired.
 Full details, thresholds and off-switches under [Install](#install).</sub>
@@ -73,8 +73,8 @@ working diff, or branch vs merge-base) and reports like a code reviewer. Both bu
 install-free engine.
 
 ```sh
-npx skills add maxgfr/ultra11y                 # this agent
-npx skills add maxgfr/ultra11y --agent codex   # …or opencode, cursor, gemini, amp, zed…
+npx skills add SocialGouv/ultra11y                 # this agent
+npx skills add SocialGouv/ultra11y --agent codex   # …or opencode, cursor, gemini, amp, zed…
 ```
 
 **As an agent plugin** — the same two skills, plus the hook that makes the review
@@ -83,8 +83,8 @@ that carries accessibility findings is stopped once and the agent is handed the
 so `review-a11y` runs before the work goes out — you never type the skill's name.
 
 ```
-/plugin marketplace add maxgfr/ultra11y          # Claude Code
-codex plugin marketplace add maxgfr/ultra11y     # Codex CLI
+/plugin marketplace add SocialGouv/ultra11y          # Claude Code
+codex plugin marketplace add SocialGouv/ultra11y     # Codex CLI
 npx ultra11y install --opencode                  # OpenCode
 ```
 
@@ -125,7 +125,7 @@ claude mcp add ultra11y -- npx -y ultra11y mcp
 **As a GitHub Action** — audits the PR diff and, optionally, the served pages:
 
 ```yaml
-- uses: maxgfr/ultra11y@v5
+- uses: SocialGouv/ultra11y@v5
   with: { since: auto, standard: rgaa, fail-on: blocking }
 ```
 
@@ -436,7 +436,7 @@ is the source of truth; CI rebuilds it from the vendored DINUM data and rejects
   block. It re-decides nothing and invents no format, so a page sheet and the compliance report
   cannot disagree; `check` gates it against invented criteria like any other report.
   See `references/pages.md`.
-- **A shipped GitHub Action** — `uses: maxgfr/ultra11y@v5` audits the **code** (PR diff) and,
+- **A shipped GitHub Action** — `uses: SocialGouv/ultra11y@v5` audits the **code** (PR diff) and,
   optionally, the **pages** (it can start your app, wait for it, then scan real URLs or your
   declared sample). The engine ships inside the action, so there is nothing to install and no
   `setup-node`. With pages in scope, its job summary and `pages-status.md` artifact list every

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-Bb1uQH1q.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-BMFQTm5s.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-Bb1uQH1q.js';
-export { s as slugify } from './payload-Bb1uQH1q.js';
+import { C as CheckOptions } from './payload-BMFQTm5s.js';
+export { s as slugify } from './payload-BMFQTm5s.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/{payload-Bb1uQH1q.d.ts → payload-BMFQTm5s.d.ts}

@@ -80,7 +80,10 @@ interface CheckOptions {
      *  for nothing but recording the sample and asserts nothing afterwards. `{ clicks: true }`
      *  additionally presses `button[type=button]` (destructive-sounding names skipped, navigation
      *  aborts the pass) — never the default on an authenticated session, where a server mutation
-     *  is invisible to any check this side of the network. */
+     *  is invisible to any check this side of the network.
+     *
+     *  PLAYWRIGHT ONLY, like `probes` beside it: the Cypress integration records a page and runs
+     *  no live probe at all, so both are inert there. Stated rather than left to be discovered. */
     liveRegion?: boolean | {
         clicks?: boolean;
     };

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-Bb1uQH1q.js';
+import { C as CheckOptions, A as AuditLike } from './payload-BMFQTm5s.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -133,6 +133,7 @@ var COLLECT_SNAPSHOT = `(() => {
 })()`;
 
 // src/probes.ts
+var PROBES_VERSION = 2;
 var PRELUDE = `
 const __sel = (e) => {
   if (!e || !e.tagName) return '\u2014';
@@ -240,8 +241,18 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
   // from it is not merely unmeasured -- it is silently cleared. A page whose only control is a
   // <summary> tagged nothing at all, so the count was zero, so the ring was "vacuously whole",
   // so 2.4.7 and 2.4.11 closed without a single Tab press.
+  //
+  // AND NOT iframe / audio[controls] / video[controls], which were here for one release and
+  // had to come back out. They are genuinely focusable, but their focus lives in another
+  // document: everything below reads the PARENT'S activeElement, which stays the host element
+  // press after press while the user tabs through the controls inside. The trap walk reads
+  // exactly that as a cage, so an ordinary page with a video player, a payment frame, a map or
+  // a support widget was reported as a bloquant 2.1.2 -- a blocker manufactured out of our own
+  // blindness, able to fail somebody else's gate. The measurement we cannot make is not a
+  // finding; Tab still crosses them, the walk still records that it crossed something it never
+  // measured, and the page is not cleared either.
   // (No backticks in this comment: it lives inside a template literal.)
-  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,iframe,audio[controls],video[controls],[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
+  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
   // A BOX THAT IS ANIMATING CANNOT BE COMPARED ACROSS TIME, so it contributes a constant.
   //
   // The snapshot is taken before Tab and re-read after it, and the properties compared include
@@ -587,6 +598,7 @@ async function runLiveProbes(page, opts = {}) {
   const size = canResize ? page.viewportSize() ?? null : null;
   const restore = size ?? { width: 1280, height: 900 };
   const out = {
+    v: PROBES_VERSION,
     focusVisible: [],
     hover: [],
     keyboardTrap: [],
@@ -703,6 +715,12 @@ async function runLiveProbes(page, opts = {}) {
       else skip("4.1.3", r.why ?? "the live-region pass did not exercise the whole page");
     }
   }
+  for (const [bucket, sc] of UNREADABLE_BY_OLDER) {
+    if (out[bucket]?.length) {
+      const at = out.probed.indexOf(sc);
+      if (at >= 0) out.probed.splice(at, 1);
+    }
+  }
   return out;
 }
 var DESTRUCTIVE_NAME_RE = "\\b(supprim|retir|effac|envoy|valid|confirm|pay|achet|command|delete|remove|eras|clear|send|submit|buy|order)";
@@ -856,6 +874,11 @@ var REMOVE_TEXT_SPACING_STEP = `(() => {
   }
   return true;
 })()`;
+var UNREADABLE_BY_OLDER = [
+  ["focusObscured", "2.4.11"],
+  ["keyboardTrap", "2.1.2"],
+  ["liveRegion", "4.1.3"]
+];
 
 // src/integrations/core.ts
 import { spawnSync } from "child_process";
@@ -1055,9 +1078,13 @@ async function checkA11y(page, opts = {}) {
     );
   }
   let probes;
-  if (opts.probes) {
+  if (opts.probes || opts.liveRegion) {
     try {
-      probes = await runLiveProbes(page, { ...probeOptions(opts.probes), ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {} });
+      probes = await runLiveProbes(page, {
+        ...probeOptions(opts.probes),
+        ...opts.probes ? {} : { only: ["4.1.3"] },
+        ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {}
+      });
     } catch (e) {
       console.warn(
         `ultra11y: the live probes failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria they decide stay to assess.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.42.0",
+  "version": "5.43.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -55,7 +55,7 @@
     "lint:fix": "biome check --write .",
     "format": "biome format --write .",
     "verify:bundle": "node scripts/verify-skill-bundle.mjs",
-    "check:build": "tsup && node scripts/copy-bundle.mjs && git diff --exit-code -- scripts/ultra11y.mjs skills/ultra11y/scripts/ultra11y.mjs skills/review-a11y/scripts/ultra11y.mjs dist && node scripts/build-extension-icons.mjs --check && node scripts/verify-skill-bundle.mjs && node scripts/sync-engine.mjs --check",
+    "check:build": "tsup && node scripts/copy-bundle.mjs && git diff --exit-code -- scripts/ultra11y.mjs skills/ultra11y/scripts/ultra11y.mjs skills/review-a11y/scripts/ultra11y.mjs dist && node scripts/build-extension-icons.mjs --check && node scripts/verify-skill-bundle.mjs",
     "build:wcag": "node scripts/build-standards.mjs",
     "check:standards": "node scripts/build-standards.mjs --check",
     "build:pack:rgaa": "node scripts/build-pack-rgaa.mjs",
@@ -75,7 +75,7 @@
   "author": "maxgfr",
   "repository": {
     "type": "git",
-    "url": "https://github.com/maxgfr/ultra11y"
+    "url": "https://github.com/SocialGouv/ultra11y"
   },
   "dependencies": {
     "@axe-core/playwright": "^4.13.0",

package/scripts/build-pack-rgaa.mjs

@@ -711,6 +711,15 @@ const DOWNLOAD_EXT = "pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|ep
     // Where DINUM publishes each criterion. Cited by the adjudication brief so a reader can
     // reach the normative page — the vendored text above stays the authority either way.
     criterionUrl: "https://accessibilite.numerique.gouv.fr/methode/criteres-et-tests/#{id}",
+    // The three levels a French declaration of accessibility may state, fixed by the arrêté of
+    // 20 September 2019 (accessibilite.numerique.gouv.fr, obligations): every applicable
+    // criterion validated, at least half of them, or fewer. The report summary names the
+    // audited site's level from this scale and says what separates it from the next one.
+    conformityLevels: [
+      { min: 100, label: { fr: "Totalement conforme", en: "Fully compliant" } },
+      { min: 50, label: { fr: "Partiellement conforme", en: "Partially compliant" } },
+      { min: 0, label: { fr: "Non conforme", en: "Non-compliant" } },
+    ],
     // Auditor-display vocabulary (FR): the nouns an RGAA auditor reads. Rendered by the
     // `prd` auditor block + GitHub issues; see src/standards/vocabulary.ts.
     vocabulary: {