ultra11y 5.45.0 → 5.46.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.45.0",
+      "version": "5.46.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/SocialGouv/ultra11y",
       "repository": "https://github.com/SocialGouv/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.45.0",
+  "version": "5.46.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/SocialGouv/ultra11y",
   "repository": "https://github.com/SocialGouv/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.45.0",
+  "version": "5.46.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/SocialGouv/ultra11y",
   "repository": "https://github.com/SocialGouv/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.45.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.46.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -6,6 +6,8 @@
 [![node](https://img.shields.io/node/v/ultra11y)](https://nodejs.org)
 [![license](https://img.shields.io/npm/l/ultra11y)](LICENSE)
 
+**Documentation (in French): [socialgouv.github.io/ultra11y](https://socialgouv.github.io/ultra11y/)** — what the tool does, what it cannot check, criterion-by-criterion RGAA coverage and how it is tested, with every number generated from the code.
+
 ### Add to your coding agent
 
 Two lines, and the accessibility review runs **by itself** before every commit, push and
@@ -25,7 +27,7 @@ Full details, thresholds and off-switches under [Install](#install).</sub>
 
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
-ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 93 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
+ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 94 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
 
 - **Automatable (engine):** missing `alt`/`lang`/`title`, unlabeled fields, empty links/buttons, icon-only controls, iframes without title, tables without headers, heading-level skips, empty/dangling headings & labels, duplicate ids, invalid/broken ARIA, positive `tabindex`, autoplay/timed-refresh/`blink`/`marquee` media…
 - **Agent judgment (gated):** alt-text relevance, link purpose in context, reading/tab order, caption accuracy — the agent rules on these via `verify --manual` → `--apply`, each verdict carrying a justification (or a groundable NC), never a silent "conforming".
@@ -41,11 +43,11 @@ A self-authored fixture can only prove that a rule fires on the defect written f
 
 | | |
 |---|---|
-| Rules scored | **40** (the ACT rules an equivalent engine check exists for) |
-| `failed` examples caught | **125 / 176** |
-| `passed` / `inapplicable` examples left alone | **364 / 364** — no unexplained false positive |
+| Rules scored | **44** (the ACT rules an equivalent engine check exists for) |
+| `failed` examples caught | **168 / 187** |
+| `passed` / `inapplicable` examples left alone | **401 / 401** — no unexplained false positive |
 | Deliberate divergences | 9, each argued on the record |
-| Declared gaps (statically decidable, not implemented) | 5 |
+| Declared gaps (statically decidable, not implemented) | 0 |
 
 Rules needing a rendered page (computed contrast, keyboard traps) or a human call (is this heading descriptive?) are **declared and routed**, not silently scored zero. The full per-rule matrix — including every gap and every divergence — is generated into [`skills/ultra11y/references/act.md`](skills/ultra11y/references/act.md) and re-checked on every build; the corpus itself is refreshed daily by a workflow, so the numbers cannot quietly go stale.
 
@@ -316,7 +318,7 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
 
 ### What RGAA automation actually covers
 
-The engine's 93 rules are not 93 RGAA criteria: several rules can evidence the same official
+The engine's 94 rules are not 94 RGAA criteria: several rules can evidence the same official
 test, and a rule can detect a useful symptom without exhausting the criterion's alternatives,
 exceptions or relevance checks. The generated contract classifies all **258 official RGAA
 tests**:
@@ -346,8 +348,8 @@ The number can grow, but the useful target is **more observed, exact failures**,
 marketing count. The best next candidates are complete rendered probes for zoom/reflow and
 hover content (10.4, 10.11, 10.13), and contrast,
 link distinction or orientation checks (3.2, 3.3, 10.6, 13.9) that first rule out every
-official alternative and particular case. The 5 declared ACT gaps are another implementation
-queue, although adding one does not necessarily cover a new RGAA criterion. A candidate is
+official alternative and particular case. The ACT corpus's remaining misses are another
+implementation queue, although closing one does not necessarily cover a new RGAA criterion. A candidate is
 promoted only when a narrower rule demonstrably exhausts its cited official test; the two
 `C`-by-silence criteria stay unchanged until an equally complete proof exists.
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "ultra11y",
-  "version": "5.45.0",
+  "version": "5.46.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
+  "homepage": "https://socialgouv.github.io/ultra11y/",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
   "bin": {
@@ -67,6 +68,8 @@
     "build:act:refresh": "node scripts/build-act-corpus.mjs --refresh",
     "build:adjudication": "node scripts/build-adjudication.mjs && UPDATE_ADJUDICATION_MD=1 vitest run tests/adjudication-md-sync.test.ts",
     "check:adjudication": "node scripts/build-adjudication.mjs --check",
+    "build:site": "node scripts/build-site.mjs",
+    "check:site": "node scripts/build-site.mjs --check",
     "demo": "node scripts/ultra11y.mjs audit tests/fixtures/non-conforming/bad.html --out /tmp/ultra11y-demo --json > /dev/null && node scripts/ultra11y.mjs report --in /tmp/ultra11y-demo/audit-latest.json --out /tmp/ultra11y-demo && node scripts/ultra11y.mjs check --report /tmp/ultra11y-demo/wcag-*.md && node scripts/ultra11y.mjs criteria --list",
     "release": "semantic-release",
     "build:icons": "node scripts/build-extension-icons.mjs"

package/scripts/build-pack-rgaa.mjs

@@ -148,7 +148,7 @@ const RULE_SC = {
   "multiple-main-landmark": ["1.3.1"], "nav-landmark-missing": ["1.3.1"], "nav-landmark-unnamed": ["1.3.1"],
   "nested-interactive": ["4.1.2"], "object-embed-no-name": ["1.1.1"], "radio-checkbox-group-ungrouped": ["1.3.1", "3.3.2"],
   "placeholder-as-label": ["4.1.2"], "positive-tabindex": ["2.4.3"], "redundant-aria": ["4.1.2"], "select-has-option": ["4.1.2"],
-  "skip-link-target-missing": ["2.4.1"], "sortable-header-no-aria-sort": ["1.3.1"], "status-message-not-assertive": ["4.1.3"],
+  "skip-link-target-missing": ["2.4.1"], "bypass-blocks-missing": ["2.4.1"], "sortable-header-no-aria-sort": ["1.3.1"], "status-message-not-assertive": ["4.1.3"],
   "table-caption-missing": ["1.3.1"], "table-empty-data-cell": ["1.3.1"], "title-missing-empty": ["2.4.2"],
 };
 
@@ -267,6 +267,11 @@ const RULE_TO_CRITERIA = {
   "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"],
   // Theme 12 — navigation (12.7 skip link, 12.8 tab order, 12.9 keyboard trap)
   "skip-link-target-missing": ["12.7"], "axe:skip-link": ["12.7"], "axe:bypass": ["12.7"],
+  // A page whose <nav> precedes content with no landmark, heading, button or in-page link at
+  // all: the content zone can be neither reached nor the navigation skipped (12.6), and no
+  // skip link exists (12.7). Candidate, not decisive: the tests also ask about the other zones
+  // and about links built in script, which this source-only rule does not see.
+  "bypass-blocks-missing": ["12.6", "12.7"],
   "positive-tabindex": ["12.8"], "axe:tabindex": ["12.8"],
   // 12.9 « la navigation ne doit pas contenir de piège au clavier ». The probe that answers it
   // has existed since `probeKeyboardTrap` landed, and it was mapped to WCAG 2.1.2 alone — so a

package/scripts/build-site.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// DEV-ONLY (not in `bin`). Generates the numbers of the documentation site (site/, published
+// on GitHub Pages by .github/workflows/pages.yml) from the code itself: site/data.json, plus
+// every `data-gen` value and `<!-- gen:… -->` block of site/*.html.
+//
+// The logic lives in src/site-data.ts so the test suite can import it directly
+// (tests/site-data.test.ts fails when the committed site drifts). This script bundles that
+// module with tsup — the same bundler as the engine — because plain `node` cannot resolve
+// the `.js` → `.ts` imports of the source tree.
+//
+// Usage:
+//   node scripts/build-site.mjs           # rewrite site/data.json and the generated regions
+//   node scripts/build-site.mjs --check   # exit 1 when the committed site is stale
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { build } from "tsup";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const SITE = join(root, "site");
+const CHECK = process.argv.includes("--check");
+
+const tmp = mkdtempSync(join(tmpdir(), "ultra11y-site-"));
+try {
+  await build({
+    entry: { site: join(root, "src", "site-data.ts") },
+    outDir: tmp,
+    format: ["esm"],
+    outExtension: () => ({ js: ".mjs" }),
+    platform: "node",
+    target: "node22",
+    bundle: true,
+    noExternal: [/.*/],
+    config: false,
+    silent: true,
+    dts: false,
+    sourcemap: false,
+  });
+  const { buildSiteData, renderData, renderPage, SITE_PAGES } = await import(pathToFileURL(join(tmp, "site.mjs")).href);
+  const data = buildSiteData(root);
+  const outputs = [["data.json", renderData(data)]];
+  for (const file of SITE_PAGES) outputs.push([file, renderPage(readFileSync(join(SITE, file), "utf8"), file, data)]);
+
+  const stale = outputs.filter(([file, text]) => {
+    try {
+      return readFileSync(join(SITE, file), "utf8") !== text;
+    } catch {
+      return true;
+    }
+  });
+  if (CHECK) {
+    if (stale.length) {
+      console.error(`site is stale: ${stale.map(([f]) => f).join(", ")} — run \`pnpm run build:site\``);
+      process.exit(1);
+    }
+    console.log("site is up to date");
+  } else {
+    for (const [file, text] of stale) writeFileSync(join(SITE, file), text);
+    const l = data.rgaa.levels;
+    console.log(
+      `site: ${stale.length} file(s) written · RGAA ${data.rgaa.criteria} criteria: ${l.det} deterministic / ${l.nc} NC proven / ${l.hint} signals / ${l.llm} judgment only · ACT ${data.act.caught}/${data.act.failedScored} on ${data.act.scoredRules} rules`,
+    );
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}

package/scripts/build-standards.mjs

@@ -659,7 +659,7 @@ const RULE_SC_COVERAGE = {
   "2.1.1": ["clickable-noninteractive"],
   "2.2.1": ["meta-refresh-redirect"],
   "2.2.2": ["autoplay-media", "blink-marquee"],
-  "2.4.1": ["skip-link-target-missing"],
+  "2.4.1": ["skip-link-target-missing", "bypass-blocks-missing"],
   "2.4.2": ["title-missing-empty"],
   "2.4.3": ["positive-tabindex"],
   "2.4.7": ["rendered-focus-not-visible"],