ultra11y 5.5.0 → 5.5.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.5.0",
+      "version": "5.5.2",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.5.0",
+  "version": "5.5.2",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.5.0",
+  "version": "5.5.2",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.5.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.5.2";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.5.0",
+  "version": "5.5.2",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.0";
+var VERSION = "5.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -5456,8 +5456,11 @@ function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
   let end = doc.source.indexOf("\n", lineStart);
   if (end === -1) end = doc.source.length;
-  const raw = doc.source.slice(lineStart, end).trim();
-  return raw.length > max ? raw.slice(0, max - 1) + "\u2026" : raw;
+  const from = Math.min(Math.max(el.start, lineStart), end);
+  const tagEnd = doc.source.indexOf(">", from);
+  const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
+  const raw = doc.source.slice(from, Math.min(to, doc.source.length)).replace(/\s+/g, " ").trim();
+  return raw.length > max ? `${raw.slice(0, max - 1)}\u2026` : raw;
 }
 
 // src/parse/jsx.ts
@@ -55755,6 +55758,13 @@ import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
 import { join as join35, resolve as resolve10 } from "path";
 
 // src/adjudicate-subjects.ts
+var VOLATILE = [
+  [/\b\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b/g, "<date>"],
+  [/\b\d{4}-\d{2}-\d{2}\b/g, "<date>"],
+  [/\b\d{1,2}:\d{2}(?::\d{2})?\b/g, "<time>"],
+  [/\b\d{6,}\b/g, "<num>"]
+];
+var stable = (s) => VOLATILE.reduce((acc, [re, to]) => acc.replace(re, to), s);
 var selectorFor = (el) => {
   const id = el.attribs.id ? `#${el.attribs.id}` : "";
   const cls = el.attribs.class ? `.${el.attribs.class.trim().split(/\s+/)[0]}` : "";
@@ -55763,14 +55773,14 @@ var selectorFor = (el) => {
 function h(doc, el, note, cls) {
   return {
     ev: { file: doc.file, line: el.line, selector: selectorFor(el), snippet: snippet(doc, el, 160), note },
-    cls: cls ?? `${el.tag}|${note}`,
+    cls: stable(cls ?? `${el.tag}|${note}`),
     at: el.start
   };
 }
 function hAt(doc, line, selector, note, cls) {
   return {
     ev: { file: doc.file, line, selector, snippet: (doc.source.split("\n")[line - 1] ?? "").trim().slice(0, 160), note },
-    cls,
+    cls: stable(cls),
     at: line
   };
 }
@@ -57171,7 +57181,7 @@ function adjudicationText(sc, lang) {
 }
 
 // src/adjudicate.ts
-var ADJUDICATE_MAX_EVIDENCE_CLASSES = 600;
+var ADJUDICATE_MAX_EVIDENCE_CLASSES = 1200;
 var ALSO_AT_MAX = 8;
 function adjudicationContract() {
   return {

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.5.0
+  version: 5.5.2
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.0";
+var VERSION = "5.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -5456,8 +5456,11 @@ function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
   let end = doc.source.indexOf("\n", lineStart);
   if (end === -1) end = doc.source.length;
-  const raw = doc.source.slice(lineStart, end).trim();
-  return raw.length > max ? raw.slice(0, max - 1) + "\u2026" : raw;
+  const from = Math.min(Math.max(el.start, lineStart), end);
+  const tagEnd = doc.source.indexOf(">", from);
+  const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
+  const raw = doc.source.slice(from, Math.min(to, doc.source.length)).replace(/\s+/g, " ").trim();
+  return raw.length > max ? `${raw.slice(0, max - 1)}\u2026` : raw;
 }
 
 // src/parse/jsx.ts
@@ -55755,6 +55758,13 @@ import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
 import { join as join35, resolve as resolve10 } from "path";
 
 // src/adjudicate-subjects.ts
+var VOLATILE = [
+  [/\b\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b/g, "<date>"],
+  [/\b\d{4}-\d{2}-\d{2}\b/g, "<date>"],
+  [/\b\d{1,2}:\d{2}(?::\d{2})?\b/g, "<time>"],
+  [/\b\d{6,}\b/g, "<num>"]
+];
+var stable = (s) => VOLATILE.reduce((acc, [re, to]) => acc.replace(re, to), s);
 var selectorFor = (el) => {
   const id = el.attribs.id ? `#${el.attribs.id}` : "";
   const cls = el.attribs.class ? `.${el.attribs.class.trim().split(/\s+/)[0]}` : "";
@@ -55763,14 +55773,14 @@ var selectorFor = (el) => {
 function h(doc, el, note, cls) {
   return {
     ev: { file: doc.file, line: el.line, selector: selectorFor(el), snippet: snippet(doc, el, 160), note },
-    cls: cls ?? `${el.tag}|${note}`,
+    cls: stable(cls ?? `${el.tag}|${note}`),
     at: el.start
   };
 }
 function hAt(doc, line, selector, note, cls) {
   return {
     ev: { file: doc.file, line, selector, snippet: (doc.source.split("\n")[line - 1] ?? "").trim().slice(0, 160), note },
-    cls,
+    cls: stable(cls),
     at: line
   };
 }
@@ -57171,7 +57181,7 @@ function adjudicationText(sc, lang) {
 }
 
 // src/adjudicate.ts
-var ADJUDICATE_MAX_EVIDENCE_CLASSES = 600;
+var ADJUDICATE_MAX_EVIDENCE_CLASSES = 1200;
 var ALSO_AT_MAX = 8;
 function adjudicationContract() {
   return {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.5.0
+  version: 5.5.2
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.0";
+var VERSION = "5.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -5456,8 +5456,11 @@ function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
   let end = doc.source.indexOf("\n", lineStart);
   if (end === -1) end = doc.source.length;
-  const raw = doc.source.slice(lineStart, end).trim();
-  return raw.length > max ? raw.slice(0, max - 1) + "\u2026" : raw;
+  const from = Math.min(Math.max(el.start, lineStart), end);
+  const tagEnd = doc.source.indexOf(">", from);
+  const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
+  const raw = doc.source.slice(from, Math.min(to, doc.source.length)).replace(/\s+/g, " ").trim();
+  return raw.length > max ? `${raw.slice(0, max - 1)}\u2026` : raw;
 }
 
 // src/parse/jsx.ts
@@ -55755,6 +55758,13 @@ import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
 import { join as join35, resolve as resolve10 } from "path";
 
 // src/adjudicate-subjects.ts
+var VOLATILE = [
+  [/\b\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b/g, "<date>"],
+  [/\b\d{4}-\d{2}-\d{2}\b/g, "<date>"],
+  [/\b\d{1,2}:\d{2}(?::\d{2})?\b/g, "<time>"],
+  [/\b\d{6,}\b/g, "<num>"]
+];
+var stable = (s) => VOLATILE.reduce((acc, [re, to]) => acc.replace(re, to), s);
 var selectorFor = (el) => {
   const id = el.attribs.id ? `#${el.attribs.id}` : "";
   const cls = el.attribs.class ? `.${el.attribs.class.trim().split(/\s+/)[0]}` : "";
@@ -55763,14 +55773,14 @@ var selectorFor = (el) => {
 function h(doc, el, note, cls) {
   return {
     ev: { file: doc.file, line: el.line, selector: selectorFor(el), snippet: snippet(doc, el, 160), note },
-    cls: cls ?? `${el.tag}|${note}`,
+    cls: stable(cls ?? `${el.tag}|${note}`),
     at: el.start
   };
 }
 function hAt(doc, line, selector, note, cls) {
   return {
     ev: { file: doc.file, line, selector, snippet: (doc.source.split("\n")[line - 1] ?? "").trim().slice(0, 160), note },
-    cls,
+    cls: stable(cls),
     at: line
   };
 }
@@ -57171,7 +57181,7 @@ function adjudicationText(sc, lang) {
 }
 
 // src/adjudicate.ts
-var ADJUDICATE_MAX_EVIDENCE_CLASSES = 600;
+var ADJUDICATE_MAX_EVIDENCE_CLASSES = 1200;
 var ALSO_AT_MAX = 8;
 function adjudicationContract() {
   return {

package/src/adjudicate-subjects.ts

@@ -27,6 +27,29 @@ import { type Doc, type El, ancestors, attr, elementsByTag, snippet as elSnippet
 import { parseInlineStyle } from "./color.js";
 import type { Evidence } from "./adjudicate.js";
 
+/** Mask the parts of a text that change between runs without the code changing.
+ *
+ *  Only the class IDENTITY is masked — the note and the snippet keep the real text, so the
+ *  adjudicator still reads what the page says. What this decides is whether two anchors are
+ *  "the same thing": a row rendered at 13:04 and the same row rendered at 14:12 are one
+ *  decision about accessibility, not two.
+ *
+ *  It matters beyond tidiness. The verdict ledger fingerprints the evidence a criterion was
+ *  ruled against, and a fingerprint that moves every run makes a stored verdict stale on
+ *  arrival — the criterion returns to « to assess » and the ledger stops paying for itself.
+ *  Measured on a real capture set: four criteria carried a run timestamp in their evidence.
+ *
+ *  Deliberately narrow. Generated ids that are stable for a given tree (React `useId`) and
+ *  content hashes that are stable for given source are NOT masked: when those move, the code
+ *  moved, and a verdict about it SHOULD be re-examined. */
+const VOLATILE: [RegExp, string][] = [
+  [/\b\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b/g, "<date>"],
+  [/\b\d{4}-\d{2}-\d{2}\b/g, "<date>"],
+  [/\b\d{1,2}:\d{2}(?::\d{2})?\b/g, "<time>"],
+  [/\b\d{6,}\b/g, "<num>"],
+];
+const stable = (s: string): string => VOLATILE.reduce((acc, [re, to]) => acc.replace(re, to), s);
+
 /** One harvested anchor, plus the content class it belongs to. Two anchors sharing a class
  *  are the same thing rendered twice — a header link on 38 pages, not 38 link problems. */
 export interface Harvested {
@@ -52,7 +75,7 @@ const selectorFor = (el: El): string => {
 function h(doc: Doc, el: El, note: string, cls?: string): Harvested {
   return {
     ev: { file: doc.file, line: el.line, selector: selectorFor(el), snippet: elSnippet(doc, el, 160), note },
-    cls: cls ?? `${el.tag}|${note}`,
+    cls: stable(cls ?? `${el.tag}|${note}`),
     at: el.start,
   };
 }
@@ -62,7 +85,7 @@ function h(doc: Doc, el: El, note: string, cls?: string): Harvested {
 function hAt(doc: Doc, line: number, selector: string, note: string, cls: string): Harvested {
   return {
     ev: { file: doc.file, line, selector, snippet: (doc.source.split("\n")[line - 1] ?? "").trim().slice(0, 160), note },
-    cls,
+    cls: stable(cls),
     at: line,
   };
 }

package/src/adjudicate.ts

@@ -47,15 +47,18 @@ import { guidanceExampleBlock } from "./prd.js";
  *  887 links over 38 captured pages are 97 distinct (text, href) pairs. When even the class
  *  count exceeds this, `evidenceComplete` goes false and the fold refuses a `C` outright —
  *  an incomplete reading may still find a real failure, it may never clear one. */
-export const ADJUDICATE_MAX_EVIDENCE_CLASSES = 600;
+export const ADJUDICATE_MAX_EVIDENCE_CLASSES = 1200;
 
-// Why 600 and not a rounder, smaller number: it is set by what a real application actually
-// contains, measured, not by taste. On a 338-file product with 38 captured pages the largest
-// per-criterion populations are 456 classes (what survives when CSS is off), 404 (reading
-// order), 360 (structure) and 334 (the heading outline) — and those ARE the populations, not
-// samples of them. A cap below them would not bound anything worth bounding; it would simply
-// refuse every `C` on the criteria that matter most, and refusing to conclude is only honest
-// when something really was not looked at.
+// The number is set by what a real application actually contains, measured, and then given
+// room to grow. On a 338-file product with 38 captured pages the largest per-criterion
+// populations run to 592 classes (what survives when CSS is off), 531 (reading order) and 487
+// (structure) — and those ARE the populations, not samples of them.
+//
+// The headroom is the point. A cap sitting just above today's largest criterion is a gate
+// that flips the day someone adds a heading: the criterion becomes unclearable for reasons of
+// VOLUME rather than of uncertainty, which is the wrong reason to refuse a verdict and an
+// especially confusing one, since nothing about the code got worse. Refusing to conclude is
+// honest only when something really was not looked at.
 
 /** Sibling anchors listed per class. Bounded for readability; `occurrences` carries the true
  *  count, and the citation gate accepts any anchor of the class, listed or not. */

package/src/parse/html.ts

@@ -261,10 +261,32 @@ export function allIds(doc: Doc): { id: string; el: El }[] {
 }
 
 /** The source line(s) the element starts on, trimmed and truncated. */
+/** The source text that SHOWS this element, bounded to `max`.
+ *
+ *  Anchored at the element's own offset, not at the start of its line. On hand-written source
+ *  the two are the same thing once indentation is trimmed — but a serialized DOM capture is a
+ *  SINGLE LINE, so anchoring on the line handed back the document head for every element in
+ *  the page, identical for all of them. Measured on a real capture: every one of 128 form
+ *  controls carried `<html data-fr-scheme="system" lang="fr">…` as its snippet, which tells a
+ *  reader nothing and gives the grounding check nothing to match on.
+ *
+ *  The line still bounds the slice, so a multi-line element shows its opening tag rather than
+ *  its whole subtree. */
 export function snippet(doc: Doc, el: El, max = 120): string {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
   let end = doc.source.indexOf("\n", lineStart);
   if (end === -1) end = doc.source.length;
-  const raw = doc.source.slice(lineStart, end).trim();
-  return raw.length > max ? raw.slice(0, max - 1) + "…" : raw;
+  const from = Math.min(Math.max(el.start, lineStart), end);
+  // A JSX element usually opens on one line and carries its attributes on the next ones, so
+  // stopping at the line break showed "<a" and nothing else. Read to the end of the OPENING
+  // TAG instead — that is what identifies the element — and collapse the whitespace, which
+  // grounding normalises on both sides anyway (src/grounding.ts).
+  //
+  // The opening tag and not the element: a snippet longer than `max` gets an ellipsis, and an
+  // ellipsis is not in the source, so `includes` stops matching and grounding refuses a
+  // citation that was perfectly real. Keeping the slice short keeps it verbatim.
+  const tagEnd = doc.source.indexOf(">", from);
+  const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
+  const raw = doc.source.slice(from, Math.min(to, doc.source.length)).replace(/\s+/g, " ").trim();
+  return raw.length > max ? `${raw.slice(0, max - 1)}…` : raw;
 }

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.5.0";
+export const VERSION = "5.5.2";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,