ultra11y 5.5.3 → 5.5.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.5.3",
+      "version": "5.5.4",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.5.3",
+  "version": "5.5.4",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.5.3",
+  "version": "5.5.4",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.5.3";
+const ULTRA11Y_PLUGIN_VERSION = "5.5.4";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.5.3",
+  "version": "5.5.4",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.3";
+var VERSION = "5.5.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -57288,6 +57288,14 @@ function buildAdjudicationWorklist(audit2, opts = {}) {
     (r) => blankItem(r.criteriaId, r.automatability, scTitle(r.criteriaId) ?? void 0, harvestSubjects(subjectsForSc(r.criteriaId), docs))
   );
 }
+function readCitation(c2) {
+  if (typeof c2 !== "string") return c2;
+  const at = c2.lastIndexOf(":");
+  if (at <= 0) return null;
+  const line = Number.parseInt(c2.slice(at + 1), 10);
+  if (!Number.isFinite(line)) return null;
+  return { file: c2.slice(0, at), line, selector: "", snippet: "" };
+}
 function auditFiles(audit2, cwd) {
   const inputs = audit2.scope.inputs.filter((i2) => i2 !== "-" && i2 !== "<stdin>");
   if (!inputs.length) return /* @__PURE__ */ new Set();
@@ -57408,7 +57416,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
       if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
-      const cites = it.citations ?? [];
+      const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
           it.criteriaId,
@@ -57843,7 +57851,9 @@ function entriesFrom(adj, accepted, date) {
       verdict: it.verdict,
       ...it.justification?.trim() ? { justification: it.justification.trim() } : {},
       ...it.reason ? { reason: it.reason } : {},
-      ...it.citations?.length ? { citations: it.citations } : {},
+      // Normalised here too: a citation may have arrived as a bare "file:line" string, and a
+      // ledger entry has to hold the object form so a replay can re-anchor and re-ground it.
+      ...it.citations?.length ? { citations: it.citations.map(readCitation).filter((c2) => c2 !== null) } : {},
       ...it.findings?.length ? { findings: it.findings } : {},
       ...it.recommendations?.length ? { recommendations: it.recommendations } : {},
       evidenceFingerprint: evidenceFingerprint(it.evidence),

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.5.3
+  version: 5.5.4
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.3";
+var VERSION = "5.5.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -57288,6 +57288,14 @@ function buildAdjudicationWorklist(audit2, opts = {}) {
     (r) => blankItem(r.criteriaId, r.automatability, scTitle(r.criteriaId) ?? void 0, harvestSubjects(subjectsForSc(r.criteriaId), docs))
   );
 }
+function readCitation(c2) {
+  if (typeof c2 !== "string") return c2;
+  const at = c2.lastIndexOf(":");
+  if (at <= 0) return null;
+  const line = Number.parseInt(c2.slice(at + 1), 10);
+  if (!Number.isFinite(line)) return null;
+  return { file: c2.slice(0, at), line, selector: "", snippet: "" };
+}
 function auditFiles(audit2, cwd) {
   const inputs = audit2.scope.inputs.filter((i2) => i2 !== "-" && i2 !== "<stdin>");
   if (!inputs.length) return /* @__PURE__ */ new Set();
@@ -57408,7 +57416,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
       if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
-      const cites = it.citations ?? [];
+      const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
           it.criteriaId,
@@ -57843,7 +57851,9 @@ function entriesFrom(adj, accepted, date) {
       verdict: it.verdict,
       ...it.justification?.trim() ? { justification: it.justification.trim() } : {},
       ...it.reason ? { reason: it.reason } : {},
-      ...it.citations?.length ? { citations: it.citations } : {},
+      // Normalised here too: a citation may have arrived as a bare "file:line" string, and a
+      // ledger entry has to hold the object form so a replay can re-anchor and re-ground it.
+      ...it.citations?.length ? { citations: it.citations.map(readCitation).filter((c2) => c2 !== null) } : {},
       ...it.findings?.length ? { findings: it.findings } : {},
       ...it.recommendations?.length ? { recommendations: it.recommendations } : {},
       evidenceFingerprint: evidenceFingerprint(it.evidence),

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.5.3
+  version: 5.5.4
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.5.3";
+var VERSION = "5.5.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -57288,6 +57288,14 @@ function buildAdjudicationWorklist(audit2, opts = {}) {
     (r) => blankItem(r.criteriaId, r.automatability, scTitle(r.criteriaId) ?? void 0, harvestSubjects(subjectsForSc(r.criteriaId), docs))
   );
 }
+function readCitation(c2) {
+  if (typeof c2 !== "string") return c2;
+  const at = c2.lastIndexOf(":");
+  if (at <= 0) return null;
+  const line = Number.parseInt(c2.slice(at + 1), 10);
+  if (!Number.isFinite(line)) return null;
+  return { file: c2.slice(0, at), line, selector: "", snippet: "" };
+}
 function auditFiles(audit2, cwd) {
   const inputs = audit2.scope.inputs.filter((i2) => i2 !== "-" && i2 !== "<stdin>");
   if (!inputs.length) return /* @__PURE__ */ new Set();
@@ -57408,7 +57416,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
       if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
-      const cites = it.citations ?? [];
+      const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
           it.criteriaId,
@@ -57843,7 +57851,9 @@ function entriesFrom(adj, accepted, date) {
       verdict: it.verdict,
       ...it.justification?.trim() ? { justification: it.justification.trim() } : {},
       ...it.reason ? { reason: it.reason } : {},
-      ...it.citations?.length ? { citations: it.citations } : {},
+      // Normalised here too: a citation may have arrived as a bare "file:line" string, and a
+      // ledger entry has to hold the object form so a replay can re-anchor and re-ground it.
+      ...it.citations?.length ? { citations: it.citations.map(readCitation).filter((c2) => c2 !== null) } : {},
       ...it.findings?.length ? { findings: it.findings } : {},
       ...it.recommendations?.length ? { recommendations: it.recommendations } : {},
       evidenceFingerprint: evidenceFingerprint(it.evidence),

package/src/adjudicate.ts

@@ -139,7 +139,10 @@ export interface AdjudicationItem {
   // is what turns "cite something real" into "cite the evidence you were shown". When the
   // harvester found no evidence at all there is nothing to clear, and the honest verdicts
   // are `manual` or `NA`, never `C`.
-  citations?: Evidence[];
+  // Objects are what the contract asks for; a bare `"file:line"` string is accepted too,
+  // because that is the shape the worklist's own `alsoAt` uses and a real run reached for it.
+  // See `readCitation` — the gate is identical either way, a string just carries no snippet.
+  citations?: (Evidence | string)[];
   // Non-normative good practices the agent noted on this criterion — folded back into the
   // audit as ADVISORY findings (grounded exactly like an NC finding, but never affecting
   // status: they cannot flip the criterion to NC nor enter conformancePct). Optional.
@@ -334,6 +337,25 @@ export function buildAdjudicationWorklist(audit: AuditResult, opts: { cwd?: stri
   );
 }
 
+/** Read a citation whichever way it was written.
+ *
+ *  The contract asks for `{file, line, …}`, and a real run wrote `"src/Foo.tsx:15"` instead —
+ *  63 verdicts refused for a shape, not for a claim. It is an unambiguous form and the
+ *  worklist itself is full of it (`alsoAt` is exactly `file:line`), so an adjudicator
+ *  reaching for it is being consistent, not careless.
+ *
+ *  Nothing about the gate moves: membership and grounding run on the result either way. A
+ *  string simply carries no snippet, so grounding falls back to its selector/line checks —
+ *  weaker evidence, and the reason the object form stays what the contract asks for. */
+export function readCitation(c: Evidence | string): Evidence | null {
+  if (typeof c !== "string") return c;
+  const at = c.lastIndexOf(":");
+  if (at <= 0) return null;
+  const line = Number.parseInt(c.slice(at + 1), 10);
+  if (!Number.isFinite(line)) return null;
+  return { file: c.slice(0, at), line, selector: "", snippet: "" };
+}
+
 /** The files this audit actually read. Computed from the audit's own scope inputs, so it is
  *  the same set the harvest walked — `discover` only globs, it does not parse, so this costs
  *  little and is memoised per fold. */
@@ -580,7 +602,7 @@ export function applyAdjudication(
       // A clearing verdict is gated exactly like an accusing one. Before this, the only
       // check was "the justification is a non-empty string", so `"x"` cleared a criterion —
       // and a model answering C to everything published a conformance nobody had assessed.
-      const cites = it.citations ?? [];
+      const cites = (it.citations ?? []).map(readCitation).filter((c): c is Evidence => c !== null);
       // An INCOMPLETE reading may report a failure it saw; it may never clear what it never
       // looked at. Before class-based harvesting the evidence was a 30-anchor sample of a
       // population that ran to thousands, so a `C` was routinely a conformity claim over

package/src/ledger.ts

@@ -30,7 +30,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { type AdjudicationFile, type AdjudicationItem, type AgentFinding, buildAdjudicationWorklist, type Evidence } from "./adjudicate.js";
+import { type AdjudicationFile, type AdjudicationItem, type AgentFinding, buildAdjudicationWorklist, type Evidence, readCitation } from "./adjudicate.js";
 import { CORE, type StandardId } from "./standards/index.js";
 import type { AuditResult } from "./types.js";
 import { SCHEMA_VERSION } from "./types.js";
@@ -148,7 +148,9 @@ export function entriesFrom(adj: AdjudicationFile, accepted: ReadonlySet<string>
       verdict: it.verdict,
       ...(it.justification?.trim() ? { justification: it.justification.trim() } : {}),
       ...(it.reason ? { reason: it.reason } : {}),
-      ...(it.citations?.length ? { citations: it.citations } : {}),
+      // Normalised here too: a citation may have arrived as a bare "file:line" string, and a
+      // ledger entry has to hold the object form so a replay can re-anchor and re-ground it.
+      ...(it.citations?.length ? { citations: it.citations.map(readCitation).filter((c): c is Evidence => c !== null) } : {}),
       ...(it.findings?.length ? { findings: it.findings } : {}),
       ...(it.recommendations?.length ? { recommendations: it.recommendations } : {}),
       evidenceFingerprint: evidenceFingerprint(it.evidence),

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.5.3";
+export const VERSION = "5.5.4";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,