ultra11y 5.6.1 → 5.8.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.6.1",
+      "version": "5.8.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.6.1",
+  "version": "5.8.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.6.1",
+  "version": "5.8.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.6.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.8.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-BshGXnOO.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-DzQb84Kw.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-BshGXnOO.js';
-export { s as slugify } from './payload-BshGXnOO.js';
+import { C as CheckOptions } from './payload-DzQb84Kw.js';
+export { s as slugify } from './payload-DzQb84Kw.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/{payload-BshGXnOO.d.ts → payload-DzQb84Kw.d.ts}

@@ -61,8 +61,27 @@ interface CheckOptions {
      *  and a suite should opt into that. Everything is restored before it returns, and the
      *  snapshot has already been collected, so what they measure cannot alter what was recorded.
      *  Pass an array to run only some of them (by criterion: "1.4.4", "1.4.10", "1.4.12",
-     *  "1.4.13", "2.4.7"). */
-    probes?: boolean | string[];
+     *  "1.4.13", "2.4.7"), or an object to also set the bounds — how wide the reflow probe
+     *  narrows to, how many focusables are worth tabbing through, how many hits are worth
+     *  recording. 320px is normative and stays the default; the other two are judgements about
+     *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
+     *  quietly cut off at 120. */
+    probes?: boolean | string[] | ProbeTuning;
+}
+/** The bounds a repository may put on the live probes. Stated once, here, because the same
+ *  list is read from `.ultra11yrc.json`, accepted at the call site and handed to the engine —
+ *  three copies of a field list is three chances for one of them to fall behind.
+ *
+ *  `budgetMs` and `actionTimeoutMs` are not tuning in the same sense as the others: they are
+ *  what stops a probe from spending SOMEBODY ELSE'S test timeout. See ProbeLimits. */
+interface ProbeTuning {
+    only?: string[];
+    reflowWidth?: number;
+    maxFocusables?: number;
+    maxHits?: number;
+    maxTriggers?: number;
+    actionTimeoutMs?: number;
+    budgetMs?: number;
 }
 
 export { type AuditLike as A, type CheckOptions as C, type FindingLike as F, type SnapshotPayload as S, slugify as s };

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-BshGXnOO.js';
+import { C as CheckOptions, A as AuditLike } from './payload-DzQb84Kw.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;
@@ -106,6 +106,20 @@ declare function samplePagesFor(opts?: Pick<SweepOptions, "cwd" | "only">): Samp
  *  `scan`, which needs a real address); a Playwright test wants the path, so its `baseURL`
  *  applies. Anything unparseable is already a path. */
 declare function sweepTarget(url: string): string;
+/** The defaults every swept page is checked with, and the one seam a test can reach without
+ *  a Playwright runtime in the room.
+ *
+ *  `probes: true` is the default HERE and opt-in on `checkA11y`, and the asymmetry is the
+ *  point. `checkA11y` is called from a test that owns its page and may be asserting on focus
+ *  or hover a line later; a sweep exists for nothing but recording the sample, and the probes
+ *  are the only thing that can decide zoom, reflow, text spacing and content-on-hover on
+ *  screens a cold scanner never reaches. Measured on egapro: 15 of 20 pages came from a sweep
+ *  that never probed, and because conformity is an AND across every page in scope, those four
+ *  criteria stayed « à évaluer » for the whole audit — including on the five pages that HAD
+ *  been probed. Opt out with `check: { probes: false }`. */
+declare function sweepCheckOptions(check?: SweepOptions["check"]): SweepOptions["check"] & {
+    failOn: false | undefined;
+};
 declare function sweepSample(opts?: SweepOptions): void;
 
-export { AuditLike, CheckOptions, type PlaywrightCheckOptions, type SamplePageLike, type SweepOptions, checkA11y, samplePagesFor, sweepSample, sweepTarget, test };
+export { AuditLike, CheckOptions, type PlaywrightCheckOptions, type SamplePageLike, type SweepOptions, checkA11y, samplePagesFor, sweepCheckOptions, sweepSample, sweepTarget, test };

package/dist/playwright.mjs

@@ -154,6 +154,22 @@ const __vis = (e) => {
 };
 const __html = (e) => (e.outerHTML || '').slice(0, 160);
 `;
+var PROBE_DEFAULTS = {
+  reflowWidth: 320,
+  maxFocusables: 120,
+  maxHits: 20,
+  maxTriggers: 60,
+  actionTimeoutMs: 1e3,
+  budgetMs: 2e4
+};
+function probeDeadline(budgetMs, now = Date.now) {
+  const end = now() + budgetMs;
+  return { out: () => now() >= end, left: () => Math.max(0, end - now()) };
+}
+function actionTimeout(limits, deadline) {
+  const left = deadline ? deadline.left() : limits.actionTimeoutMs;
+  return Math.max(1, Math.min(limits.actionTimeoutMs, left || limits.actionTimeoutMs));
+}
 var REFLOW_PROBE = `(() => {
   const el = document.scrollingElement || document.documentElement;
   return { horizontalScroll: el.scrollWidth > el.clientWidth + 2 };
@@ -193,7 +209,7 @@ var TEXT_SPACING_PROBE = `(() => { ${PRELUDE}
   }
   return hits;
 })()`;
-function focusSetupExpr(scope = "") {
+function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables) {
   const rootExpr = scope ? `document.querySelectorAll(${JSON.stringify(scope)})` : `[document.documentElement]`;
   return `(() => { ${PRELUDE}
   const sel = 'a[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
@@ -227,7 +243,7 @@ function focusSetupExpr(scope = "") {
     proxy.setAttribute('data-u11y-fp', key);
     window.__u11yF[key] = { rest: snap(proxy), sel: __sel(proxy), html: __html(proxy) };
     n++;
-    if (n >= 120) break;
+    if (n >= ${maxFocusables}) break;
   }
   return n;
 })()`;
@@ -266,13 +282,14 @@ function hoverVisibleExpr(id, wantHidden = false) {
   const j = JSON.stringify(id);
   return `(() => { const t = document.getElementById(${j}); if (!t) return ${wantHidden ? "true" : "false"}; const s = getComputedStyle(t); const shown = s.display !== 'none' && s.visibility !== 'hidden' && t.getBoundingClientRect().height > 0; return ${wantHidden ? "!shown" : "shown"}; })()`;
 }
-async function probeFocusVisible(page, scope = "") {
-  const count = await page.evaluate(focusSetupExpr(scope));
+async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, deadline) {
+  const count = await page.evaluate(focusSetupExpr(scope, limits.maxFocusables));
   if (!count) return [];
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  const limit = Math.min(count + 2, 130);
+  const limit = Math.min(count + 2, limits.maxFocusables + 10);
   for (let i = 0; i < limit; i++) {
+    if (deadline?.out()) break;
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
@@ -289,12 +306,13 @@ async function probeFocusVisible(page, scope = "") {
   }
   return hits;
 }
-async function probeHover(page) {
+async function probeHover(page, limits = PROBE_DEFAULTS, deadline) {
   const triggers = await page.evaluate(HOVER_SETUP_PROBE);
   const hits = [];
-  for (const tr of triggers) {
+  for (const tr of triggers.slice(0, Math.max(1, limits.maxTriggers))) {
+    if (deadline?.out()) break;
     try {
-      await page.hover(`[data-u11y-h="${tr.key}"]`);
+      await page.hover(`[data-u11y-h="${tr.key}"]`, { timeout: actionTimeout(limits, deadline) });
     } catch {
       continue;
     }
@@ -313,13 +331,15 @@ async function probeHover(page) {
         detail: `Le contenu r\xE9v\xE9l\xE9 au survol (aria-describedby #${tr.target}) ne se masque pas avec \xC9chap \u2014 Contenu au survol ou au focus (1.4.13).`
       });
     }
-    if (hits.length >= 8) break;
+    if (hits.length >= Math.min(limits.maxHits, 8)) break;
   }
   return hits;
 }
 async function runLiveProbes(page, opts = {}) {
+  const limits = { ...PROBE_DEFAULTS, ...opts.limits };
   const only = opts.only?.length ? new Set(opts.only) : null;
   const want = (id) => only === null || only.has(id);
+  const deadline = probeDeadline(limits.budgetMs);
   const canResize = typeof page.setViewportSize === "function" && typeof page.viewportSize === "function";
   const canType = !!page.keyboard && typeof page.keyboard.press === "function";
   const canHover = typeof page.hover === "function" && typeof page.waitForTimeout === "function";
@@ -330,45 +350,53 @@ async function runLiveProbes(page, opts = {}) {
   const skip = (sc, why) => {
     out.skipped?.push({ sc, why });
   };
+  const bounded = async (sc, run) => {
+    if (deadline.out()) {
+      skip(sc, `the probe budget of ${limits.budgetMs}ms was already spent when this criterion came up`);
+      return null;
+    }
+    let timer;
+    const CUT = /* @__PURE__ */ Symbol("cut");
+    const started = Date.now();
+    try {
+      const raced = await Promise.race([
+        run().catch((e) => {
+          throw e;
+        }),
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(CUT), Math.max(1, deadline.left()));
+        })
+      ]);
+      if (raced === CUT) {
+        skip(sc, `the probe budget of ${limits.budgetMs}ms ran out after ${Date.now() - started}ms \u2014 this measurement did not complete`);
+        return null;
+      }
+      return raced;
+    } catch (e) {
+      skip(sc, String(e?.message ?? e).slice(0, 160));
+      return null;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
   if (!canResize) skip("1.4.10", "the page object cannot resize its viewport");
   if (!canType) skip("2.4.7", "the page object exposes no keyboard");
   if (!canHover) skip("1.4.13", "the page object cannot hover");
   if (!canStyle) skip("1.4.12", "the page object cannot inject a stylesheet");
-  if (want("2.4.7") && canType) {
-    const r = await probeFocusVisible(page).catch((e) => {
-      skip("2.4.7", String(e?.message ?? e).slice(0, 160));
-      return null;
-    });
-    if (r) {
-      out.focusVisible = r;
-      out.probed.push("2.4.7");
-    }
-  }
-  if (want("1.4.13") && canHover && canType) {
-    const r = await probeHover(page).catch((e) => {
-      skip("1.4.13", String(e?.message ?? e).slice(0, 160));
-      return null;
-    });
+  if (want("1.4.4")) {
+    const r = await bounded("1.4.4", async () => await page.evaluate(REFLOW_ZOOM_PROBE));
     if (r) {
-      out.hover = r;
-      out.probed.push("1.4.13");
+      out.reflowZoom = r ?? [];
+      out.probed.push("1.4.4");
     }
   }
-  if (want("1.4.4")) {
-    out.reflowZoom = await page.evaluate(REFLOW_ZOOM_PROBE).catch(() => []) ?? [];
-    out.probed.push("1.4.4");
-  }
   if (want("1.4.10") && canResize) {
-    let narrowed = true;
-    await page.setViewportSize({ width: 320, height: restore.height }).catch((e) => {
-      narrowed = false;
-      skip("1.4.10", String(e?.message ?? e).slice(0, 160));
+    const narrowed = await bounded("1.4.10", async () => {
+      await page.setViewportSize({ width: limits.reflowWidth, height: restore.height });
+      return true;
     });
     if (narrowed) {
-      const r = await page.evaluate(REFLOW_PROBE).catch((e) => {
-        skip("1.4.10", String(e?.message ?? e).slice(0, 160));
-        return null;
-      });
+      const r = await bounded("1.4.10", async () => await page.evaluate(REFLOW_PROBE));
       await page.setViewportSize(restore).catch(() => {
       });
       if (r) {
@@ -378,15 +406,9 @@ async function runLiveProbes(page, opts = {}) {
     }
   }
   if (want("1.4.12") && canStyle) {
-    const handle = await page.addStyleTag({ content: TEXT_SPACING_CSS }).catch((e) => {
-      skip("1.4.12", String(e?.message ?? e).slice(0, 160));
-      return null;
-    });
+    const handle = await bounded("1.4.12", () => page.addStyleTag({ content: TEXT_SPACING_CSS }));
     if (handle) {
-      const r = await page.evaluate(TEXT_SPACING_PROBE).catch((e) => {
-        skip("1.4.12", String(e?.message ?? e).slice(0, 160));
-        return null;
-      });
+      const r = await bounded("1.4.12", async () => await page.evaluate(TEXT_SPACING_PROBE));
       await page.evaluate(REMOVE_TEXT_SPACING_STEP).catch(() => {
       });
       if (r) {
@@ -395,6 +417,20 @@ async function runLiveProbes(page, opts = {}) {
       }
     }
   }
+  if (want("2.4.7") && canType) {
+    const r = await bounded("2.4.7", () => probeFocusVisible(page, "", limits, deadline));
+    if (r) {
+      out.focusVisible = r;
+      out.probed.push("2.4.7");
+    }
+  }
+  if (want("1.4.13") && canHover && canType) {
+    const r = await bounded("1.4.13", () => probeHover(page, limits, deadline));
+    if (r) {
+      out.hover = r;
+      out.probed.push("1.4.13");
+    }
+  }
   return out;
 }
 var REMOVE_TEXT_SPACING_STEP = `(() => {
@@ -525,6 +561,23 @@ function writePagesReport(opts = {}, engine = enginePath()) {
 }
 
 // src/integrations/playwright.ts
+function probeOptions(p) {
+  if (p === true || p === void 0) return fromConfig();
+  if (p === false) return {};
+  if (Array.isArray(p)) return { only: p, ...fromConfig() };
+  const { only, ...limits } = p;
+  return { ...only ? { only } : {}, limits };
+}
+function fromConfig() {
+  try {
+    const cfg = JSON.parse(readFileSync(join(process.cwd(), ".ultra11yrc.json"), "utf8"));
+    if (!cfg.probes) return {};
+    const { only, ...limits } = cfg.probes;
+    return { ...only ? { only } : {}, limits };
+  } catch {
+    return {};
+  }
+}
 async function checkA11y(page, opts = {}) {
   const collected = await page.evaluate(COLLECT_SNAPSHOT);
   let shot;
@@ -543,7 +596,7 @@ async function checkA11y(page, opts = {}) {
   let probes;
   if (opts.probes) {
     try {
-      probes = await runLiveProbes(page, Array.isArray(opts.probes) ? { only: opts.probes } : {});
+      probes = await runLiveProbes(page, probeOptions(opts.probes));
     } catch (e) {
       console.warn(
         `ultra11y: the live probes failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria they decide stay to assess.`
@@ -591,6 +644,9 @@ function sweepTarget(url) {
     return url;
   }
 }
+function sweepCheckOptions(check) {
+  return { failOn: false, probes: true, ...check };
+}
 function sweepSample(opts = {}) {
   const pages = samplePagesFor(opts);
   const t = test;
@@ -609,8 +665,7 @@ function sweepSample(opts = {}) {
         `${target} answered HTTP ${status} \u2014 an error page at the requested address; nothing to record as "${p.name}"`
       );
       await checkA11y(page, {
-        failOn: false,
-        ...opts.check,
+        ...sweepCheckOptions(opts.check),
         as: p.id,
         name: p.name,
         ...p.auth !== void 0 ? { auth: p.auth } : {},
@@ -624,6 +679,7 @@ function sweepSample(opts = {}) {
 export {
   checkA11y,
   samplePagesFor,
+  sweepCheckOptions,
   sweepSample,
   sweepTarget,
   test

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.6.1",
+  "version": "5.8.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",