@designesy/score 0.8.0 → 0.9.0

package/README.md

@@ -1,6 +1,6 @@
 # @designesy/score
 
-Standalone 44-check design-contract scoring engine. Fetches a URL, extracts CSS + `:root` tokens, runs all checks locally, with **no server required**. No required dependencies.
+Design quality gate for AI-generated UI: score any URL on 45 deterministic checks, A–F grade. This is the standalone engine: it fetches a URL, extracts CSS + `:root` tokens, and runs every check that needs no browser locally, with **no Designesy server required**; the browser checks return MANUAL. No required dependencies.
 
 ## Install
 
@@ -54,7 +54,7 @@ console.log(result.fail);    // 3
 console.log(result.checks);  // [{ id: 'v01', status: 'PASS', detail: '...' }, ...]
 ```
 
-## The 44 checks
+## The 45 checks
 
 | Category | Checks | Weight |
 |---|---|---|
@@ -85,7 +85,7 @@ Plus 12 anti-slop deductions (S1 to S12) and 7 originality lifts (O1 to O7).
 
 ## Scope system
 
-- **contract** (default for designesy.org): All 44 checks active. Absence = WARN/FAIL.
+- **contract** (default for designesy.org): All 45 checks active. Absence = WARN/FAIL.
 - **universal** (default for external sites): Optional features SKIP on absence instead of penalizing.
 
 Auto-detect: `designesy.org` → contract, everything else → universal.

package/dist/cli.d.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
- * @designesy/score CLI — Score a URL against the 44-check Designesy engine.
+ * @designesy/score CLI — Score a URL against the 45-check Designesy engine.
  *
- * Runs the full 44-check scoring engine locally — no server required.
+ * Runs the full 45-check scoring engine locally — no server required.
  * Fetches the target URL, extracts CSS + :root tokens, runs all checks,
  * and prints a formatted report. Exits with code 1 when the score drops
  * below --min-score or the grade drops below --min-grade.

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
- * @designesy/score CLI — Score a URL against the 44-check Designesy engine.
+ * @designesy/score CLI — Score a URL against the 45-check Designesy engine.
  *
- * Runs the full 44-check scoring engine locally — no server required.
+ * Runs the full 45-check scoring engine locally — no server required.
  * Fetches the target URL, extracts CSS + :root tokens, runs all checks,
  * and prints a formatted report. Exits with code 1 when the score drops
  * below --min-score or the grade drops below --min-grade.
@@ -98,10 +98,10 @@ function formatReport(result, url) {
 }
 function printUsage() {
     console.log(`
-designesy-score: Score a URL against the 44-check Designesy engine.
+designesy-score: Score a URL against the 45-check Designesy engine.
 
 Runs locally: no server required. Fetches the URL, extracts CSS + tokens,
-and runs all 44 checks in one process.
+and runs all 45 checks in one process.
 
 Usage:
   designesy-score <url> [options]
@@ -192,7 +192,7 @@ async function main() {
     // Progress and the gate verdict go to stderr: stdout carries only the
     // result, so --json and the JSON formats pipe straight into a parser.
     if (!args.quiet) {
-        console.error(`${DIM}Scoring ${url} locally (44-check engine, scope=${scope || 'auto'})…${RESET}`);
+        console.error(`${DIM}Scoring ${url} locally (45-check engine, scope=${scope || 'auto'})…${RESET}`);
     }
     let result;
     try {

package/dist/engine.d.ts

@@ -1,8 +1,8 @@
 /**
- * @designesy/score — 44-check design-contract scoring engine.
+ * @designesy/score — 45-check design-contract scoring engine.
  *
  * Scores a URL against the Designesy design-system contract: fetches the page,
- * extracts CSS + :root tokens, runs 44 checks (41 scored, 3 that need a
+ * extracts CSS + :root tokens, runs 45 checks (42 scored, 3 that need a
  * browser), computes a weighted score (0-100), assigns a letter grade (A-F),
  * and applies anti-slop deductions + originality lifts.
  *
@@ -159,7 +159,7 @@ export declare function scoreFromParts(input: ScorePartsInput): Promise<ScoreRes
  * the site served v0.4.3; test/engine-1-2-0.test.mjs now reads the site's
  * contract source and fails when the two differ.
  */
-export declare const CONTRACT_VERSION = "v0.4.4";
+export declare const CONTRACT_VERSION = "v0.4.6";
 /**
  * The one verdict rule, shared by every emission format.
  *

package/dist/engine.js

@@ -1,8 +1,8 @@
 /**
- * @designesy/score — 44-check design-contract scoring engine.
+ * @designesy/score — 45-check design-contract scoring engine.
  *
  * Scores a URL against the Designesy design-system contract: fetches the page,
- * extracts CSS + :root tokens, runs 44 checks (41 scored, 3 that need a
+ * extracts CSS + :root tokens, runs 45 checks (42 scored, 3 that need a
  * browser), computes a weighted score (0-100), assigns a letter grade (A-F),
  * and applies anti-slop deductions + originality lifts.
  *
@@ -209,7 +209,21 @@ const BROWSER_HEADERS = {
     'Sec-Fetch-User': '?1',
     'Upgrade-Insecure-Requests': '1',
 };
-function httpsFetch(url, headers, timeoutMs = 8000) {
+/** Redirects httpsFetch follows before it gives up (engine 1.3.1). */
+const MAX_REDIRECT_HOPS = 3;
+/**
+ * GET a URL, following each 3xx with a Location by hand. Every redirect target
+ * is re-validated with isValidUrl first (the SSRF guard), and at most
+ * MAX_REDIRECT_HOPS redirects are followed. Until engine 1.3.1 the comment said
+ * "Follow up to 3 redirects" but nothing counted them, so a redirect loop
+ * recursed until the process gave out. A redirect past the limit fails closed,
+ * the same way a refused target does. A response reached through at least one
+ * redirect reports redirected: true and the final hop's URL as finalUrl; before
+ * 1.3.1 redirected was true only when the LAST response was itself a 3xx, so a
+ * followed redirect read redirected: false. `hop` counts the redirects already
+ * followed; callers leave it at 0.
+ */
+function httpsFetch(url, headers, timeoutMs = 8000, hop = 0) {
     return new Promise((resolve) => {
         let resolved = false;
         const done = (r) => {
@@ -220,18 +234,19 @@ function httpsFetch(url, headers, timeoutMs = 8000) {
         };
         try {
             const req = httpsGet(url, { headers: { ...BROWSER_HEADERS, ...(headers || {}) }, timeout: timeoutMs, lookup: safeLookup }, (res) => {
-                // Follow one redirect manually (3xx → Location)
+                // Follow a redirect manually (3xx → Location)
                 if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
                     try {
                         const next = new URL(res.headers.location, url).href;
                         res.resume();
-                        // SSRF guard: re-validate every redirect target before following it
-                        if (!isValidUrl(next)) {
+                        // SSRF guard: re-validate every redirect target before following
+                        // it. Hop limit: a chain longer than MAX_REDIRECT_HOPS (a loop
+                        // among them) fails closed the same way.
+                        if (!isValidUrl(next) || hop >= MAX_REDIRECT_HOPS) {
                             done({ ok: false, status: 0, text: '', redirected: false, finalUrl: url });
                             return;
                         }
-                        // Follow up to 3 redirects
-                        httpsFetch(next, headers, timeoutMs).then(done);
+                        httpsFetch(next, headers, timeoutMs, hop + 1).then(done);
                         return;
                     }
                     catch { /* fall through */ }
@@ -240,7 +255,7 @@ function httpsFetch(url, headers, timeoutMs = 8000) {
                 res.setEncoding('utf-8');
                 res.on('data', (chunk) => { body += chunk; });
                 res.on('end', () => {
-                    done({ ok: (res.statusCode || 0) < 400, status: res.statusCode || 0, text: body, redirected: res.statusCode !== undefined && res.statusCode >= 300 && res.statusCode < 400, finalUrl: url });
+                    done({ ok: (res.statusCode || 0) < 400, status: res.statusCode || 0, text: body, redirected: hop > 0, finalUrl: url });
                 });
                 res.on('error', () => done({ ok: false, status: 0, text: '', redirected: false, finalUrl: url }));
             });
@@ -466,10 +481,11 @@ const REMEDIATION = {
     v43: 'Express UI states as semantic color roles: --ok/--success (verification pass), --warn/--warning (caution), --error/--danger (failure), --info (notice). The contract ships --ok, --warn, and --error for exactly this. Status colors named by state let components consume meaning (a score badge, a form error, and a toast all read the same token) and stay legible when the palette evolves.',
     v44: 'Give each status hue a text token for words and keep the hue itself for marks. A color that marks a state (a dot, a bar, a tint) needs 3:1, while the word for that state needs 4.5:1 (3:1 at 24px, or 18.66px bold) in every theme the site declares. Mix the hue toward your ink for text, for example --warn-ink: color-mix(in oklab, var(--warn) 70%, var(--ink)), measure it on the page and on each surface it sits on in every theme, and paint status words with it.',
     v45: 'Let every entrance that starts invisible run to its end when motion is paused. Under the pause rule, give one-shot entrances whose first keyframe is opacity 0 a negative delay longer than the animation, for example html[data-motion="paused"] :is(.fade-up, .reveal) { animation-delay: -3600s !important; }, or remove them with animation: none. Loops can stay held. Test by pausing motion and reloading: every page should still show its content.',
+    v46: 'Size text from the type scale. Use a type token (font-size: var(--text-body)) or a size that sits on the scale your tokens declare; keep deliberate fluid type in clamp() with a viewport or container unit, and keep its lower bound at or above the smallest type token. A static size between two steps reads as a one-off and drifts the rhythm the scale exists to hold.',
     v34: 'If the page hosts an AI chatbot or agent, tell people they are talking to an AI no later than their first interaction, in a form assistive technology announces. EU AI Act Article 50(1), which applies from 2026-08-02, places this duty on the provider of the AI system (the organisation that develops it and places it on the market or puts it into service under its own name); it does not apply where the AI nature is obvious from the context, and Article 50(5) asks for the information to be clear and accessible. The check reads any one of: visible "AI assistant" or "Chatbot" text, aria-label="AI assistant" on the chat container, or a data-ai-disclosure attribute on the widget. A live chat answered by people needs no AI disclosure: if the check flagged one for review, confirm who answers. US laws differ in scope: California\'s bot-disclosure law (SB 1001, Bus. & Prof. Code §§17940-17943) covers bots that mislead people about being bots to drive a sale or influence a vote; Colorado SB 24-205 was repealed and re-enacted by SB 26-189 (signed 2026-05-14, obligations from 2027-01-01), which governs automated decision-making in consequential decisions. This is not legal advice.',
     v35: 'Add a forced-colors readiness block: @media (forced-colors: active) { ... } with forced-color-adjust: none on elements that must preserve brand identity (logos, charts, semantic-color indicators). Windows High Contrast Mode and Chrome forced-colors recolor the page: without this media query, critical UI becomes illegible. Also ensure borders/outlines use currentColor or system colors so they adapt. Test with Windows HCM (Settings > Accessibility > Contrast themes).',
     v36: 'Remove UTS #39 confusable characters from CSS identifiers and token names. Confusables are Unicode characters from different scripts (Cyrillic, Greek, fullwidth) that look identical to ASCII letters; Cyrillic а (U+0430), for example, looks like Latin a (U+0061). In token names they enable shadowing attacks (--соlor-bg with Cyrillic с vs --color-bg). Audit all custom property names, class names, and url() paths for non-ASCII characters using a Unicode confusable detector. Provenance: Unicode Technical Standard #39, Unicode 16.0.0. Designesy is the only design verification engine that checks this surface.',
-    v37: 'Publish a DESIGN.md file at /DESIGN.md in your repo root and serve it publicly. Google\'s @google/design.md CLI (v0.4.0, Apache-2.0) validates the file format: 11 lint rules covering broken token refs, missing primary colors, WCAG contrast, orphaned tokens, section order, and more. Designesy integrates Google\'s linter as the spec layer and runs its own 44-check contract verification as the layer above. Install the CLI: npm install -g @google/design.md. Lint locally: npx @google/design.md lint DESIGN.md. Export to W3C DTCG: npx @google/design.md export --format dtcg DESIGN.md. Note: DESIGN.md uses sRGB hex only; for OKLCH/Display P3 color spaces, use the W3C DTCG JSON format directly.',
+    v37: 'Publish a DESIGN.md file at /DESIGN.md in your repo root and serve it publicly. Google\'s @google/design.md CLI (v0.4.0, Apache-2.0) validates the file format: 11 lint rules covering broken token refs, missing primary colors, WCAG contrast, orphaned tokens, section order, and more. Designesy integrates Google\'s linter as the spec layer and runs its own 45-check contract verification as the layer above. Install the CLI: npm install -g @google/design.md. Lint locally: npx @google/design.md lint DESIGN.md. Export to W3C DTCG: npx @google/design.md export --format dtcg DESIGN.md. Note: DESIGN.md uses sRGB hex only; for OKLCH/Display P3 color spaces, use the W3C DTCG JSON format directly.',
     v38: 'Rewrite button labels to start with a verb or recognized command. NN/g: "Lead with verbs or verb phrases that clearly outline what will happen after the command is selected." Use "Save changes" not "Changes", "Delete file" not "File". Recognized commands: Save, Cancel, Delete, Edit, Share, Close, Back, Next, etc. This is a WARN (heuristic): review flagged buttons manually.',
     v39: 'Remove trailing periods from button text, labels, and tab text. Microsoft Fluent: "Don\'t end text for buttons, radio buttons, labels, or checkboxes with a period." Periods are for full sentences in tooltips, error messages, and dialog bodies only.',
     v40: 'Replace non-descriptive link text with destination-revealing text. WCAG 2.4.4 Link Purpose: link text should describe the destination. Use "Read the typography guide" not "Click here". Use "View the leaderboard" not "Learn more". NN/g: non-descriptive links force users to read surrounding context to understand the destination.',
@@ -1086,7 +1102,13 @@ function checkFontFamilyCount(css, tokens) {
         // the adjusted @font-face. Those are not additional typeface choices — they
         // are the same family's fallback metrics — so they must not count as
         // palette drift.
-        if (/\sfallback$/.test(stack))
+        //
+        // Engine 1.3.1: the WORD fallback anywhere in the name, not only as its
+        // last word. A hand-tuned face can carry a suffix after it: designesy.org's
+        // "Fraunces Fallback Tuned" is Times New Roman under size-adjust, drawn only
+        // before Fraunces loads, and `\sfallback$` counted it as a fourth family
+        // (v26 WARN, "4 families: fraunces fallback tuned, fraunces, ...").
+        if (/\bfallback\b/.test(stack))
             continue;
         families.add(stack);
     }
@@ -1098,6 +1120,57 @@ function checkFontFamilyCount(css, tokens) {
         return { id: 'v26', item: 'Font family count ≤3 (body + heading + mono)', category: 'cadence', status: 'WARN', detail: `${count} families (recommended ≤3): ${list}` };
     return { id: 'v26', item: 'Font family count ≤3 (body + heading + mono)', category: 'cadence', status: 'FAIL', detail: `${count} families, palette drift (recommended ≤3): ${list}` };
 }
+/**
+ * v27 helper (engine 1.3.1): does this rule's selector style a form field
+ * itself? True when the subject (the last compound) of any selector in the
+ * list is an input, textarea or select element, or carries the exact class
+ * .input or .field, and is not a pseudo-element (::placeholder does not set
+ * the size iOS Safari reads). ".field-card-meta", ".input-hint", "::selection",
+ * ".field label" and "user-select" are not fields.
+ */
+function isFieldSelector(selector) {
+    const clean = selector.replace(/\/\*[\s\S]*?\*\//g, ' ');
+    return splitCssTopLevel(clean, ',').some((part) => {
+        const compounds = part.trim().split(/\s*[>+~]\s*|\s+/);
+        const subject = compounds[compounds.length - 1] || '';
+        if (subject.indexOf('::') >= 0)
+            return false;
+        return /(?:^|[^\w.#:-])(?:input|textarea|select)(?![\w-])/i.test(subject)
+            || /\.(?:input|field)(?![\w-])/i.test(subject);
+    });
+}
+/**
+ * v27 helper (engine 1.3.1): in each rule whose selector styles a field
+ * (isFieldSelector), every `font-size: var(...)` declaration is rewritten to
+ * its value from the :root token table, through substituteCssVars (var()
+ * chains, and a var()'s own fallback where no token declares the name). A
+ * value that does not resolve is left exactly as written, and so is every rule
+ * that does not style a field: v27's literal scan matches its keywords
+ * anywhere before a brace, so resolving var() in every rule would have read
+ * designesy.org's `.field-card-meta { font-size: var(--text-label) }` (12.8px,
+ * a card caption) as an input below 16px. Only values that start with var(
+ * are touched; calc(), clamp() and min()/max() stay as written, as before.
+ *
+ * The scan is anchored on each `font-size: var(` and reads its rule's selector
+ * backwards from the opening brace, so its cost is linear in the sheet. A
+ * whole-sheet rule regex (`([^{}]*)\{([^{}]*)\}`) is quadratic on a long
+ * @media prelude: measured at +4.5 s on five 43 KB preludes.
+ */
+function resolveFontSizeVars(css, tokens) {
+    if (css.indexOf('var(') < 0)
+        return css;
+    return css.replace(/(font-size\s*:\s*)(var\([^;{}]*\))/gi, (decl, lead, value, offset) => {
+        const open = css.lastIndexOf('{', offset);
+        // Not inside a rule body (a stray declaration, or a brace closed between).
+        if (open < 0 || css.lastIndexOf('}', offset) > open)
+            return decl;
+        const start = Math.max(css.lastIndexOf('}', open - 1), css.lastIndexOf('{', open - 1), css.lastIndexOf(';', open - 1)) + 1;
+        if (!isFieldSelector(css.slice(start, open)))
+            return decl;
+        const sub = substituteCssVars(value, [tokens]);
+        return sub === null ? decl : lead + sub.trim();
+    });
+}
 /**
  * v27 helper: does the delivered markup carry a field iOS Safari zooms into on
  * focus? That is a <textarea>, a <select>, or an <input> of any type except the
@@ -1124,12 +1197,20 @@ function hasZoomableField(html) {
 // unchanged: a sub-16px input rule still FAILs and a declared floor still PASSes,
 // because both describe the stylesheet that fields rendered later by script
 // would also inherit.
-function checkInputFontFloor(css, html) {
+//
+// Since engine 1.3.1 a font-size written as var() is read through the :root
+// token table first (resolveFontSizeVars), so `input { font-size:
+// var(--text-body) }` with `--text-body: 1rem` is the 16px floor it renders as.
+// Both regexes below read literals only; before 1.3.1 that rule read WARN ("no
+// explicit input font-size ≥16px detected") on designesy.org. A var() the table
+// cannot resolve is left as written, so it reads as it did before.
+function checkInputFontFloor(css, html, tokens = {}) {
+    const sheet = resolveFontSizeVars(css, tokens);
     // Find input/textarea/select rules with font-size < 16px or < 1rem.
     const inputRe = /(?:input|textarea|select|\.input|\.field)[^{]*\{[^}]*font-size\s*:\s*(\d+(?:\.\d+)?)(px|rem)/gi;
     const below = [];
     let m;
-    while ((m = inputRe.exec(css)) !== null) {
+    while ((m = inputRe.exec(sheet)) !== null) {
         const val = parseFloat(m[1]);
         const unit = m[2].toLowerCase();
         const px = unit === 'rem' ? val * 16 : val;
@@ -1140,8 +1221,8 @@ function checkInputFontFloor(css, html) {
         // Also check: is there a global input font-size ≥16px? (e.g. `input { font-size: 1rem }`)
         // The strict form `input\s*\{` matches standalone rules; the grouped form
         // `input,...,{` matches selectors merged by CSS minifiers (e.g. `input,textarea,select{font-size:1rem}`).
-        const hasGlobalFloor = /input\s*\{[^}]*font-size\s*:\s*(?:1rem|16px|1\.0(?:\d+)?rem|[2-9]\dpx)/i.test(css)
-            || /input\s*[,][^{]*\{[^}]*font-size\s*:\s*(?:1rem|16px|1\.0(?:\d+)?rem|[2-9]\dpx)/i.test(css);
+        const hasGlobalFloor = /input\s*\{[^}]*font-size\s*:\s*(?:1rem|16px|1\.0(?:\d+)?rem|[2-9]\dpx)/i.test(sheet)
+            || /input\s*[,][^{]*\{[^}]*font-size\s*:\s*(?:1rem|16px|1\.0(?:\d+)?rem|[2-9]\dpx)/i.test(sheet);
         if (hasGlobalFloor)
             return { id: 'v27', item: 'Input font-size ≥16px (prevents iOS Safari auto-zoom)', category: 'accessibility', status: 'PASS', detail: 'input font-size floor detected' };
         if (!hasZoomableField(html))
@@ -1391,7 +1472,8 @@ function checkSemanticStatusRoles(tokens) {
             families.ok = true;
         if (segments.some((s) => ['warn', 'warning', 'caution'].includes(s)))
             families.warn = true;
-        if (segments.some((s) => ['error', 'danger', 'fail', 'critical', 'negative'].includes(s)))
+        // 'destructive' is shadcn/ui's error role (--destructive); engine 1.3.1.
+        if (segments.some((s) => ['error', 'danger', 'fail', 'critical', 'negative', 'destructive'].includes(s)))
             families.error = true;
         if (segments.some((s) => ['info', 'notice', 'informational'].includes(s)))
             families.info = true;
@@ -2761,6 +2843,143 @@ function isDocumentScope(compound) {
     return simple.every((s) => s.startsWith('.') || s.startsWith('['))
         && simple.some((s) => V45_TOGGLE_ATTR.test(s) || V45_TOGGLE_CLASS.test(s));
 }
+// v46 — Type sizes come from the scale (engine 1.4.0).
+//
+// v16 asks that sizes be written in rem; it cannot tell a rem that sits on the
+// type scale from one that sits between steps, so a page can pass v16 while its
+// sizes drift off the scale its own tokens declare. v46 reads the scale from the
+// page itself: the :root type-size tokens (a name such as --text-*, --font-size-*,
+// --fs-* or --type-*, whose value resolves to a static rem or px length; colour
+// tokens named --text-muted never resolve to a length, so they never count). The
+// steps are every token value plus the token ratio (the median of consecutive
+// token ratios) extended four steps below and ten above the token nearest 16px.
+// The floor is the smallest type token.
+//
+// Fluid type is a deliberate design move, so a clamp(), min() or max() that
+// moves with a viewport or container unit is accepted as written; only its lower
+// bound is held to the floor. Relative sizes (em, %, inherit, keywords) follow
+// their parent, not the global scale, and are not judged. A static rem or px
+// size is judged: off the scale when it sits more than 2.5% from every step,
+// below the floor when it is smaller than the smallest type token.
+//
+// WARN only: an off-scale size is a hygiene finding, not a broken page.
+const V46_ITEM = 'Type sizes come from the scale';
+const V46_TOLERANCE = 0.025;
+const V46_FLUID = /(?:^|[^a-z-])(?:[sld]?v[wh]|v[ib]|vmin|vmax|cq[iwhb]|cqmin|cqmax)\b/i;
+function v46StaticPx(value) {
+    const m = value.trim().match(/^(\d*\.?\d+)(rem|px)$/i);
+    if (!m)
+        return null;
+    return parseFloat(m[1]) * (m[2].toLowerCase() === 'rem' ? 16 : 1);
+}
+function v46TypeScale(tokens) {
+    const values = [];
+    for (const [name, raw] of Object.entries(tokens)) {
+        if (!/^--(?:text|font-size|fs|type)-[\w-]+$/i.test(name))
+            continue;
+        const px = v46StaticPx(resolveVar(raw, tokens));
+        if (px !== null && px > 0)
+            values.push(px);
+    }
+    const unique = [...new Set(values.map((v) => Math.round(v * 1000) / 1000))].sort((a, b) => a - b);
+    if (unique.length < 3)
+        return null;
+    const ratios = [];
+    for (let i = 1; i < unique.length; i++) {
+        const r = unique[i] / unique[i - 1];
+        if (r >= 1.05 && r <= 1.7)
+            ratios.push(r);
+    }
+    ratios.sort((a, b) => a - b);
+    const ratio = ratios.length ? ratios[Math.floor(ratios.length / 2)] : 1.25;
+    const base = unique.reduce((best, v) => (Math.abs(v - 16) < Math.abs(best - 16) ? v : best), unique[0]);
+    const steps = new Set(unique);
+    for (let n = -4; n <= 10; n++)
+        steps.add(Math.round(base * Math.pow(ratio, n) * 1000) / 1000);
+    return { steps: [...steps].sort((a, b) => a - b), floor: unique[0], ratio, count: unique.length };
+}
+/** Lower bound in px of a fluid size: clamp()'s first argument, or the largest static argument of max(). */
+function v46FluidFloor(value) {
+    const fn = value.trim().match(/^(clamp|max)\((.*)\)$/i);
+    if (!fn)
+        return null;
+    const args = splitCssTopLevel(fn[2], ',').map((a) => v46StaticPx(a));
+    if (fn[1].toLowerCase() === 'clamp')
+        return args.length === 3 ? args[0] : null;
+    const statics = args.filter((a) => a !== null);
+    return statics.length ? Math.max(...statics) : null;
+}
+function v46Selector(css, at) {
+    const open = css.lastIndexOf('{', at);
+    if (open < 0)
+        return '';
+    const start = Math.max(css.lastIndexOf('}', open), css.lastIndexOf(';', open), css.lastIndexOf('{', open - 1)) + 1; // stop at an enclosing @media brace too
+    return css.slice(start, open).replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80);
+}
+function checkTypeScale(css, tokens) {
+    const scale = v46TypeScale(tokens);
+    if (!scale) {
+        return { id: 'v46', item: V46_ITEM, category: 'cadence', status: 'SKIP', detail: 'fewer than 3 type-size tokens in :root: no scale to measure against' };
+    }
+    const { steps, floor, ratio } = scale;
+    const nearest = (px) => steps.reduce((best, s) => (Math.abs(s - px) < Math.abs(best - px) ? s : best), steps[0]);
+    const onScale = (px) => steps.some((s) => Math.abs(px - s) / s <= V46_TOLERANCE);
+    const below = (px) => px < floor * (1 - V46_TOLERANCE);
+    const findings = [];
+    const seen = new Set(); // one finding per rule: a bundle repeats rules across @media copies
+    const add = (f) => {
+        const key = `${f.selector}|${f.value}|${f.issue}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            findings.push(f);
+        }
+    };
+    let judged = 0;
+    let fluid = 0;
+    const re = /font-size\s*:\s*([^;}]+)/gi;
+    let m;
+    while ((m = re.exec(css)) !== null) {
+        const written = m[1].replace(/\/\*[\s\S]*?\*\//g, '').replace(/!important/i, '').trim();
+        const value = resolveVar(written, tokens);
+        if (/^var\(/i.test(value))
+            continue; // an alias the token table cannot resolve
+        if (/^(?:clamp|min|max)\(/i.test(value) && V46_FLUID.test(value)) {
+            fluid++;
+            const low = v46FluidFloor(value);
+            if (low !== null && below(low)) {
+                add({ selector: v46Selector(css, m.index), value: written, px: Math.round(low * 100) / 100, issue: 'fluid minimum below the floor', nearest: floor });
+            }
+            continue;
+        }
+        const px = v46StaticPx(value);
+        if (px === null)
+            continue; // em, %, keywords, calc(): relative or not static
+        judged++;
+        if (below(px)) {
+            add({ selector: v46Selector(css, m.index), value: written, px: Math.round(px * 100) / 100, issue: 'below the floor', nearest: floor });
+        }
+        else if (!onScale(px)) {
+            add({ selector: v46Selector(css, m.index), value: written, px: Math.round(px * 100) / 100, issue: 'off the scale', nearest: nearest(px) });
+        }
+    }
+    const scaleText = `${steps.length}-step scale (ratio ${ratio.toFixed(3)}, ${scale.count} type tokens, floor ${floor}px)`;
+    if (judged + fluid === 0) {
+        return { id: 'v46', item: V46_ITEM, category: 'cadence', status: 'SKIP', detail: `no static or fluid font sizes outside the tokens to measure against the ${scaleText}` };
+    }
+    const offScale = findings.filter((f) => f.issue === 'off the scale').length;
+    const underFloor = findings.length - offScale;
+    if (findings.length === 0) {
+        return { id: 'v46', item: V46_ITEM, category: 'cadence', status: 'PASS', detail: `${judged} static and ${fluid} fluid sizes sit on the ${scaleText}` };
+    }
+    return {
+        id: 'v46', item: V46_ITEM, category: 'cadence', status: 'WARN',
+        detail: `${offScale} static size(s) off the ${scaleText} and ${underFloor} below its floor, of ${judged} static and ${fluid} fluid sizes measured`,
+        evidence: {
+            findings: findings.slice(0, 20).map((f) => ({ selector: f.selector, value: f.value, px: f.px, issue: f.issue, nearest: f.nearest })),
+            truncated: Math.max(0, findings.length - 20),
+        },
+    };
+}
 function checkPausedEntrances(css) {
     const ID = 'v45';
     const ITEM = 'Pausing motion keeps content visible';
@@ -3343,6 +3562,25 @@ const RECOGNIZED_BUTTON_COMMANDS = new Set([
     'find', 'replace', 'navigate', 'run', 'score', 'review', 'verify',
     'detect', 'assess', 'enforce', 'dismiss', 'analyze', 'inspect', 'check',
     'evaluate', 'validate', 'test', 'monitor', 'track', 'measure', 'scan',
+    // Engine 1.3.1. get, set and try: the comment in checkButtonTextVerb said
+    // "Get X", "Set X" and "Try X" were allowed, but none of the three was in
+    // this set, so "Get started" and "Try it free" read WARN on any site.
+    'get', 'set', 'try',
+    // Imperative CTA verbs that the suffix heuristic in isVerbLike misses (it
+    // already accepts explore, collapse, toggle, choose and compare by their -e
+    // ending). Each is read as a verb at the start of a button label, and none
+    // names a thing a button would be labelled with on its own:
+    //   flip    "Flip card", "Flip to the flame": a command, no noun label use
+    //   learn   "Learn more": verb only
+    //   sign    "Sign in", "Sign up", "Sign out": the noun reading does not
+    //           lead a button label
+    //   join    "Join the waitlist": verb only
+    //   expand  "Expand all", "Expand section": verb only
+    //   select  "Select all", "Select plan": an imperative in button use
+    //   read    "Read more", "Read the guide": an imperative in button use
+    // Left out on purpose: switch and watch, which are common nouns ("Switch",
+    // a toggle's name; "Watch", a product) as well as verbs.
+    'flip', 'learn', 'sign', 'join', 'expand', 'select', 'read',
 ]);
 function isVerbLike(word) {
     const w = word.toLowerCase().trim();
@@ -3440,12 +3678,41 @@ function checkButtonTextVerb(html) {
     // with no space between). A space separates a real word: "Alt text" is a
     // label, not a shortcut, and must not be eaten.
     const TEXT_SHORTCUT_RE = /[\s]*(?:Ctrl|Cmd|Shift|Alt|Option|Command)(?:\+[A-Za-z0-9+\-]*|[A-Z0-9]+)?$/;
+    // Engine 1.3.1: a "+key" hint written in lower case ("Save ctrl+s",
+    // "Find ctrl+k") is a hint too. The modifier is case-insensitive here but
+    // must stand as its own word (the start of the label or after a space), so
+    // "Halt+1" is untouched, and only the plus form is read: a modifier followed
+    // by a space and a letter ("Shift A") is a label, as it was in 1.3.0.
+    const PLUS_SHORTCUT_RE = /(?:^|\s)(?:ctrl|cmd|shift|alt|option|command)(?:\s*\+\s*[a-z0-9]+)+$/i;
+    const stripShortcut = (s) => s.replace(SHORTCUT_RE, '').replace(TEXT_SHORTCUT_RE, '').replace(PLUS_SHORTCUT_RE, '').trim();
+    // Engine 1.3.1: keycaps are read from the markup, not guessed from text.
+    // A <kbd> element is keyboard input (HTML Living Standard, the kbd element),
+    // a hint beside the label rather than the label, so its text is dropped
+    // before the verb check, innermost first so nested keycaps
+    // (<kbd><kbd>Ctrl</kbd>+<kbd>K</kbd></kbd>) go too. designesy.org's flip
+    // button, <kbd>ctrl</kbd> <span aria-hidden="true">+</span> <kbd>i</kbd>
+    // after a hidden lead, read as "Flip to the flame: ctrl  i" in 1.3.0. A "+"
+    // left between dropped keycaps is dropped with them. A button whose only
+    // text is keycaps is then empty and is judged as an icon-only button: by its
+    // aria-label when it has one, and not at all when it does not.
+    const labelText = (inner) => {
+        const visible = stripAriaHidden(inner);
+        let out = visible;
+        for (let i = 0; i < 4; i++) {
+            const next = out.replace(/<kbd\b[^>]*>(?:(?!<kbd\b)[\s\S])*?<\/kbd>/gi, ' ');
+            if (next === out)
+                break;
+            out = next;
+        }
+        const text = out.replace(/<[^>]*>/g, '').trim();
+        return out === visible ? text : text.replace(/(?:\s*\+)+$/, '').trim();
+    };
     while ((m = buttonRe.exec(html)) !== null) {
-        let text = stripAriaHidden(m[1]).replace(/<[^>]*>/g, '').trim();
+        let text = labelText(m[1]);
         // Strip leading icon characters so "✕Close" → "Close"
         text = text.replace(ICON_PREFIX_RE, '').trim();
         // Strip trailing keyboard shortcut hints so "Find⌘K" → "Find"
-        text = text.replace(SHORTCUT_RE, '').replace(TEXT_SHORTCUT_RE, '').trim();
+        text = stripShortcut(text);
         // Icon-only button with an accessible name: use the aria-label verb.
         if (!text) {
             const aria = /aria-label=["']([^"']+)["']/i.exec(m[0]);
@@ -3466,9 +3733,9 @@ function checkButtonTextVerb(html) {
             buttonTexts.push({ text, tag: m[0] });
     }
     while ((m = roleButtonRe.exec(html)) !== null) {
-        let text = stripAriaHidden(m[1]).replace(/<[^>]*>/g, '').trim();
+        let text = labelText(m[1]);
         text = text.replace(ICON_PREFIX_RE, '').trim();
-        text = text.replace(SHORTCUT_RE, '').replace(TEXT_SHORTCUT_RE, '').trim();
+        text = stripShortcut(text);
         if (!text) {
             const aria = /aria-label=["']([^"']+)["']/i.exec(m[0]);
             if (aria)
@@ -3530,7 +3797,9 @@ function checkButtonTextVerb(html) {
         // Allow if first word is verb-like
         if (isVerbLike(firstWord))
             continue;
-        // Allow "Get X", "Set X", "Try X" patterns (Get/Set/Try are in the set)
+        // "Get X", "Set X", "Try X" are allowed above: get, set and try are in
+        // RECOGNIZED_BUTTON_COMMANDS (since engine 1.3.1; this comment claimed it
+        // before they were).
         // If we get here, the first word is likely a noun → potential violation
         violations.push(`"${text}"`);
     }
@@ -4195,7 +4464,7 @@ export async function scoreFromParts(input) {
         checkTouchTargets(css),
         checkHeadingHierarchy(html),
         checkFontFamilyCount(css, tokens),
-        checkInputFontFloor(css, html),
+        checkInputFontFloor(css, html, rawTokens),
         checkReadingWidth(css),
         checkTokenLayerDepth(tokens),
         checkSemanticColorVocabulary(tokens),
@@ -4209,6 +4478,7 @@ export async function scoreFromParts(input) {
         checkNoAllCaps(html),
         checkStatusTextContrast(css),
         checkPausedEntrances(css),
+        checkTypeScale(css, rawTokens),
     ];
     // v37 is async — added after the synchronous checks array
     //
@@ -4704,7 +4974,7 @@ export async function scoreFromParts(input) {
  * the site served v0.4.3; test/engine-1-2-0.test.mjs now reads the site's
  * contract source and fails when the two differ.
  */
-export const CONTRACT_VERSION = 'v0.4.4';
+export const CONTRACT_VERSION = 'v0.4.6';
 /**
  * The one verdict rule, shared by every emission format.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@designesy/score",
-  "version": "0.8.0",
-  "description": "Standalone 44-check design-contract scoring engine: fetches a URL, extracts CSS + tokens, and runs all checks locally. No required dependencies.",
+  "version": "0.9.0",
+  "description": "Design quality gate for AI-generated UI: score any URL on 45 deterministic checks, A–F grade. Runs locally; browser checks return MANUAL. No required dependencies.",
   "license": "MIT",
   "author": "Designesy <hello@designesy.org>",
   "homepage": "https://www.designesy.org/score",