@ksmv/ui-checks 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.2.0 - 2026-09-29
+
+- **Contrato de tema 2.0.0** empacotado, com os 20 tokens de densidade obrigatórios e os 3 derivados. Pontes da 0.1.x ficam incompletas em `tokens/complete`, e evidência capturada antes da mudança deixa de conferir com a identidade do contrato.
+- **Validação de valor dos tokens de densidade** em `tokens/complete`, pela lista fechada de tokens (nunca por padrão de nome): fonte e altura aceitam comprimento maior que zero em `px`, `rem` ou `em`; respiro e espaçamento aceitam também `0`; entrelinha, número sem unidade maior que zero; nos três, também `calc()`, `clamp()`, `min()` ou `max()`; peso, inteiro de 1 a 1000, `normal` ou `bold`. A conferência usa o valor da evidência calculada quando existe; sem evidência, um `var()` é conferido pelo token do mesmo tema ou pelo fallback que ele alcança. Valor inválido é cobertura obrigatória: sai com código 2 e não entra em baseline, e a mensagem diz o formato esperado, sem repetir o valor.
+- `css/no-literal-color` deixa de ler como cor uma palavra só com dígitos hexadecimais e sem `#`, como o peso `600` numa custom property fora do seletor de tema.
+
+## 0.1.5 - 2026-09-28
+
+- **Fingerprints de baseline estáveis.** O fingerprint passa a seguir o conteúdo do achado e a ordem entre achados idênticos no mesmo arquivo, e não mais a linha e a coluna. Na 0.1.4, uma linha inserida acima de dívida conhecida fazia toda a dívida seguinte reaparecer como achado novo; numa aplicação consumidora real, um comentário no topo do CSS gerou 115 falsos achados novos. O conteúdo entra no fingerprint só como hash, e nenhum trecho é gravado ou relatado.
+- **Baselines da 0.1.4 ou anteriores precisam ser regeneradas uma vez**, porque os fingerprints mudaram.
+- Espaços dentro de valores entre aspas, como em `[data-state="a  b"]`, continuam distinguindo achados. Uma regra de terceiros que não forneça âncora de conteúdo mantém o fingerprint posicional, para que uma mensagem genérica não faça um achado ocupar o lugar de outro.
+- `css/no-literal-color` deixa de abortar o arquivo quando o parser de cores lança exceção em valores que ele não reconhece, como `calc(100vw-1.5rem)` num valor arbitrário do Tailwind. O valor passa a ser tratado como "não é cor".
+
 ## 0.1.4 - 2026-09-28
 
 - A evidência calculada aceita tokens derivados ausentes ou vazios, que é como o navegador informa um token que o tema deixou no padrão, e usa o valor do token de origem. Na 0.1.3, um tema que confiava nos padrões documentados dos derivados nunca produzia evidência válida pela receita do README.

package/README.md

@@ -55,6 +55,8 @@ npx ksmv-ui-checks baseline ksmv-ui.config.js --write --first-seen-version=0.1.2
 
 O arquivo guarda fingerprints, regra, papel responsável e meta de redução, sem copiar o trecho encontrado. Uma atualização que aumente a dívida exige `--allow-growth` e uma justificativa em arquivo via `--reason-file`. Erro operacional e cobertura obrigatória ausente nunca entram na baseline.
 
+O fingerprint segue o conteúdo do achado, como seletor, propriedade e valor, e a ordem entre achados idênticos no mesmo arquivo, não a linha. Linhas inseridas ou removidas em outro ponto do arquivo não transformam dívida conhecida em achado novo; mudar o próprio trecho, sim. Baselines gravadas pela `0.1.4` ou anterior usavam a posição e precisam ser regeneradas uma vez com a `0.1.5`.
+
 ## Códigos de saída
 
 - `0`: análise completa, sem violações novas;
@@ -86,6 +88,8 @@ A evidência não é uma exceção manual. O arquivo é recusado, com código `2
 
 Tokens opcionais, os derivados e os de marca, podem ficar vazios na captura: é assim que o navegador informa um token que o tema não declarou. Um derivado vazio assume o valor do token de origem, que é o padrão documentado no contrato.
 
+Os tokens de densidade têm o valor conferido por `tokens/complete`: comprimento maior que zero em `px`, `rem` ou `em` para fonte e altura; também `0` para respiro e espaçamento; número sem unidade maior que zero para a entrelinha; em todos esses, também `calc()`, `clamp()`, `min()` ou `max()`; inteiro de 1 a 1000, `normal` ou `bold` para o peso. Com evidência, vale o valor capturado no navegador. Sem evidência, um valor que chega por `var()` é conferido pelo que ele alcança: o token declarado no mesmo tema ou, se não houver, o fallback do próprio `var()`; uma referência que não chega a valor nenhum fica como cobertura pendente. Valor inválido é cobertura obrigatória e não entra em baseline.
+
 A captura usa a API pública deste pacote e um navegador à sua escolha. Com Playwright, e a aplicação servida localmente:
 
 ```js

package/dist/anchor.d.ts

@@ -0,0 +1,8 @@
+import type { Declaration } from "postcss";
+import type { Node, SourceFile } from "typescript/unstable/ast";
+/** The selector chain and the declaration, value included. */
+export declare function cssDeclarationAnchor(declaration: Declaration): string;
+/** The selector chain and the property name, for findings about the name. */
+export declare function cssPropertyAnchor(declaration: Declaration): string;
+/** The source text of a TSX node. */
+export declare function tsxNodeAnchor(node: Node, sourceFile: SourceFile): string;

package/dist/anchor.js

@@ -0,0 +1,62 @@
+// Anchors identify a finding by its content rather than its position, so a
+// baseline survives lines inserted or removed elsewhere in the file. They are
+// hashed into the fingerprint and never stored or reported as text.
+// Collapses whitespace outside quoted strings only: inside quotes, as in
+// [data-state="a  b"], whitespace is part of the value and tells findings apart.
+function normalize(text) {
+    let result = "";
+    let quote;
+    let pendingSpace = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        if (quote !== undefined) {
+            result += character;
+            if (character === "\\" && index + 1 < text.length) {
+                index += 1;
+                result += text[index];
+            }
+            else if (character === quote) {
+                quote = undefined;
+            }
+            continue;
+        }
+        if (/\s/.test(character)) {
+            pendingSpace = result.length > 0;
+            continue;
+        }
+        if (pendingSpace) {
+            result += " ";
+            pendingSpace = false;
+        }
+        result += character;
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+        }
+    }
+    return result;
+}
+function cssContext(declaration) {
+    const context = [];
+    for (let parent = declaration.parent; parent && parent.type !== "root"; parent = parent.parent) {
+        if (parent.type === "rule") {
+            context.unshift(parent.selector);
+        }
+        else if (parent.type === "atrule") {
+            const atRule = parent;
+            context.unshift(`@${atRule.name} ${atRule.params}`);
+        }
+    }
+    return context;
+}
+/** The selector chain and the declaration, value included. */
+export function cssDeclarationAnchor(declaration) {
+    return normalize([...cssContext(declaration), `${declaration.prop}: ${declaration.value}`].join(" > "));
+}
+/** The selector chain and the property name, for findings about the name. */
+export function cssPropertyAnchor(declaration) {
+    return normalize([...cssContext(declaration), declaration.prop].join(" > "));
+}
+/** The source text of a TSX node. */
+export function tsxNodeAnchor(node, sourceFile) {
+    return normalize(node.getText(sourceFile));
+}

package/dist/baseline.d.ts

@@ -36,6 +36,14 @@ export interface GrowthApproval {
     errors: string[];
 }
 export declare function normalizeRelativePath(path: string): string;
+/**
+ * Gives every violation a fingerprint that follows its content and its order
+ * among identical findings in the same file, not its line and column, so lines
+ * inserted or removed elsewhere do not turn baselined debt into new findings.
+ * The content comes from the rule's anchor, or the message when a rule sets
+ * none; either way only its hash is kept.
+ */
+export declare function assignFingerprints(violations: Violation[]): void;
 export declare function fingerprintViolation(violation: Violation): string;
 export declare function baselineFor(violations: Violation[], metadata: BaselineMetadata, previous?: BaselineFile): BaselineFile;
 export declare function validateBaseline(value: unknown): BaselineValidation;

package/dist/baseline.js

@@ -48,7 +48,51 @@ function compareEntries(left, right) {
         left.rule.localeCompare(right.rule) ||
         left.fingerprint.localeCompare(right.fingerprint));
 }
+const fingerprintPattern = /^[a-f0-9]{64}$/;
+/**
+ * Gives every violation a fingerprint that follows its content and its order
+ * among identical findings in the same file, not its line and column, so lines
+ * inserted or removed elsewhere do not turn baselined debt into new findings.
+ * The content comes from the rule's anchor, or the message when a rule sets
+ * none; either way only its hash is kept.
+ */
+export function assignFingerprints(violations) {
+    const ordered = [...violations].sort((left, right) => normalizeRelativePath(left.path).localeCompare(normalizeRelativePath(right.path)) ||
+        left.line - right.line ||
+        left.column - right.column);
+    const occurrences = new Map();
+    for (const violation of ordered) {
+        // Without an anchor there is no content to follow, and a generic message
+        // could let one finding stand in for another; such a violation keeps its
+        // positional fingerprint.
+        if (violation.anchor === undefined) {
+            violation.fingerprint = positionalFingerprint(violation);
+            continue;
+        }
+        const identity = [
+            violation.rule.trim(),
+            normalizeRelativePath(violation.path),
+            normalizeNodeKind(violation.nodeKind),
+            violation.anchor,
+        ];
+        const key = JSON.stringify(identity);
+        const occurrence = occurrences.get(key) ?? 0;
+        occurrences.set(key, occurrence + 1);
+        violation.fingerprint = createHash("sha256")
+            .update(JSON.stringify([2, ...identity, occurrence]))
+            .digest("hex");
+        delete violation.anchor;
+    }
+}
 export function fingerprintViolation(violation) {
+    if (violation.fingerprint !== undefined && fingerprintPattern.test(violation.fingerprint)) {
+        return violation.fingerprint;
+    }
+    return positionalFingerprint(violation);
+}
+// The identity of a violation without an anchor, and of one built outside
+// runChecks: its position, which only compares with others built the same way.
+function positionalFingerprint(violation) {
     const input = JSON.stringify([
         1,
         violation.rule.trim(),

package/dist/color.js

@@ -38,7 +38,15 @@ export function isColorBearingProperty(property) {
         cssProperty === "column-rule");
 }
 function parsedColor(value) {
-    const parsed = parse(value);
+    // culori throws, instead of answering "not a color", on some values Tailwind
+    // allows in arbitrary classes, such as calc(100vw-1.5rem).
+    let parsed;
+    try {
+        parsed = parse(value);
+    }
+    catch {
+        return undefined;
+    }
     const color = parsed ? toRgb(parsed) : undefined;
     if (!color ||
         !Number.isFinite(color.r) ||
@@ -92,6 +100,8 @@ export function containsLiteralColor(value) {
         if (node.type === "word" &&
             node.value.toLowerCase() !== "currentcolor" &&
             node.value.toLowerCase() !== "transparent" &&
+            // culori parses bare hex digits ("600", "fed") as colors; CSS never does.
+            !/^[0-9a-f]{3,8}$/iu.test(node.value) &&
             parsedColor(node.value)) {
             literal = true;
             return false;

package/dist/density.d.ts

@@ -0,0 +1,22 @@
+export type DensityKind = "control-height" | "font-size" | "font-weight" | "line-height" | "spacing";
+/**
+ * The closed list of density tokens whose values the checker validates. It is
+ * matched by exact name, never by pattern: `--ui-font-body` or
+ * `--ui-shadow-sm` must not be read as lengths.
+ */
+export declare const densityTokenKinds: Readonly<Record<string, DensityKind>>;
+export declare function isValidDensityValue(kind: DensityKind, raw: string): boolean;
+/**
+ * Human-readable description of what a valid value looks like for the given
+ * density kind, used in checker diagnostics. Never echoes the offending
+ * value itself.
+ */
+export declare function densityExpectation(kind: DensityKind): string;
+/**
+ * Resolves a whole-value `var()` reference to the literal it ends in, using
+ * the theme's own declarations (and the evidence) first and the reference's
+ * fallback second. Returns undefined when the chain does not end in a literal
+ * (the reference check reports that) or when it passes through another
+ * density token, which is validated on its own.
+ */
+export declare function resolveDensityReference(value: string, tokens: ReadonlyMap<string, string>, seen?: ReadonlySet<string>): string | undefined;

package/dist/density.js

@@ -0,0 +1,100 @@
+import valueParser from "postcss-value-parser";
+/**
+ * The closed list of density tokens whose values the checker validates. It is
+ * matched by exact name, never by pattern: `--ui-font-body` or
+ * `--ui-shadow-sm` must not be read as lengths.
+ */
+export const densityTokenKinds = Object.freeze({
+    "--ui-font-size-xs": "font-size",
+    "--ui-font-size-sm": "font-size",
+    "--ui-font-size-md": "font-size",
+    "--ui-font-size-lg": "font-size",
+    "--ui-font-size-xl": "font-size",
+    "--ui-font-weight-strong": "font-weight",
+    "--ui-line-height-control": "line-height",
+    "--ui-control-height-sm": "control-height",
+    "--ui-control-height-md": "control-height",
+    "--ui-control-height-lg": "control-height",
+    "--ui-control-padding-inline-sm": "spacing",
+    "--ui-control-padding-inline-md": "spacing",
+    "--ui-control-padding-inline-lg": "spacing",
+    "--ui-space-1": "spacing",
+    "--ui-space-1-5": "spacing",
+    "--ui-space-2": "spacing",
+    "--ui-space-3": "spacing",
+    "--ui-space-4": "spacing",
+    "--ui-space-6": "spacing",
+    "--ui-space-8": "spacing",
+    "--ui-field-height": "control-height",
+    "--ui-dialog-title-font-size": "font-size",
+    "--ui-button-font-weight": "font-weight",
+});
+const lengthPattern = /^(?:\d+(?:\.\d+)?|\.\d+)(?:px|rem|em)$/iu;
+const math = /^(?:calc|clamp|min|max)\(.+\)$/iu;
+const unitless = /^(?:\d+(?:\.\d+)?|\.\d+)$/u;
+export function isValidDensityValue(kind, raw) {
+    const value = raw.trim();
+    switch (kind) {
+        case "font-weight": {
+            if (/^(?:normal|bold)$/iu.test(value))
+                return true;
+            if (!/^\d+$/u.test(value))
+                return false;
+            const weight = Number(value);
+            return weight >= 1 && weight <= 1000;
+        }
+        case "line-height":
+            return math.test(value) || (unitless.test(value) && Number(value) > 0);
+        case "spacing":
+            return value === "0" || math.test(value) || lengthPattern.test(value);
+        case "control-height":
+        case "font-size":
+            return math.test(value) || (lengthPattern.test(value) && Number.parseFloat(value) > 0);
+    }
+}
+/**
+ * Human-readable description of what a valid value looks like for the given
+ * density kind, used in checker diagnostics. Never echoes the offending
+ * value itself.
+ */
+export function densityExpectation(kind) {
+    switch (kind) {
+        case "control-height":
+        case "font-size":
+            return "a length above zero in px, rem or em, or calc()/clamp()/min()/max()";
+        case "spacing":
+            return "zero or a length in px, rem or em, or calc()/clamp()/min()/max()";
+        case "line-height":
+            return "a unitless number above zero, or calc()/clamp()/min()/max()";
+        case "font-weight":
+            return "an integer from 1 to 1000, normal or bold";
+    }
+}
+/**
+ * Resolves a whole-value `var()` reference to the literal it ends in, using
+ * the theme's own declarations (and the evidence) first and the reference's
+ * fallback second. Returns undefined when the chain does not end in a literal
+ * (the reference check reports that) or when it passes through another
+ * density token, which is validated on its own.
+ */
+export function resolveDensityReference(value, tokens, seen = new Set()) {
+    const trimmed = value.trim();
+    const nodes = valueParser(trimmed).nodes;
+    if (nodes.length !== 1)
+        return undefined;
+    const [node] = nodes;
+    if (node.type !== "function" || node.value.toLowerCase() !== "var")
+        return trimmed;
+    const comma = node.nodes.findIndex((child) => child.type === "div" && child.value === ",");
+    const name = valueParser.stringify(comma === -1 ? node.nodes : node.nodes.slice(0, comma)).trim();
+    const fallback = comma === -1 ? undefined : valueParser.stringify(node.nodes.slice(comma + 1)).trim();
+    if (name in densityTokenKinds || seen.has(name))
+        return undefined;
+    const next = new Set([...seen, name]);
+    const declared = tokens.get(name);
+    if (declared !== undefined)
+        return resolveDensityReference(declared, tokens, next);
+    if (fallback)
+        return resolveDensityReference(fallback, tokens, next);
+    return undefined;
+}

package/dist/result.d.ts

@@ -4,6 +4,14 @@ export interface SourceLocation {
     line: number;
 }
 export interface Violation extends SourceLocation {
+    /**
+     * Content that identifies the finding independently of its position. Rules
+     * set it; `runChecks` hashes it into `fingerprint` and removes it, so it is
+     * never reported or stored.
+     */
+    anchor?: string;
+    /** Stable fingerprint assigned by `runChecks`; see `fingerprintViolation`. */
+    fingerprint?: string;
     message: string;
     nodeKind: string;
     path: string;

package/dist/rules/noLiteralColor.js

@@ -1,4 +1,5 @@
 import { isComputedPropertyName, isIdentifier, isJsxAttribute, isJsxExpression, isObjectLiteralExpression, isPropertyAssignment, isStringLiteralLikeNode, } from "typescript/unstable/ast";
+import { cssDeclarationAnchor, tsxNodeAnchor } from "../anchor.js";
 import { containsLiteralColor, isColorBearingProperty } from "../color.js";
 import { isAllowedThemeDeclaration } from "./theme.js";
 function emptyResult() {
@@ -56,6 +57,7 @@ export function createNoLiteralColorRule({ themes, }) {
                     containsLiteralColor(declaration.value) &&
                     !isAllowedThemeDeclaration(file, declaration, themes)) {
                     result.violations.push({
+                        anchor: cssDeclarationAnchor(declaration),
                         column: declaration.source?.start?.column ?? 1,
                         line: declaration.source?.start?.line ?? 1,
                         message: "Literal colors are allowed only in configured themes.",
@@ -79,7 +81,13 @@ export function createNoLiteralColorRule({ themes, }) {
                     if (value !== undefined &&
                         ((isDirectColor && containsLiteralColor(value)) || isLiteralClass)) {
                         const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+                        // For className, only the classes that carry the literal color
+                        // identify the finding; the other classes may change freely.
+                        const anchor = isLiteralClass && !isDirectColor
+                            ? `className: ${value.split(/\s+/).filter(classContainsLiteralColor).join(" ")}`
+                            : tsxNodeAnchor(node, sourceFile);
                         result.violations.push({
+                            anchor,
                             column: position.character + 1,
                             line: position.line + 1,
                             message: "Literal colors are allowed only in configured themes.",
@@ -107,6 +115,7 @@ export function createNoLiteralColorRule({ themes, }) {
                             containsLiteralColor(property.initializer.text)) {
                             const position = sourceFile.getLineAndCharacterOfPosition(property.initializer.getStart(sourceFile));
                             result.violations.push({
+                                anchor: tsxNodeAnchor(property, sourceFile),
                                 column: position.character + 1,
                                 line: position.line + 1,
                                 message: "Literal colors are allowed only in configured themes.",

package/dist/rules/tokenComplete.js

@@ -1,5 +1,6 @@
 import { unresolvedTokenReferences } from "../color.js";
 import { parseThemeContract, } from "../contracts.js";
+import { densityExpectation, densityTokenKinds, isValidDensityValue, resolveDensityReference, } from "../density.js";
 import { createThemeCollector } from "./theme.js";
 export async function loadThemeContract(url) {
     const { readFile } = await import("node:fs/promises");
@@ -58,6 +59,7 @@ export function createTokenCompleteRule({ computed = {}, contract, themes, }) {
                         missingRequired = true;
                         result.violations.push({
                             ...location,
+                            anchor: theme.name,
                             message: `Theme ${theme.name} is missing required token ${token}.`,
                             nodeKind: `theme-token:${token}`,
                             rule: "tokens/complete",
@@ -78,6 +80,7 @@ export function createTokenCompleteRule({ computed = {}, contract, themes, }) {
                         !theme.declarations.has(fallback)) {
                         result.violations.push({
                             ...location,
+                            anchor: theme.name,
                             message: `Derived token ${token} has no available documented fallback.`,
                             nodeKind: `theme-token:${token}`,
                             rule: "tokens/complete",
@@ -114,6 +117,38 @@ export function createTokenCompleteRule({ computed = {}, contract, themes, }) {
                         }
                     }
                 }
+                // Density values are checked on the value the browser resolved when the
+                // evidence carries it; without evidence, a var() is checked through
+                // what it resolves to in this theme or its own fallback, and one that
+                // resolves to nothing stays with the reference check above. An invalid
+                // value is mandatory coverage, so no baseline can absorb it.
+                for (const [token, kind] of Object.entries(densityTokenKinds)) {
+                    if (!evidenceTokens.has(token))
+                        continue;
+                    const declaration = theme.declarations.get(token);
+                    // A derived token that is not declared here is validated through
+                    // its own source (the fallback token it derives from); reporting
+                    // it again from this theme would just duplicate that diagnostic.
+                    if (token in contract.derived && !declaration)
+                        continue;
+                    const raw = computedTheme[token] ?? declaration?.value;
+                    if (raw === undefined)
+                        continue;
+                    const value = /var\s*\(/iu.test(raw) ? resolveDensityReference(raw, tokens) : raw;
+                    if (value === undefined)
+                        continue;
+                    if (!isValidDensityValue(kind, value)) {
+                        result.uncovered.push({
+                            ...(declaration
+                                ? { column: declaration.column, line: declaration.line, path: declaration.path }
+                                : location),
+                            message: `Theme ${theme.name} has an invalid value for ${token}; expected ${densityExpectation(kind)}.`,
+                            nodeKind: "theme-density-value",
+                            rule: "tokens/complete",
+                            required: true,
+                        });
+                    }
+                }
             }
             return result;
         },

package/dist/rules/tokenContrast.js

@@ -157,6 +157,7 @@ export function createTokenContrastRule({ computed = {}, manifest, themes, }) {
                     else if (ratio < pair.minimum) {
                         result.violations.push({
                             ...location,
+                            anchor: theme.name,
                             message: `Contrast pair ${pair.context} is below ${pair.minimum}:1.`,
                             nodeKind: `contrast-pair:${pair.context}:${pair.foreground}:${pair.background}`,
                             rule: "tokens/contrast",

package/dist/rules/tokenPrefix.js

@@ -1,4 +1,5 @@
 import { isComputedPropertyName, isIdentifier, isJsxAttribute, isJsxExpression, isObjectLiteralExpression, isPropertyAssignment, isStringLiteralLikeNode, } from "typescript/unstable/ast";
+import { cssPropertyAnchor, tsxNodeAnchor } from "../anchor.js";
 export function createTokenPrefixRule() {
     return {
         name: "tokens/prefix",
@@ -8,6 +9,7 @@ export function createTokenPrefixRule() {
                 if (declaration.prop.startsWith("--") &&
                     !declaration.prop.startsWith("--ui-")) {
                     violations.push({
+                        anchor: cssPropertyAnchor(declaration),
                         column: declaration.source?.start?.column ?? 1,
                         line: declaration.source?.start?.line ?? 1,
                         message: "Public custom properties must use the --ui- prefix.",
@@ -42,6 +44,7 @@ export function createTokenPrefixRule() {
                             if (name?.startsWith("--") && !name.startsWith("--ui-")) {
                                 const position = sourceFile.getLineAndCharacterOfPosition(propertyNode.getStart(sourceFile));
                                 violations.push({
+                                    anchor: tsxNodeAnchor(propertyNode, sourceFile),
                                     column: position.character + 1,
                                     line: position.line + 1,
                                     message: "Public custom properties must use the --ui- prefix.",

package/dist/scan.js

@@ -5,6 +5,7 @@ import { computeLineStarts, createScanner, LanguageVariant, SyntaxKind, } from "
 import { API } from "typescript/unstable/sync";
 import { resolveContractSet } from "./contracts.js";
 import { loadComputedEvidence } from "./evidence.js";
+import { assignFingerprints } from "./baseline.js";
 import { applyDebtControls } from "./governance.js";
 const supportedExtensions = [".css", ".js", ".jsx", ".ts", ".tsx"];
 function toPosixPath(path) {
@@ -384,6 +385,7 @@ export async function runChecks(config, options = {}) {
     }
     typeScriptSnapshot?.dispose();
     typeScriptApi?.close();
+    assignFingerprints(report.violations);
     if (options.applyGovernance ?? usesDefaultRules) {
         await applyDebtControls(report, config);
     }

package/dist/theme-contract.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.0.0",
+  "contractVersion": "2.0.0",
   "schemaVersion": 1,
   "prefix": "--ui-",
   "required": [
@@ -62,7 +62,27 @@
     "--ui-radius-pill",
     "--ui-shadow-sm",
     "--ui-shadow-md",
-    "--ui-shadow-lg"
+    "--ui-shadow-lg",
+    "--ui-font-size-xs",
+    "--ui-font-size-sm",
+    "--ui-font-size-md",
+    "--ui-font-size-lg",
+    "--ui-font-size-xl",
+    "--ui-font-weight-strong",
+    "--ui-line-height-control",
+    "--ui-control-height-sm",
+    "--ui-control-height-md",
+    "--ui-control-height-lg",
+    "--ui-control-padding-inline-sm",
+    "--ui-control-padding-inline-md",
+    "--ui-control-padding-inline-lg",
+    "--ui-space-1",
+    "--ui-space-1-5",
+    "--ui-space-2",
+    "--ui-space-3",
+    "--ui-space-4",
+    "--ui-space-6",
+    "--ui-space-8"
   ],
   "derived": {
     "--ui-action-primary-border": "--ui-action-primary-bg",
@@ -71,7 +91,10 @@
     "--ui-status-success-border": "--ui-status-success",
     "--ui-status-warning-border": "--ui-status-warning",
     "--ui-status-danger-border": "--ui-status-danger",
-    "--ui-status-info-border": "--ui-status-info"
+    "--ui-status-info-border": "--ui-status-info",
+    "--ui-field-height": "--ui-control-height-md",
+    "--ui-dialog-title-font-size": "--ui-font-size-xl",
+    "--ui-button-font-weight": "--ui-font-weight-strong"
   },
   "brandComposition": [
     "--ui-brand-primary",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ksmv/ui-checks",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Static and computed quality checks for semantic UI token contracts.",
   "keywords": ["accessibility", "design-tokens", "quality", "static-analysis"],
   "license": "Apache-2.0",