design-constraint-validator 2.1.0 → 2.2.1

package/cli/validate-api.ts

@@ -14,6 +14,7 @@ import { flattenTokens, type TokenNode, type FlatToken } from '../core/flatten.j
 import { Engine, type ConstraintIssue } from '../core/engine.js';
 import type { Breakpoint } from '../core/breakpoints.js';
 import { loadConfig } from './config.js';
+import { validateConfig } from './config-schema.js';
 import { setupConstraints, collectReferencedIds } from './constraint-registry.js';
 import { formatViolation, type ConstraintViolation } from './json-output.js';
 import type { DcvConfig } from './types.js';
@@ -57,7 +58,11 @@ function readTokensFile(p: string): TokenNode {
 
 function resolveConfig(input: ValidateInput): DcvConfig {
   if (input.constraints !== undefined) {
-    return { constraints: input.constraints };
+    const { value, errors } = validateConfig({ constraints: input.constraints });
+    if (errors) {
+      throw new Error(`Inline constraints validation failed:\n  - ${errors.join('\n  - ')}`);
+    }
+    return value!;
   }
   const res = loadConfig(input.configPath);
   if (!res.ok) {

package/core/constraints/cross-axis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-axis.d.ts","sourceRoot":"","sources":["cross-axis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,GAAC,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACnD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;IACnD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;QAAC,GAAG,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,GAAG,KAAI,MAAM,CAAA;KAAE,CAAC;CACrG,GACD;IACE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,GAAC,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACnD,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAI,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,IAAI,EAAC,MAAM,EAAC,EAAE,EAAC,MAAM,EAAC,GAAG,EAAE,GAAG,KAAI,MAAM,CAAA;KAAE,CAAC;CACvH,CAAC;AAEN,MAAM,MAAM,GAAG,GAAG;IAChB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAqBF,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAqDrF;AAGD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,aAAa,EAAE,CAkBlG"}
+{"version":3,"file":"cross-axis.d.ts","sourceRoot":"","sources":["cross-axis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,GAAC,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACnD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;IACnD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;QAAC,GAAG,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,GAAG,KAAI,MAAM,CAAA;KAAE,CAAC;CACrG,GACD;IACE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,GAAC,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACnD,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAI,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,IAAI,EAAC,MAAM,EAAC,EAAE,EAAC,MAAM,EAAC,GAAG,EAAE,GAAG,KAAI,MAAM,CAAA;KAAE,CAAC;CACvH,CAAC;AAEN,MAAM,MAAM,GAAG,GAAG;IAChB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAsCF,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgErF;AAGD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,aAAa,EAAE,CAkBlG"}

package/core/constraints/cross-axis.js

@@ -1,23 +1,40 @@
+// Shares the hardened finite-size policy used by monotonic/threshold (TASK-037):
+// bare numbers / unitless as px, `rem`/`em` as 16px-relative, real numbers only
+// (rejects ".", "5.", "1.2.3px"), and non-finite guarded. The one addition over
+// the canonical parser is a clamp()/min()/max()/calc() heuristic — but it is
+// gated on a `(` so a malformed bare value like "1.2.3px" is rejected rather
+// than silently yielding a partial parse.
 const px = (v) => {
     if (typeof v === 'number')
-        return v;
+        return Number.isFinite(v) ? v : null;
     if (typeof v !== 'string')
         return null;
     const trimmed = v.trim();
-    // Direct simple form
-    let m = trimmed.match(/^([0-9.]+)\s*(px|rem)?$/i);
+    // Direct simple form: bare number / px / rem / em.
+    const m = trimmed.match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
     if (m) {
         const n = parseFloat(m[1]);
-        return (m[2] || 'px').toLowerCase() === 'rem' ? n * 16 : n;
+        if (!Number.isFinite(n))
+            return null;
+        const unit = (m[2] || 'px').toLowerCase();
+        return unit === 'rem' || unit === 'em' ? n * 16 : n;
     }
-    // Heuristic: extract first numeric size token (px or rem) inside complex expressions (e.g., clamp())
-    const inner = trimmed.match(/([0-9.]+)\s*(px|rem)/i);
-    if (inner) {
-        const n = parseFloat(inner[1]);
-        return inner[2].toLowerCase() === 'rem' ? n * 16 : n;
+    // Heuristic: first px/rem/em token inside a CSS function expression (clamp(),
+    // min(), max(), calc(), …). Gated on `(` so garbage simple values don't leak.
+    if (trimmed.includes('(')) {
+        const inner = trimmed.match(/(\d*\.?\d+)\s*(px|rem|em)/i);
+        if (inner) {
+            const n = parseFloat(inner[1]);
+            if (!Number.isFinite(n))
+                return null;
+            return inner[2].toLowerCase() === 'px' ? n : n * 16;
+        }
     }
     return null;
 };
+// Distinguish "operand absent" (skip silently) from "operand present but
+// unparseable" (warn loudly) — a silent skip of a present value is a false green.
+const presentButUnparseable = (raw) => raw != null && raw !== '' && px(raw) === null;
 export function CrossAxisPlugin(rules, bp) {
     return {
         id: "cross-axis",
@@ -33,6 +50,17 @@ export function CrossAxisPlugin(rules, bp) {
                     // Evaluate if either referenced id is among candidates (looser gating so global validate works)
                     if (!candidates.has(r.when.id) && !candidates.has(r.require.id))
                         continue;
+                    // Present-but-unparseable operand → warn, don't silently skip (TASK-037).
+                    if (presentButUnparseable(ctx.get(r.when.id)) || presentButUnparseable(ctx.get(r.require.id))) {
+                        issues.push({
+                            id: r.require.id,
+                            rule: "cross-axis",
+                            level: "warn",
+                            where: r.where,
+                            message: `Cannot check cross-axis rule "${r.id}": unparseable size value(s)`
+                        });
+                        continue;
+                    }
                     const wv = ctx.getPx(r.when.id);
                     // compare-style loader rules set when.id = a, require.id = a; use same value if second missing
                     let rv = ctx.getPx(r.require.id);

package/core/constraints/cross-axis.ts

@@ -18,25 +18,42 @@ export type Ctx = {
   bp?: string;
 };
 
+// Shares the hardened finite-size policy used by monotonic/threshold (TASK-037):
+// bare numbers / unitless as px, `rem`/`em` as 16px-relative, real numbers only
+// (rejects ".", "5.", "1.2.3px"), and non-finite guarded. The one addition over
+// the canonical parser is a clamp()/min()/max()/calc() heuristic — but it is
+// gated on a `(` so a malformed bare value like "1.2.3px" is rejected rather
+// than silently yielding a partial parse.
 const px = (v: unknown): number | null => {
-  if (typeof v === 'number') return v;
+  if (typeof v === 'number') return Number.isFinite(v) ? v : null;
   if (typeof v !== 'string') return null;
   const trimmed = v.trim();
-  // Direct simple form
-  let m = trimmed.match(/^([0-9.]+)\s*(px|rem)?$/i);
+  // Direct simple form: bare number / px / rem / em.
+  const m = trimmed.match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
   if (m) {
     const n = parseFloat(m[1]);
-    return (m[2] || 'px').toLowerCase() === 'rem' ? n * 16 : n;
+    if (!Number.isFinite(n)) return null;
+    const unit = (m[2] || 'px').toLowerCase();
+    return unit === 'rem' || unit === 'em' ? n * 16 : n;
   }
-  // Heuristic: extract first numeric size token (px or rem) inside complex expressions (e.g., clamp())
-  const inner = trimmed.match(/([0-9.]+)\s*(px|rem)/i);
-  if (inner) {
-    const n = parseFloat(inner[1]);
-    return inner[2].toLowerCase() === 'rem' ? n * 16 : n;
+  // Heuristic: first px/rem/em token inside a CSS function expression (clamp(),
+  // min(), max(), calc(), …). Gated on `(` so garbage simple values don't leak.
+  if (trimmed.includes('(')) {
+    const inner = trimmed.match(/(\d*\.?\d+)\s*(px|rem|em)/i);
+    if (inner) {
+      const n = parseFloat(inner[1]);
+      if (!Number.isFinite(n)) return null;
+      return inner[2].toLowerCase() === 'px' ? n : n * 16;
+    }
   }
   return null;
 };
 
+// Distinguish "operand absent" (skip silently) from "operand present but
+// unparseable" (warn loudly) — a silent skip of a present value is a false green.
+const presentButUnparseable = (raw: unknown): boolean =>
+  raw != null && raw !== '' && px(raw) === null;
+
 export function CrossAxisPlugin(rules: CrossAxisRule[], bp?: string): ConstraintPlugin {
   return {
     id: "cross-axis",
@@ -57,6 +74,17 @@ export function CrossAxisPlugin(rules: CrossAxisRule[], bp?: string): Constraint
         if ("when" in r) {
           // Evaluate if either referenced id is among candidates (looser gating so global validate works)
           if (!candidates.has(r.when.id) && !candidates.has(r.require.id)) continue;
+          // Present-but-unparseable operand → warn, don't silently skip (TASK-037).
+          if (presentButUnparseable(ctx.get(r.when.id)) || presentButUnparseable(ctx.get(r.require.id))) {
+            issues.push({
+              id: r.require.id,
+              rule: "cross-axis",
+              level: "warn",
+              where: r.where,
+              message: `Cannot check cross-axis rule "${r.id}": unparseable size value(s)`
+            });
+            continue;
+          }
           const wv = ctx.getPx(r.when.id);
           // compare-style loader rules set when.id = a, require.id = a; use same value if second missing
           let rv = ctx.getPx(r.require.id);

package/core/constraints/monotonic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"monotonic.d.ts","sourceRoot":"","sources":["monotonic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,EAAE,EACf,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,EACpC,MAAM,SAAc,GACnB,gBAAgB,CAsBlB;AAGD,eAAO,MAAM,SAAS,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAO/C,CAAC;AAGF,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAOjD,CAAC;AAGF,eAAO,MAAM,cAAc,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAoBpD,CAAC"}
+{"version":3,"file":"monotonic.d.ts","sourceRoot":"","sources":["monotonic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,EAAE,EACf,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,EACpC,MAAM,SAAc,GACnB,gBAAgB,CAoClB;AAMD,eAAO,MAAM,SAAS,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAW/C,CAAC;AAGF,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAOjD,CAAC;AAGF,eAAO,MAAM,cAAc,GAAI,GAAG,OAAO,KAAG,MAAM,GAAG,IAoBpD,CAAC"}

package/core/constraints/monotonic.js

@@ -4,12 +4,27 @@ export function MonotonicPlugin(orders, parse, ruleId = "monotonic") {
         evaluate(engine, candidates) {
             const issues = [];
             for (const [a, op, b] of orders) {
-                const va = parse(engine.get(a));
-                const vb = parse(engine.get(b));
+                if (!candidates.has(a) && !candidates.has(b))
+                    continue; // incremental
+                const rawA = engine.get(a);
+                const rawB = engine.get(b);
+                const va = parse(rawA);
+                const vb = parse(rawB);
+                // A present-but-unparseable size operand (e.g. "50%", "10vw") can't be
+                // compared — warn instead of silently skipping (TASK-031).
+                if ((rawA != null && rawA !== "" && va == null) || (rawB != null && rawB !== "" && vb == null)) {
+                    issues.push({
+                        id: `${a}|${b}`,
+                        rule: "monotonic",
+                        level: "warn",
+                        message: `Cannot check ${a} ${op} ${b}: unparseable size value(s)`
+                    });
+                    continue;
+                }
                 if (va == null || vb == null)
-                    continue; // skip unparseable
+                    continue; // operand absent — nothing to check
                 const ok = op === ">=" ? va >= vb : va <= vb;
-                if (!ok && (candidates.has(a) || candidates.has(b))) {
+                if (!ok) {
                     issues.push({
                         id: `${a}|${b}`,
                         rule: "monotonic",
@@ -22,16 +37,25 @@ export function MonotonicPlugin(orders, parse, ruleId = "monotonic") {
         }
     };
 }
-// a minimal parser for "rem"/"px" numbers
+// Parse a size to px for comparison. Coerces bare numbers and unitless strings to
+// px (TASK-031: numeric `$value` and aliases-to-numbers previously returned null,
+// silently skipping the rule). `rem`/`em` are 16px-relative. Returns null only for
+// genuinely unparseable operands (e.g. "50%", "10vw") — callers warn, not skip.
 export const parseSize = (v) => {
+    if (typeof v === "number")
+        return Number.isFinite(v) ? v : null; // bare number == px
     if (typeof v !== "string")
         return null;
-    const m = v.trim().match(/^([0-9.]+)(rem|px)?$/i);
+    // Real number only: rejects ".", "5.", "1.2.3px" (which previously slipped
+    // through `[0-9.]+` + parseFloat as NaN/garbage and became spurious errors).
+    const m = v.trim().match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
     if (!m)
         return null;
     const num = parseFloat(m[1]);
-    const unit = (m[2] || "rem").toLowerCase();
-    return unit === "px" ? num : num * 16; // assume 1rem=16px for comparisons
+    if (!Number.isFinite(num))
+        return null;
+    const unit = (m[2] || "px").toLowerCase();
+    return unit === "rem" || unit === "em" ? num * 16 : num; // px and unitless as-is
 };
 // Parser for unitless numbers (like scale factors)
 export const parseNumber = (v) => {

package/core/constraints/monotonic.ts

@@ -12,11 +12,25 @@ export function MonotonicPlugin(
     evaluate(engine, candidates) {
       const issues = [];
       for (const [a, op, b] of orders) {
-        const va = parse(engine.get(a));
-        const vb = parse(engine.get(b));
-        if (va == null || vb == null) continue; // skip unparseable
+        if (!candidates.has(a) && !candidates.has(b)) continue; // incremental
+        const rawA = engine.get(a);
+        const rawB = engine.get(b);
+        const va = parse(rawA);
+        const vb = parse(rawB);
+        // A present-but-unparseable size operand (e.g. "50%", "10vw") can't be
+        // compared — warn instead of silently skipping (TASK-031).
+        if ((rawA != null && rawA !== "" && va == null) || (rawB != null && rawB !== "" && vb == null)) {
+          issues.push({
+            id: `${a}|${b}`,
+            rule: "monotonic",
+            level: "warn" as const,
+            message: `Cannot check ${a} ${op} ${b}: unparseable size value(s)`
+          });
+          continue;
+        }
+        if (va == null || vb == null) continue; // operand absent — nothing to check
         const ok = op === ">=" ? va >= vb : va <= vb;
-        if (!ok && (candidates.has(a) || candidates.has(b))) {
+        if (!ok) {
           issues.push({
             id: `${a}|${b}`,
             rule: "monotonic",
@@ -30,14 +44,21 @@ export function MonotonicPlugin(
   };
 }
 
-// a minimal parser for "rem"/"px" numbers
+// Parse a size to px for comparison. Coerces bare numbers and unitless strings to
+// px (TASK-031: numeric `$value` and aliases-to-numbers previously returned null,
+// silently skipping the rule). `rem`/`em` are 16px-relative. Returns null only for
+// genuinely unparseable operands (e.g. "50%", "10vw") — callers warn, not skip.
 export const parseSize = (v: unknown): number | null => {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null; // bare number == px
   if (typeof v !== "string") return null;
-  const m = v.trim().match(/^([0-9.]+)(rem|px)?$/i);
+  // Real number only: rejects ".", "5.", "1.2.3px" (which previously slipped
+  // through `[0-9.]+` + parseFloat as NaN/garbage and became spurious errors).
+  const m = v.trim().match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
   if (!m) return null;
   const num = parseFloat(m[1]);
-  const unit = (m[2] || "rem").toLowerCase();
-  return unit === "px" ? num : num * 16; // assume 1rem=16px for comparisons
+  if (!Number.isFinite(num)) return null;
+  const unit = (m[2] || "px").toLowerCase();
+  return unit === "rem" || unit === "em" ? num * 16 : num; // px and unitless as-is
 };
 
 // Parser for unitless numbers (like scale factors)

package/core/constraints/threshold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threshold.d.ts","sourceRoot":"","sources":["threshold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,CAAC;AAWF,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,SAAc,GAAG,gBAAgB,CAuB9F"}
+{"version":3,"file":"threshold.d.ts","sourceRoot":"","sources":["threshold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,CAAC;AAiBF,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,SAAc,GAAG,gBAAgB,CAoC9F"}

package/core/constraints/threshold.js

@@ -1,12 +1,20 @@
+// Coerces bare numbers and unitless strings to px (TASK-031: numeric `$value`
+// previously returned null, silently skipping the threshold). `rem`/`em` are
+// 16px-relative. Returns null only for genuinely unparseable operands.
 const parseSizePx = (v) => {
+    if (typeof v === "number")
+        return Number.isFinite(v) ? v : null;
     if (typeof v !== "string")
         return null;
-    const m = v.trim().match(/^([0-9.]+)\s*(px|rem)?$/i);
+    // Real number only — rejects ".", "5.", "1.2.3px" (TASK-034).
+    const m = v.trim().match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
     if (!m)
         return null;
     const n = parseFloat(m[1]);
+    if (!Number.isFinite(n))
+        return null;
     const unit = (m[2] || "px").toLowerCase();
-    return unit === "rem" ? n * 16 : n;
+    return unit === "rem" || unit === "em" ? n * 16 : n;
 };
 export function ThresholdPlugin(rules, ruleId = "threshold") {
     return {
@@ -16,9 +24,21 @@ export function ThresholdPlugin(rules, ruleId = "threshold") {
             for (const r of rules) {
                 if (!candidates.has(r.id))
                     continue; // incremental
-                const px = parseSizePx(engine.get(r.id));
-                if (px == null)
+                const raw = engine.get(r.id);
+                const px = parseSizePx(raw);
+                if (px == null) {
+                    // Present-but-unparseable size — warn instead of silently skipping (TASK-031).
+                    if (raw != null && raw !== "") {
+                        issues.push({
+                            id: r.id,
+                            rule: ruleId,
+                            level: "warn",
+                            where: r.where,
+                            message: `Cannot check ${r.id} ${r.op} ${r.valuePx}px: unparseable size value`
+                        });
+                    }
                     continue;
+                }
                 const ok = r.op === ">=" ? px >= r.valuePx : px <= r.valuePx;
                 if (!ok) {
                     issues.push({

package/core/constraints/threshold.ts

@@ -8,13 +8,19 @@ export type ThresholdRule = {
   level?: "error" | "warn";      // default error
 };
 
+// Coerces bare numbers and unitless strings to px (TASK-031: numeric `$value`
+// previously returned null, silently skipping the threshold). `rem`/`em` are
+// 16px-relative. Returns null only for genuinely unparseable operands.
 const parseSizePx = (v: unknown): number | null => {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null;
   if (typeof v !== "string") return null;
-  const m = v.trim().match(/^([0-9.]+)\s*(px|rem)?$/i);
+  // Real number only — rejects ".", "5.", "1.2.3px" (TASK-034).
+  const m = v.trim().match(/^(\d*\.?\d+)\s*(px|rem|em)?$/i);
   if (!m) return null;
   const n = parseFloat(m[1]);
+  if (!Number.isFinite(n)) return null;
   const unit = (m[2] || "px").toLowerCase();
-  return unit === "rem" ? n * 16 : n;
+  return unit === "rem" || unit === "em" ? n * 16 : n;
 };
 
 export function ThresholdPlugin(rules: ThresholdRule[], ruleId = "threshold"): ConstraintPlugin {
@@ -24,8 +30,21 @@ export function ThresholdPlugin(rules: ThresholdRule[], ruleId = "threshold"): C
       const issues = [];
       for (const r of rules) {
         if (!candidates.has(r.id)) continue; // incremental
-        const px = parseSizePx(engine.get(r.id));
-        if (px == null) continue;
+        const raw = engine.get(r.id);
+        const px = parseSizePx(raw);
+        if (px == null) {
+          // Present-but-unparseable size — warn instead of silently skipping (TASK-031).
+          if (raw != null && raw !== "") {
+            issues.push({
+              id: r.id,
+              rule: ruleId,
+              level: "warn" as const,
+              where: r.where,
+              message: `Cannot check ${r.id} ${r.op} ${r.valuePx}px: unparseable size value`
+            });
+          }
+          continue;
+        }
         const ok = r.op === ">=" ? px >= r.valuePx : px <= r.valuePx;
         if (!ok) {
           issues.push({

package/core/constraints/wcag.js

@@ -3,7 +3,7 @@ function resolveColor(engineGet, x) {
     if (typeof x !== "string")
         return undefined;
     // If it's a CSS color literal, return as is; else treat as token id.
-    const isLiteral = /^#|^rgb|^hsl|^oklch|^oklab|^transparent/i.test(x);
+    const isLiteral = /^(#|rgba?\(|hsla?\(|oklch\(|oklab\(|transparent$)/i.test(x);
     return isLiteral ? x : String(engineGet(x) ?? "");
 }
 export function WcagContrastPlugin(pairs) {

package/core/constraints/wcag.ts

@@ -14,7 +14,7 @@ export type ContrastPair = {
 function resolveColor(engineGet: (id: TokenId)=>unknown, x: TokenId | string): string | undefined {
   if (typeof x !== "string") return undefined;
   // If it's a CSS color literal, return as is; else treat as token id.
-  const isLiteral = /^#|^rgb|^hsl|^oklch|^oklab|^transparent/i.test(x);
+  const isLiteral = /^(#|rgba?\(|hsla?\(|oklch\(|oklab\(|transparent$)/i.test(x);
   return isLiteral ? x : String(engineGet(x) ?? "");
 }
 

package/core/flatten.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten.d.ts","sourceRoot":"","sources":["flatten.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAGzC,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1D,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,mBAAmB,CAAC;IAC1C,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,GAAG,mBAAmB,CAAC;IACtC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C,CAAC;AAKF,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CA4G5D"}
+{"version":3,"file":"flatten.d.ts","sourceRoot":"","sources":["flatten.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAGzC,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1D,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,mBAAmB,CAAC;IAC1C,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,GAAG,mBAAmB,CAAC;IACtC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C,CAAC;AAKF,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAqH5D"}

package/core/flatten.js

@@ -2,6 +2,14 @@ import { normalizeDtcgValue } from "./dtcg.js";
 const REF_RE = /\{([a-z0-9_.-]+)\}/gi;
 const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 export function flattenTokens(root) {
+    // Fail closed on a malformed token root (TASK-017). A non-object root — null,
+    // an array, or a scalar — previously walked to a silently-empty set that
+    // "validated" with ok:true; that hid garbage input. The token root must be a
+    // JSON object. (An empty object `{}` is still valid — it just has no tokens.)
+    if (root === null || typeof root !== 'object' || Array.isArray(root)) {
+        const got = root === null ? 'null' : Array.isArray(root) ? 'array' : typeof root;
+        throw new Error(`Token root must be a JSON object (got ${got}).`);
+    }
     const flat = {};
     const edges = [];
     // First pass: collect all tokens

package/core/flatten.ts

@@ -29,6 +29,15 @@ const REF_RE = /\{([a-z0-9_.-]+)\}/gi;
 const escapeRegExp = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
 export function flattenTokens(root: TokenNode): FlattenResult {
+  // Fail closed on a malformed token root (TASK-017). A non-object root — null,
+  // an array, or a scalar — previously walked to a silently-empty set that
+  // "validated" with ok:true; that hid garbage input. The token root must be a
+  // JSON object. (An empty object `{}` is still valid — it just has no tokens.)
+  if (root === null || typeof root !== 'object' || Array.isArray(root)) {
+    const got = root === null ? 'null' : Array.isArray(root) ? 'array' : typeof root;
+    throw new Error(`Token root must be a JSON object (got ${got}).`);
+  }
+
   const flat: Record<TokenId, FlatToken> = {};
   const edges: Array<[TokenId, TokenId]> = [];
 

package/core/poset.d.ts

@@ -3,7 +3,12 @@ export type Comp = "<=" | ">=";
 export type Order = [Id, Comp, Id];
 export type Digraph = Map<Id, Set<Id>>;
 export type EdgeLabels = Map<string, string>;
-/** Safe ID for Mermaid/DOT node identifiers */
+/**
+ * Safe, INJECTIVE node identifier for Mermaid/DOT. Each non-alphanumeric byte
+ * (including `_`) is encoded as `_<charCode>_`, so distinct token ids can never
+ * collapse to the same node id (e.g. `a.b` -> `a_46_b`, `a_b` -> `a_95_b`).
+ * A naive `[^a-zA-Z0-9_] -> _` replacement merged those, corrupting graphs.
+ */
 export declare function sanitizeId(id: string): string;
 export type Highlight = {
     nodes?: Set<string>;

package/core/poset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poset.d.ts","sourceRoot":"","sources":["poset.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AACxB,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEnC,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAGvC,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAM7C,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAYnD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAwBvD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,EAAC,KAAe,EAAC;;CAAK,GAAG,MAAM,CAQ9E;AAGD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,OAAO,EACV,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACxE,MAAM,CAuCR;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,OAAO,EACf,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACjD,MAAM,CAoBR;AAGD,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,OAAO,EACV,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACxE,MAAM,CAyCR;AAGD,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAA;CAAE,CA2C7E;AAED,wBAAgB,aAAa,CAC3B,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GACjC,OAAO,CAYT;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAKtE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAK3E;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAI,GAAG,OAAO,CA8B3E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAOxF"}
+{"version":3,"file":"poset.d.ts","sourceRoot":"","sources":["poset.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AACxB,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEnC,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAGvC,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAM7C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAYnD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAwBvD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,EAAC,KAAe,EAAC;;CAAK,GAAG,MAAM,CAQ9E;AAGD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,OAAO,EACV,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACxE,MAAM,CAuCR;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,OAAO,EACf,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACjD,MAAM,CAoBR;AAGD,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,OAAO,EACV,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACxE,MAAM,CAyCR;AAGD,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAA;CAAE,CA2C7E;AAED,wBAAgB,aAAa,CAC3B,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GACjC,OAAO,CAYT;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAKtE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAK3E;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAI,GAAG,OAAO,CA8B3E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAOxF"}

package/core/poset.js

@@ -3,9 +3,14 @@
 // Small escapes so Mermaid/DOT don't choke on special characters
 const escMermaid = (s) => s.replace(/"/g, '\\"').replace(/\n/g, "\\n");
 const escDot = (s) => s.replace(/"/g, '\\"').replace(/\n/g, "\\n");
-/** Safe ID for Mermaid/DOT node identifiers */
+/**
+ * Safe, INJECTIVE node identifier for Mermaid/DOT. Each non-alphanumeric byte
+ * (including `_`) is encoded as `_<charCode>_`, so distinct token ids can never
+ * collapse to the same node id (e.g. `a.b` -> `a_46_b`, `a_b` -> `a_95_b`).
+ * A naive `[^a-zA-Z0-9_] -> _` replacement merged those, corrupting graphs.
+ */
 export function sanitizeId(id) {
-    return id.replace(/[^a-zA-Z0-9_]/g, "_");
+    return id.replace(/[^a-zA-Z0-9]/g, (c) => `_${c.charCodeAt(0)}_`);
 }
 export function buildPoset(orders) {
     const g = new Map();

package/core/poset.ts

@@ -14,9 +14,14 @@ export type EdgeLabels = Map<string, string>; // key = "a|b" (raw ids)
 const escMermaid = (s: string) => s.replace(/"/g, '\\"').replace(/\n/g, "\\n");
 const escDot = (s: string) => s.replace(/"/g, '\\"').replace(/\n/g, "\\n");
 
-/** Safe ID for Mermaid/DOT node identifiers */
+/**
+ * Safe, INJECTIVE node identifier for Mermaid/DOT. Each non-alphanumeric byte
+ * (including `_`) is encoded as `_<charCode>_`, so distinct token ids can never
+ * collapse to the same node id (e.g. `a.b` -> `a_46_b`, `a_b` -> `a_95_b`).
+ * A naive `[^a-zA-Z0-9_] -> _` replacement merged those, corrupting graphs.
+ */
 export function sanitizeId(id: string): string {
-  return id.replace(/[^a-zA-Z0-9_]/g, "_");
+  return id.replace(/[^a-zA-Z0-9]/g, (c) => `_${c.charCodeAt(0)}_`);
 }
 
 export type Highlight = {