token-audit

Run a token audit scoped to a component, all components, or the website directory. The scan flags hardcoded hex colours, raw rgb() calls, pixel values matching tokens, hardcoded font weights, and literal transition timings, reporting file, line, and recommended token replacement.

Pass the component name as the scope, for example Avatar, and the audit scans that component's CSS file against the token registry. The report lists each violation with its line number and the token that should replace it.

A near-twin is a raw value that almost matches an existing token, such as a colour within a few points per channel or a spacing value one pixel off a scale step. These are reported as their own finding class because they usually indicate a mistyped token value rather than a deliberate choice.

Yes, a ds-allow directive comment sanctions a deliberate off-token value for a declaration, section, or entire file. Values covered by a directive are reported as documented exceptions rather than violations, and the directive grammar is enforced by a build script.

Yes, component TS and TSX files are scanned for colour-shaped literals such as hex, rgb(), and hsl() values. Hits are judged against the sanctioned out-of-CSS surfaces in the token reference validation script, and anything outside those mirrors is reported as a finding.

The chart palette emits var() references with literal hex fallbacks so charts follow theme switches, and those fallbacks are deliberate. A separate validation script fails the build if a fallback stops matching its token, so the audit treats them as sanctioned.