#!/usr/bin/env bash
# WP-02 token guard: fail if any *.component.ts hardcodes a colour (hex/rgb/hsl)
# instead of a --rhc-*/--app-* design token. Palette values live ONLY in the
# styles.scss token bridge (the one exempt file — it IS the bridge).
#
# px/rem are deliberately NOT grepped: too many false positives (font sizes,
# transforms, media queries). Raw border widths are fixed by hand and mapped to
# --rhc-border-width-*; see docs/backlog/WP-02-check-tokens.md.
#
# Escape hatch: put a `token-ok` marker + reason on a line to suppress a justified
# false positive (a colour word inside a comment or a data-URI). Keep the bar high.
set -uo pipefail

hits=$(grep -rnE '#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(' src/app --include='*.component.ts' | grep -v 'token-ok' || true)
if [ -n "$hits" ]; then
  echo "$hits"
  echo 'FAIL: hardcoded colours in components (use --rhc-*/--app-* tokens, or add a `token-ok` marker + reason)'
  exit 1
fi
echo 'OK: no hardcoded colours in components'