
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@tokens-studio/tokenscript-schemas
Advanced tools
Schema registry for TokenScript with bundled schemas and validation
Schema registry test setup for TokenScript with bundled schemas and validation.
This package provides a centralized registry of TokenScript schemas with tools to:
Bundle specific schemas for use in your projects with automatic dependency resolution:
# Bundle using a preset
npx @tokens-studio/tokenscript-schemas bundle preset:css -o ./schemas.js
# List available presets
npx @tokens-studio/tokenscript-schemas presets
# Bundle specific color schemas
npx @tokens-studio/tokenscript-schemas bundle oklch-color rgb-color -o ./schemas.js
# Bundle with functions
npx @tokens-studio/tokenscript-schemas bundle rgb-color function:invert -o ./schemas.js
# Build individual schema directory
npx @tokens-studio/tokenscript-schemas build ./src/schemas/types/css-color
npx @tokens-studio/tokenscript-schemas build ./src/schemas/types/css-color -o css-color.json
npx @tokens-studio/tokenscript-schemas build ./src/schemas/types/css-color --pretty -o css-color.json
# Combine presets with specific schemas
npx @tokens-studio/tokenscript-schemas bundle preset:css type:lab-color -o ./schemas.js
# Use config file for repeatable builds
npx @tokens-studio/tokenscript-schemas bundle --config schemas.json
# Preview what would be bundled (dry-run)
npx @tokens-studio/tokenscript-schemas bundle oklch-color rgb-color --dry-run
# Bundle from custom schema directory
npx @tokens-studio/tokenscript-schemas bundle type:my-color -o ./schemas.js --schemas-dir ./my-schemas
# List available schemas
npx @tokens-studio/tokenscript-schemas list
npx @tokens-studio/tokenscript-schemas list --types
npx @tokens-studio/tokenscript-schemas list --functions
preset:css - Modern CSS color types (CSS Color Level 4+)
css-color, hex-color, oklch-color, oklab-colorlighten, darken, mix, invert, to_gamut, contrast_ratioConfig File Format (schemas.json):
{
"schemas": ["oklch-color", "rgb-color", "function:invert"],
"output": "./src/generated/schemas.js"
}
Generated Output (schemas.js):
// Auto-generated by @tokens-studio/tokenscript-schemas
// Version: 0.0.14
// GitHub: https://github.com/tokens-studio/tokenscript-schemas
// Command: npx tokenscript-schemas bundle preset:css -o ./schemas.js
// Generated: 2026-01-07T10:30:00.000Z
import { Config } from "@tokens-studio/tokenscript-interpreter";
export const SCHEMAS = [
{ uri: "https://schema.../rgb-color/0/", schema: { /* bundled schema */ } },
{ uri: "https://schema.../oklch-color/0/", schema: { /* bundled schema */ } },
// ... all dependencies included
];
export function makeConfig() {
return new Config().registerSchemas(SCHEMAS);
}
Using in Your Code:
import { makeConfig } from "./schemas.js";
import { Interpreter, Lexer, Parser } from "@tokens-studio/tokenscript-interpreter";
const config = makeConfig();
const code = `
variable c: Color.Rgb = rgb(255, 128, 64);
c.to.oklch()
`;
const lexer = new Lexer(code);
const parser = new Parser(lexer);
const interpreter = new Interpreter(parser, { config });
const result = interpreter.interpret();
Each schema is self-contained in its own folder with file-based script references:
src/schemas/types/srgb-color/
├── schema.json # Complete schema definition (with file references)
├── srgb-initializer.tokenscript # Initializer script
├── from-hex-color.tokenscript # Conversion: HEX → SRGB
├── to-hex-color.tokenscript # Conversion: SRGB → HEX
└── unit.test.ts # Co-located tests
Key Points:
schema.json contains the complete schema definition with script references like "./filename.tokenscript".tokenscript files for better readability and syntax highlightingYou can use the bundler with your own custom schema directories, useful for:
See Custom Schema Directories Documentation for detailed examples and usage.
# Bundle from custom directory
npm run cli -- bundle my-color -o ./output.js --schemas-dir ./path/to/custom/schemas
# Build from custom directory
npm run build-schemas -- --schemas-dir ./path/to/custom/schemas
npm run build-schemas
Builds all schemas using the shared build logic from @/bundler/build-schema.ts:
schema.json from each schema directory./file.tokenscript references in the schemaresult/ directory:
registry.json - Complete registrytypes.json - All type schemasfunctions.json - All function schemastypes/{slug}.json - Individual type schemasfunctions/{slug}.json - Individual function schemas# Run all tests (logs disabled by default)
npm test
# Run tests with verbose logging
npm run test:verbose
# or
LOG_LEVEL=info npm test
# Run tests with debug logging
npm run test:debug
# or
LOG_LEVEL=debug npm test
# Run specific test file
npm test -- src/schemas/types/rgb-color/unit.test.ts
Test Logging:
LOG_LEVEL environment variable to enable logs: debug, info, warn, errorbuildSchemaFromDirectory() from @/bundler/build-schema.tsFAQs
Schema registry for TokenScript with bundled schemas and validation
The npm package @tokens-studio/tokenscript-schemas receives a total of 23 weekly downloads. As such, @tokens-studio/tokenscript-schemas popularity was classified as not popular.
We found that @tokens-studio/tokenscript-schemas demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.