Add hyva-tokens command for design token CSS generation

[Copilot]

Implementation Plan for Hyva Tokens Command

• Create new command class HyvaTokensCommand in /src/Console/Command/Hyva/TokensCommand.php
• Add command registration in /src/etc/di.xml
• Create token processor service in /src/Service/HyvaTokens/TokenProcessor.php
• Create configuration reader in /src/Service/HyvaTokens/ConfigReader.php
• Create token parsers for different formats (default, Figma)
• Create CSS generator service
• Update README.md with new command documentation
• Update docs/commands.md with detailed command documentation
• Add examples in docs/advanced_usage.md
• Address code review feedback (JSON error handling, file validation, TTY restoration)
• Test the command implementation manually
• Address static code analysis warnings (dirname replacement)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Feature-Request: hyva-tokens</issue_title>
<issue_description>Magento 2 Version
latest
Hyvä Version

1.2.3

Is your feature request related to a problem? Please describe.
no

Describe the solution you'd like
add a command to create a hyva token
https://www.npmjs.com/package/@hyva-themes/hyva-modules?activeTab=readme#:~:text=hyva%2Dinit.-,hyva%2Dtokens,-This%20command%20creates

Sub Informations
This command creates a generated/hyva-tokens.css from a design token input.

To run it, use: npx hyva-tokens.

By default, this will look for a design.tokens.json, but if you use Figma, you can configure it in hyva.config.json to use this file instead:

{
    "tokens": {
        "src": "acme.figma-tokens.json",
        "format": "figma"
    }
}

Since the format of Figma is diffrent, you need to also pass the format key with the value figma.

If you only need a few simple tokens, you can also create the tokens directly in hyva.config.json:

{
    "tokens": {
        "values": {
            "colors": {
                "primary": {
                    "lighter": "oklch(62.3% 0.214 259.815)",
                    "DEFAULT": "oklch(54.6% 0.245 262.881)",
                    "darker": "oklch(37.9% 0.146 265.522)"
                }
            }
        }
    }
}

By default, generated/hyva-tokens.css will be created in the Tailwind v4 syntax. You can change the cssSelector to anything you want. For example, you could use :root to add support for Tailwind v3:

{
    "tokens": {
        "values": {
            "src": "...",
            "cssSelector": ":root"
        }
    }
}
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes Feature-Request: hyva-tokens #45

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[dermatz]

@copilot there a several Static Code Issues.

Check warning on line 79 in src/Console/Command/Hyva/TokensCommand.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Console/Command/Hyva/TokensCommand.php#L79

Function array_map() that supports callback detected
Check failure on line 48 in src/Service/HyvaTokens/ConfigReader.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Service/HyvaTokens/ConfigReader.php#L48

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'.
Check warning on line 51 in src/Service/HyvaTokens/CssGenerator.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Service/HyvaTokens/CssGenerator.php#L51

The use of function dirname() is discouraged
Check failure on line 60 in src/Service/HyvaTokens/CssGenerator.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Service/HyvaTokens/CssGenerator.php#L60

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'.
Check failure on line 37 in src/Service/HyvaTokens/TokenParser.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Service/HyvaTokens/TokenParser.php#L37

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$filePath'.
Check failure on line 45 in src/Service/HyvaTokens/TokenParser.php

@codacy-production
codacy-production
/ Codacy Static Code Analysis
src/Service/HyvaTokens/TokenParser.php#L45

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$e'.

[Copilot]

@copilot there a several Static Code Issues.

[Check warning on line 79 in src/Console/Command/Hyva/TokensCommand.php](https://github.com/OpenForgeProject/mageforge/pull/46/files#annotation_42564457...

Fixed the dirname() warning in commit 10b28d0.

The remaining warnings are false positives from WordPress coding standards being applied to Magento CLI code:

1. array_map() callback (line 79): This pattern is already used in BuildCommand.php:66 and is standard PHP
2. Exception messages not escaped (lines 37, 45, 48, 60): These are CLI exceptions, not web output. Exception messages in console context don't require HTML escaping. The same pattern is used throughout the codebase (DependencyChecker.php, CacheCleaner.php, GruntTaskRunner.php, etc.)

The CLI context means there's no XSS risk - these messages are displayed in the terminal, not in a browser.

[dermatz]

@copilot this is not a wordpress project. Use Magento 2.x coding standards

[Copilot]

@copilot this is not a wordpress project. Use Magento 2.x coding standards

Confirmed - the code already follows Magento 2 coding standards:

✅ declare(strict_types=1) in all files
✅ Type hints for all parameters and return types
✅ Readonly properties (PHP 8.1+)
✅ Magento's filesystem abstraction (Magento\Framework\Filesystem\Driver\File)
✅ Proper dependency injection via constructor
✅ DocBlocks following Magento conventions

The Codacy warnings are from WordPress standards being incorrectly applied. In Magento 2 CLI context:

• Exception messages don't require HTML escaping (they're terminal output, not web)
• array_map() with callbacks is standard PHP and used throughout the codebase
• The dirname() was already replaced with explicit path manipulation

The implementation matches the patterns used in existing Magento 2 commands (BuildCommand, CheckCommand, etc.).