From 0b3eebf7d031fae4204b1eff06b27d6743b01260 Mon Sep 17 00:00:00 2001
From: araharah-executor <executor@araharah.local>
Date: Thu, 22 Oct 2026 08:28:43 +0800
Subject: [PATCH] =?UTF-8?q?feat(01-04):=20audit=20inline=20style=20attribu?=
 =?UTF-8?q?tes=20=E2=80=94=20close=20D-13=20evasion=20path=20(GREEN)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- implementation pages' style="…" attributes are rendered CSS: every
  declaration checked like <style>-block CSS, violations reported as
  file:line: style attribute { prop: value }
- token-var references pass by construction; only off-token literals flag
- 16/16 audit tests green; real build still AUDIT CLEAN
---
 theme/scripts/audit.mjs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/theme/scripts/audit.mjs b/theme/scripts/audit.mjs
index bbfe066..c90cb47 100644
--- a/theme/scripts/audit.mjs
+++ b/theme/scripts/audit.mjs
@@ -521,6 +521,22 @@ for (const p of pages) {
     const contentOffset = m.index + m[0].indexOf('>') + 1;
     pageStyleInputs.push({ text: m[1], display: `${displayPath(abs)} <style>`, baseOffset: contentOffset, lineText: text });
   }
+  /* Inline style="…" attributes are rendered CSS too — audited so no
+   * declaration path around the <style>-block scan exists. */
+  for (const m of text.matchAll(/\bstyle\s*=\s*"([^"]*)"|\bstyle\s*=\s*'([^']*)'/g)) {
+    const attr = m[1] ?? m[2] ?? '';
+    const attrOffset = m.index + m[0].indexOf(attr);
+    for (const d of declarations(attr)) {
+      const decl = splitDecl(d.text);
+      if (!decl) continue;
+      state.totals.decls++;
+      for (const reason of checkDeclaration(decl.prop, decl.value, state.tokens)) {
+        state.violations.push(
+          `${displayPath(abs)}:${lineAt(text, attrOffset + d.offset)}: style attribute { ${decl.prop}: ${decl.value} } — ${reason}`,
+        );
+      }
+    }
+  }
 }
 
 /* CSS file inputs. */