@sorb/leaf 0.1.1 → 0.2.1

package/README.md

@@ -41,6 +41,32 @@ properties on `:root`, and polls for live updates. If the server isn't
 running it falls back silently to the committed tokens — preview never
 breaks production.
 
+## Security
+
+Sorb injects externally-authored token values into your running app, so the
+SDK treats every value and preview origin as untrusted input.
+
+- **Value sanitization.** Every token value is validated before it is written
+  to `:root`. Values containing `url(...)`, `image-set(...)`, `expression(...)`,
+  `@import`, `javascript:`, raw `;`/`{`/`}`, or any non-allowlisted CSS function
+  are **skipped** (the rest still apply). This neutralizes CSS-exfil and
+  defacement via a hostile token. The check is exported as `sanitizeCssValue`.
+- **Preview is off by default and origin-allowlisted.** `?preview=` is honored
+  only when `preview.enabled === true` **and** the resolved `preview.origin` is
+  localhost / `127.0.0.1` / `[::1]` (any port) or is listed in
+  `preview.allowedOrigins`. A stray `?preview=` on a production deploy against an
+  untrusted bridge is ignored. **Never enable preview in production against an
+  untrusted bridge origin.**
+
+```jsx
+preview: {
+  enabled: import.meta.env.MODE !== 'production',
+  origin: 'http://localhost:7777',
+  // optional: trust an additional exact origin (e.g. a staging bridge)
+  allowedOrigins: ['https://staging-bridge.example.com'],
+}
+```
+
 ## Hooks
 
 ```jsx

package/dist/index.js

@@ -31,10 +31,12 @@ var src_exports = {};
 __export(src_exports, {
   PreviewBanner: () => PreviewBanner,
   SorbProvider: () => SorbProvider,
+  sanitizeCssValue: () => sanitizeCssValue,
   useIsPreview: () => useIsPreview,
   usePreviewState: () => usePreviewState,
   useToken: () => useToken,
-  useTokens: () => useTokens
+  useTokens: () => useTokens,
+  verifyResolved: () => verifyResolved
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -52,16 +54,147 @@ var useTokenContext = () => {
   return ctx;
 };
 
+// src/sanitize.js
+var ALLOWED_FUNCTIONS = /* @__PURE__ */ new Set([
+  "rgb",
+  "rgba",
+  "hsl",
+  "hsla",
+  "hwb",
+  "lab",
+  "lch",
+  "oklab",
+  "oklch",
+  "color",
+  "calc",
+  "min",
+  "max",
+  "clamp",
+  "var",
+  "env"
+]);
+var FUNCTION_CALL = /([a-zA-Z_-][\w-]*)\s*\(/g;
+var CONTROL_CHARS = /[\x00-\x1f]/;
+var CONTEXT_BREAK = /[{};]/;
+var sanitizeCssValue = (value) => {
+  if (typeof value !== "string") {
+    return { ok: false, value: "", reason: "not-a-string" };
+  }
+  const raw = value;
+  if (raw.length === 0) {
+    return { ok: false, value: "", reason: "empty" };
+  }
+  if (CONTROL_CHARS.test(raw)) {
+    return { ok: false, value: raw, reason: "control-char" };
+  }
+  if (CONTEXT_BREAK.test(raw)) {
+    return { ok: false, value: raw, reason: "context-break-char" };
+  }
+  const lower = raw.toLowerCase();
+  const collapsed = lower.replace(/\s+/g, "");
+  if (collapsed.includes("@import")) {
+    return { ok: false, value: raw, reason: "at-import" };
+  }
+  if (collapsed.includes("javascript:")) {
+    return { ok: false, value: raw, reason: "javascript-scheme" };
+  }
+  if (collapsed.includes("</")) {
+    return { ok: false, value: raw, reason: "markup-break" };
+  }
+  FUNCTION_CALL.lastIndex = 0;
+  let match;
+  while ((match = FUNCTION_CALL.exec(raw)) !== null) {
+    const name = match[1].toLowerCase();
+    if (!ALLOWED_FUNCTIONS.has(name)) {
+      return { ok: false, value: raw, reason: `disallowed-function:${name}` };
+    }
+  }
+  return { ok: true, value: raw };
+};
+
 // src/apply.js
+var warnRejected = (key, reason) => {
+  try {
+    if (typeof process !== "undefined" && process.env && true) {
+      console.warn(
+        `[sorb] skipped token "--${key}": value failed CSS sanitization` + (reason ? ` (${reason})` : "")
+      );
+    }
+  } catch (e) {
+  }
+};
 var applyTokens = (tokens) => {
   const root = document.documentElement;
   Object.entries(tokens).forEach(([key, value]) => {
-    root.style.setProperty(`--${key}`, String(value));
+    const result = sanitizeCssValue(String(value));
+    if (!result.ok) {
+      warnRejected(key, result.reason);
+      return;
+    }
+    root.style.setProperty(`--${key}`, result.value);
   });
 };
 
+// src/previewGuard.js
+var DEFAULT_ORIGIN = "http://localhost:7777";
+var isLocalhostOrigin = (origin) => {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch (e) {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+};
+var toOrigin = (value) => {
+  try {
+    return new URL(value).origin;
+  } catch (e) {
+    return null;
+  }
+};
+var shouldLoadPreview = (config) => {
+  const preview = config && config.preview;
+  if (!preview || preview.enabled !== true) {
+    return { allowed: false, origin: null, reason: "preview-disabled" };
+  }
+  const origin = preview.origin ?? DEFAULT_ORIGIN;
+  const normalized = toOrigin(origin);
+  if (!normalized) {
+    return { allowed: false, origin: null, reason: "malformed-origin" };
+  }
+  if (isLocalhostOrigin(origin)) {
+    return { allowed: true, origin };
+  }
+  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : [];
+  const allowed = extra.some((entry) => toOrigin(entry) === normalized);
+  if (allowed) {
+    return { allowed: true, origin };
+  }
+  return { allowed: false, origin, reason: "origin-not-allowlisted" };
+};
+
+// src/bridgeAuth.js
+var bridgeHeaders = (key, base) => {
+  const headers = base ? { ...base } : {};
+  if (typeof key === "string" && key.trim() !== "") {
+    headers.Authorization = `Bearer ${key.trim()}`;
+  }
+  return headers;
+};
+
 // src/TokenProvider.jsx
 var import_jsx_runtime = require("react/jsx-runtime");
+var devWarn = (msg) => {
+  try {
+    if (typeof process !== "undefined" && process.env && true) {
+      console.warn(`[sorb] ${msg}`);
+    }
+  } catch (e) {
+  }
+};
 var SorbProvider = ({ config, children }) => {
   const [activeTokens, setActiveTokens] = (0, import_react2.useState)(config.tokens);
   const [isPreview, setIsPreview] = (0, import_react2.useState)(false);
@@ -75,9 +208,16 @@ var SorbProvider = ({ config, children }) => {
   }, [config.tokens]);
   const loadPreview = (0, import_react2.useCallback)(
     async (id) => {
-      const origin = config.preview?.origin ?? "http://localhost:7777";
+      const guard = shouldLoadPreview(config);
+      if (!guard.allowed) {
+        loadCommitted();
+        return false;
+      }
+      const origin = guard.origin;
       try {
-        const res = await fetch(`${origin}/preview/${id}`);
+        const res = await fetch(`${origin}/preview/${id}`, {
+          headers: bridgeHeaders(config.preview?.key)
+        });
         if (!res.ok) throw new Error("preview not found");
         const tokens = await res.json();
         applyTokens(tokens);
@@ -85,12 +225,12 @@ var SorbProvider = ({ config, children }) => {
         setIsPreview(true);
         setPreviewId(id);
         return true;
-      } catch {
+      } catch (e) {
         loadCommitted();
         return false;
       }
     },
-    [config.preview?.origin, loadCommitted]
+    [config, loadCommitted]
   );
   const clearPreview = (0, import_react2.useCallback)(() => {
     if (pollRef.current) clearInterval(pollRef.current);
@@ -101,9 +241,14 @@ var SorbProvider = ({ config, children }) => {
     loadCommitted();
   }, [loadCommitted]);
   (0, import_react2.useEffect)(() => {
-    const previewEnabled = config.preview?.enabled ?? false;
+    const guard = shouldLoadPreview(config);
     const id = new URLSearchParams(location.search).get("preview");
-    if (!previewEnabled || !id) {
+    if (!guard.allowed || !id) {
+      if (id && !guard.allowed) {
+        devWarn(
+          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? "blocked"}); loading committed tokens`
+        );
+      }
       loadCommitted();
       return;
     }
@@ -214,4 +359,49 @@ var PreviewBanner = () => {
     }
   );
 };
+
+// src/verify.js
+var toCssVar = (name) => {
+  const s = String(name).trim();
+  return s.startsWith("--") ? s : `--${s}`;
+};
+var verifyResolved = async (tokens, { origin = "http://localhost:7777", key, fetch: fetchImpl } = {}) => {
+  if (typeof document === "undefined" || !document.documentElement) {
+    return { ok: false, reason: "no-dom" };
+  }
+  if (!Array.isArray(tokens) || tokens.length === 0) {
+    return { ok: false, reason: "no-tokens" };
+  }
+  const cs = getComputedStyle(document.documentElement);
+  const values = {};
+  for (const t of tokens) {
+    const cssVar = toCssVar(t);
+    values[cssVar] = cs.getPropertyValue(cssVar).trim();
+  }
+  const unapplied = Object.entries(values).filter(([, v]) => v.startsWith("var(")).map(([k]) => k);
+  if (unapplied.length) return { ok: false, reason: "provider-not-applied", unapplied };
+  const f = fetchImpl || (typeof fetch !== "undefined" ? fetch : globalThis.fetch);
+  if (typeof f !== "function") return { ok: false, reason: "no-fetch" };
+  const base = String(origin).replace(/\/+$/, "");
+  try {
+    const res = await f(`${base}/verify/app`, {
+      method: "POST",
+      // Hosted bridge needs the bearer key; localhost (no key) sends no header.
+      headers: bridgeHeaders(key, { "Content-Type": "application/json" }),
+      body: JSON.stringify({ values })
+    });
+    if (!res.ok) {
+      let detail = "";
+      try {
+        const b = await res.json();
+        detail = b && b.error ? b.error : "";
+      } catch (e) {
+      }
+      return { ok: false, reason: "bridge-error", error: `${res.status}${detail ? ` \u2014 ${detail}` : ""}` };
+    }
+    return await res.json();
+  } catch (e) {
+    return { ok: false, reason: "bridge-unreachable", error: e && e.message };
+  }
+};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/index.js", "../src/TokenProvider.jsx", "../src/context.js", "../src/apply.js", "../src/PreviewBanner.jsx", "../src/hooks.js"],
-  "sourcesContent": ["export { SorbProvider } from './TokenProvider'\nexport { PreviewBanner } from './PreviewBanner'\nexport { useTokens, useToken, useIsPreview, usePreviewState } from './hooks'\n", "import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      const origin = config.preview?.origin ?? 'http://localhost:7777'\n      try {\n        const res = await fetch(`${origin}/preview/${id}`)\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        loadCommitted()\n        return false\n      }\n    },\n    [config.preview?.origin, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const previewEnabled = config.preview?.enabled ?? false\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // bail out immediately if preview is disabled or no param present\n    if (!previewEnabled || !id) {\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    root.style.setProperty(`--${key}`, String(value))\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgE;;;ACAhE,mBAA0C;AAGnC,IAAM,mBAAe,4BAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,UAAM,yBAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACLO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC;AAAA,EAClD,CAAC;AACH;;;AFkEI;AAvEG,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,QAAI,wBAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,cAAU,sBAAO,IAAI;AAG3B,QAAM,oBAAgB,2BAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,kBAAc;AAAA,IAClB,OAAO,OAAO;AACZ,YAAM,SAAS,OAAO,SAAS,UAAU;AACzC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,EAAE;AACjD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,QAAQ;AAGN,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,OAAO,SAAS,QAAQ,aAAa;AAAA,EACxC;AAGA,QAAM,mBAAe,2BAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,+BAAU,MAAM;AACd,UAAM,iBAAiB,OAAO,SAAS,WAAW;AAClD,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAG7D,QAAI,CAAC,kBAAkB,CAAC,IAAI;AAC1B,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,4CAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AGlFA,IAAAC,gBAAkB;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,IAAAC,sBAAA;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,sDAAC,UACC;AAAA,uDAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,6CAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;",
+  "sources": ["../src/index.js", "../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/bridgeAuth.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
+  "sourcesContent": ["export { SorbProvider } from './TokenProvider'\nexport { PreviewBanner } from './PreviewBanner'\nexport { useTokens, useToken, useIsPreview, usePreviewState } from './hooks'\nexport { sanitizeCssValue } from './sanitize'\nexport { verifyResolved } from './verify'\n", "import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\nimport { bridgeHeaders } from './bridgeAuth'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        // Hosted bridge needs `Authorization: Bearer <config.preview.key>`;\n        // when no key is configured (localhost `sorb dev`) NO header is sent\n        // and this call is unchanged.\n        const res = await fetch(`${origin}/preview/${id}`, {\n          headers: bridgeHeaders(config.preview?.key),\n        })\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "// bridgeAuth.js \u2014 hosted-bridge Authorization header (Plugin-UX U4).\n//\n// Sorb's hosted bridge (https://bridge.sorbcloud.com) requires\n// `Authorization: Bearer <key>` on every route except /health. The key is a\n// read-only publishable `sorb_pk_\u2026` (safe to ship in a distributable; 403s on\n// writes). Local `sorb dev` runs with NO auth, so when no key is configured we\n// send NO header and the localhost path is byte-for-byte unchanged.\n//\n// One place builds the header so both fetch sites (TokenProvider preview poll +\n// verify.js) stay consistent. Pure + node:test-able; no DOM, no fetch.\n\n/**\n * Build the request headers for a hosted-bridge call, merging in the bearer\n * `Authorization` header only when a non-empty key is configured.\n *\n * @param {string} [key]   The configured bearer key (`config.preview.key`), if any.\n * @param {Record<string,string>} [base]   Base headers to extend (e.g. Content-Type).\n * @returns {Record<string,string>}\n */\nexport const bridgeHeaders = (key, base) => {\n  const headers = base ? { ...base } : {}\n  if (typeof key === 'string' && key.trim() !== '') {\n    headers.Authorization = `Bearer ${key.trim()}`\n  }\n  return headers\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\nimport { bridgeHeaders } from './bridgeAuth.js'\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, key?: string, fetch?: typeof globalThis.fetch }} [opts]\n *   `key` is the hosted-bridge bearer key (`config.preview.key`). Omit for the\n *   no-auth localhost bridge \u2014 no `Authorization` header is then sent.\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', key, fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      // Hosted bridge needs the bearer key; localhost (no key) sends no header.\n      headers: bridgeHeaders(key, { 'Content-Type': 'application/json' }),\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgE;;;ACAhE,mBAA0C;AAGnC,IAAM,mBAAe,4BAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,UAAM,yBAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AClEO,IAAM,gBAAgB,CAAC,KAAK,SAAS;AAC1C,QAAM,UAAU,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;AACtC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,YAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;AL6FI;AA3GJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,QAAI,wBAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,cAAU,sBAAO,IAAI;AAG3B,QAAM,oBAAgB,2BAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,kBAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AAIF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,IAAI;AAAA,UACjD,SAAS,cAAc,OAAO,SAAS,GAAG;AAAA,QAC5C,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,mBAAe,2BAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,+BAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,4CAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AM1HA,IAAAC,gBAAkB;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,IAAAC,sBAAA;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,sDAAC,UACC;AAAA,uDAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,6CAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEvEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAiBO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM;AAChH,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA;AAAA,MAER,SAAS,cAAc,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MAClE,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
   "names": ["import_react", "import_react", "import_jsx_runtime"]
 }

package/dist/index.mjs

@@ -12,16 +12,147 @@ var useTokenContext = () => {
   return ctx;
 };
 
+// src/sanitize.js
+var ALLOWED_FUNCTIONS = /* @__PURE__ */ new Set([
+  "rgb",
+  "rgba",
+  "hsl",
+  "hsla",
+  "hwb",
+  "lab",
+  "lch",
+  "oklab",
+  "oklch",
+  "color",
+  "calc",
+  "min",
+  "max",
+  "clamp",
+  "var",
+  "env"
+]);
+var FUNCTION_CALL = /([a-zA-Z_-][\w-]*)\s*\(/g;
+var CONTROL_CHARS = /[\x00-\x1f]/;
+var CONTEXT_BREAK = /[{};]/;
+var sanitizeCssValue = (value) => {
+  if (typeof value !== "string") {
+    return { ok: false, value: "", reason: "not-a-string" };
+  }
+  const raw = value;
+  if (raw.length === 0) {
+    return { ok: false, value: "", reason: "empty" };
+  }
+  if (CONTROL_CHARS.test(raw)) {
+    return { ok: false, value: raw, reason: "control-char" };
+  }
+  if (CONTEXT_BREAK.test(raw)) {
+    return { ok: false, value: raw, reason: "context-break-char" };
+  }
+  const lower = raw.toLowerCase();
+  const collapsed = lower.replace(/\s+/g, "");
+  if (collapsed.includes("@import")) {
+    return { ok: false, value: raw, reason: "at-import" };
+  }
+  if (collapsed.includes("javascript:")) {
+    return { ok: false, value: raw, reason: "javascript-scheme" };
+  }
+  if (collapsed.includes("</")) {
+    return { ok: false, value: raw, reason: "markup-break" };
+  }
+  FUNCTION_CALL.lastIndex = 0;
+  let match;
+  while ((match = FUNCTION_CALL.exec(raw)) !== null) {
+    const name = match[1].toLowerCase();
+    if (!ALLOWED_FUNCTIONS.has(name)) {
+      return { ok: false, value: raw, reason: `disallowed-function:${name}` };
+    }
+  }
+  return { ok: true, value: raw };
+};
+
 // src/apply.js
+var warnRejected = (key, reason) => {
+  try {
+    if (typeof process !== "undefined" && process.env && true) {
+      console.warn(
+        `[sorb] skipped token "--${key}": value failed CSS sanitization` + (reason ? ` (${reason})` : "")
+      );
+    }
+  } catch (e) {
+  }
+};
 var applyTokens = (tokens) => {
   const root = document.documentElement;
   Object.entries(tokens).forEach(([key, value]) => {
-    root.style.setProperty(`--${key}`, String(value));
+    const result = sanitizeCssValue(String(value));
+    if (!result.ok) {
+      warnRejected(key, result.reason);
+      return;
+    }
+    root.style.setProperty(`--${key}`, result.value);
   });
 };
 
+// src/previewGuard.js
+var DEFAULT_ORIGIN = "http://localhost:7777";
+var isLocalhostOrigin = (origin) => {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch (e) {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+};
+var toOrigin = (value) => {
+  try {
+    return new URL(value).origin;
+  } catch (e) {
+    return null;
+  }
+};
+var shouldLoadPreview = (config) => {
+  const preview = config && config.preview;
+  if (!preview || preview.enabled !== true) {
+    return { allowed: false, origin: null, reason: "preview-disabled" };
+  }
+  const origin = preview.origin ?? DEFAULT_ORIGIN;
+  const normalized = toOrigin(origin);
+  if (!normalized) {
+    return { allowed: false, origin: null, reason: "malformed-origin" };
+  }
+  if (isLocalhostOrigin(origin)) {
+    return { allowed: true, origin };
+  }
+  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : [];
+  const allowed = extra.some((entry) => toOrigin(entry) === normalized);
+  if (allowed) {
+    return { allowed: true, origin };
+  }
+  return { allowed: false, origin, reason: "origin-not-allowlisted" };
+};
+
+// src/bridgeAuth.js
+var bridgeHeaders = (key, base) => {
+  const headers = base ? { ...base } : {};
+  if (typeof key === "string" && key.trim() !== "") {
+    headers.Authorization = `Bearer ${key.trim()}`;
+  }
+  return headers;
+};
+
 // src/TokenProvider.jsx
 import { jsx } from "react/jsx-runtime";
+var devWarn = (msg) => {
+  try {
+    if (typeof process !== "undefined" && process.env && true) {
+      console.warn(`[sorb] ${msg}`);
+    }
+  } catch (e) {
+  }
+};
 var SorbProvider = ({ config, children }) => {
   const [activeTokens, setActiveTokens] = useState(config.tokens);
   const [isPreview, setIsPreview] = useState(false);
@@ -35,9 +166,16 @@ var SorbProvider = ({ config, children }) => {
   }, [config.tokens]);
   const loadPreview = useCallback(
     async (id) => {
-      const origin = config.preview?.origin ?? "http://localhost:7777";
+      const guard = shouldLoadPreview(config);
+      if (!guard.allowed) {
+        loadCommitted();
+        return false;
+      }
+      const origin = guard.origin;
       try {
-        const res = await fetch(`${origin}/preview/${id}`);
+        const res = await fetch(`${origin}/preview/${id}`, {
+          headers: bridgeHeaders(config.preview?.key)
+        });
         if (!res.ok) throw new Error("preview not found");
         const tokens = await res.json();
         applyTokens(tokens);
@@ -45,12 +183,12 @@ var SorbProvider = ({ config, children }) => {
         setIsPreview(true);
         setPreviewId(id);
         return true;
-      } catch {
+      } catch (e) {
         loadCommitted();
         return false;
       }
     },
-    [config.preview?.origin, loadCommitted]
+    [config, loadCommitted]
   );
   const clearPreview = useCallback(() => {
     if (pollRef.current) clearInterval(pollRef.current);
@@ -61,9 +199,14 @@ var SorbProvider = ({ config, children }) => {
     loadCommitted();
   }, [loadCommitted]);
   useEffect(() => {
-    const previewEnabled = config.preview?.enabled ?? false;
+    const guard = shouldLoadPreview(config);
     const id = new URLSearchParams(location.search).get("preview");
-    if (!previewEnabled || !id) {
+    if (!guard.allowed || !id) {
+      if (id && !guard.allowed) {
+        devWarn(
+          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? "blocked"}); loading committed tokens`
+        );
+      }
       loadCommitted();
       return;
     }
@@ -174,12 +317,59 @@ var PreviewBanner = () => {
     }
   );
 };
+
+// src/verify.js
+var toCssVar = (name) => {
+  const s = String(name).trim();
+  return s.startsWith("--") ? s : `--${s}`;
+};
+var verifyResolved = async (tokens, { origin = "http://localhost:7777", key, fetch: fetchImpl } = {}) => {
+  if (typeof document === "undefined" || !document.documentElement) {
+    return { ok: false, reason: "no-dom" };
+  }
+  if (!Array.isArray(tokens) || tokens.length === 0) {
+    return { ok: false, reason: "no-tokens" };
+  }
+  const cs = getComputedStyle(document.documentElement);
+  const values = {};
+  for (const t of tokens) {
+    const cssVar = toCssVar(t);
+    values[cssVar] = cs.getPropertyValue(cssVar).trim();
+  }
+  const unapplied = Object.entries(values).filter(([, v]) => v.startsWith("var(")).map(([k]) => k);
+  if (unapplied.length) return { ok: false, reason: "provider-not-applied", unapplied };
+  const f = fetchImpl || (typeof fetch !== "undefined" ? fetch : globalThis.fetch);
+  if (typeof f !== "function") return { ok: false, reason: "no-fetch" };
+  const base = String(origin).replace(/\/+$/, "");
+  try {
+    const res = await f(`${base}/verify/app`, {
+      method: "POST",
+      // Hosted bridge needs the bearer key; localhost (no key) sends no header.
+      headers: bridgeHeaders(key, { "Content-Type": "application/json" }),
+      body: JSON.stringify({ values })
+    });
+    if (!res.ok) {
+      let detail = "";
+      try {
+        const b = await res.json();
+        detail = b && b.error ? b.error : "";
+      } catch (e) {
+      }
+      return { ok: false, reason: "bridge-error", error: `${res.status}${detail ? ` \u2014 ${detail}` : ""}` };
+    }
+    return await res.json();
+  } catch (e) {
+    return { ok: false, reason: "bridge-unreachable", error: e && e.message };
+  }
+};
 export {
   PreviewBanner,
   SorbProvider,
+  sanitizeCssValue,
   useIsPreview,
   usePreviewState,
   useToken,
-  useTokens
+  useTokens,
+  verifyResolved
 };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/TokenProvider.jsx", "../src/context.js", "../src/apply.js", "../src/PreviewBanner.jsx", "../src/hooks.js"],
-  "sourcesContent": ["import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      const origin = config.preview?.origin ?? 'http://localhost:7777'\n      try {\n        const res = await fetch(`${origin}/preview/${id}`)\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        loadCommitted()\n        return false\n      }\n    },\n    [config.preview?.origin, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const previewEnabled = config.preview?.enabled ?? false\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // bail out immediately if preview is disabled or no param present\n    if (!previewEnabled || !id) {\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    root.style.setProperty(`--${key}`, String(value))\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n"],
-  "mappings": ";AAAA,OAAO,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;ACAhE,SAAS,eAAe,kBAAkB;AAGnC,IAAM,eAAe,cAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,MAAM,WAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACLO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC;AAAA,EAClD,CAAC;AACH;;;AFkEI;AAvEG,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,UAAU,OAAO,IAAI;AAG3B,QAAM,gBAAgB,YAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,cAAc;AAAA,IAClB,OAAO,OAAO;AACZ,YAAM,SAAS,OAAO,SAAS,UAAU;AACzC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,EAAE;AACjD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,QAAQ;AAGN,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,OAAO,SAAS,QAAQ,aAAa;AAAA,EACxC;AAGA,QAAM,eAAe,YAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,YAAU,MAAM;AACd,UAAM,iBAAiB,OAAO,SAAS,WAAW;AAClD,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAG7D,QAAI,CAAC,kBAAkB,CAAC,IAAI;AAC1B,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AGlFA,OAAOA,YAAW;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,SACE,OAAAC,MADF;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,6BAAC,UACC;AAAA,0BAAAA,KAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC,gBAAAA;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,gBAAAA,KAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA,gBAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;",
+  "sources": ["../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/bridgeAuth.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
+  "sourcesContent": ["import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\nimport { bridgeHeaders } from './bridgeAuth'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        // Hosted bridge needs `Authorization: Bearer <config.preview.key>`;\n        // when no key is configured (localhost `sorb dev`) NO header is sent\n        // and this call is unchanged.\n        const res = await fetch(`${origin}/preview/${id}`, {\n          headers: bridgeHeaders(config.preview?.key),\n        })\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "// bridgeAuth.js \u2014 hosted-bridge Authorization header (Plugin-UX U4).\n//\n// Sorb's hosted bridge (https://bridge.sorbcloud.com) requires\n// `Authorization: Bearer <key>` on every route except /health. The key is a\n// read-only publishable `sorb_pk_\u2026` (safe to ship in a distributable; 403s on\n// writes). Local `sorb dev` runs with NO auth, so when no key is configured we\n// send NO header and the localhost path is byte-for-byte unchanged.\n//\n// One place builds the header so both fetch sites (TokenProvider preview poll +\n// verify.js) stay consistent. Pure + node:test-able; no DOM, no fetch.\n\n/**\n * Build the request headers for a hosted-bridge call, merging in the bearer\n * `Authorization` header only when a non-empty key is configured.\n *\n * @param {string} [key]   The configured bearer key (`config.preview.key`), if any.\n * @param {Record<string,string>} [base]   Base headers to extend (e.g. Content-Type).\n * @returns {Record<string,string>}\n */\nexport const bridgeHeaders = (key, base) => {\n  const headers = base ? { ...base } : {}\n  if (typeof key === 'string' && key.trim() !== '') {\n    headers.Authorization = `Bearer ${key.trim()}`\n  }\n  return headers\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\nimport { bridgeHeaders } from './bridgeAuth.js'\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, key?: string, fetch?: typeof globalThis.fetch }} [opts]\n *   `key` is the hosted-bridge bearer key (`config.preview.key`). Omit for the\n *   no-auth localhost bridge \u2014 no `Authorization` header is then sent.\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', key, fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      // Hosted bridge needs the bearer key; localhost (no key) sends no header.\n      headers: bridgeHeaders(key, { 'Content-Type': 'application/json' }),\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
+  "mappings": ";AAAA,OAAO,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;ACAhE,SAAS,eAAe,kBAAkB;AAGnC,IAAM,eAAe,cAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,MAAM,WAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AClEO,IAAM,gBAAgB,CAAC,KAAK,SAAS;AAC1C,QAAM,UAAU,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;AACtC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,YAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;AL6FI;AA3GJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,UAAU,OAAO,IAAI;AAG3B,QAAM,gBAAgB,YAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,cAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AAIF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,IAAI;AAAA,UACjD,SAAS,cAAc,OAAO,SAAS,GAAG;AAAA,QAC5C,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,eAAe,YAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,YAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AM1HA,OAAOA,YAAW;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,SACE,OAAAC,MADF;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,6BAAC,UACC;AAAA,0BAAAA,KAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC,gBAAAA;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,gBAAAA,KAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA,gBAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEvEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAiBO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM;AAChH,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA;AAAA,MAER,SAAS,cAAc,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MAClE,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
   "names": ["React", "jsx"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorb/leaf",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "React provider for Sorb design tokens — the foliage rendered in your running app",
   "license": "MIT",
   "keywords": [
@@ -33,6 +33,7 @@
   "sideEffects": false,
   "scripts": {
     "build": "node build.mjs",
+    "test": "node --test",
     "dev": "node build.mjs --watch",
     "prepublishOnly": "node build.mjs"
   },