@sorb/leaf 0.2.0 → 0.2.1

package/dist/index.js

@@ -176,6 +176,15 @@ var shouldLoadPreview = (config) => {
   return { allowed: false, origin, reason: "origin-not-allowlisted" };
 };
 
+// src/bridgeAuth.js
+var bridgeHeaders = (key, base) => {
+  const headers = base ? { ...base } : {};
+  if (typeof key === "string" && key.trim() !== "") {
+    headers.Authorization = `Bearer ${key.trim()}`;
+  }
+  return headers;
+};
+
 // src/TokenProvider.jsx
 var import_jsx_runtime = require("react/jsx-runtime");
 var devWarn = (msg) => {
@@ -206,7 +215,9 @@ var SorbProvider = ({ config, children }) => {
       }
       const origin = guard.origin;
       try {
-        const res = await fetch(`${origin}/preview/${id}`);
+        const res = await fetch(`${origin}/preview/${id}`, {
+          headers: bridgeHeaders(config.preview?.key)
+        });
         if (!res.ok) throw new Error("preview not found");
         const tokens = await res.json();
         applyTokens(tokens);
@@ -354,7 +365,7 @@ var toCssVar = (name) => {
   const s = String(name).trim();
   return s.startsWith("--") ? s : `--${s}`;
 };
-var verifyResolved = async (tokens, { origin = "http://localhost:7777", fetch: fetchImpl } = {}) => {
+var verifyResolved = async (tokens, { origin = "http://localhost:7777", key, fetch: fetchImpl } = {}) => {
   if (typeof document === "undefined" || !document.documentElement) {
     return { ok: false, reason: "no-dom" };
   }
@@ -375,7 +386,8 @@ var verifyResolved = async (tokens, { origin = "http://localhost:7777", fetch: f
   try {
     const res = await f(`${base}/verify/app`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      // Hosted bridge needs the bearer key; localhost (no key) sends no header.
+      headers: bridgeHeaders(key, { "Content-Type": "application/json" }),
       body: JSON.stringify({ values })
     });
     if (!res.ok) {

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/index.js", "../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
-  "sourcesContent": ["export { SorbProvider } from './TokenProvider'\nexport { PreviewBanner } from './PreviewBanner'\nexport { useTokens, useToken, useIsPreview, usePreviewState } from './hooks'\nexport { sanitizeCssValue } from './sanitize'\nexport { verifyResolved } from './verify'\n", "import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        const res = await fetch(`${origin}/preview/${id}`)\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, fetch?: typeof globalThis.fetch }} [opts]\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgE;;;ACAhE,mBAA0C;AAGnC,IAAM,mBAAe,4BAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,UAAM,yBAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AJ2BI;AAtGJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,QAAI,wBAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,cAAU,sBAAO,IAAI;AAG3B,QAAM,oBAAgB,2BAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,kBAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,EAAE;AACjD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,mBAAe,2BAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,+BAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,4CAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AKpHA,IAAAC,gBAAkB;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,IAAAC,sBAAA;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,sDAAC,UACC;AAAA,uDAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,6CAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEzEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAeO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,OAAO,UAAU,IAAI,CAAC,MAAM;AAC3G,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
+  "sources": ["../src/index.js", "../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/bridgeAuth.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
+  "sourcesContent": ["export { SorbProvider } from './TokenProvider'\nexport { PreviewBanner } from './PreviewBanner'\nexport { useTokens, useToken, useIsPreview, usePreviewState } from './hooks'\nexport { sanitizeCssValue } from './sanitize'\nexport { verifyResolved } from './verify'\n", "import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\nimport { bridgeHeaders } from './bridgeAuth'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        // Hosted bridge needs `Authorization: Bearer <config.preview.key>`;\n        // when no key is configured (localhost `sorb dev`) NO header is sent\n        // and this call is unchanged.\n        const res = await fetch(`${origin}/preview/${id}`, {\n          headers: bridgeHeaders(config.preview?.key),\n        })\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "// bridgeAuth.js \u2014 hosted-bridge Authorization header (Plugin-UX U4).\n//\n// Sorb's hosted bridge (https://bridge.sorbcloud.com) requires\n// `Authorization: Bearer <key>` on every route except /health. The key is a\n// read-only publishable `sorb_pk_\u2026` (safe to ship in a distributable; 403s on\n// writes). Local `sorb dev` runs with NO auth, so when no key is configured we\n// send NO header and the localhost path is byte-for-byte unchanged.\n//\n// One place builds the header so both fetch sites (TokenProvider preview poll +\n// verify.js) stay consistent. Pure + node:test-able; no DOM, no fetch.\n\n/**\n * Build the request headers for a hosted-bridge call, merging in the bearer\n * `Authorization` header only when a non-empty key is configured.\n *\n * @param {string} [key]   The configured bearer key (`config.preview.key`), if any.\n * @param {Record<string,string>} [base]   Base headers to extend (e.g. Content-Type).\n * @returns {Record<string,string>}\n */\nexport const bridgeHeaders = (key, base) => {\n  const headers = base ? { ...base } : {}\n  if (typeof key === 'string' && key.trim() !== '') {\n    headers.Authorization = `Bearer ${key.trim()}`\n  }\n  return headers\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\nimport { bridgeHeaders } from './bridgeAuth.js'\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, key?: string, fetch?: typeof globalThis.fetch }} [opts]\n *   `key` is the hosted-bridge bearer key (`config.preview.key`). Omit for the\n *   no-auth localhost bridge \u2014 no `Authorization` header is then sent.\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', key, fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      // Hosted bridge needs the bearer key; localhost (no key) sends no header.\n      headers: bridgeHeaders(key, { 'Content-Type': 'application/json' }),\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgE;;;ACAhE,mBAA0C;AAGnC,IAAM,mBAAe,4BAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,UAAM,yBAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AClEO,IAAM,gBAAgB,CAAC,KAAK,SAAS;AAC1C,QAAM,UAAU,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;AACtC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,YAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;AL6FI;AA3GJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,QAAI,wBAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,cAAU,sBAAO,IAAI;AAG3B,QAAM,oBAAgB,2BAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,kBAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AAIF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,IAAI;AAAA,UACjD,SAAS,cAAc,OAAO,SAAS,GAAG;AAAA,QAC5C,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,mBAAe,2BAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,+BAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,4CAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AM1HA,IAAAC,gBAAkB;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,IAAAC,sBAAA;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,sDAAC,UACC;AAAA,uDAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,6CAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEvEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAiBO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM;AAChH,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA;AAAA,MAER,SAAS,cAAc,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MAClE,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
   "names": ["import_react", "import_react", "import_jsx_runtime"]
 }

package/dist/index.mjs

@@ -134,6 +134,15 @@ var shouldLoadPreview = (config) => {
   return { allowed: false, origin, reason: "origin-not-allowlisted" };
 };
 
+// src/bridgeAuth.js
+var bridgeHeaders = (key, base) => {
+  const headers = base ? { ...base } : {};
+  if (typeof key === "string" && key.trim() !== "") {
+    headers.Authorization = `Bearer ${key.trim()}`;
+  }
+  return headers;
+};
+
 // src/TokenProvider.jsx
 import { jsx } from "react/jsx-runtime";
 var devWarn = (msg) => {
@@ -164,7 +173,9 @@ var SorbProvider = ({ config, children }) => {
       }
       const origin = guard.origin;
       try {
-        const res = await fetch(`${origin}/preview/${id}`);
+        const res = await fetch(`${origin}/preview/${id}`, {
+          headers: bridgeHeaders(config.preview?.key)
+        });
         if (!res.ok) throw new Error("preview not found");
         const tokens = await res.json();
         applyTokens(tokens);
@@ -312,7 +323,7 @@ var toCssVar = (name) => {
   const s = String(name).trim();
   return s.startsWith("--") ? s : `--${s}`;
 };
-var verifyResolved = async (tokens, { origin = "http://localhost:7777", fetch: fetchImpl } = {}) => {
+var verifyResolved = async (tokens, { origin = "http://localhost:7777", key, fetch: fetchImpl } = {}) => {
   if (typeof document === "undefined" || !document.documentElement) {
     return { ok: false, reason: "no-dom" };
   }
@@ -333,7 +344,8 @@ var verifyResolved = async (tokens, { origin = "http://localhost:7777", fetch: f
   try {
     const res = await f(`${base}/verify/app`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      // Hosted bridge needs the bearer key; localhost (no key) sends no header.
+      headers: bridgeHeaders(key, { "Content-Type": "application/json" }),
       body: JSON.stringify({ values })
     });
     if (!res.ok) {

package/dist/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
-  "sourcesContent": ["import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        const res = await fetch(`${origin}/preview/${id}`)\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, fetch?: typeof globalThis.fetch }} [opts]\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
-  "mappings": ";AAAA,OAAO,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;ACAhE,SAAS,eAAe,kBAAkB;AAGnC,IAAM,eAAe,cAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,MAAM,WAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AJ2BI;AAtGJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,UAAU,OAAO,IAAI;AAG3B,QAAM,gBAAgB,YAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,cAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,EAAE;AACjD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,eAAe,YAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,YAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AKpHA,OAAOA,YAAW;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,SACE,OAAAC,MADF;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,6BAAC,UACC;AAAA,0BAAAA,KAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC,gBAAAA;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,gBAAAA,KAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA,gBAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEzEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAeO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,OAAO,UAAU,IAAI,CAAC,MAAM;AAC3G,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
+  "sources": ["../src/TokenProvider.jsx", "../src/context.js", "../src/sanitize.js", "../src/apply.js", "../src/previewGuard.js", "../src/bridgeAuth.js", "../src/PreviewBanner.jsx", "../src/hooks.js", "../src/verify.js"],
+  "sourcesContent": ["import React, { useCallback, useEffect, useRef, useState } from 'react'\nimport { TokenContext } from './context'\nimport { applyTokens } from './apply'\nimport { shouldLoadPreview } from './previewGuard'\nimport { bridgeHeaders } from './bridgeAuth'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * @param {string} msg\n * @returns {void}\n */\nconst devWarn = (msg) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(`[sorb] ${msg}`)\n    }\n  } catch (e) {\n    void e\n  }\n}\n\n/**\n * @param {{ config: import('./types').SorbConfig, children: React.ReactNode }} props\n */\nexport const SorbProvider = ({ config, children }) => {\n  const [activeTokens, setActiveTokens] = useState(config.tokens)\n  const [isPreview, setIsPreview] = useState(false)\n  const [previewId, setPreviewId] = useState(null)\n  const pollRef = useRef(null)\n\n  // \u2500\u2500\u2500 committed token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadCommitted = useCallback(() => {\n    applyTokens(config.tokens)\n    setActiveTokens(config.tokens)\n    setIsPreview(false)\n    setPreviewId(null)\n  }, [config.tokens])\n\n  // \u2500\u2500\u2500 preview token loader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const loadPreview = useCallback(\n    async (id) => {\n      // Re-check the guard here too: loadPreview must never fetch an\n      // untrusted origin even if called directly. Use the guard-resolved\n      // origin, not the raw config, so the trust decision is single-sourced.\n      const guard = shouldLoadPreview(config)\n      if (!guard.allowed) {\n        loadCommitted()\n        return false\n      }\n      const origin = guard.origin\n      try {\n        // Hosted bridge needs `Authorization: Bearer <config.preview.key>`;\n        // when no key is configured (localhost `sorb dev`) NO header is sent\n        // and this call is unchanged.\n        const res = await fetch(`${origin}/preview/${id}`, {\n          headers: bridgeHeaders(config.preview?.key),\n        })\n        if (!res.ok) throw new Error('preview not found')\n        const tokens = await res.json()\n        applyTokens(tokens)\n        setActiveTokens(tokens)\n        setIsPreview(true)\n        setPreviewId(id)\n        return true\n      } catch (e) {\n        // local server not running, preview expired, or network error\n        // fall back silently \u2014 never break the app\n        void e\n        loadCommitted()\n        return false\n      }\n    },\n    [config, loadCommitted],\n  )\n\n  // \u2500\u2500\u2500 clear preview + remove query param \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const clearPreview = useCallback(() => {\n    if (pollRef.current) clearInterval(pollRef.current)\n    const params = new URLSearchParams(location.search)\n    params.delete('preview')\n    const qs = params.toString()\n    history.replaceState(null, '', qs ? `?${qs}` : location.pathname)\n    loadCommitted()\n  }, [loadCommitted])\n\n  // \u2500\u2500\u2500 initialise on mount \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  useEffect(() => {\n    const guard = shouldLoadPreview(config)\n    const id = new URLSearchParams(location.search).get('preview')\n\n    // Preview only runs when the origin-allowlist guard says so (C3). A stray\n    // `?preview=` on a production deploy against an untrusted origin is ignored\n    // \u2014 we load committed tokens and dev-warn instead.\n    if (!guard.allowed || !id) {\n      if (id && !guard.allowed) {\n        devWarn(\n          `ignoring ?preview= \u2014 preview not permitted (${guard.reason ?? 'blocked'}); ` +\n            'loading committed tokens',\n        )\n      }\n      loadCommitted()\n      return\n    }\n\n    // load the preview, then start polling so Figma changes reflect live\n    loadPreview(id).then((ok) => {\n      if (!ok) return\n      const interval = config.preview?.pollInterval ?? 1500\n      pollRef.current = setInterval(() => loadPreview(id), interval)\n    })\n\n    return () => {\n      if (pollRef.current) clearInterval(pollRef.current)\n    }\n  }, []) // intentionally empty \u2014 only runs on mount\n\n  return (\n    <TokenContext.Provider value={{ tokens: activeTokens, isPreview, previewId, clearPreview }}>\n      {children}\n    </TokenContext.Provider>\n  )\n}\n", "import { createContext, useContext } from 'react'\n\n/** @type {import('react').Context<import('./types').TokenContextValue | null>} */\nexport const TokenContext = createContext(null)\n\n/** @returns {import('./types').TokenContextValue} */\nexport const useTokenContext = () => {\n  const ctx = useContext(TokenContext)\n  if (!ctx) {\n    throw new Error('Sorb hooks must be used inside <SorbProvider>')\n  }\n  return ctx\n}\n", "/**\n * CSS token-value sanitizer \u2014 the C1 injection-boundary guard.\n *\n * Token values flow Figma \u2192 bridge \u2192 `applyTokens` \u2192 `setProperty`. Those values\n * are UNTRUSTED INPUT crossing a trust boundary. This is a pure string function\n * (no DOM) so it is fully node:test-able and reusable. Phase 2 will hoist it to\n * `@sorb/core`; do NOT add a DOM dependency here.\n *\n * Strategy: deny-by-default on the dangerous classes, then allowlist CSS\n * functions. A *valid* hostile value (a real `url(...)`) passes `setProperty`\n * unharmed, so we cannot rely on the browser \u2014 we reject it here.\n */\n\n/**\n * The only CSS functions we permit inside a token value. Anything else \u2014\n * `url(`, `image(`, `image-set(`, `-webkit-image-set(`, `cross-fade(`,\n * `expression(`, `paint(`, `element(`, `attr(`, \u2026 \u2014 is rejected.\n * @type {Set<string>}\n */\nconst ALLOWED_FUNCTIONS = new Set([\n  'rgb',\n  'rgba',\n  'hsl',\n  'hsla',\n  'hwb',\n  'lab',\n  'lch',\n  'oklab',\n  'oklch',\n  'color',\n  'calc',\n  'min',\n  'max',\n  'clamp',\n  'var',\n  'env',\n])\n\n// Matches an identifier immediately followed by '(' \u2014 i.e. a CSS function call.\n// Identifiers may start with one or two leading hyphens (vendor prefixes like\n// `-webkit-image-set`). The lookahead keeps the '(' out of the captured name.\nconst FUNCTION_CALL = /([a-zA-Z_-][\\w-]*)\\s*\\(/g\n\n// ASCII control chars (incl. NUL, newlines, tabs) \u2014 never legitimate in a\n// token value and a classic way to smuggle past naive filters.\n// eslint-disable-next-line no-control-regex\nconst CONTROL_CHARS = /[\\x00-\\x1f]/\n\n// CSS-context-break characters that let a value escape the custom-property\n// declaration: `;` ends the declaration, `{` / `}` open/close a block.\nconst CONTEXT_BREAK = /[{};]/\n\n/**\n * Validate an untrusted CSS token value before it is injected via\n * `setProperty`. Pure \u2014 does not touch the DOM.\n *\n * Rules (deny-by-default):\n *  - non-string / empty input is rejected.\n *  - reject ASCII control chars `\\x00-\\x1f`.\n *  - reject the context-break chars `{` `}` `;`.\n *  - reject (case-insensitive, whitespace-tolerant) `@import`, `javascript:`,\n *    and the markup-break `</`.\n *  - extract every `identifier(` and reject if ANY is not in the allowlist\n *    (this is what stops `url(`, `image-set(`, `expression(`, `paint(`, \u2026).\n *\n * @param {unknown} value\n * @returns {{ ok: boolean, value: string, reason?: string }}\n */\nexport const sanitizeCssValue = (value) => {\n  if (typeof value !== 'string') {\n    return { ok: false, value: '', reason: 'not-a-string' }\n  }\n\n  const raw = value\n  if (raw.length === 0) {\n    return { ok: false, value: '', reason: 'empty' }\n  }\n\n  if (CONTROL_CHARS.test(raw)) {\n    return { ok: false, value: raw, reason: 'control-char' }\n  }\n\n  if (CONTEXT_BREAK.test(raw)) {\n    return { ok: false, value: raw, reason: 'context-break-char' }\n  }\n\n  // Case-insensitive, whitespace-tolerant dangerous tokens. We strip ASCII\n  // whitespace before substring-matching so `@ import`, `java script:`,\n  // `< /script` style evasions are still caught.\n  const lower = raw.toLowerCase()\n  const collapsed = lower.replace(/\\s+/g, '')\n  if (collapsed.includes('@import')) {\n    return { ok: false, value: raw, reason: 'at-import' }\n  }\n  if (collapsed.includes('javascript:')) {\n    return { ok: false, value: raw, reason: 'javascript-scheme' }\n  }\n  if (collapsed.includes('</')) {\n    return { ok: false, value: raw, reason: 'markup-break' }\n  }\n\n  // Allowlist every function call in the value.\n  FUNCTION_CALL.lastIndex = 0\n  let match\n  while ((match = FUNCTION_CALL.exec(raw)) !== null) {\n    const name = match[1].toLowerCase()\n    if (!ALLOWED_FUNCTIONS.has(name)) {\n      return { ok: false, value: raw, reason: `disallowed-function:${name}` }\n    }\n  }\n\n  return { ok: true, value: raw }\n}\n", "import { sanitizeCssValue } from './sanitize.js'\n\n/**\n * Dev-only warning that never throws in a browser (no `process` global there).\n * Silent in production so a hostile token can't spam a shipped app's console.\n *\n * @param {string} key\n * @param {string} [reason]\n * @returns {void}\n */\nconst warnRejected = (key, reason) => {\n  try {\n    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV !== 'production') {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[sorb] skipped token \"--${key}\": value failed CSS sanitization` +\n          (reason ? ` (${reason})` : ''),\n      )\n    }\n  } catch (e) {\n    // never let logging break token application\n    void e\n  }\n}\n\n/**\n * Writes all token values as CSS custom properties on :root.\n * Applies globally \u2014 affects the entire app.\n *\n * Each value is validated by {@link sanitizeCssValue} at this injection\n * boundary (concern C1). A value that fails sanitization is SKIPPED (fail\n * safe) \u2014 it is never written \u2014 and the remaining tokens still apply.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const applyTokens = (tokens) => {\n  const root = document.documentElement\n  Object.entries(tokens).forEach(([key, value]) => {\n    const result = sanitizeCssValue(String(value))\n    if (!result.ok) {\n      warnRejected(key, result.reason)\n      return\n    }\n    root.style.setProperty(`--${key}`, result.value)\n  })\n}\n\n/**\n * Removes token CSS custom properties from :root.\n * Called when clearing a preview to restore the committed set.\n *\n * @param {import('./types').TokenSet} tokens\n * @returns {void}\n */\nexport const clearTokenOverrides = (tokens) => {\n  const root = document.documentElement\n  Object.keys(tokens).forEach((key) => {\n    root.style.removeProperty(`--${key}`)\n  })\n}\n", "/**\n * Preview-origin guard \u2014 the C3 production foot-gun guard.\n *\n * Preview defaults OFF. Even when a team opts in, the SDK must only talk to a\n * TRUSTED bridge origin: a stray `?preview=` on a production link must not be\n * able to point the running app at an untrusted bridge. This pure helper makes\n * that decision; the provider wires it in. No DOM, fully node:test-able.\n */\n\nconst DEFAULT_ORIGIN = 'http://localhost:7777'\n\n/**\n * Is `origin` a localhost / loopback origin (any port)? `http`/`https`,\n * `localhost`, `127.0.0.1`, and IPv6 `[::1]` all count.\n *\n * @param {string} origin\n * @returns {boolean}\n */\nconst isLocalhostOrigin = (origin) => {\n  let url\n  try {\n    url = new URL(origin)\n  } catch (e) {\n    void e\n    return false\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false\n  const host = url.hostname.toLowerCase()\n  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]'\n}\n\n/**\n * Normalise to a bare `protocol//host:port` origin for exact comparison\n * against a consumer-supplied allowlist (trailing slashes / paths ignored).\n *\n * @param {string} value\n * @returns {string|null}\n */\nconst toOrigin = (value) => {\n  try {\n    return new URL(value).origin\n  } catch (e) {\n    void e\n    return null\n  }\n}\n\n/**\n * Decide whether the preview path may run, and against which origin.\n *\n * Allowed only when BOTH:\n *   1. `config.preview?.enabled === true` (strict \u2014 not just truthy), and\n *   2. the resolved origin is on the allowlist: localhost/127.0.0.1/[::1]\n *      (any port) by default, plus any exact origins the consumer lists in\n *      `config.preview.allowedOrigins`.\n *\n * Anything else (disabled, missing config, non-allowlisted origin, malformed\n * origin) \u2192 not allowed; the caller falls back to committed tokens.\n *\n * @param {import('./types').SorbConfig} [config]\n * @returns {{ allowed: boolean, origin: string|null, reason?: string }}\n */\nexport const shouldLoadPreview = (config) => {\n  const preview = config && config.preview\n  if (!preview || preview.enabled !== true) {\n    return { allowed: false, origin: null, reason: 'preview-disabled' }\n  }\n\n  const origin = preview.origin ?? DEFAULT_ORIGIN\n  const normalized = toOrigin(origin)\n  if (!normalized) {\n    return { allowed: false, origin: null, reason: 'malformed-origin' }\n  }\n\n  if (isLocalhostOrigin(origin)) {\n    return { allowed: true, origin }\n  }\n\n  const extra = Array.isArray(preview.allowedOrigins) ? preview.allowedOrigins : []\n  const allowed = extra.some((entry) => toOrigin(entry) === normalized)\n  if (allowed) {\n    return { allowed: true, origin }\n  }\n\n  return { allowed: false, origin, reason: 'origin-not-allowlisted' }\n}\n", "// bridgeAuth.js \u2014 hosted-bridge Authorization header (Plugin-UX U4).\n//\n// Sorb's hosted bridge (https://bridge.sorbcloud.com) requires\n// `Authorization: Bearer <key>` on every route except /health. The key is a\n// read-only publishable `sorb_pk_\u2026` (safe to ship in a distributable; 403s on\n// writes). Local `sorb dev` runs with NO auth, so when no key is configured we\n// send NO header and the localhost path is byte-for-byte unchanged.\n//\n// One place builds the header so both fetch sites (TokenProvider preview poll +\n// verify.js) stay consistent. Pure + node:test-able; no DOM, no fetch.\n\n/**\n * Build the request headers for a hosted-bridge call, merging in the bearer\n * `Authorization` header only when a non-empty key is configured.\n *\n * @param {string} [key]   The configured bearer key (`config.preview.key`), if any.\n * @param {Record<string,string>} [base]   Base headers to extend (e.g. Content-Type).\n * @returns {Record<string,string>}\n */\nexport const bridgeHeaders = (key, base) => {\n  const headers = base ? { ...base } : {}\n  if (typeof key === 'string' && key.trim() !== '') {\n    headers.Authorization = `Bearer ${key.trim()}`\n  }\n  return headers\n}\n", "import React from 'react'\nimport { usePreviewState } from './hooks'\n\n/**\n * Drop-in banner that appears at the bottom of the screen when a\n * Sorb preview is active. Includes an \"Exit preview\" button.\n *\n * Only renders when preview.enabled is true AND a preview is loaded.\n * Safe to include unconditionally \u2014 renders nothing in production.\n *\n * @example\n * // In your app root, after <SorbProvider>\n * <PreviewBanner />\n */\nexport const PreviewBanner = () => {\n  const { isPreview, previewId, clearPreview } = usePreviewState()\n  if (!isPreview) return null\n\n  return (\n    <div\n      role=\"status\"\n      aria-live=\"polite\"\n      style={{\n        position: 'fixed',\n        bottom: 0,\n        left: 0,\n        right: 0,\n        background: '#3B5BDB',\n        color: '#fff',\n        padding: '10px 20px',\n        display: 'flex',\n        alignItems: 'center',\n        justifyContent: 'space-between',\n        gap: '12px',\n        fontSize: '13px',\n        lineHeight: '1.4',\n        zIndex: 99999,\n        fontFamily:\n          'system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif',\n        boxShadow: '0 -2px 12px rgba(0,0,0,0.15)',\n      }}\n    >\n      <span>\n        <strong style={{ fontWeight: 600 }}>Sorb preview active</strong>\n        {previewId && (\n          <code\n            style={{\n              marginLeft: '8px',\n              opacity: 0.75,\n              fontSize: '11px',\n              background: 'rgba(255,255,255,0.15)',\n              padding: '2px 6px',\n              borderRadius: '4px',\n            }}\n          >\n            {previewId}\n          </code>\n        )}\n        <span style={{ marginLeft: '8px', opacity: 0.75, fontSize: '12px' }}>\n          Token changes from Figma are live\n        </span>\n      </span>\n      <button\n        onClick={clearPreview}\n        style={{\n          flexShrink: 0,\n          background: 'rgba(255,255,255,0.2)',\n          border: '1px solid rgba(255,255,255,0.3)',\n          color: '#fff',\n          padding: '5px 14px',\n          borderRadius: '6px',\n          cursor: 'pointer',\n          fontSize: '12px',\n          fontWeight: 500,\n          transition: 'background 0.15s',\n        }}\n        onMouseEnter={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.3)')\n        }\n        onMouseLeave={(e) =>\n          (e.target.style.background = 'rgba(255,255,255,0.2)')\n        }\n      >\n        Exit preview\n      </button>\n    </div>\n  )\n}\n", "import { useTokenContext } from './context'\n\n/**\n * Returns the full active token set (committed or preview).\n * @returns {import('./types').TokenSet}\n */\nexport const useTokens = () => {\n  return useTokenContext().tokens\n}\n\n/**\n * Returns a single token value by key.\n *\n * @param {string} key\n * @returns {string}\n * @example\n * const primary = useToken('color-primary') // \u2192 '#3B5BDB'\n */\nexport const useToken = (key) => {\n  const tokens = useTokenContext().tokens\n  const value = tokens[key]\n  if (value === undefined && process.env.NODE_ENV === 'development') {\n    console.warn(`[Sorb] Token not found: \"${key}\"`)\n  }\n  return String(value ?? '')\n}\n\n/**\n * Returns whether a preview token set is currently active.\n * Useful for showing a preview indicator in your app.\n * @returns {boolean}\n */\nexport const useIsPreview = () => {\n  return useTokenContext().isPreview\n}\n\n/**\n * Returns full preview state \u2014 useful for building a preview banner.\n *\n * @example\n * const { isPreview, previewId, clearPreview } = usePreviewState()\n */\nexport const usePreviewState = () => {\n  const { isPreview, previewId, clearPreview } = useTokenContext()\n  return { isPreview, previewId, clearPreview }\n}\n", "// verify.js \u2014 RUNNING-APP token verification (e2e-fix W2).\n//\n// Reports the values the running app ACTUALLY resolved for a set of tokens (read\n// off `:root` \u2014 where SorbProvider's applyTokens wrote the committed/preview\n// values) to the bridge's `POST /verify/app`, which diffs them against the\n// committed resolved map. This is what makes \"verify-before-merge in your running\n// app\" true in code: it asserts the live DOM resolves to the bound token values,\n// not Figma-side geometry.\n//\n// SSR-safe: no DOM \u2192 returns a clear `{ ok:false, reason:'no-dom' }` rather than\n// throwing (safe to call from a server-rendered component's effect). `fetch` is\n// injectable for tests.\n\nimport { bridgeHeaders } from './bridgeAuth.js'\n\n/** Normalize a token name to a `--cssVar`. */\nconst toCssVar = (name) => {\n  const s = String(name).trim()\n  return s.startsWith('--') ? s : `--${s}`\n}\n\n/**\n * Read each token's resolved value off `:root` and ask the bridge whether the\n * running app matches the committed resolved map.\n *\n * Precondition: call from inside a mounted `<SorbProvider>` \u2014 it applies the\n * resolved token literals onto `:root`. Without it, custom props read back as\n * `var(...)` refs (outputReferences css) and the result is `{ ok:false,\n * reason:'provider-not-applied' }` rather than a misleading mismatch.\n *\n * @param {string[]} tokens  Token names or `--cssVar`s to check (e.g. `'button-primary-bg-default'`).\n * @param {{ origin?: string, key?: string, fetch?: typeof globalThis.fetch }} [opts]\n *   `key` is the hosted-bridge bearer key (`config.preview.key`). Omit for the\n *   no-auth localhost bridge \u2014 no `Authorization` header is then sent.\n * @returns {Promise<{ok:boolean, reason?:string, checked?:number, matched?:number, mismatches?:Array<{cssVar:string,expected:any,got:any}>, unknown?:string[], error?:string}>}\n */\nexport const verifyResolved = async (tokens, { origin = 'http://localhost:7777', key, fetch: fetchImpl } = {}) => {\n  if (typeof document === 'undefined' || !document.documentElement) {\n    return { ok: false, reason: 'no-dom' }\n  }\n  if (!Array.isArray(tokens) || tokens.length === 0) {\n    return { ok: false, reason: 'no-tokens' }\n  }\n  const cs = getComputedStyle(document.documentElement)\n  /** @type {Record<string,string>} */\n  const values = {}\n  for (const t of tokens) {\n    const cssVar = toCssVar(t)\n    values[cssVar] = cs.getPropertyValue(cssVar).trim()\n  }\n  // Precondition: SorbProvider must have applied the resolved literals onto :root.\n  // `variables.css` is built with outputReferences, so an un-applied custom prop\n  // reads back as a `var(--\u2026)` reference, not a value \u2014 verifying that is\n  // meaningless. Detect it and say so plainly instead of reporting false mismatches.\n  const unapplied = Object.entries(values)\n    .filter(([, v]) => v.startsWith('var('))\n    .map(([k]) => k)\n  if (unapplied.length) return { ok: false, reason: 'provider-not-applied', unapplied }\n  const f = fetchImpl || (typeof fetch !== 'undefined' ? fetch : globalThis.fetch)\n  if (typeof f !== 'function') return { ok: false, reason: 'no-fetch' }\n  const base = String(origin).replace(/\\/+$/, '')\n  try {\n    const res = await f(`${base}/verify/app`, {\n      method: 'POST',\n      // Hosted bridge needs the bearer key; localhost (no key) sends no header.\n      headers: bridgeHeaders(key, { 'Content-Type': 'application/json' }),\n      body: JSON.stringify({ values }),\n    })\n    if (!res.ok) {\n      let detail = ''\n      try {\n        const b = await res.json()\n        detail = b && b.error ? b.error : ''\n      } catch (e) {\n        void e\n      }\n      return { ok: false, reason: 'bridge-error', error: `${res.status}${detail ? ` \u2014 ${detail}` : ''}` }\n    }\n    return await res.json()\n  } catch (e) {\n    // Bridge not running / network error \u2014 never throw into the app.\n    return { ok: false, reason: 'bridge-unreachable', error: e && e.message }\n  }\n}\n"],
+  "mappings": ";AAAA,OAAO,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;ACAhE,SAAS,eAAe,kBAAkB;AAGnC,IAAM,eAAe,cAAc,IAAI;AAGvC,IAAM,kBAAkB,MAAM;AACnC,QAAM,MAAM,WAAW,YAAY;AACnC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;;;ACOA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,gBAAgB;AAKtB,IAAM,gBAAgB;AAItB,IAAM,gBAAgB;AAkBf,IAAM,mBAAmB,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,eAAe;AAAA,EACxD;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAEA,MAAI,cAAc,KAAK,GAAG,GAAG;AAC3B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,qBAAqB;AAAA,EAC/D;AAKA,QAAM,QAAQ,IAAI,YAAY;AAC9B,QAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;AAC1C,MAAI,UAAU,SAAS,SAAS,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,YAAY;AAAA,EACtD;AACA,MAAI,UAAU,SAAS,aAAa,GAAG;AACrC,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC9D;AACA,MAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,eAAe;AAAA,EACzD;AAGA,gBAAc,YAAY;AAC1B,MAAI;AACJ,UAAQ,QAAQ,cAAc,KAAK,GAAG,OAAO,MAAM;AACjD,UAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,QAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,OAAO,KAAK,QAAQ,uBAAuB,IAAI,GAAG;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;;;ACtGA,IAAM,eAAe,CAAC,KAAK,WAAW;AACpC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ;AAAA,QACN,2BAA2B,GAAG,sCAC3B,SAAS,KAAK,MAAM,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;AAaO,IAAM,cAAc,CAAC,WAAW;AACrC,QAAM,OAAO,SAAS;AACtB,SAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAM,SAAS,iBAAiB,OAAO,KAAK,CAAC;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,mBAAa,KAAK,OAAO,MAAM;AAC/B;AAAA,IACF;AACA,SAAK,MAAM,YAAY,KAAK,GAAG,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACH;;;ACrCA,IAAM,iBAAiB;AASvB,IAAM,oBAAoB,CAAC,WAAW;AACpC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS;AACpF;AASA,IAAM,WAAW,CAAC,UAAU;AAC1B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,oBAAoB,CAAC,WAAW;AAC3C,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,CAAC,WAAW,QAAQ,YAAY,MAAM;AACxC,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,SAAS,MAAM;AAClC,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,QAAQ,mBAAmB;AAAA,EACpE;AAEA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,cAAc,IAAI,QAAQ,iBAAiB,CAAC;AAChF,QAAM,UAAU,MAAM,KAAK,CAAC,UAAU,SAAS,KAAK,MAAM,UAAU;AACpE,MAAI,SAAS;AACX,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,yBAAyB;AACpE;;;AClEO,IAAM,gBAAgB,CAAC,KAAK,SAAS;AAC1C,QAAM,UAAU,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;AACtC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,YAAQ,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;;;AL6FI;AA3GJ,IAAM,UAAU,CAAC,QAAQ;AACvB,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,OAAO,MAAuC;AAE1F,cAAQ,KAAK,UAAU,GAAG,EAAE;AAAA,IAC9B;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACF;AAKO,IAAM,eAAe,CAAC,EAAE,QAAQ,SAAS,MAAM;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,OAAO,MAAM;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,UAAU,OAAO,IAAI;AAG3B,QAAM,gBAAgB,YAAY,MAAM;AACtC,gBAAY,OAAO,MAAM;AACzB,oBAAgB,OAAO,MAAM;AAC7B,iBAAa,KAAK;AAClB,iBAAa,IAAI;AAAA,EACnB,GAAG,CAAC,OAAO,MAAM,CAAC;AAGlB,QAAM,cAAc;AAAA,IAClB,OAAO,OAAO;AAIZ,YAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAI,CAAC,MAAM,SAAS;AAClB,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM;AACrB,UAAI;AAIF,cAAM,MAAM,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,IAAI;AAAA,UACjD,SAAS,cAAc,OAAO,SAAS,GAAG;AAAA,QAC5C,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,mBAAmB;AAChD,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,oBAAY,MAAM;AAClB,wBAAgB,MAAM;AACtB,qBAAa,IAAI;AACjB,qBAAa,EAAE;AACf,eAAO;AAAA,MACT,SAAS,GAAG;AAIV,sBAAc;AACd,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,aAAa;AAAA,EACxB;AAGA,QAAM,eAAe,YAAY,MAAM;AACrC,QAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAClD,UAAM,SAAS,IAAI,gBAAgB,SAAS,MAAM;AAClD,WAAO,OAAO,SAAS;AACvB,UAAM,KAAK,OAAO,SAAS;AAC3B,YAAQ,aAAa,MAAM,IAAI,KAAK,IAAI,EAAE,KAAK,SAAS,QAAQ;AAChE,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAGlB,YAAU,MAAM;AACd,UAAM,QAAQ,kBAAkB,MAAM;AACtC,UAAM,KAAK,IAAI,gBAAgB,SAAS,MAAM,EAAE,IAAI,SAAS;AAK7D,QAAI,CAAC,MAAM,WAAW,CAAC,IAAI;AACzB,UAAI,MAAM,CAAC,MAAM,SAAS;AACxB;AAAA,UACE,oDAA+C,MAAM,UAAU,SAAS;AAAA,QAE1E;AAAA,MACF;AACA,oBAAc;AACd;AAAA,IACF;AAGA,gBAAY,EAAE,EAAE,KAAK,CAAC,OAAO;AAC3B,UAAI,CAAC,GAAI;AACT,YAAM,WAAW,OAAO,SAAS,gBAAgB;AACjD,cAAQ,UAAU,YAAY,MAAM,YAAY,EAAE,GAAG,QAAQ;AAAA,IAC/D,CAAC;AAED,WAAO,MAAM;AACX,UAAI,QAAQ,QAAS,eAAc,QAAQ,OAAO;AAAA,IACpD;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,QAAQ,cAAc,WAAW,WAAW,aAAa,GACtF,UACH;AAEJ;;;AM1HA,OAAOA,YAAW;;;ACMX,IAAM,YAAY,MAAM;AAC7B,SAAO,gBAAgB,EAAE;AAC3B;AAUO,IAAM,WAAW,CAAC,QAAQ;AAC/B,QAAM,SAAS,gBAAgB,EAAE;AACjC,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,UAAU,UAAa,MAAwC;AACjE,YAAQ,KAAK,4BAA4B,GAAG,GAAG;AAAA,EACjD;AACA,SAAO,OAAO,SAAS,EAAE;AAC3B;AAOO,IAAM,eAAe,MAAM;AAChC,SAAO,gBAAgB,EAAE;AAC3B;AAQO,IAAM,kBAAkB,MAAM;AACnC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,SAAO,EAAE,WAAW,WAAW,aAAa;AAC9C;;;ADHM,SACE,OAAAC,MADF;AA5BC,IAAM,gBAAgB,MAAM;AACjC,QAAM,EAAE,WAAW,WAAW,aAAa,IAAI,gBAAgB;AAC/D,MAAI,CAAC,UAAW,QAAO;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,aAAU;AAAA,MACV,OAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YACE;AAAA,QACF,WAAW;AAAA,MACb;AAAA,MAEA;AAAA,6BAAC,UACC;AAAA,0BAAAA,KAAC,YAAO,OAAO,EAAE,YAAY,IAAI,GAAG,iCAAmB;AAAA,UACtD,aACC,gBAAAA;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,UAAU;AAAA,gBACV,YAAY;AAAA,gBACZ,SAAS;AAAA,gBACT,cAAc;AAAA,cAChB;AAAA,cAEC;AAAA;AAAA,UACH;AAAA,UAEF,gBAAAA,KAAC,UAAK,OAAO,EAAE,YAAY,OAAO,SAAS,MAAM,UAAU,OAAO,GAAG,+CAErE;AAAA,WACF;AAAA,QACA,gBAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,OAAO;AAAA,cACP,SAAS;AAAA,cACT,cAAc;AAAA,cACd,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,YAAY;AAAA,YACd;AAAA,YACA,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAE/B,cAAc,CAAC,MACZ,EAAE,OAAO,MAAM,aAAa;AAAA,YAEhC;AAAA;AAAA,QAED;AAAA;AAAA;AAAA,EACF;AAEJ;;;AEvEA,IAAM,WAAW,CAAC,SAAS;AACzB,QAAM,IAAI,OAAO,IAAI,EAAE,KAAK;AAC5B,SAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK,CAAC;AACxC;AAiBO,IAAM,iBAAiB,OAAO,QAAQ,EAAE,SAAS,yBAAyB,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM;AAChH,MAAI,OAAO,aAAa,eAAe,CAAC,SAAS,iBAAiB;AAChE,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,QAAM,KAAK,iBAAiB,SAAS,eAAe;AAEpD,QAAM,SAAS,CAAC;AAChB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,SAAS,CAAC;AACzB,WAAO,MAAM,IAAI,GAAG,iBAAiB,MAAM,EAAE,KAAK;AAAA,EACpD;AAKA,QAAM,YAAY,OAAO,QAAQ,MAAM,EACpC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EACtC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjB,MAAI,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,wBAAwB,UAAU;AACpF,QAAM,IAAI,cAAc,OAAO,UAAU,cAAc,QAAQ,WAAW;AAC1E,MAAI,OAAO,MAAM,WAAY,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AACpE,QAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAC9C,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,IAAI,eAAe;AAAA,MACxC,QAAQ;AAAA;AAAA,MAER,SAAS,cAAc,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MAClE,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,IACjC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,SAAS;AACb,UAAI;AACF,cAAM,IAAI,MAAM,IAAI,KAAK;AACzB,iBAAS,KAAK,EAAE,QAAQ,EAAE,QAAQ;AAAA,MACpC,SAAS,GAAG;AAAA,MAEZ;AACA,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,OAAO,GAAG,IAAI,MAAM,GAAG,SAAS,WAAM,MAAM,KAAK,EAAE,GAAG;AAAA,IACpG;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,SAAS,GAAG;AAEV,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB,OAAO,KAAK,EAAE,QAAQ;AAAA,EAC1E;AACF;",
   "names": ["React", "jsx"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorb/leaf",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "React provider for Sorb design tokens — the foliage rendered in your running app",
   "license": "MIT",
   "keywords": [