···200200201201 function setupAuthenticatedSession(permissions: string[]) {
202202 mockFetch.mockResolvedValueOnce(
203203- mockResponse({ authenticated: true, did: "did:plc:admin", handle: "admin.test" })
203203+ mockResponse({ authenticated: true, did: "did:plc:forum", handle: "admin.bsky.social" })
204204 );
205205 mockFetch.mockResolvedValueOnce(mockResponse({ permissions }));
206206 }
···321321 const html = await res.text();
322322 // The injected block-escape value must not appear
323323 expect(html).not.toContain("red} body");
324324+ // The entire dirty value must be dropped — not just the injected suffix
325325+ expect(html).not.toContain("--color-bg");
324326 });
325327326326- it("returns a fallback HTML fragment when no tokens are submitted (does not crash)", async () => {
328328+ it("returns an empty-token preview fragment when no tokens are submitted (does not crash)", async () => {
327329 setupAuthenticatedSession([MANAGE_THEMES]);
328330329331 const routes = await loadThemeRoutes();