Variable: FORBIDDEN_CSS_CONSTRUCTS

const FORBIDDEN_CSS_CONSTRUCTS: readonly ["@import", "javascript:", "expression(", "-moz-binding", "behavior:", "url(http:", "url(https:", "url(//", "data:text/html", "!important"]

Defined in: manifest.ts:113

CSS constructs that must never appear in theme package stylesheets or in manifest token values — executable legacy hooks, remote resources and cascade escapes. Single source of truth for both the manifest validator and the server-side package CSS assertion (apps/server themes.ts).