{# Carried in the document itself so it also protects srcdoc-rendered draft
previews, which have no HTTP response to set the header on. #}
{% if csp %}{% endif %}
{# Design tokens + app styling baseline, before the widget's own CSS so every
widget inherits the active theme's look (var(--…) tokens, .yf-* helpers) and
can override specifics. The second link adds a custom (runtime) theme's
token block — tokens only, never its skin, whose body/app rules would leak
into the widget document. The CSP allows same-origin stylesheets, and
srcdoc previews inherit the parent's base URL, so the links resolve too. #}
{{ widget.html | safe }}
⚠ {{ _("This widget couldn't render") }}
{# The widget runtime API (window.yaffo). Inlined, not