Design tokens: carry preset defaults on upload, resolve them on download

[pbking]

Stacked on #47 (its diff shows only token work; it retargets when #47 merges). Server half: Twenty-Bellows/patternbuilderwp.com#4.

Patterns reference theme presets by slug — a foreground color, a spacing step, a font size. This PR makes those references portable per the agreed semantics: the uploading site's values travel as defaults; the downloading site's own definitions always win; only missing tokens prompt the user for a home.

Upload — automatic

Pattern_Builder_Cloud_Tokens::collect() scans the serialized markup for every preset reference (named attributes, var:preset|… style paths, var(--wp--preset--…) custom properties, and derived has-… classes — generic support classes like has-text-color excluded) and resolves each slug against this site's merged global settings (user customizations > theme.json > core defaults), fluid font sizes included via wp_get_typography_font_size_value(). The porter bundles the result into the package; nothing to ask.

Download — destination wins; missing tokens ask once

Before a download runs, the flow checks the pattern's tokens against this site (POST /cloud/tokens/check). Tokens the site already defines — any origin — are never touched: the pattern simply adopts the local look. Missing ones open a modal listing them (swatches for colors, values shown) with one batch choice of home:

• Site styles (the theme's user Global Styles post) — recommended default, revertable in the editor, and
• theme.json (the active theme's file) — versioned, ships with the theme (with graceful errors when the theme has none or it isn't writable).

Values are re-validated locally with the same strict grammar the service enforces before anything is written (never trust the wire), the theme-JSON cache is busted, then the pattern imports as usual; the response reports tokensWritten and the UI confirms with a snackbar. Generated-pattern downloads go through the identical gate.

Verified live (two-site loop)

A Twenty Twenty-Five pattern using accent-2, accent-4, spacing|50, and x-large uploaded with all four tokens resolved (including TT25's fluid clamp() font size); the service stored them and its preview renders with the source palette. Downloaded onto Twenty Twenty-Three: the modal offered exactly the two accent colors TT23 lacks — its own spacing/font-size definitions won silently — wrote them to the user palette on confirm, and the pattern imported rendering correctly.

Testing

9 new PHPUnit tests (112 total, all green): every reference form extracted with support-classes excluded, resolution against injected theme data, unresolvable references dropped, missing-detection honoring existing origins, idempotent Global Styles writes that round-trip through wp_get_global_settings(), theme.json writes + its two error paths, hostile wire values rejected, and porter export bundling. ESLint/PHPCS clean; build green.

🤖 Generated with Claude Code

https://claude.ai/code/session_014jnurSGDDL9SPMcptRgB8U

---

Generated by Claude Code

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[pbking]

The failing claude-review check is the repo-wide issue diagnosed on #47, not this PR's diff: the action's model step fails with 401 authentication_error: OAuth access token has been revoked (job log). Every review run in this repo will fail until the CLAUDE_CODE_OAUTH_TOKEN repository secret is re-minted (claude setup-token) and updated. This PR's code is verified locally: 112/112 PHPUnit, ESLint/PHPCS clean, plus the live two-site token loop described in the PR body.

---

Generated by Claude Code