Juan DenisandClaude Opus 4.8 c20a9f14f2 feat(themes): backend model, API, and registry pipeline (plan 60 Phase 2-3) ...

Themes are data, not code — so the backend is a simple validated-JSON store,
no zips/checksums/permissions.

- Theme model + migration 078_themes
- theme_tokens.py: server-side mirror of the token whitelist + validators
  (the gate: a malicious/malformed theme never reaches the DB)
- theme_service: bundled-seed loading, import/list/delete, panel default,
  pre-auth public/active
- /api/v1/themes: /installed, /import (admin), DELETE (admin), /default
  get+set (admin), unauthenticated /public/active for login/setup, plus
  /registry + /registry/<slug>/install
- theme_registry_service: offline-tolerant registry fetch (TTL + last-good +
  bundled fallback), mirrors the extension registry pattern
- bundled seed themes synced to app/data/themes + themes_index.json
- 18 proving tests (server-side validation sanitizes url()/;/} smuggling,
  admin gate, panel-default → public/active, offline fallback, install flow)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-23 00:24:00 -04:00

..

capture-skeletons.mjs

chore(frontend): drop unused eslint-disable in capture-skeletons script

2026-07-18 19:23:59 -04:00

check-settings-index.mjs

feat(palette): settings search — deep-link focus + completeness guard

2026-07-10 23:42:57 -04:00

check-theme-tokens.mjs

feat(themes): theme gallery + runtime skins (plan 60 Phase 1)

2026-07-22 23:55:19 -04:00

fetch-fonts.mjs

feat(ui): redesign foundation — tokens, self-hosted fonts, primitives, sidebar

2026-06-07 03:34:28 -04:00

sync-bundled-themes.mjs

feat(themes): backend model, API, and registry pipeline (plan 60 Phase 2-3)

2026-07-23 00:24:00 -04:00