Theme System

The current production build only exposes theme packages. An administrator uploads a ZIP from the Themes page in the control panel; the system validates the whole package before writing it to theme storage, and a new package starts disabled. There is no plugin upload API, no plugin management page, and no plugin runtime.

Builtin official themes

Every production deployment ships two official themes (no upload needed): NIE-SLA Original (enabled by default) and the NodeGet canvas theme (shipped disabled). Both appear on the Themes admin page and support enable, disable and settings exactly like third-party packages:

• The original theme's "Appearance & copy" settings are the editor that used to live in the system settings page (brand, header, copy, colors and visible sections); the entry moved into the theme center.
• The NodeGet canvas theme is the official port of NIE-Theme-NodeGet: enabling it switches the public page to the interactive canvas UI and disabling it restores the original; its settings use the same storage and validation as third-party canvas themes.
• Third-party upload, SHA-256 verification and manual enable flow are unchanged; builtin theme IDs are reserved and cannot be overwritten through uploads.

Choosing an Extension Type

Type	Use case	JavaScript	Data access	Height range
CSS theme	Keep the original behavior, adjust colors, fonts, spacing and visuals	Not allowed	Uses the host DOM	Page itself
Canvas theme	Fully rewrite the public page layout, interaction and charts	Sandboxed iframe	Status snapshot + restricted history requests	400-12000

Use a Canvas theme for full page customization; use a CSS theme when only visual styles change. For a separate panel, build against the public v1 API and deploy to its own domain.

Install and Enable Flow

1. The author builds a clean dist/ from source.
2. manifest.json sits at the ZIP root.
3. The author computes and publishes the ZIP SHA-256.
4. The administrator uploads it from the theme entry point.
5. Browser and Worker each verify the SHA-256.
6. After validation the package stays disabled until an administrator reviews and enables it.
7. Disabling a theme immediately restores the original UI.

Permission Boundary

CSS themes do not execute scripts. Canvas themes run in an iframe with sandbox="allow-scripts" and no allow-same-origin; the CSP forbids direct network access, forms and top-level navigation. Data arrives through the restricted message protocol from the host, and only status:read can be declared. Admin sessions, passwords, TOTP, the Agent master token and node scoped tokens never reach a theme.

Theme ZIPs are checked for size, file count, paths, type, manifest and SHA-256. Specific limits are in the security and release guide.

Documentation

• CSS themes: minimal manifest, field rules, scoping and accessibility.
• Canvas themes: full layout, permissions and acceptance scenarios.
• Message protocol: postMessage types, request/response and lifecycle.
• Security and release: platform validation limits, supply chain and release acceptance.
• Plugin status: why plugin capabilities are not open, and the alternatives.