Security and Release

Third-party themes are supply-chain input. Platform validation and sandboxing reduce risk but do not replace source review, license verification or reproducible releases.

Platform Validation Limits

Item	Limit
Compressed ZIP size	8 MiB max
Total unpacked size	16 MiB max
Single file size	4 MiB max
File count	300 max
manifest.json	64 KiB max, UTF-8 JSON
Path depth	8 levels max
Single path length	180 characters max
CSS files	1-4 for CSS themes
Canvas height	400-12000

Uploads must use the ZIP Content-Type and carry a browser-computed x-theme-sha256. The Worker recomputes the SHA-256 of the whole package and rejects on mismatch. x-extension-sha256 is only a legacy client compatibility header for old theme tools; it does not mean plugin support. New tools send x-theme-sha256.

Manifest Validation

• schema must be nie-sla-theme-v1.
• id is 3-49 lowercase letters, digits or hyphens, starts with a letter, and stays stable after release.
• version must be SemVer.
• type is fixed at theme.
• CSS mode requires 1-4 packaged style files; Canvas mode requires an entry HTML.
• permissions can only be ["status:read"].
• files, when declared, must match the ZIP contents exactly.
• Paths must be NFC Unicode; absolute paths, backslashes, .., control characters and duplicate paths are rejected.
• Allowed extensions are .css, .html, .js, .json, common web image formats and WOFF/WOFF2 fonts.

Supply Chain and Release

• Build clean artifacts from source; never ship dev-server output.
• State the author, version, license and source address clearly; do not impersonate official themes.
• Publish the ZIP SHA-256 separately: shasum -a 256 theme.zip.
• Updates keep the same id and raise the SemVer; after an overwrite upload an administrator re-enables the theme.
• Validate on a test deployment before enabling in production.
• Do not include extensionless license files or Markdown in the ZIP; keep the license in the source repository and Release page.

Runtime Isolation

CSS themes do not execute scripts. Canvas themes run in a sandbox iframe without same-origin privileges; the CSP forbids direct network access, forms and top-level navigation, and data only arrives through the message protocol. The plugin upload API and plugin runtime are not open.

Administrators should only enable themes from trusted sources. Platform validation stops accidental uploads and common bypasses, not a malicious author deliberately poisoning a theme; source review and license verification remain the administrator's responsibility.