@capybara-hq/kernel 0.1.0-rc.10 → 0.1.0-rc.12

package/dist/admin/admin.schemas.d.ts

@@ -50,6 +50,9 @@ export declare const DeploymentSettingsBody: z.ZodObject<{
         deny: "deny";
     }>>;
     orgMarketplaceBrowse: z.ZodOptional<z.ZodBoolean>;
+    uiTheme: z.ZodOptional<z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const PurposeParams: z.ZodObject<{
     purpose: z.ZodString;

package/dist/agents/agents.schemas.d.ts

@@ -33,6 +33,7 @@ export declare const AgentCreateDefinition: z.ZodObject<{
         tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
     }, z.core.$strict>], "kind">>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;
@@ -116,6 +117,7 @@ export declare const AgentCreateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;
@@ -231,6 +233,7 @@ export declare const AgentUpdateBody: z.ZodObject<{
             tools: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>], "kind">>>;
         toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            allow: "allow";
             ask: "ask";
             deny: "deny";
         }>>>;

package/dist/agents/agents.service.js

@@ -8,6 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
+import { parseToolKey } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
@@ -310,7 +311,16 @@ let AgentsService = class AgentsService {
                 message: "subagentTools is set only on a sub-agent's definition at dispatch",
             });
         }
-        for (const key of Object.keys(def.toolPolicies)) {
+        for (const [key, policy] of Object.entries(def.toolPolicies)) {
+            // `allow` counts only for a connector tool (decision 2026-11-09): elsewhere a policy only
+            // tightens, so an `allow` there is refused rather than kept as a no-op
+            if (policy === "allow" && parseToolKey(key)?.kind !== "connector") {
+                details.push({
+                    path: `toolPolicies.${key}`,
+                    message: `"allow" applies only to a connector's tools; "${key}" can only be tightened (ask or deny)`,
+                });
+                continue;
+            }
             if (!isToolPolicyKey(key, keys)) {
                 // an rc key (tool naming spec §8.3): saving writes current keys only, so name them
                 const renamed = legacyKeySaveText(key, keys);

package/dist/agents/definition.d.ts

@@ -196,6 +196,7 @@ export declare const AgentDefinitionSchema: z.ZodObject<{
         deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     toolPolicies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        allow: "allow";
         ask: "ask";
         deny: "deny";
     }>>>;

package/dist/agents/definition.js

@@ -207,10 +207,14 @@ export const AgentDefinitionSchema = z.object({
      */
     subagentTools: SubagentToolsSchema.optional(),
     /**
-     * Tightened policies by tool key (`ask` / `deny` only, never `allow`); keys are tools the agent
-     * could have (on or turned off). Older definitions without it read as empty.
+     * Policies by tool key; keys are tools the agent could have (on or turned off). `ask` / `deny`
+     * tighten any tool. `allow` is accepted only on a connector tool key and counts only for a
+     * personal-credential connector's tool (decision 2026-11-09): it overrides the org default and
+     * the member's own 询问, never the org's or the member's 禁止 (`tools/policy.ts`
+     * `connectorPolicy`); on any other tool it changes nothing. Older definitions without it read as
+     * empty.
      */
-    toolPolicies: z.record(z.string(), z.enum(["ask", "deny"])).default({}),
+    toolPolicies: z.record(z.string(), z.enum(["allow", "ask", "deny"])).default({}),
     /**
      * 技能（M5 T13）：`orgSkills` 是引用的组织技能 id（保存时校验属于本组织且未删除，不可重复）。
      * agent 自己的技能（`scope=agent`）自动对它生效，不进定义。可省略（较早保存的定义也没有），按空处理；

package/dist/agents/org-templates.js

@@ -200,6 +200,10 @@ extensionTools = []) {
     const toolPolicies = {};
     const connectorPolicies = new Map();
     for (const [k, v] of Object.entries(def.toolPolicies ?? {})) {
+        // a template only tightens: an agent's `allow` (a connector tool's, decision 2026-11-09)
+        // is not carried into it
+        if (v === "allow")
+            continue;
         const parsed = parseToolKey(k);
         if (parsed !== null && parsed.kind !== "connector" && TOOL_KEY_RE.test(k)) {
             toolPolicies[k] = v;

package/dist/agents/pending-connectors.service.js

@@ -134,7 +134,7 @@ let PendingConnectorsService = class PendingConnectorsService {
             }
             const k = connectorToolKey(c.slug, n);
             const prev = toolPolicies[k];
-            if (prev === undefined || RANK[p] > RANK[prev])
+            if (prev === undefined || prev === "allow" || RANK[p] > RANK[prev])
                 toolPolicies[k] = p;
         }
         // tools are on by default (tools default-on spec §3): binding an entry that names some tools

package/dist/catalog/catalog-content.d.ts

@@ -1,4 +1,4 @@
-import { type AgentTemplate, type Connector, type ConnectorTemplateFile, type ConnectorTemplateSpec, type LocalizedName, type PluginManifest } from "@capybara-hq/plugin-sdk";
+import { type AgentTemplate, type Connector, type ConnectorTemplateFile, type ConnectorTemplateSpec, type LocalizedName, type ParsedTheme, type PluginManifest } from "@capybara-hq/plugin-sdk";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { ExtensionRegistry } from "../extensions/registry.js";
 import type { ExtensionUnavailableReason } from "../extensions/unavailable.js";
@@ -230,3 +230,35 @@ export declare function readCatalogAgentTemplates(storage: StorageService, v: Ca
     path: string;
     template: AgentTemplate;
 }[]>;
+/** A theme of a catalog version ({@link readCatalogThemes}). */
+export interface CatalogTheme {
+    /** The theme id (the file's base name). */
+    id: string;
+    /** Relative to the plugin root. */
+    path: string;
+    theme: ParsedTheme;
+    /** The theme's fonts and logo files (paths relative to the plugin root), sanitized. */
+    assets: SkillPackageFile[];
+    /** {@link themeAssetsDigest} of the version's records of those files. */
+    assetsDigest: string;
+}
+/** The asset paths a parsed theme references (fonts, logo mark and favicon), without `./`. */
+export declare function themeAssetPaths(theme: ParsedTheme): string[];
+/**
+ * The digest of a theme's assets as recorded on a catalog version (`files`): equal digests = the
+ * same fonts and logo. With the canonical definition it decides whether a theme changed.
+ */
+export declare function themeAssetsDigest(files: {
+    path: string;
+    sha256: string;
+}[], theme: ParsedTheme): string;
+/**
+ * The themes of a catalog version (`manifest.themes`, listed explicitly since import), parsed from
+ * storage and their assets checked again (checked at import; again in case storage was changed).
+ * Grammar and token names are checked again (a token renamed in core stays loud, themes spec
+ * §4.1), but not readability: the version passed it at import, and a later change of the built-in
+ * tokens must not block an update or a rollback to it. A theme that fails -> 400 `theme.invalid`
+ * as at import (themes spec §6: a failing new version blocks the plugin update with the same
+ * refusal).
+ */
+export declare function readCatalogThemes(storage: StorageService, v: CatalogVersionFiles): Promise<CatalogTheme[]>;

package/dist/catalog/catalog-content.js

@@ -3,14 +3,14 @@
 // OrgCatalogService: kept out of org-catalog.service.ts so the installer's module never imports a
 // module whose provider injects PluginInstaller (an ESM import cycle would run decorators early).
 import { createHash } from "node:crypto";
-import { parseAgentTemplate, parseConnectorTemplateFile, } from "@capybara-hq/plugin-sdk";
+import { parseAgentTemplate, parseConnectorTemplateFile, parseThemeFile, themeIdOf, validateThemeAssets, } from "@capybara-hq/plugin-sdk";
 import { normalizeToolKeys } from "../agents/definition.js";
 import { ApiError } from "../errors.js";
 import { can } from "../orgs/roles.js";
 import { packagePath } from "../packages/tgz.js";
 import { checkSkillFiles, SkillArchiveError } from "../skills/package.js";
 import { readDisplayFiles } from "./catalog-files.js";
-import { iconProblem } from "./plugin-package.js";
+import { iconProblem, pluginThemeError, themeApiError } from "./plugin-package.js";
 import { satisfiesRange } from "./versions.js";
 /**
  * A connector template as an org sees it (the install wizard and the upgrade preview's inputs):
@@ -365,3 +365,66 @@ export async function readCatalogAgentTemplates(storage, v) {
         return { path, template: normalizeToolKeys(parsed.template) };
     });
 }
+/** The asset paths a parsed theme references (fonts, logo mark and favicon), without `./`. */
+export function themeAssetPaths(theme) {
+    const refs = (theme.fonts ?? []).map((f) => f.file);
+    for (const ref of [theme.logo?.mark, theme.logo?.favicon])
+        if (ref !== undefined)
+            refs.push(ref);
+    return [...new Set(refs.map((r) => packagePath(r)))];
+}
+/**
+ * The digest of a theme's assets as recorded on a catalog version (`files`): equal digests = the
+ * same fonts and logo. With the canonical definition it decides whether a theme changed.
+ */
+export function themeAssetsDigest(files, theme) {
+    const paths = new Set(themeAssetPaths(theme));
+    return skillFilesDigest(files.filter((f) => paths.has(f.path)));
+}
+/**
+ * The themes of a catalog version (`manifest.themes`, listed explicitly since import), parsed from
+ * storage and their assets checked again (checked at import; again in case storage was changed).
+ * Grammar and token names are checked again (a token renamed in core stays loud, themes spec
+ * §4.1), but not readability: the version passed it at import, and a later change of the built-in
+ * tokens must not block an update or a rollback to it. A theme that fails -> 400 `theme.invalid`
+ * as at import (themes spec §6: a failing new version blocks the plugin update with the same
+ * refusal).
+ */
+export async function readCatalogThemes(storage, v) {
+    const refs = v.manifest.themes ?? [];
+    if (refs.length === 0)
+        return [];
+    const read = async (paths) => (await readCatalogFiles(storage, v.object_prefix, v.files.filter((f) => paths.includes(f.path)))).map((f) => [f.path, f.data]);
+    const paths = refs.map((r) => packagePath(r.path));
+    const texts = new Map(await read(paths));
+    const parsed = paths.map((path) => {
+        const id = themeIdOf(path);
+        const data = texts.get(path);
+        if (data === undefined)
+            throw new ApiError("internal", `Stored theme ${path} is missing`);
+        const r = parseThemeFile(id, new TextDecoder().decode(data), { readability: false });
+        if ("errors" in r)
+            throw themeApiError(pluginThemeError([{ theme: id, problems: r.errors }]));
+        return { id, path, theme: r };
+    });
+    const files = new Map(await read([...new Set(parsed.flatMap((t) => themeAssetPaths(t.theme)))]));
+    const out = [];
+    for (const { id, path, theme } of parsed) {
+        const { assets, errors } = validateThemeAssets(theme, files);
+        if (errors.length > 0)
+            throw themeApiError(pluginThemeError([{ theme: id, problems: errors }]));
+        out.push({
+            id,
+            path,
+            theme,
+            assets: [...assets].map(([p, bytes]) => ({
+                path: p,
+                size: bytes.byteLength,
+                sha256: createHash("sha256").update(bytes).digest("hex"),
+                data: bytes,
+            })),
+            assetsDigest: themeAssetsDigest(v.files, theme),
+        });
+    }
+    return out;
+}

package/dist/catalog/catalog-items.js

@@ -670,6 +670,7 @@ export function componentCountsOf(m) {
     return {
         extension: m?.extension === undefined ? 0 : 1,
         skills: m?.skills?.length ?? 0,
+        themes: m?.themes?.length ?? 0,
         connectorTemplates: m?.connectorTemplates?.length ?? 0,
         agentTemplates: m?.agents?.length ?? 0,
     };

package/dist/catalog/catalog-scope.service.d.ts

@@ -1,4 +1,5 @@
 import type { Queue } from "bullmq";
+import { ApiError } from "../errors.js";
 import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { ExtensionLifecycle } from "../extensions/lifecycle.js";
@@ -8,6 +9,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
 import { OrgLock } from "../orgs/org-lock.js";
+import { type ThemePreview } from "../themes/theme-usage.js";
 import { type ActorOpts, type CatalogItemView, CatalogService } from "./catalog.service.js";
 import { type ComponentKind } from "./component-state.js";
 import { type PluginConfirmResult, PluginImport } from "./plugin-import.js";
@@ -46,7 +48,9 @@ export interface ScopePreview {
     }[];
     /**
      * The orgs the change would newly offer a skill of the plugin whose own skills already use its
-     * name (rule 10): the change is refused while there are any.
+     * name, or turn a theme of the plugin on in where another theme with its id is on (rule 10,
+     * themes spec §6; `kind: "theme"` with the clashing themes in `themes`, `skills` empty): the
+     * change is refused while there are any.
      */
     conflicts: {
         orgId: string;
@@ -54,7 +58,16 @@ export interface ScopePreview {
         name: string;
         skills: string[];
         plugins: string[];
+        /** Set for a theme id clash; absent for a skill. */
+        kind?: "theme";
+        /** A theme id clash: the clashing themes on in the org. */
+        themes?: string[];
     }[];
+    /**
+     * The plugin's themes the change takes away from some orgs (themes spec §6): the orgs among
+     * them whose default each is and how many people picked it. Absent when no theme is taken away.
+     */
+    themes?: ThemePreview[];
     scopeHash: string;
 }
 /** A scope change (`orgs` only with `named`) or a disable. */
@@ -64,6 +77,12 @@ export type ScopeTarget = {
 } | {
     disabled: true;
 };
+/**
+ * The refusal of a preview's conflicts: skill ones as `plugin.skill_conflict`, theme ones as
+ * `theme.id_taken`; both at once as `plugin.skill_conflict` listing every clash (the skill details
+ * first, then the theme ones `{ theme, orgId, themes, plugins }`), so none waits for a retry.
+ */
+export declare function conflictsError(conflicts: ScopePreview["conflicts"]): ApiError;
 /**
  * The super admin's plugin scope and deployment-level disable (plugin and component management
  * spec §4.1, §5 rules 2-4 and 8), and the import confirm that enqueues the scope sync of the item it
@@ -234,6 +253,12 @@ export declare class CatalogScopeService {
     enqueueSync(itemId: string): Promise<void>;
     /** Enqueues the item's scope sync; a failure only warns (the next change or org sync converges). */
     private enqueue;
+    /**
+     * 409 `theme.platform_default` when a live theme of the item is the platform default and `after`
+     * says the change leaves it narrower than `all` or gone (themes spec §7). In the caller's
+     * transaction, before anything is written.
+     */
+    private assertKeepsPlatformDefault;
     /** The live item (row locked with `forUpdate`); missing -> 404, builtin -> `plugin.builtin`. */
     private item;
     /** The `named` list of the item, sorted. */
@@ -247,8 +272,9 @@ export declare class CatalogScopeService {
      * components with their own scope a scope change replaces; the orgs where a skill or agent
      * template is on now and would be off after (agents merged into `affected`: a component with its
      * own scope that goes back to following the plugin, or one cut by the disable); and the orgs a
-     * skill would newly be offered to whose own skills use its name. `onAfter`: the orgs the plugin
-     * is on in after the change.
+     * skill would newly be offered to whose own skills use its name, or a theme would come on in
+     * where another theme with its id is on; and per theme the orgs it would go off in
+     * (`themesLost`). `onAfter`: the orgs the plugin is on in after the change.
      */
     private componentChanges;
     /**

package/dist/catalog/catalog-scope.service.js

@@ -26,10 +26,11 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { OrgLock } from "../orgs/org-lock.js";
 import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { assertNotPlatformDefault, themesPreview, } from "../themes/theme-usage.js";
 import { CatalogService } from "./catalog.service.js";
 import { assertOrgsExist, markVersionApplied } from "./catalog-items.js";
 import { nameConflictError } from "./component-scope.service.js";
-import { agentsUsing, COMPONENT_KINDS, componentOffered, componentOn, listedIn, loadComponents, loadScopeState, pluginFactsOf, skillNameClashes, switchOf, } from "./component-state.js";
+import { agentsUsing, COMPONENT_KINDS, componentOffered, componentOn, listedIn, loadComponents, loadScopeState, pluginFactsOf, skillNameClashes, switchOf, themeIdClashes, } from "./component-state.js";
 import { ownedPluginCleanupJob } from "./job-ids.js";
 import { assertNotAwaiting, assertOwnerListed, assertShareable, assertShareableTarget, itemRemovedError, newlySharedWith, ownerOf, ownersOf, PLATFORM_OWNER, packageOwner, pendingDigest, releaseExtensionClaim, } from "./ownership.js";
 import { PluginImport } from "./plugin-import.js";
@@ -63,9 +64,30 @@ function scopeHash(target, p) {
         needsConfig: [...p.needsConfig].sort(),
         replaced: [...p.replaced].sort((a, b) => a.id.localeCompare(b.id)),
         conflicts: [...p.conflicts].sort((a, b) => a.orgId.localeCompare(b.orgId)),
+        // only when present: a preview without themes keeps the hash it had before themes
+        ...(p.themes !== undefined && { themes: p.themes }),
     }))
         .digest("hex");
 }
+/**
+ * The refusal of a preview's conflicts: skill ones as `plugin.skill_conflict`, theme ones as
+ * `theme.id_taken`; both at once as `plugin.skill_conflict` listing every clash (the skill details
+ * first, then the theme ones `{ theme, orgId, themes, plugins }`), so none waits for a retry.
+ */
+export function conflictsError(conflicts) {
+    const skills = conflicts.filter((c) => c.kind !== "theme");
+    const themes = conflicts.filter((c) => c.kind === "theme").map(({ kind: _k, ...c }) => c);
+    if (themes.length === 0)
+        return nameConflictError(skills);
+    const t = nameConflictError(themes, "theme");
+    if (skills.length === 0)
+        return t;
+    const s = nameConflictError(skills);
+    return new ApiError(s.code, `${s.message}\n${t.message}`, [
+        ...(s.details ?? []),
+        ...(t.details ?? []),
+    ]);
+}
 /**
  * The super admin's plugin scope and deployment-level disable (plugin and component management
  * spec §4.1, §5 rules 2-4 and 8), and the import confirm that enqueues the scope sync of the item it
@@ -676,11 +698,14 @@ let CatalogScopeService = class CatalogScopeService {
         // The owner stays listed (P3-17); widening goes through the share gate (P3-16)
         assertOwnerListed(item, t);
         assertShareableTarget(item, { scope: item.scope, orgs: from }, t);
+        // A scope change sends every theme back to following the plugin (rule 2): each is `all` after
+        // only when the plugin is (themes spec §7)
+        await this.assertKeepsPlatformDefault(item.id, (c) => c.disabled || item.disabled ? "gone" : t.scope === "all" ? "all" : "narrower");
         const p = await this.compute(item, t);
         if (p.scopeHash !== hash)
             throw staleError();
         if (p.conflicts.length > 0)
-            throw nameConflictError(p.conflicts);
+            throw conflictsError(p.conflicts);
         if (item.scope === t.scope && from.join() === t.orgs.join() && p.replaced.length === 0)
             return;
         await this.followAgain(actor, itemId, p.replaced, opts);
@@ -723,13 +748,15 @@ let CatalogScopeService = class CatalogScopeService {
         const item = await this.item(itemId, true);
         if (item.disabled === disabled)
             return;
+        if (disabled)
+            await this.assertKeepsPlatformDefault(item.id, () => "gone");
         const p = await this.compute(item, disabled
             ? await this.targetOf(item, { disabled: true })
             : { scope: item.scope, orgs: await this.listed(itemId), disabled, scopeChange: false });
         if (disabled && p.scopeHash !== hash)
             throw staleError();
         if (p.conflicts.length > 0)
-            throw nameConflictError(p.conflicts);
+            throw conflictsError(p.conflicts);
         await this.db
             .updateTable("catalog_items")
             .set({
@@ -780,6 +807,7 @@ let CatalogScopeService = class CatalogScopeService {
             "platform_skills",
             "platform_agent_templates",
             "platform_connector_templates",
+            "platform_themes",
         ]) {
             await this.db
                 .updateTable(table)
@@ -830,6 +858,15 @@ let CatalogScopeService = class CatalogScopeService {
             this.log.warn("enqueueing the plugin scope sync failed", { itemId, err });
         }
     }
+    /**
+     * 409 `theme.platform_default` when a live theme of the item is the platform default and `after`
+     * says the change leaves it narrower than `all` or gone (themes spec §7). In the caller's
+     * transaction, before anything is written.
+     */
+    async assertKeepsPlatformDefault(itemId, after) {
+        const themes = await loadComponents(this.db, "theme", { itemId });
+        await assertNotPlatformDefault(this.db, themes.map((c) => c.id), (id) => after(themes.find((c) => c.id === id) ?? { disabled: false }));
+    }
     /** The live item (row locked with `forUpdate`); missing -> 404, builtin -> `plugin.builtin`. */
     async item(itemId, forUpdate) {
         if (!UUID_RE.test(itemId))
@@ -954,8 +991,15 @@ let CatalogScopeService = class CatalogScopeService {
             else
                 onAfter.add(org.id);
         }
-        const { replaced, conflicts } = await this.componentChanges(item, target, orgs, onAfter, affected);
-        const p = { affected, needsConfig, replaced, conflicts };
+        const { replaced, conflicts, themesLost } = await this.componentChanges(item, target, orgs, onAfter, affected);
+        const themes = await themesPreview(db, themesLost);
+        const p = {
+            affected,
+            needsConfig,
+            replaced,
+            conflicts,
+            ...(themes !== undefined && { themes }),
+        };
         return { ...p, scopeHash: scopeHash(target, p) };
     }
     /**
@@ -963,13 +1007,15 @@ let CatalogScopeService = class CatalogScopeService {
      * components with their own scope a scope change replaces; the orgs where a skill or agent
      * template is on now and would be off after (agents merged into `affected`: a component with its
      * own scope that goes back to following the plugin, or one cut by the disable); and the orgs a
-     * skill would newly be offered to whose own skills use its name. `onAfter`: the orgs the plugin
-     * is on in after the change.
+     * skill would newly be offered to whose own skills use its name, or a theme would come on in
+     * where another theme with its id is on; and per theme the orgs it would go off in
+     * (`themesLost`). `onAfter`: the orgs the plugin is on in after the change.
      */
     async componentChanges(item, target, orgs, onAfter, affected) {
         const db = this.db;
         const replaced = [];
         const conflicts = [];
+        const themesLost = new Map();
         const lose = new Map();
         for (const kind of COMPONENT_KINDS) {
             const comps = await loadComponents(db, kind, { itemId: item.id });
@@ -997,7 +1043,31 @@ let CatalogScopeService = class CatalogScopeService {
                     };
                     const listed = listedIn(st, c.id, org.id);
                     const s = switchOf(st, c.id, org.id);
-                    if (componentOn(c, pNow, listed, s) && !componentOn(cAfter, pAfter, listed, s)) {
+                    const onNow = componentOn(c, pNow, listed, s);
+                    const onAfterChange = componentOn(cAfter, pAfter, listed, s);
+                    if (kind === "theme") {
+                        if (onNow && !onAfterChange) {
+                            const set = themesLost.get(c.id) ?? new Set();
+                            set.add(org.id);
+                            themesLost.set(c.id, set);
+                        }
+                        if (onAfterChange && !onNow) {
+                            const clash = await themeIdClashes(db, org.id, c, c.name);
+                            if (clash.length > 0) {
+                                conflicts.push({
+                                    orgId: org.id,
+                                    orgName: org.name,
+                                    name: c.name,
+                                    skills: [],
+                                    themes: clash.map((x) => x.id),
+                                    plugins: clash.map((x) => x.plugin ?? "platform"),
+                                    kind: "theme",
+                                });
+                            }
+                        }
+                        continue;
+                    }
+                    if (onNow && !onAfterChange) {
                         for (const a of await agentsUsing(db, org.id, kind, [c.id])) {
                             const m = lose.get(org.id) ?? new Map();
                             m.set(a.id, a.name);
@@ -1031,7 +1101,7 @@ let CatalogScopeService = class CatalogScopeService {
                     e.agents.push({ id, name });
             }
         }
-        return { replaced, conflicts };
+        return { replaced, conflicts, themesLost };
     }
     /**
      * Sends the components of the item with their own scope back to following it (a plugin scope
@@ -1044,7 +1114,9 @@ let CatalogScopeService = class CatalogScopeService {
                 ? "platform_skills"
                 : r.kind === "agent_template"
                     ? "platform_agent_templates"
-                    : "platform_connector_templates";
+                    : r.kind === "theme"
+                        ? "platform_themes"
+                        : "platform_connector_templates";
             await this.db
                 .updateTable(table)
                 .set({

package/dist/catalog/catalog.service.d.ts

@@ -111,6 +111,7 @@ export interface ComponentCounts {
     skills: number;
     connectorTemplates: number;
     agentTemplates: number;
+    themes: number;
 }
 /**
  * A git source as recorded (spec §5.1: the actual host, repo and commit, and whether it follows a
@@ -329,8 +330,8 @@ export declare class CatalogService {
     /**
      * Deletes the item (soft delete, audit `catalog.removed`; requests still pending are cancelled in
      * the same transaction): versions and stored files are kept (installed components still refer to
-     * them), organizations no longer see it; the same name can later be imported again as a new
-     * item. Deleted / missing -> `catalog.item_not_found`. A platform plugin whose extension is
+     * them), its themes are soft-deleted (nothing refers to their rows), organizations no longer see
+     * it; the same name can later be imported again as a new item. Deleted / missing -> `catalog.item_not_found`. A platform plugin whose extension is
      * still enabled on the deployment -> 409 `catalog.extension_enabled` (details
      * `[{ extension, displayName }]`): disable it on the Extensions page first, as an uninstall
      * requires. A disabled extension keeps its install record (the super admin uninstalls it on the
@@ -353,9 +354,10 @@ export declare class CatalogService {
      * The soft delete of {@link remove} in the caller's transaction, without its super admin check
      * (pre-flight F14: the super admin's remove and an owner's delete or an org deletion,
      * `OwnedItems.transferOrRemove`, share it): `deleted_at` set, a pending version cleared, the
-     * extension name claim of a first upload still waiting released (ruling P3-37, F10), pending
-     * requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the removed
-     * item's name, or null when it is gone already.
+     * extension name claim of a first upload still waiting released (ruling P3-37, F10), its themes
+     * soft-deleted (refused with 409 `theme.platform_default` while one is the platform default),
+     * pending requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the
+     * removed item's name, or null when it is gone already.
      */
     removeIn(actor: string | null, itemId: string, opts?: ActorOpts & {
         reason?: string;

package/dist/catalog/catalog.service.js

@@ -21,6 +21,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { sameRepository } from "../packages/provenance.js";
+import { assertNotPlatformDefault } from "../themes/theme-usage.js";
 import { countInstalls, itemConfirmations, itemScopeFacts, itemView, marketplaceLatest, versionUsable, } from "./catalog-items.js";
 import { expandGitUrl, GitSourceError, gitErrorDetails, normalGitPath, readGitTreeAndOids, resolveGitCommit, } from "./git-source.js";
 import { fetchMarketplaceArchive, marketplaceNetPolicy, marketplaceUrlProblem, } from "./marketplace-fetch.js";
@@ -463,8 +464,8 @@ let CatalogService = class CatalogService {
     /**
      * Deletes the item (soft delete, audit `catalog.removed`; requests still pending are cancelled in
      * the same transaction): versions and stored files are kept (installed components still refer to
-     * them), organizations no longer see it; the same name can later be imported again as a new
-     * item. Deleted / missing -> `catalog.item_not_found`. A platform plugin whose extension is
+     * them), its themes are soft-deleted (nothing refers to their rows), organizations no longer see
+     * it; the same name can later be imported again as a new item. Deleted / missing -> `catalog.item_not_found`. A platform plugin whose extension is
      * still enabled on the deployment -> 409 `catalog.extension_enabled` (details
      * `[{ extension, displayName }]`): disable it on the Extensions page first, as an uninstall
      * requires. A disabled extension keeps its install record (the super admin uninstalls it on the
@@ -522,13 +523,25 @@ let CatalogService = class CatalogService {
      * The soft delete of {@link remove} in the caller's transaction, without its super admin check
      * (pre-flight F14: the super admin's remove and an owner's delete or an org deletion,
      * `OwnedItems.transferOrRemove`, share it): `deleted_at` set, a pending version cleared, the
-     * extension name claim of a first upload still waiting released (ruling P3-37, F10), pending
-     * requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the removed
-     * item's name, or null when it is gone already.
+     * extension name claim of a first upload still waiting released (ruling P3-37, F10), its themes
+     * soft-deleted (refused with 409 `theme.platform_default` while one is the platform default),
+     * pending requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the
+     * removed item's name, or null when it is gone already.
      */
     async removeIn(actor, itemId, opts = {}) {
         const t = this.db;
         const now = sql `now()`;
+        // Its themes go with it: refused while one is the platform default (themes spec §7), before
+        // anything is written
+        // (the theme rows FOR UPDATE first: the theme lock order is item, theme row, `uiTheme`)
+        const themes = await t
+            .selectFrom("platform_themes")
+            .select("id")
+            .where("catalog_item_id", "=", itemId)
+            .where("deleted_at", "is", null)
+            .forUpdate()
+            .execute();
+        await assertNotPlatformDefault(t, themes.map((r) => r.id), () => "gone");
         const row = await t
             .updateTable("catalog_items")
             .set({
@@ -551,6 +564,14 @@ let CatalogService = class CatalogService {
             await this.installLock.lock(row.name);
             await releaseExtensionClaim(t, row.name, row.package_name);
         }
+        // Its themes go with it (themes spec §6): nothing refers to a theme row (a theme picked by an
+        // org or a person is an id that falls back once no live theme has it)
+        await t
+            .updateTable("platform_themes")
+            .set({ deleted_at: now, updated_at: now })
+            .where("catalog_item_id", "=", itemId)
+            .where("deleted_at", "is", null)
+            .execute();
         // Pending requests for a deleted item are pointless: cancel them in the same transaction
         await cancelPendingRequests(t, { itemId }, actor, "item_removed", opts);
         await audit(t, {

package/dist/catalog/claude/translate.js

@@ -836,6 +836,9 @@ export function translateClaudePlugin(files, o) {
         // the raw Claude agents/*.md the tree still holds and parse them as Capybara templates
         // (batch 12 review I1); normalizedManifest drops an empty list, so digests are unchanged
         agents: agents.agents.map((a) => ({ path: `./${a.path}` })),
+        // always empty, for the same reason: a Claude Code plugin's themes/*.json are not Capybara
+        // themes (themes spec §4); normalizedManifest drops the empty list
+        themes: [],
     };
     const checked = parsePluginManifest(manifest);
     if ("errors" in checked) {