Theme registry

An agency registers signed/approved theme versions before a client can select them. A site pins one theme version at a time. Theme switching always begins with a registry migration preview, then writes a separate draft document after all missing/incompatible slots are resolved.

ThemeRegistry resolves the developer-deployed theme definitions used for preview and migration. The Cloudflare adapter now persists each site’s draft and published theme selection in its tenant Durable Object through TenantWorkspaceThemeStore; theme source code remains deployed with the Astro application.

Theme selection and content are a pair. switchDraft() writes the schema-validated migrated document and target theme pin in one SQLite transaction with independent expected versions. publishSite() atomically publishes the matching draft document/theme pair. Public rendering therefore cannot observe new content under an old layout or an incompatible theme under old content.

The installed/agency-approved theme catalog and package signature/provenance checks remain an alpha gap. A site pin alone never proves that arbitrary third-party code is trusted.