Scope raw custom CSS under selector, but hoist at-rules that MUST live at the
stylesheet top level (@keyframes, @font-face, @property) out of the wrapper —
CSS nesting forbids them inside a style rule, so nesting them would silently break
animations/fonts. Everything else is wrapped so it only applies to this theme.
@import is STRIPPED entirely, not hoisted: a scoped theme overlay has no
legitimate need to pull another stylesheet, an org-wide @import of a remote URL
is a cross-origin request from every user's session (data-exfiltration surface),
and a hoisted @import would be dead anyway — CSS ignores @import after any
other rule, and the overlay Blob always begins with the token block.
Scope raw custom CSS under
selector, but hoist at-rules that MUST live at the stylesheet top level (@keyframes,@font-face,@property) out of the wrapper — CSS nesting forbids them inside a style rule, so nesting them would silently break animations/fonts. Everything else is wrapped so it only applies to this theme.@importis STRIPPED entirely, not hoisted: a scoped theme overlay has no legitimate need to pull another stylesheet, an org-wide@importof a remote URL is a cross-origin request from every user's session (data-exfiltration surface), and a hoisted@importwould be dead anyway — CSS ignores@importafter any other rule, and the overlay Blob always begins with the token block.