Seeds from an untrusted source, reduced to what derivation can use safely: hex colors, finite numbers
clamped to sane ranges, and font stacks that cannot end the CSS declaration they are written into.
Anything else is dropped (the default takes its place); no usable primary means null.
For a page that applies a theme before anyone signs in, where the seeds came over an unauthenticated
route: derive writes several of these values into CSS verbatim.
Seeds from an untrusted source, reduced to what derivation can use safely: hex colors, finite numbers clamped to sane ranges, and font stacks that cannot end the CSS declaration they are written into. Anything else is dropped (the default takes its place); no usable
primarymeans null.For a page that applies a theme before anyone signs in, where the seeds came over an unauthenticated route:
derivewrites several of these values into CSS verbatim.