Theme Forge Stellar Burst v0.4.0

Theme Forge Stellar Burst v0.4.0

Theme Forge Stellar Burst v0.4.0 provides a brand system engine and design-evidence workbench, featuring typed protocol adapters, deterministic rendering transformations, and verified distribution artifacts.

Coordinated Products

• Core Package: Theme Forge Stellar Burst v0.4.0 (Published to npm registry; distribution package attached)
• Desktop Companion: Theme Forge Nebular Fusion v0.1.0 (Knowledge-Forge-AI/theme-forge-nebular-fusion, macOS Apple Silicon aarch64-apple-darwin developer distribution)

Distribution Assets & Package Differentiation

This release distinguishes the staging source composition archive from the npm distribution package:

Asset	Type	Size	SHA-256
theme-forge-stellar-burst-0.4.0.tgz	Staging Source Composition Archive	1,299,876 bytes	90863cc5f0fb0de193ab89ef7730e875349b4ccc2a154753aaa8d0af3f975bad
knowledge-forge-ai-theme-forge-stellar-burst-0.4.0.tgz	npm Distribution Package	548,758 bytes	baac6608c91bf52fbdd5b84a41a9af3a074866d0e29700a03410b87575925263
SHA256SUMS-stellar-v0.4.0.txt	Source & Staging Manifest	658 bytes	548cacd3a0df9a3affdd5454bdf867fd7759dd7cbb64262433646f5988e940f2
SHA256SUMS-npm-package-v0.4.0.txt	Supplemental npm Package Manifest	121 bytes	558172772870fc63ca2940814ae8d75e807d1f0d07f43bdd439a343c2de81fe5

npm Package Details

• Package Name: @knowledge-forge-ai/theme-forge-stellar-burst
• Version: 0.4.0
• SHA-256: baac6608c91bf52fbdd5b84a41a9af3a074866d0e29700a03410b87575925263
• Integrity: sha512-Lo8LryYHsGTwGJF9WtdywzuEdkq4KdjGhDfDZ0c11zYrsjiThpsGrsSKS/uN0mqkQGIve5LbgIprwuJVrLpF6A==
• Tarball Entries: 302 entries (under package/)
• Binaries: tfsb (./dist/cli.js), tfsb-studio-service (./dist/service-protocol/server-cli.js)
• Native Prebuilds Included: darwin-arm64, darwin-x64, linux-x64-gnu (fail-closed loader architecture)
• Licensing: AGPL-3.0-or-later + separate commercial licensing (COMMERCIAL-LICENSE.md); third-party notices (NOTICE)

Verification & Source Binding

• Composed Tree SHA-256: 2743d0ba09ee22e33c3d0ffd55cad9607745ce055ab55844aba043c6f08c5521
• Public Merge Tree: a5deea96cfec03b565e205fcd6d9bbc1e6a752d1
• Public Merge Commit: 4f6d7720204c895517b544ce706624776cefb6a0

Installation & Distribution Status

Install from the public npm registry:

npm install --global @knowledge-forge-ai/theme-forge-stellar-burst@0.4.0

To install directly from the verified release asset:

npm install --global https://github.com/Knowledge-Forge-AI/theme-forge-stellar-burst/releases/download/v0.4.0/knowledge-forge-ai-theme-forge-stellar-burst-0.4.0.tgz

Requires Node.js >=22.0.0.

Signing & Provenance Boundaries

• npm Package: Local CLI publish channel; does not carry npm hosted provenance attestations (dist.attestations absent).
• Desktop Application (nebular-fusion.app.tar.gz): macOS developer distribution with ad-hoc signing (Signature=adhoc). Apple Developer ID and Apple Notarization are not present as designed.

Measured Security & Supply Chain Coverage

• CodeQL Security Analysis: 0 open security alerts under GitHub CodeQL (/code-scanning/alerts). Analyses evaluated JavaScript/TypeScript (103 rules, 45 SARIF results), C/C++ (95 rules, 0 results), and GitHub Actions workflows (23 rules, 0 results).
• Software Bill of Materials (SBOM): Syft v1.51.1 cataloged 12 package entries across 6 distinct npm packages (@knowledge-forge-ai/theme-forge-stellar-burst, @knowledge-forge-ai/tfsb-raster-resvg, @resvg/resvg-wasm, @xmldom/xmldom, fflate, smol-toml) from the root package release payload. Available in SPDX (root-package.spdx.json), CycloneDX (root-package.cdx.json), and Syft JSON (root-package.syft.json).
• Vulnerability Scanning: Grype CLI 0.118.0 scanned cataloged packages against vulnerability database schema v6.1.9 (built 2026-09-05T06:27:00Z) with 0 reported vulnerabilities (root-package.grype.json).