[OpenSpec] authoring-multi-brand-token-source

[github-actions]

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• ✅ Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Specs

• 📄 multi-brand-token-sources
• 📄 theming-audit

Tasks

• 1.1 Read packages/tokens-studio-for-figma/src/types/ThemeObject.ts and the token set status
• 1.2 Build three fixtures under tests/Unit/fixtures/multi-brand/: a Tokens Studio file with
• 2.1 Add TokenSetConverterService::detectBrands() (design decision 1). Verify: PHPUnit
• 2.2 Cut one brand out of a source and feed it to convert() (decision 3). Verify: PHPUnit
• 2.3 Add the optional referenceOnlyPaths argument to DesignTokensMapper::map() and to
• 2.4 Mirror 2.1 and 2.2 in js/lib/tokenConverter.js, so the CLI and the admin path agree.
• 3.1 Add the brands parameter to CustomTokenSetController::upload(): no parameter lists
• 3.2 Store each brand through CustomTokenSetService::store() with the source link, write the
• 3.3 Add POST /settings/tokensets/sources/{sourceId} (updateSource()) with
• 3.4 Remove the source record when its last brand set is deleted (decision 6). Verify: PHPUnit
• 3.5 Add custom_source_updated to ThemingAuditService::VOCABULARY, and carry sourceId and
• 3.6 Add the upload and update calls, with 200, 401, 403, 409 and 422 paths, to
• 4.1 Render the brand picker after a multiBrand response: one labelled checkbox per brand,
• 4.2 Group brand sets under their source name in renderCustomSetList() with an "Update
• 4.3 Render the update report (updated, missing, new) in the existing result region
• 5.1 Localisation: every new string in l10n/en.json and l10n/nl.json, using the thematiq
• 5.2 Documentation: a "Several brands in one source" section in
• 5.3 WCAG AA contrast: each brand set gets its own contrast warnings through store(). Test a
• 5.4 Dark mode: each brand set gets a dark variant on import and on update. Verify: PHPUnit
• 5.5 Incomplete token sets: a brand that sets only a primary colour still stores all required
• 5.6 Accessibility of the picker: checkboxes have visible labels, the picker works without a
• 5.7 Security: the new endpoint is admin-only, CSRF-protected, and returns generic error text
• 6.1 Run COMPOSER_PROCESS_TIMEOUT=0 composer check:strict once, then npm run lint,
• 6.2 Upload a real multi-brand source by hand on a running instance, import two brands, map one

Design

See design.md for technical design details.

---

Synced from openspec/changes/authoring-multi-brand-token-source by OpenSpec workflow
App: thematiq