@odla-ai/brand 0.2.0 → 0.3.0

package/dist/index.js

@@ -59,6 +59,7 @@ var BRAND_NS = {
   section: "brand_section",
   palette: "brand_palette",
   proposal: "brand_proposal",
+  approvalReceipt: "brand_approval_receipt",
   asset: "brand_asset"
 };
 var BOOK_STATUSES = ["draft", "active", "archived"];
@@ -66,9 +67,9 @@ var SECTION_KINDS = ["palette", "typography", "voice", "logo", "imagery"];
 var SECTION_STATUSES = ["draft", "approved"];
 var PALETTE_STATUSES = ["active", "archived"];
 var PALETTE_SOURCES = ["extracted", "derived", "manual"];
-var PROPOSAL_KINDS = ["palette", "typography", "voice", "logo"];
+var PROPOSAL_KINDS = SECTION_KINDS;
 var PROPOSAL_STATUSES = ["open", "accepted", "rejected", "superseded"];
-var ASSET_KINDS = ["logo", "wordmark", "inspiration", "document", "font", "other"];
+var ASSET_KINDS = ["logo", "wordmark", "inspiration", "document", "other"];
 var SWATCH_ROLES = [
   "primary",
   "secondary",
@@ -84,6 +85,25 @@ var SWATCH_ROLES = [
   "custom"
 ];
 
+// src/agent-profile.ts
+var BRAND_AGENT_PROFILE = {
+  version: 1,
+  projectCapabilities: ["brand.read", "brand.edit"],
+  semanticOperations: [
+    "brand.proposal.create",
+    "brand.asset.analysis.record",
+    "brand.asset.content.read"
+  ],
+  rawBrandWrites: false,
+  rawFileOperations: false,
+  approval: {
+    principalKind: "human",
+    projectCapability: "brand.approve",
+    capability: "brand.proposal.resolve",
+    exactAction: true
+  }
+};
+
 // src/errors.ts
 var BrandInputError = class extends Error {
   fields;
@@ -99,6 +119,31 @@ var BrandNotFoundError = class extends Error {
     this.name = "BrandNotFoundError";
   }
 };
+var BrandGoneError = class extends Error {
+  constructor(message = "brand authority or resource is no longer available") {
+    super(message);
+    this.name = "BrandGoneError";
+  }
+};
+var BrandForbiddenError = class extends Error {
+  constructor(message = "forbidden") {
+    super(message);
+    this.name = "BrandForbiddenError";
+  }
+};
+var BrandConflictError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BrandConflictError";
+  }
+};
+var BrandReviewStateChangedError = class extends BrandConflictError {
+  code = "brand_review_state_changed";
+  constructor(message = "proposal or live brand dependencies changed; review and approve again") {
+    super(message);
+    this.name = "BrandReviewStateChangedError";
+  }
+};
 
 // src/deps.ts
 async function defaultFetchBytes(url) {
@@ -134,17 +179,21 @@ var BRAND_SCHEMA = {
     [BRAND_NS.book]: {
       attrs: {
         id: uniq("string"),
+        version: a("number"),
         slug: uniq("string"),
         name: idx("string"),
         status: idx("string"),
         // draft | active | archived
         ownerId: idx("string"),
+        createdAuthorityRef: idx("string"),
+        rosterAuthorityRef: opt("string"),
         memberIds: a("json"),
         // the auth roster, incl. the bot agent id
-        channelId: idx("string", true),
+        channelId: a("string", { unique: true, indexed: true, optional: true }),
         activePaletteId: opt("string"),
+        activationRevision: a("number"),
         tokens: opt("json"),
-        // { light, dark, warnings, compiledAt }
+        // maps + complete palette/typography receipt provenance
         summary: opt("string"),
         createdAt: idx("date"),
         updatedAt: idx("date")
@@ -162,7 +211,9 @@ var BRAND_SCHEMA = {
         content: a("json"),
         audience: a("json"),
         updatedBy: a("string"),
-        updatedAt: idx("date")
+        updatedAt: idx("date"),
+        approvalReceiptId: opt("string"),
+        approvalActionDigest: opt("string")
       }
     },
     [BRAND_NS.palette]: {
@@ -178,7 +229,9 @@ var BRAND_SCHEMA = {
         source: a("string"),
         // extracted | derived | manual
         rationale: opt("string"),
-        proposalId: opt("string"),
+        proposalId: idx("string"),
+        approvalReceiptId: a("string"),
+        approvalActionDigest: a("string"),
         audience: a("json"),
         createdAt: idx("date"),
         updatedAt: idx("date")
@@ -194,14 +247,45 @@ var BRAND_SCHEMA = {
         // open | accepted | rejected | superseded
         payload: a("json"),
         rationale: a("string"),
-        sourceAssetId: opt("string"),
-        messageId: opt("string"),
+        provenance: a("json"),
+        // exact source asset/message/turn ids (nullable asset)
+        reviewDigest: idx("string"),
         audience: a("json"),
         createdBy: a("string"),
+        createdAuthorityRef: a("string"),
         createdAt: idx("date"),
         resolvedBy: opt("string"),
         resolvedAt: opt("date"),
-        resolutionNote: opt("string")
+        resolutionNote: opt("string"),
+        approvedBy: opt("string"),
+        appliedBy: opt("string"),
+        resolutionReceiptId: opt("string"),
+        resolutionActionDigest: opt("string")
+      }
+    },
+    [BRAND_NS.approvalReceipt]: {
+      attrs: {
+        id: uniq("string"),
+        version: a("number"),
+        mutationKey: uniq("string"),
+        bookId: idx("string"),
+        proposalId: idx("string"),
+        resolution: idx("string"),
+        // accepted | rejected
+        paletteId: opt("string"),
+        resolutionNote: opt("string"),
+        reviewedProposal: a("json"),
+        actionDigest: idx("string"),
+        decisionBinding: a("json"),
+        approvedBy: idx("string"),
+        approvedByKind: a("string"),
+        appliedBy: idx("string"),
+        appliedByKind: a("string"),
+        authorityRef: idx("string"),
+        authorityCapability: a("string"),
+        authorityConsumption: a("json"),
+        createdAt: idx("date"),
+        receiptDigest: idx("string")
       }
     },
     [BRAND_NS.asset]: {
@@ -209,59 +293,94 @@ var BRAND_SCHEMA = {
         id: uniq("string"),
         bookId: idx("string"),
         kind: idx("string"),
-        // logo | wordmark | inspiration | document | font | other
+        // logo | wordmark | inspiration | document | other
         path: idx("string"),
-        url: a("string"),
+        storageObjectId: idx("string"),
+        contentDigest: idx("string"),
         contentType: a("string"),
         size: a("number"),
+        status: idx("string"),
+        // live | deleting | deleted
         title: opt("string"),
         analysis: opt("json"),
         // { description, dominantColors: hex[], tags }
         analyzedAt: opt("date"),
+        analysisRevision: a("number"),
+        analysisDigest: opt("string"),
+        analyzedBy: opt("string"),
+        analyzedAuthorityRef: opt("string"),
         audience: a("json"),
         uploadedBy: a("string"),
+        uploadedAuthorityRef: a("string"),
         createdAt: idx("date"),
-        deletedAt: opt("date")
+        deletedAt: opt("date"),
         // tombstone — asset rows are never row-deleted
+        deletedBy: opt("string"),
+        deletedAuthorityRef: opt("string")
       }
     }
   },
-  links: {}
+  links: {
+    brandSectionBook: {
+      forward: { on: BRAND_NS.section, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "sections" }
+    },
+    brandPaletteBook: {
+      forward: { on: BRAND_NS.palette, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "palettes" }
+    },
+    brandProposalBook: {
+      forward: { on: BRAND_NS.proposal, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "proposals" }
+    },
+    brandApprovalReceiptBook: {
+      forward: { on: BRAND_NS.approvalReceipt, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "approvalReceipts" }
+    },
+    brandAssetBook: {
+      forward: { on: BRAND_NS.asset, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "assets" }
+    }
+  }
 };
 
 // src/rules.ts
-var AUDIENCE = "auth.id in data.audience";
+var CURRENT_BOOK_MEMBER = "ref('book.memberIds').exists(members, auth.id in members)";
 var BRAND_RULES = {
   [BRAND_NS.book]: {
     view: "auth.id in data.memberIds",
-    // Creator is the owner and must include itself in the roster.
-    create: "auth.signedIn && auth.id == data.ownerId && auth.id in data.memberIds",
-    update: "auth.id == data.ownerId",
-    delete: "auth.id == data.ownerId"
+    // Every mutation is worker-routed: CEL cannot distinguish an update from
+    // a retract, so effect-bearing fields must never be browser-writable.
+    create: "false",
+    update: "false",
+    delete: "false"
   },
   [BRAND_NS.section]: {
-    view: AUDIENCE,
-    create: AUDIENCE,
-    update: AUDIENCE,
+    view: CURRENT_BOOK_MEMBER,
+    create: "false",
+    update: "false",
     delete: "false"
-    // sections are upserted in place, never removed
   },
   [BRAND_NS.palette]: {
-    view: AUDIENCE,
-    create: AUDIENCE,
-    update: AUDIENCE,
+    view: CURRENT_BOOK_MEMBER,
+    create: "false",
+    update: "false",
     delete: "false"
-    // archive via status, keep provenance
   },
   [BRAND_NS.proposal]: {
-    view: AUDIENCE,
-    create: AUDIENCE,
-    update: AUDIENCE,
+    view: CURRENT_BOOK_MEMBER,
+    create: "false",
+    update: "false",
+    delete: "false"
+  },
+  [BRAND_NS.approvalReceipt]: {
+    view: CURRENT_BOOK_MEMBER,
+    create: "false",
+    update: "false",
     delete: "false"
-    // resolution history is the audit trail
   },
   [BRAND_NS.asset]: {
-    view: "false",
+    view: CURRENT_BOOK_MEMBER,
     create: "false",
     update: "false",
     delete: "false"
@@ -278,7 +397,6 @@ var ASSET_CONTENT_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/gif",
   "image/webp",
-  "image/svg+xml",
   "application/pdf"
 ]);
 var HEX_RGB = /^#[0-9a-f]{3}$/;
@@ -395,8 +513,11 @@ function assertSectionContent(kind, content) {
 }
 function safeFileName(name) {
   if (typeof name !== "string") throw new BrandInputError("file name must be a string");
-  const cleaned = name.replace(/[/\\]/g, "").replace(/[\u0000-\u001f\u007f]/g, "").trim().replace(/^\.+/, "");
-  if (cleaned === "") throw new BrandInputError("file name is empty after sanitizing");
+  if (/[/\\?#%\u0000-\u001f\u007f]/.test(name))
+    throw new BrandInputError("file name must not contain path or URL delimiter characters");
+  const cleaned = name.trim().replace(/^\.+/, "");
+  if (cleaned === "" || cleaned === "." || cleaned === "..")
+    throw new BrandInputError("file name is empty or a dot segment after sanitizing");
   return cleaned.slice(0, 120);
 }
 function assertAssetContentType(value) {
@@ -421,6 +542,237 @@ function assertAnalysis(value) {
   };
 }
 
+// src/review-json.ts
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+function isBoundedBrandJson(root, limits = {}) {
+  const maxDepth = limits.maxDepth ?? 12;
+  const maxNodes = limits.maxNodes ?? 2048;
+  const maxBytes = limits.maxBytes ?? 32 * 1024;
+  const stack = [{
+    value: root,
+    depth: 0
+  }];
+  const seen = /* @__PURE__ */ new Set();
+  let nodes = 0;
+  while (stack.length) {
+    const { value, depth } = stack.pop();
+    if (++nodes > maxNodes || depth > maxDepth) return false;
+    if (value === null || typeof value === "string" || typeof value === "boolean") continue;
+    if (typeof value === "number") {
+      if (!Number.isFinite(value)) return false;
+      continue;
+    }
+    if (typeof value !== "object" || seen.has(value)) return false;
+    seen.add(value);
+    if (Array.isArray(value)) {
+      for (const child of value)
+        stack.push({ value: child, depth: depth + 1 });
+    } else if (record(value)) {
+      for (const child of Object.values(value))
+        stack.push({ value: child, depth: depth + 1 });
+    } else {
+      return false;
+    }
+  }
+  try {
+    return new TextEncoder().encode(JSON.stringify(root)).byteLength <= maxBytes;
+  } catch {
+    return false;
+  }
+}
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  const row = value;
+  return `{${Object.keys(row).sort().map((key) => `${JSON.stringify(key)}:${canonical(row[key])}`).join(",")}}`;
+}
+function canonicalBrandJson(value) {
+  if (!isBoundedBrandJson(value, {
+    maxDepth: 20,
+    maxNodes: 8192,
+    maxBytes: 128 * 1024
+  })) throw new TypeError("brand digest input must be bounded finite JSON");
+  return canonical(value);
+}
+async function brandJsonDigest(value) {
+  const bytes = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(canonicalBrandJson(value))
+  );
+  return `sha256:${[...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/review.ts
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var record2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+var exactKeys = (value, required, optional = []) => {
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => allowed.has(key));
+};
+var boundedString = (value, max = 200) => typeof value === "string" && value.length > 0 && value.length <= max;
+var safeTime = (value) => Number.isSafeInteger(value) && value >= 0;
+function brandAuthorityRef(consumption) {
+  return `authority:${consumption.grantId}:v${consumption.grantVersion}`;
+}
+var SNAPSHOT_REQUIRED = [
+  "id",
+  "bookId",
+  "kind",
+  "status",
+  "payload",
+  "rationale",
+  "provenance",
+  "reviewDigest",
+  "audience",
+  "createdBy",
+  "createdAuthorityRef",
+  "createdAt"
+];
+function validSnapshotShape(value) {
+  if (!record2(value) || !exactKeys(value, SNAPSHOT_REQUIRED)) return false;
+  const provenance = value.provenance;
+  return boundedString(value.id) && boundedString(value.bookId) && typeof value.kind === "string" && PROPOSAL_KINDS.includes(value.kind) && value.status === "open" && record2(value.payload) && boundedString(value.rationale, 2e3) && record2(provenance) && exactKeys(provenance, [
+    "sourceAssetId",
+    "sourceAsset",
+    "messageId",
+    "turnId",
+    "taintLabels"
+  ]) && (provenance.sourceAssetId === null || boundedString(provenance.sourceAssetId)) && (provenance.sourceAsset === null || record2(provenance.sourceAsset) && exactKeys(provenance.sourceAsset, [
+    "assetId",
+    "contentDigest",
+    "objectEtag",
+    "objectSize",
+    "pathDigest",
+    "contentType",
+    "analysisRevision",
+    "analysisDigest"
+  ]) && boundedString(provenance.sourceAsset.assetId) && typeof provenance.sourceAsset.contentDigest === "string" && DIGEST.test(provenance.sourceAsset.contentDigest) && boundedString(provenance.sourceAsset.objectEtag) && Number.isSafeInteger(provenance.sourceAsset.objectSize) && provenance.sourceAsset.objectSize > 0 && typeof provenance.sourceAsset.pathDigest === "string" && DIGEST.test(provenance.sourceAsset.pathDigest) && (provenance.sourceAsset.contentType === null || boundedString(provenance.sourceAsset.contentType, 160)) && (provenance.sourceAsset.analysisRevision === null || Number.isSafeInteger(provenance.sourceAsset.analysisRevision) && provenance.sourceAsset.analysisRevision >= 0) && (provenance.sourceAsset.analysisDigest === null || typeof provenance.sourceAsset.analysisDigest === "string" && DIGEST.test(provenance.sourceAsset.analysisDigest))) && (provenance.sourceAssetId === null && provenance.sourceAsset === null || provenance.sourceAssetId !== null && provenance.sourceAsset !== null && provenance.sourceAsset.assetId === provenance.sourceAssetId) && (provenance.messageId === null || boundedString(provenance.messageId)) && (provenance.turnId === null || boundedString(provenance.turnId)) && Array.isArray(provenance.taintLabels) && provenance.taintLabels.length <= 16 && provenance.taintLabels.every((label) => boundedString(label, 120)) && new Set(provenance.taintLabels).size === provenance.taintLabels.length && typeof value.reviewDigest === "string" && DIGEST.test(value.reviewDigest) && Array.isArray(value.audience) && value.audience.length > 0 && value.audience.length <= 100 && value.audience.every((id) => boundedString(id)) && new Set(value.audience).size === value.audience.length && boundedString(value.createdBy) && boundedString(value.createdAuthorityRef) && safeTime(value.createdAt);
+}
+var CONSUMPTION_REQUIRED = [
+  "id",
+  "grantId",
+  "grantVersion",
+  "useNumber",
+  "actorPrincipalId",
+  "actorKind",
+  "credentialId",
+  "credentialKind",
+  "appId",
+  "appIncarnation",
+  "capability",
+  "projectCapability",
+  "effect",
+  "actionDigest",
+  "resourceDigest",
+  "constraintEvidence",
+  "consumptionIdempotencyKey",
+  "requestDigest",
+  "consumedAt"
+];
+function isBrandHumanAuthorityConsumption(value) {
+  if (!record2(value) || !exactKeys(value, CONSUMPTION_REQUIRED)) return false;
+  return boundedString(value.id) && boundedString(value.grantId) && Number.isSafeInteger(value.grantVersion) && value.grantVersion > 0 && Number.isSafeInteger(value.useNumber) && value.useNumber > 0 && boundedString(value.actorPrincipalId) && value.actorKind === "human" && boundedString(value.credentialId) && value.credentialKind === "clerk" && boundedString(value.appId) && typeof value.appIncarnation === "string" && /^[a-f0-9]{32}$/.test(value.appIncarnation) && value.capability === "brand.proposal.resolve" && value.projectCapability === "brand.approve" && value.effect === "internal" && typeof value.actionDigest === "string" && DIGEST.test(value.actionDigest) && typeof value.resourceDigest === "string" && DIGEST.test(value.resourceDigest) && record2(value.constraintEvidence) && boundedString(value.consumptionIdempotencyKey) && typeof value.requestDigest === "string" && DIGEST.test(value.requestDigest) && safeTime(value.consumedAt);
+}
+var RECEIPT_REQUIRED = [
+  "version",
+  "id",
+  "mutationKey",
+  "bookId",
+  "proposalId",
+  "resolution",
+  "reviewedProposal",
+  "actionDigest",
+  "decisionBinding",
+  "approvedBy",
+  "approvedByKind",
+  "appliedBy",
+  "appliedByKind",
+  "authorityRef",
+  "authorityCapability",
+  "authorityConsumption",
+  "createdAt",
+  "receiptDigest"
+];
+async function verifyBrandApprovalReceipt(receipt2) {
+  try {
+    if (!isBoundedBrandJson(receipt2, { maxDepth: 14, maxNodes: 2500, maxBytes: 48 * 1024 }))
+      return false;
+    if (!record2(receipt2) || !exactKeys(receipt2, RECEIPT_REQUIRED, ["paletteId", "resolutionNote"]))
+      return false;
+    const binding = receipt2.decisionBinding;
+    if (receipt2.version !== 1 || !boundedString(receipt2.id) || !boundedString(receipt2.mutationKey) || !boundedString(receipt2.bookId) || !boundedString(receipt2.proposalId) || receipt2.resolution !== "accepted" && receipt2.resolution !== "rejected" || !validSnapshotShape(receipt2.reviewedProposal) || typeof receipt2.actionDigest !== "string" || !DIGEST.test(receipt2.actionDigest) || !record2(binding) || !exactKeys(binding, [
+      "version",
+      "bookVersion",
+      "activationRevision",
+      "activePaletteId",
+      "memberIdsDigest",
+      "activePaletteDigest",
+      "typographyDigest",
+      "sourceAssetDigest",
+      "effectDigest"
+    ]) || binding.version !== 1 || !Number.isSafeInteger(binding.bookVersion) || binding.bookVersion < 1 || !Number.isSafeInteger(binding.activationRevision) || binding.activationRevision < 0 || binding.activePaletteId !== null && !boundedString(binding.activePaletteId) || typeof binding.memberIdsDigest !== "string" || !DIGEST.test(binding.memberIdsDigest) || binding.activePaletteDigest !== null && (typeof binding.activePaletteDigest !== "string" || !DIGEST.test(binding.activePaletteDigest)) || binding.typographyDigest !== null && (typeof binding.typographyDigest !== "string" || !DIGEST.test(binding.typographyDigest)) || binding.sourceAssetDigest !== null && (typeof binding.sourceAssetDigest !== "string" || !DIGEST.test(binding.sourceAssetDigest)) || typeof binding.effectDigest !== "string" || !DIGEST.test(binding.effectDigest) || !boundedString(receipt2.approvedBy) || receipt2.approvedByKind !== "human" || !boundedString(receipt2.appliedBy) || receipt2.appliedByKind !== "human" || !boundedString(receipt2.authorityRef) || receipt2.authorityCapability !== "brand.approve" || !isBrandHumanAuthorityConsumption(receipt2.authorityConsumption) || !safeTime(receipt2.createdAt) || typeof receipt2.receiptDigest !== "string" || !DIGEST.test(receipt2.receiptDigest) || receipt2.paletteId !== void 0 && !boundedString(receipt2.paletteId) || receipt2.resolutionNote !== void 0 && !boundedString(receipt2.resolutionNote, 1e3)) return false;
+    const reviewed = receipt2.reviewedProposal;
+    const authority = receipt2.authorityConsumption;
+    if (reviewed.id !== receipt2.proposalId || reviewed.bookId !== receipt2.bookId || receipt2.approvedBy !== receipt2.appliedBy || authority.actorPrincipalId !== receipt2.approvedBy || authority.actionDigest !== receipt2.actionDigest || authority.consumptionIdempotencyKey !== receipt2.mutationKey || receipt2.authorityRef !== brandAuthorityRef(authority) || authority.consumedAt > receipt2.createdAt || receipt2.resolution === "rejected" && receipt2.paletteId !== void 0 || receipt2.resolution === "accepted" && reviewed.kind === "palette" && !receipt2.paletteId || reviewed.kind !== "palette" && receipt2.paletteId !== void 0) return false;
+    const { reviewDigest, ...unsignedReview } = reviewed;
+    if (await brandJsonDigest(unsignedReview) !== reviewDigest) return false;
+    const expectedAction = await brandJsonDigest({
+      version: 1,
+      reviewedProposal: reviewed,
+      resolution: receipt2.resolution,
+      resolutionNote: receipt2.resolutionNote ?? null,
+      paletteId: receipt2.paletteId ?? null,
+      decisionBinding: binding
+    });
+    if (expectedAction !== receipt2.actionDigest) return false;
+    if (await brandJsonDigest({ bookId: receipt2.bookId, proposalId: receipt2.proposalId }) !== authority.resourceDigest) return false;
+    const { receiptDigest, ...immutable } = receipt2;
+    return await brandJsonDigest(immutable) === receiptDigest;
+  } catch {
+    return false;
+  }
+}
+
+// src/discussion-reference.ts
+var BRAND_DISCUSSION_REFERENCE_KINDS = [
+  "brand:book",
+  "brand:asset",
+  "brand:palette",
+  "brand:proposal",
+  "brand:receipt"
+];
+var SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,199}$/;
+function brandDiscussionReferenceId(target) {
+  return target.resourceId ? `${target.bookId}/${target.resourceId}` : target.bookId;
+}
+function formatBrandDiscussionReference(target) {
+  return `${target.kind}/${brandDiscussionReferenceId(target)}`;
+}
+function parseBrandDiscussionReference(input) {
+  let raw;
+  try {
+    raw = input instanceof URL ? input.searchParams.get("odla-ref") : new URL(input, "https://brand.invalid").searchParams.get("odla-ref");
+  } catch {
+    return null;
+  }
+  if (!raw) return null;
+  const [kind, bookId, resourceId, extra] = raw.split("/");
+  if (extra !== void 0 || !BRAND_DISCUSSION_REFERENCE_KINDS.includes(
+    kind
+  ) || !bookId || !SEGMENT.test(bookId)) return null;
+  const typedKind = kind;
+  if (typedKind === "brand:book") {
+    return resourceId === void 0 ? { kind: typedKind, bookId } : null;
+  }
+  return resourceId && SEGMENT.test(resourceId) ? { kind: typedKind, bookId, resourceId } : null;
+}
+function brandDiscussionReferenceHref(current, target, basePath = "/") {
+  const next = new URL(current.origin);
+  next.pathname = basePath.startsWith("/") ? basePath : `/${basePath}`;
+  next.searchParams.set("odla-ref", formatBrandDiscussionReference(target));
+  return next.toString();
+}
+
 // src/ops/books.ts
 var SLUG_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 function createBookOps(input) {
@@ -428,7 +780,11 @@ function createBookOps(input) {
   if (!SLUG_RE.test(slug))
     throw new BrandInputError("slug must be lowercase letters, digits, and inner hyphens");
   const name = capString(input.name, "name", 120);
-  const memberIds = Array.from(/* @__PURE__ */ new Set([input.ownerId, ...input.memberIds]));
+  const ownerId = capString(input.ownerId, "ownerId", 160);
+  const createdAuthorityRef = capString(input.createdAuthorityRef, "createdAuthorityRef", 200);
+  const memberIds = Array.from(/* @__PURE__ */ new Set([ownerId, ...input.memberIds.map((id, index) => capString(id, `memberIds[${index}]`, 160))]));
+  if (memberIds.length > 100)
+    throw new BrandInputError("a brand book supports at most 100 members");
   return [
     {
       t: "update",
@@ -436,11 +792,14 @@ function createBookOps(input) {
       id: input.id,
       attrs: {
         id: input.id,
+        version: 1,
         slug,
         name,
         status: "draft",
-        ownerId: input.ownerId,
+        ownerId,
+        createdAuthorityRef,
         memberIds,
+        activationRevision: 0,
         createdAt: input.now,
         updatedAt: input.now,
         ...input.channelId ? { channelId: input.channelId } : {}
@@ -448,8 +807,8 @@ function createBookOps(input) {
     }
   ];
 }
-var PATCHABLE = /* @__PURE__ */ new Set(["name", "status", "channelId", "summary", "activePaletteId", "tokens"]);
-var CLEARABLE = /* @__PURE__ */ new Set(["channelId", "summary", "activePaletteId", "tokens"]);
+var PATCHABLE = /* @__PURE__ */ new Set(["name", "status", "channelId", "summary"]);
+var CLEARABLE = /* @__PURE__ */ new Set(["channelId", "summary"]);
 function validateBookField(key, value) {
   switch (key) {
     case "name":
@@ -462,13 +821,8 @@ function validateBookField(key, value) {
       return capString(value, "channelId", 128);
     case "summary":
       return capString(value, "summary", 2e3);
-    case "activePaletteId":
-      return capString(value, "activePaletteId", 128);
-    default: {
-      if (typeof value !== "object" || value === null || Array.isArray(value))
-        throw new BrandInputError("tokens must be an object");
+    default:
       return value;
-    }
   }
 }
 function updateBookOps(bookId, patch, now) {
@@ -515,6 +869,7 @@ function upsertSectionOps(input) {
   if (!SECTION_STATUSES.includes(status))
     throw new BrandInputError(`status must be one of: ${SECTION_STATUSES.join(", ")}`);
   const content = assertSectionContent(input.kind, input.content);
+  if (status === "approved" && (!input.approvalReceiptId || !input.approvalActionDigest)) throw new BrandInputError("approved sections require approval receipt provenance");
   const key = sectionKey(input.bookId, input.kind);
   return [
     {
@@ -529,47 +884,105 @@ function upsertSectionOps(input) {
         content,
         audience: input.audience,
         updatedBy: input.updatedBy,
-        updatedAt: input.now
+        updatedAt: input.now,
+        ...input.approvalReceiptId ? { approvalReceiptId: capString(input.approvalReceiptId, "approvalReceiptId", 200) } : {},
+        ...input.approvalActionDigest ? { approvalActionDigest: capString(input.approvalActionDigest, "approvalActionDigest", 80) } : {}
       }
+    },
+    {
+      t: "link",
+      ns: BRAND_NS.section,
+      id: { ns: BRAND_NS.section, attr: "key", value: key },
+      label: "book",
+      target: input.bookId
     }
   ];
 }
+async function proposeSectionOps(input) {
+  if (input.taintLabels.length > 16)
+    throw new BrandInputError("taintLabels must have at most 16 entries");
+  const proposal = {
+    id: input.id,
+    bookId: input.bookId,
+    kind: input.kind,
+    status: "open",
+    payload: { content: assertSectionContent(input.kind, input.content) },
+    rationale: capString(input.rationale, "rationale", 2e3),
+    provenance: {
+      sourceAssetId: input.sourceAsset?.assetId ?? null,
+      sourceAsset: input.sourceAsset ?? null,
+      messageId: capString(input.messageId, "messageId", 200),
+      turnId: capString(input.turnId, "turnId", 200),
+      taintLabels: [...new Set(input.taintLabels.map((label, index) => capString(label, `taintLabels[${index}]`, 120)))].sort()
+    },
+    audience: input.audience,
+    createdBy: input.createdBy,
+    createdAuthorityRef: input.createdAuthorityRef,
+    createdAt: input.now
+  };
+  return [
+    {
+      t: "update",
+      ns: BRAND_NS.proposal,
+      id: input.id,
+      attrs: { ...proposal, reviewDigest: await brandJsonDigest(proposal) }
+    },
+    { t: "link", ns: BRAND_NS.proposal, id: input.id, label: "book", target: input.bookId }
+  ];
+}
 
 // src/ops/palettes.ts
-function proposePaletteOps(input) {
+async function proposePaletteOps(input) {
   const name = capString(input.name, "name", 120);
   const rationale = capString(input.rationale, "rationale", 2e3);
   const swatches = assertSwatches(input.swatches);
   const seedHex = input.seedHex === void 0 ? void 0 : assertHex(input.seedHex, "seedHex");
+  if (input.taintLabels.length > 16)
+    throw new BrandInputError("taintLabels must have at most 16 entries");
   const payload = {
     name,
     swatches,
     ...seedHex ? { seedHex } : {},
     ...input.contrastReport !== void 0 ? { contrastReport: input.contrastReport } : {}
   };
+  const proposal = {
+    id: input.id,
+    bookId: input.bookId,
+    kind: "palette",
+    status: "open",
+    payload,
+    rationale,
+    provenance: {
+      sourceAssetId: input.sourceAsset?.assetId ?? null,
+      sourceAsset: input.sourceAsset ?? null,
+      messageId: capString(input.messageId, "messageId", 200),
+      turnId: capString(input.turnId, "turnId", 200),
+      taintLabels: [...new Set(input.taintLabels.map((label, index) => capString(label, `taintLabels[${index}]`, 120)))].sort()
+    },
+    audience: input.audience,
+    createdBy: input.createdBy,
+    createdAuthorityRef: input.createdAuthorityRef,
+    createdAt: input.now
+  };
   return [
     {
       t: "update",
       ns: BRAND_NS.proposal,
       id: input.id,
-      attrs: {
-        id: input.id,
-        bookId: input.bookId,
-        kind: "palette",
-        status: "open",
-        payload,
-        rationale,
-        audience: input.audience,
-        createdBy: input.createdBy,
-        createdAt: input.now,
-        ...input.sourceAssetId ? { sourceAssetId: input.sourceAssetId } : {},
-        ...input.messageId ? { messageId: input.messageId } : {}
-      }
-    }
+      attrs: { ...proposal, reviewDigest: await brandJsonDigest(proposal) }
+    },
+    { t: "link", ns: BRAND_NS.proposal, id: input.id, label: "book", target: input.bookId }
   ];
 }
 function acceptProposalOps(input) {
-  const { proposal, paletteId, resolvedBy, now } = input;
+  const {
+    proposal,
+    paletteId,
+    resolvedBy,
+    approvalReceiptId,
+    approvalActionDigest,
+    now
+  } = input;
   if (proposal.kind !== "palette")
     throw new BrandInputError(`proposal ${proposal.id} is a ${proposal.kind} proposal, not a palette`);
   if (proposal.status !== "open")
@@ -578,7 +991,7 @@ function acceptProposalOps(input) {
   const name = capString(payload.name, "payload.name", 120);
   const swatches = assertSwatches(payload.swatches);
   const seedHex = payload.seedHex === void 0 ? void 0 : assertHex(payload.seedHex, "payload.seedHex");
-  const source = proposal.sourceAssetId ? "extracted" : seedHex ? "derived" : "manual";
+  const source = proposal.provenance.sourceAsset ? "extracted" : seedHex ? "derived" : "manual";
   return [
     {
       t: "update",
@@ -593,12 +1006,19 @@ function acceptProposalOps(input) {
         source,
         rationale: proposal.rationale,
         proposalId: proposal.id,
+        approvalReceiptId: capString(approvalReceiptId, "approvalReceiptId", 200),
+        approvalActionDigest: capString(
+          approvalActionDigest,
+          "approvalActionDigest",
+          80
+        ),
         audience: proposal.audience,
         createdAt: now,
         updatedAt: now,
         ...seedHex ? { seedHex } : {}
       }
     },
+    { t: "link", ns: BRAND_NS.palette, id: paletteId, label: "book", target: proposal.bookId },
     ...upsertSectionOps({
       bookId: proposal.bookId,
       kind: "palette",
@@ -606,6 +1026,8 @@ function acceptProposalOps(input) {
       status: "approved",
       audience: proposal.audience,
       updatedBy: resolvedBy,
+      approvalReceiptId,
+      approvalActionDigest,
       now
     }),
     {
@@ -653,6 +1075,8 @@ function createAssetOps(input) {
   const contentType = assertAssetContentType(input.contentType);
   if (typeof input.size !== "number" || !Number.isFinite(input.size) || input.size <= 0)
     throw new BrandInputError("size must be a positive byte count");
+  if (!/^sha256:[0-9a-f]{64}$/.test(input.contentDigest))
+    throw new BrandInputError("contentDigest must be a SHA-256 digest");
   const title = input.title === void 0 ? void 0 : capString(input.title, "title", 160);
   return [
     {
@@ -664,27 +1088,68 @@ function createAssetOps(input) {
         bookId: input.bookId,
         kind: input.kind,
         path: capString(input.path, "path", 512),
-        url: capString(input.url, "url", 1024),
+        storageObjectId: capString(input.storageObjectId, "storageObjectId", 200),
+        contentDigest: capString(input.contentDigest, "contentDigest", 80),
         contentType,
         size: input.size,
+        status: "live",
+        analysisRevision: 0,
         audience: input.audience,
         uploadedBy: input.uploadedBy,
+        uploadedAuthorityRef: capString(
+          input.uploadedAuthorityRef,
+          "uploadedAuthorityRef",
+          200
+        ),
         createdAt: input.now,
         ...title ? { title } : {}
       }
-    }
+    },
+    { t: "link", ns: BRAND_NS.asset, id: input.id, label: "book", target: input.bookId }
   ];
 }
-function tombstoneAssetOps(assetId, now) {
-  return [{ t: "update", ns: BRAND_NS.asset, id: assetId, attrs: { deletedAt: now } }];
-}
-function recordAnalysisOps(assetId, analysis, now) {
+function beginAssetDeleteOps(assetId, now, deletedBy, deletedAuthorityRef) {
+  return [{
+    t: "update",
+    ns: BRAND_NS.asset,
+    id: assetId,
+    attrs: {
+      status: "deleting",
+      deletedAt: now,
+      deletedBy: capString(deletedBy, "deletedBy", 160),
+      deletedAuthorityRef: capString(deletedAuthorityRef, "deletedAuthorityRef", 200)
+    }
+  }];
+}
+function finishAssetDeleteOps(assetId) {
+  return [{
+    t: "update",
+    ns: BRAND_NS.asset,
+    id: assetId,
+    attrs: { status: "deleted" }
+  }];
+}
+async function recordAnalysisOps(assetId, analysis, priorRevision, analyzedBy, analyzedAuthorityRef, now) {
+  if (!Number.isSafeInteger(priorRevision) || priorRevision < 0)
+    throw new BrandInputError("prior analysis revision must be a non-negative integer");
+  const normalized = assertAnalysis(analysis);
   return [
     {
       t: "update",
       ns: BRAND_NS.asset,
       id: assetId,
-      attrs: { analysis: assertAnalysis(analysis), analyzedAt: now }
+      attrs: {
+        analysis: normalized,
+        analysisRevision: priorRevision + 1,
+        analysisDigest: await brandJsonDigest(normalized),
+        analyzedBy: capString(analyzedBy, "analyzedBy", 160),
+        analyzedAuthorityRef: capString(
+          analyzedAuthorityRef,
+          "analyzedAuthorityRef",
+          200
+        ),
+        analyzedAt: now
+      }
     }
   ];
 }
@@ -723,11 +1188,15 @@ function viewOutput(asset, bytes, contentType) {
 }
 function assetTools(ctx) {
   const loadAsset = async (assetId) => {
+    const book = await ctx.loadBook();
     const res = await ctx.db.query({
-      [BRAND_NS.asset]: { $: { where: { id: assetId, bookId: ctx.bookId } } }
+      [BRAND_NS.asset]: {
+        $: { where: { id: assetId, bookId: ctx.bookId } },
+        book: {}
+      }
     });
     const row = (res[BRAND_NS.asset] ?? [])[0];
-    if (!row || row.deletedAt) throw new BrandNotFoundError(`asset ${assetId}`);
+    if (!row || row.status !== "live" || row.deletedAt || !Array.isArray(row.book) || row.book.length !== 1 || row.book[0]?.id !== book.id) throw new BrandNotFoundError(`asset ${assetId}`);
     return row;
   };
   const viewAsset = {
@@ -746,8 +1215,8 @@ function assetTools(ctx) {
           content: `This model cannot take images inside tool results. Asset ${asset.id} must be attached as a pre-turn image by the host instead \u2014 ask the human to re-send their message referencing the asset (the dispatcher attaches it up front), or describe it from what they tell you.`
         };
       }
-      const url = asset.url.startsWith("http") ? asset.url : ctx.fileBaseUrl + asset.url;
-      const fetched = await ctx.fetchBytes(url);
+      const read = await ctx.authority("brand.read");
+      const fetched = await ctx.readAssetContent(asset.id);
       if (fetched.bytes.byteLength > MAX_VIEW_BYTES) {
         return {
           content: `Asset ${asset.id} is ${fetched.bytes.byteLength} bytes \u2014 over the ${MAX_VIEW_BYTES}-byte (4.5 MB) in-conversation viewing cap. Ask the human for a smaller export of this file.`
@@ -765,7 +1234,8 @@ function assetTools(ctx) {
   };
   const recordAnalysis = {
     name: "record_asset_analysis",
-    description: "Record what you observed in an asset you viewed: a description, its dominant colors as #rrggbb hex, and tags. Overwrites any prior analysis.",
+    description: "Record what you observed in an asset you viewed. Uses guarded analysis revisions so concurrent agents cannot overwrite each other silently.",
+    acceptsTaint: ["tool_untrusted:view_asset"],
     inputSchema: {
       type: "object",
       required: ["assetId", "description", "dominantColors", "tags"],
@@ -778,12 +1248,19 @@ function assetTools(ctx) {
     },
     handler: ctx.guard(async (input) => {
       const asset = await loadAsset(String(input.assetId));
+      await ctx.authority("brand.edit");
       const analysis = assertAnalysis({
         description: input.description,
         dominantColors: input.dominantColors,
         tags: input.tags
       });
-      await ctx.db.transact(recordAnalysisOps(asset.id, analysis, ctx.now()), { mutationId: ctx.newId() });
+      const updated = await ctx.recordAssetAnalysis({
+        mutationId: ctx.newId(),
+        assetId: asset.id,
+        analysis,
+        expectedAnalysisRevision: asset.analysisRevision
+      });
+      if (updated.id !== asset.id || updated.bookId !== ctx.bookId || updated.status !== "live" || updated.analysisRevision !== asset.analysisRevision + 1 || updated.analyzedBy !== ctx.self.selfId) throw new BrandNotFoundError("asset analysis bridge returned invalid state");
       return {
         content: `Recorded analysis for asset ${asset.id}: ${analysis.dominantColors.length} dominant color(s), ${analysis.tags.length} tag(s).`
       };
@@ -792,81 +1269,77 @@ function assetTools(ctx) {
   return [viewAsset, recordAnalysis];
 }
 
+// src/skill/source-asset.ts
+async function proposalSourceAssetId(ctx, book, value) {
+  if (value === void 0) return void 0;
+  const sourceAssetId = capString(value, "sourceAssetId", 200);
+  const result = await ctx.db.query({
+    [BRAND_NS.asset]: {
+      $: {
+        where: { id: sourceAssetId, bookId: book.id, status: "live" },
+        limit: 2
+      },
+      book: { $: { limit: 2 } }
+    }
+  });
+  const rows = result[BRAND_NS.asset] ?? [];
+  const asset = rows.length === 1 ? rows[0] : void 0;
+  if (!asset || asset.id !== sourceAssetId || asset.bookId !== book.id || asset.status !== "live" || asset.deletedAt !== void 0 || !Array.isArray(asset.book) || asset.book.length !== 1 || asset.book[0]?.id !== book.id) throw new BrandInputError(
+    "sourceAssetId must be a live asset in this brand book"
+  );
+  return sourceAssetId;
+}
+
 // src/skill/book-tools.ts
+var PROPOSABLE = SECTION_KINDS.filter((kind) => kind !== "palette");
 function bookTools(ctx) {
-  const updateSection = {
+  return [{
     name: "update_section",
-    description: "Create or replace one brand-book section (palette, typography, voice, logo, or imagery). Content is validated per kind. Status defaults to draft; a human approves.",
+    description: "Propose a typography, voice, logo, or imagery section revision for human approval. This never overwrites the live approved section.",
+    acceptsTaint: ["tool_untrusted:view_asset"],
     inputSchema: {
       type: "object",
-      required: ["kind", "content"],
+      required: ["kind", "content", "rationale"],
       properties: {
-        kind: { type: "string", enum: [...SECTION_KINDS] },
-        content: { type: "object", description: "The section payload for its kind." },
-        status: { type: "string", enum: ["draft", "approved"] }
+        kind: { type: "string", enum: PROPOSABLE },
+        content: { type: "object", description: "The complete proposed section payload." },
+        rationale: { type: "string", description: "Why this revision should replace the live section." },
+        sourceAssetId: {
+          type: "string",
+          description: "Optional exact live Brand asset that grounds this revision."
+        }
       }
     },
     handler: ctx.guard(async (input) => {
+      const allowed = /* @__PURE__ */ new Set(["kind", "content", "rationale", "sourceAssetId"]);
+      if (Object.keys(input).some((key) => !allowed.has(key)))
+        throw new BrandInputError("section proposal has unknown fields");
       const book = await ctx.loadBook();
-      const kind = String(input.kind);
-      const ops = upsertSectionOps({
-        bookId: ctx.bookId,
+      await ctx.authority("brand.edit");
+      const kind = input.kind;
+      if (kind === "palette" || !PROPOSABLE.includes(kind))
+        throw new BrandInputError(`kind must be one of: ${PROPOSABLE.join(", ")}`);
+      const rationale = capString(input.rationale, "rationale", 2e3);
+      const sourceAssetId = await proposalSourceAssetId(
+        ctx,
+        book,
+        input.sourceAssetId
+      );
+      const proposal = await ctx.createProposal({
+        mutationId: ctx.newId(),
         kind,
-        content: input.content,
-        status: input.status === void 0 ? void 0 : input.status,
-        audience: book.memberIds,
-        updatedBy: ctx.self.selfId,
-        now: ctx.now()
-      });
-      await ctx.db.transact(ops, { mutationId: ctx.newId() });
-      const status = input.status === void 0 ? "draft" : String(input.status);
-      return { content: `Saved ${kind} section as ${status} (key ${sectionKey(ctx.bookId, kind)}).` };
-    })
-  };
-  const compileTokens = {
-    name: "compile_tokens",
-    description: "Compile the book's palette (paletteId argument, or the active palette) plus the typography section into light/dark @odla-ai/ui tokens, cached on the book. Returns the compiler's warnings.",
-    inputSchema: {
-      type: "object",
-      properties: { paletteId: { type: "string", description: "Defaults to the book's active palette." } }
-    },
-    handler: ctx.guard(async (input) => {
-      const book = await ctx.loadBook();
-      const paletteId = input.paletteId === void 0 ? book.activePaletteId : capString(input.paletteId, "paletteId", 128);
-      if (!paletteId) {
-        throw new BrandInputError("no palette to compile: pass paletteId, or get a palette proposal accepted first");
-      }
-      const pres = await ctx.db.query({
-        [BRAND_NS.palette]: { $: { where: { id: paletteId, bookId: ctx.bookId } } }
-      });
-      const palette = (pres[BRAND_NS.palette] ?? [])[0];
-      if (!palette) throw new BrandNotFoundError(`palette ${paletteId}`);
-      const sres = await ctx.db.query({
-        [BRAND_NS.section]: { $: { where: { key: sectionKey(ctx.bookId, "typography") } } }
-      });
-      const typography = (sres[BRAND_NS.section] ?? [])[0];
-      const compiled = compileBrandTokens({
-        swatches: palette.swatches,
-        ...typography ? { typography: typography.content } : {}
+        payload: {
+          content: assertSectionContent(kind, input.content)
+        },
+        rationale,
+        ...sourceAssetId ? { sourceAssetId } : {}
       });
-      const now = ctx.now();
-      const snapshot = {
-        light: compiled.light,
-        dark: compiled.dark,
-        warnings: compiled.warnings,
-        compiledAt: now
+      if (proposal.bookId !== book.id || proposal.createdBy !== ctx.self.selfId || proposal.kind !== kind || proposal.status !== "open") throw new BrandInputError("brand proposal bridge returned an invalid proposal");
+      return {
+        content: `Parked ${kind} section proposal ${proposal.id}. The live section is unchanged; a human must approve this exact revision.`
       };
-      await ctx.db.transact(updateBookOps(ctx.bookId, { tokens: snapshot }, now), { mutationId: ctx.newId() });
-      const count = compiled.warnings.length;
-      const lines = [
-        `Compiled ${Object.keys(compiled.light).length} light + ${Object.keys(compiled.dark).length} dark tokens from palette ${paletteId}; ${count} warning(s).`,
-        ...compiled.warnings.slice(0, 3).map((w) => `- ${w.token}: ${w.message}${w.adjustedFrom ? ` (adjusted from ${w.adjustedFrom})` : ""}`)
-      ];
-      if (count > 3) lines.push(`\u2026 and ${count - 3} more.`);
-      return { content: lines.join("\n") };
     })
-  };
-  return [updateSection, compileTokens];
+  }];
 }
 
 // src/skill/palette-tools.ts
@@ -994,6 +1467,7 @@ function paletteTools(ctx) {
   const proposePalette = {
     name: "propose_palette",
     description: "Park a palette proposal for human review (does NOT change the brand). Pass explicit swatches, or a seedHex (and optional harmony) to derive a full palette. A WCAG contrast report is attached automatically.",
+    acceptsTaint: ["tool_untrusted:view_asset"],
     inputSchema: {
       type: "object",
       required: ["name", "rationale"],
@@ -1002,6 +1476,10 @@ function paletteTools(ctx) {
         rationale: { type: "string", description: "Why these colors \u2014 cite assets, harmony, contrast." },
         seedHex: { type: "string" },
         harmony: { type: "string", enum: Object.keys(HARMONY_COMPANIONS) },
+        sourceAssetId: {
+          type: "string",
+          description: "Optional exact asset id that grounded this palette."
+        },
         swatches: {
           type: "array",
           items: {
@@ -1017,8 +1495,16 @@ function paletteTools(ctx) {
         }
       }
     },
-    handler: ctx.guard(async (input) => {
+    handler: ctx.guard(async (input, toolCtx) => {
       const book = await ctx.loadBook();
+      await ctx.authority("brand.edit");
+      const name = capString(input.name, "name", 120);
+      const rationale = capString(input.rationale, "rationale", 2e3);
+      const sourceAssetId = await proposalSourceAssetId(
+        ctx,
+        book,
+        input.sourceAssetId
+      );
       const seedHex = input.seedHex === void 0 ? void 0 : assertHex(input.seedHex, "seedHex");
       let swatches;
       if (input.swatches !== void 0) {
@@ -1029,84 +1515,53 @@ function paletteTools(ctx) {
         if (input.harmony !== void 0) swatches = applyHarmony(swatches, seedHex, input.harmony);
       }
       const report = contrastReport(swatches);
-      const id = ctx.newId();
-      const ops = proposePaletteOps({
-        id,
-        bookId: ctx.bookId,
-        name: String(input.name),
-        rationale: String(input.rationale),
-        swatches,
-        seedHex,
-        contrastReport: report,
-        createdBy: ctx.self.selfId,
-        audience: book.memberIds,
-        now: ctx.now()
+      const proposal = await ctx.createProposal({
+        mutationId: ctx.newId(),
+        kind: "palette",
+        payload: {
+          name,
+          swatches,
+          ...seedHex ? { seedHex } : {},
+          contrastReport: report
+        },
+        rationale,
+        ...sourceAssetId ? { sourceAssetId } : {}
       });
-      await ctx.db.transact(ops, { mutationId: id });
+      if (proposal.bookId !== book.id || proposal.createdBy !== ctx.self.selfId || proposal.kind !== "palette" || proposal.status !== "open") throw new BrandInputError("brand proposal bridge returned an invalid proposal");
       const reportText = Object.entries(report).map(([k, v]) => `${k} ${r2(v)}:1`).join(", ");
       return {
-        content: `Parked palette proposal ${id} ("${String(input.name).trim()}", ${swatches.length} swatches${seedHex ? `, seeded from ${seedHex}` : ""}). Contrast: ${reportText}. Awaiting explicit human approval \u2014 call resolve_proposal only after the human confirms.`
+        content: `Parked palette proposal ${proposal.id} ("${name}", ${swatches.length} swatches${seedHex ? `, seeded from ${seedHex}` : ""}). Contrast: ${reportText}. Awaiting a human decision in the brand approval surface.`
       };
     })
   };
-  const resolveProposal = {
-    name: "resolve_proposal",
-    description: "Apply the human's explicit verdict on an open proposal. ONLY call this after the human has clearly accepted or rejected in the conversation \u2014 never on your own initiative.",
-    inputSchema: {
-      type: "object",
-      required: ["proposalId", "resolution"],
-      properties: {
-        proposalId: { type: "string" },
-        resolution: { type: "string", enum: ["accepted", "rejected"] },
-        note: { type: "string" }
-      }
-    },
-    handler: ctx.guard(async (input) => {
-      const proposalId = String(input.proposalId);
-      const res = await ctx.db.query({
-        [BRAND_NS.proposal]: { $: { where: { id: proposalId, bookId: ctx.bookId } } }
-      });
-      const proposal = (res[BRAND_NS.proposal] ?? [])[0];
-      if (!proposal) throw new BrandNotFoundError(`proposal ${proposalId}`);
-      const note = input.note === void 0 ? void 0 : capString(input.note, "note", 1e3);
-      const now = ctx.now();
-      if (input.resolution === "accepted") {
-        const paletteId = ctx.newId();
-        const ops = acceptProposalOps({ proposal, paletteId, resolvedBy: ctx.self.selfId, now, resolutionNote: note });
-        await ctx.db.transact(ops, { mutationId: paletteId });
-        return { content: `Proposal ${proposalId} accepted \u2014 palette ${paletteId} written and set as the book's active palette.` };
-      }
-      if (input.resolution === "rejected") {
-        const ops = rejectProposalOps({ proposal, resolvedBy: ctx.self.selfId, now, resolutionNote: note });
-        await ctx.db.transact(ops, { mutationId: ctx.newId() });
-        return { content: `Proposal ${proposalId} rejected.` };
-      }
-      throw new BrandInputError('resolution must be "accepted" or "rejected"');
-    })
-  };
-  return [analyzeColor, evaluateContrast, proposePalette, resolveProposal];
+  return [analyzeColor, evaluateContrast, proposePalette];
 }
 
 // src/skill/read-tools.ts
 var iso = (ms) => new Date(ms).toISOString();
-function bookLines(book) {
+var shortId = (id) => id.length <= 12 ? id : `${id.slice(0, 6)}\u2026${id.slice(-4)}`;
+var principalLabel = (id, directory) => {
+  const value = directory.get(id);
+  return value ? `${value.displayName} [${value.kind} \xB7 ${shortId(id)}]` : `Unknown principal [${shortId(id)}]`;
+};
+function bookLines(book, directory) {
   const lines = [
     `brand book "${book.name}" (${book.slug}) \u2014 ${book.status}`,
-    `members: ${book.memberIds.join(", ")}`,
+    `members: ${book.memberIds.map((id) => principalLabel(id, directory)).join(", ")}`,
     `active palette: ${book.activePaletteId ?? "(none accepted yet)"}`,
     book.tokens ? `tokens: compiled ${iso(book.tokens.compiledAt)} with ${book.tokens.warnings.length} warning(s)` : "tokens: (not compiled)"
   ];
   if (book.summary) lines.push(`summary: ${book.summary}`);
   return lines;
 }
-function childLines(sections, palettes, proposals) {
+function childLines(sections, palettes, proposals, directory) {
   return [
     "sections:",
-    ...sections.length ? sections.map((s) => `- ${s.kind}: ${s.status}, updated ${iso(s.updatedAt)} by ${s.updatedBy}`) : ["- (none)"],
+    ...sections.length ? sections.map((s) => `- ${s.kind}: ${s.status}, updated ${iso(s.updatedAt)} by ` + principalLabel(s.updatedBy, directory)) : ["- (none)"],
     "palettes:",
     ...palettes.length ? palettes.map((p) => `- ${p.id} "${p.name}" (${p.status}, ${p.source}, ${p.swatches.length} swatches)`) : ["- (none)"],
     "open proposals:",
-    ...proposals.length ? proposals.map((p) => `- ${p.id} (${p.kind}) by ${p.createdBy}: ${p.rationale}`) : ["- (none)"]
+    ...proposals.length ? proposals.map((p) => `- ${p.id} (${p.kind}) by ${principalLabel(p.createdBy, directory)}: ${p.rationale}`) : ["- (none)"]
   ];
 }
 function readTools(ctx) {
@@ -1115,18 +1570,48 @@ function readTools(ctx) {
     description: "Read the current brand book: status, members, active palette, compiled tokens, sections, palettes, and open proposals.",
     inputSchema: { type: "object", properties: {} },
     handler: ctx.guard(async () => {
+      const authorizedBook = await ctx.loadBook();
       const res = await ctx.db.query({
-        [BRAND_NS.book]: { $: { where: { id: ctx.bookId } } },
-        [BRAND_NS.section]: { $: { where: { bookId: ctx.bookId }, order: { updatedAt: "asc" } } },
-        [BRAND_NS.palette]: { $: { where: { bookId: ctx.bookId }, order: { createdAt: "asc" } } },
-        [BRAND_NS.proposal]: { $: { where: { bookId: ctx.bookId, status: "open" }, order: { createdAt: "asc" } } }
+        [BRAND_NS.section]: {
+          $: { where: { bookId: ctx.bookId }, order: { updatedAt: "asc" } },
+          book: {}
+        },
+        [BRAND_NS.palette]: {
+          $: { where: { bookId: ctx.bookId }, order: { createdAt: "asc" } },
+          book: {}
+        },
+        [BRAND_NS.proposal]: {
+          $: {
+            where: { bookId: ctx.bookId, status: "open" },
+            order: { createdAt: "asc" }
+          },
+          book: {}
+        }
       });
-      const book = (res[BRAND_NS.book] ?? [])[0];
-      if (!book) throw new BrandNotFoundError(`brand book ${ctx.bookId}`);
-      const sections = res[BRAND_NS.section] ?? [];
-      const palettes = res[BRAND_NS.palette] ?? [];
-      const proposals = res[BRAND_NS.proposal] ?? [];
-      return { content: [...bookLines(book), ...childLines(sections, palettes, proposals)].join("\n") };
+      const linked = (rows) => rows.filter((row) => row.bookId === authorizedBook.id && Array.isArray(row.book) && row.book.length === 1 && row.book[0]?.id === authorizedBook.id);
+      const sections = linked(
+        res[BRAND_NS.section] ?? []
+      );
+      const palettes = linked(
+        res[BRAND_NS.palette] ?? []
+      );
+      const proposals = linked(
+        res[BRAND_NS.proposal] ?? []
+      );
+      const ids = [
+        ...authorizedBook.memberIds,
+        ...sections.map((section) => section.updatedBy),
+        ...proposals.map((proposal) => proposal.createdBy)
+      ];
+      const directory = new Map(
+        (await ctx.resolvePrincipals(ids)).map((principal) => [principal.id, principal])
+      );
+      return {
+        content: [
+          ...bookLines(authorizedBook, directory),
+          ...childLines(sections, palettes, proposals, directory)
+        ].join("\n")
+      };
     })
   };
   const listAssets = {
@@ -1139,15 +1624,21 @@ function readTools(ctx) {
       }
     },
     handler: ctx.guard(async (input) => {
-      const where = { bookId: ctx.bookId };
+      await ctx.loadBook();
+      const where = { bookId: ctx.bookId, status: "live" };
       if (input.kind !== void 0) {
         if (typeof input.kind !== "string" || !ASSET_KINDS.includes(input.kind)) {
           throw new BrandInputError(`kind must be one of: ${ASSET_KINDS.join(", ")}`);
         }
         where.kind = input.kind;
       }
-      const res = await ctx.db.query({ [BRAND_NS.asset]: { $: { where, order: { createdAt: "asc" } } } });
-      const rows = (res[BRAND_NS.asset] ?? []).filter((a2) => !a2.deletedAt);
+      const res = await ctx.db.query({
+        [BRAND_NS.asset]: {
+          $: { where, order: { createdAt: "asc" } },
+          book: {}
+        }
+      });
+      const rows = (res[BRAND_NS.asset] ?? []).filter((asset) => asset.bookId === ctx.bookId && Array.isArray(asset.book) && asset.book.length === 1 && asset.book[0]?.id === ctx.bookId);
       if (rows.length === 0) {
         return { content: input.kind ? `(no ${String(input.kind)} assets uploaded yet)` : "(no assets uploaded yet)" };
       }
@@ -1161,29 +1652,64 @@ function readTools(ctx) {
 }
 
 // src/skill/skill.ts
-var BRAND_INSTRUCTIONS = "You help build and maintain ONE brand book. Workflow, in order:\n1. Understand the brand first: read_brand_book and list_assets before proposing anything.\n2. Look at the real material: view_asset on logos and inspiration, then record what you saw with record_asset_analysis (description, dominant colors as hex, tags).\n3. Explore with the math tools: analyze_color and evaluate_contrast. Never invent a hex without a rationale \u2014 ground every color in an asset's dominant color, a harmony companion, or a contrast fix, and say which.\n4. propose_palette parks a proposal for review. It does NOT change the brand.\n5. WAIT for the human to explicitly accept or reject in the conversation before calling resolve_proposal \u2014 never resolve a proposal on your own initiative.\n6. After acceptance, document the rest with update_section (typography, voice, logo, imagery) and run compile_tokens.\n7. Relay compile warnings conversationally \u2014 explain what was adjusted and why, don't just paste them.";
+var BRAND_INSTRUCTIONS = "You help build and maintain ONE brand book. Workflow, in order:\n1. Understand the brand first: read_brand_book and list_assets before proposing anything.\n2. Look at the real material: view_asset on logos and inspiration, then record what you saw with record_asset_analysis (description, dominant colors as hex, tags).\n3. Explore with the math tools: analyze_color and evaluate_contrast. Never invent a hex without a rationale \u2014 ground every color in an asset's dominant color, a harmony companion, or a contrast fix, and say which.\n4. propose_palette parks a proposal for review. It does NOT change the brand.\n5. You cannot approve or resolve a proposal. Direct the human to the brand approval surface, which records a guarded receipt for their decision.\n6. update_section parks a proposal; it never overwrites an approved facet. Bind sourceAssetId when a real Brand asset grounds typography, voice, logo, or imagery. Human acceptance applies the exact reviewed change and automatically recompiles dependent tokens.\n7. Re-read the book after a decision and explain any compiler warnings conversationally.";
 function brandSkill(opts) {
-  const deps = resolveDeps({ db: opts.db, now: opts.now, newId: opts.newId, fetchBytes: opts.fetchBytes });
+  if (opts.agentDbBinding.principalId !== opts.self.selfId || !opts.agentDbBinding.credentialRef) throw new BrandForbiddenError("brand db is not bound to the acting agent");
+  const deps = resolveDeps({ db: opts.db, now: opts.now, newId: opts.newId });
+  const authority = (capability) => Promise.resolve(opts.authorizeCapability({
+    agentId: opts.self.selfId,
+    bookId: opts.bookId,
+    capability
+  }) ?? null).then((result) => {
+    if (!result || result.capability !== capability || !result.authorityRef)
+      throw new BrandForbiddenError(`agent lacks ${capability} for brand book ${opts.bookId}`);
+    return result;
+  });
   const ctx = {
     db: deps.db,
     bookId: opts.bookId,
     self: opts.self,
-    fileBaseUrl: opts.fileBaseUrl,
-    fetchBytes: deps.fetchBytes,
     visionInToolResults: opts.visionInToolResults !== false,
     now: deps.now,
     newId: deps.newId,
+    agentJobId: opts.agentJobId,
+    createProposal: (input) => opts.agentBridge.createProposal({
+      jobId: opts.agentJobId,
+      bookId: opts.bookId,
+      ...input
+    }),
+    recordAssetAnalysis: (input) => opts.agentBridge.recordAssetAnalysis({
+      jobId: opts.agentJobId,
+      bookId: opts.bookId,
+      ...input
+    }),
+    readAssetContent: (assetId) => opts.agentBridge.readAssetContent({
+      jobId: opts.agentJobId,
+      bookId: opts.bookId,
+      assetId
+    }),
+    resolvePrincipals: (principalIds) => {
+      const ids = [...new Set(principalIds)].slice(0, 100);
+      return opts.resolvePrincipals({
+        requesterAgentId: opts.self.selfId,
+        bookId: opts.bookId,
+        principalIds: ids
+      });
+    },
+    authority,
     loadBook: async () => {
+      await authority("brand.read");
       const res = await deps.db.query({ [BRAND_NS.book]: { $: { where: { id: opts.bookId } } } });
       const row = (res[BRAND_NS.book] ?? [])[0];
-      if (!row) throw new BrandNotFoundError(`brand book ${opts.bookId}`);
+      if (!row || !row.memberIds.includes(opts.self.selfId))
+        throw new BrandNotFoundError(`brand book ${opts.bookId}`);
       return row;
     },
     guard: (handler) => async (input, toolCtx) => {
       try {
         return await handler(input, toolCtx);
       } catch (error) {
-        if (error instanceof BrandInputError || error instanceof BrandNotFoundError) {
+        if (error instanceof BrandInputError || error instanceof BrandNotFoundError || error instanceof BrandForbiddenError) {
           return { content: error.message, isError: true };
         }
         throw error;
@@ -1198,7 +1724,7 @@ function brandSkill(opts) {
 }
 
 // src/skill/persona.ts
-var DEFAULT_BRAND_SYSTEM = "You are a meticulous brand director for one brand book. You study the real material before forming opinions, you justify every color with math (harmony, \u0394EOK, WCAG contrast) or provenance (an asset's dominant colors), and you present options rather than dictating. Proposals are yours to make; decisions are the human's \u2014 never resolve a proposal without their explicit confirmation in this conversation. When tokens compile with warnings, explain each adjustment in plain language.";
+var DEFAULT_BRAND_SYSTEM = "You are a meticulous brand director for one brand book. You study the real material before forming opinions, you justify every color with math (harmony, \u0394EOK, WCAG contrast) or provenance (an asset's dominant colors), and you present options rather than dictating. Proposals and drafts are yours to make; decisions are the human's \u2014 you have no proposal-resolution or section-approval tool. When tokens compile with warnings, explain each adjustment in plain language.";
 function createBrandPersona(opts) {
   return {
     name: "brand-director",
@@ -1214,7 +1740,35 @@ function supportsBrandVision(spec) {
   return !!(caps?.toolResultBlocks && caps.imageIn && caps.documentIn);
 }
 
+// src/routes/asset-query.ts
+async function linkedAsset(ctx, book, assetId, allowDeleting = false) {
+  const result = await ctx.db.query({
+    [BRAND_NS.asset]: {
+      $: { where: { id: assetId, bookId: book.id } },
+      book: {}
+    }
+  });
+  const row = (result[BRAND_NS.asset] ?? [])[0];
+  const links = row?.book;
+  if (!row || row.bookId !== book.id || !Array.isArray(links) || links.length !== 1 || links[0]?.id !== book.id || row.status !== "live" && !(allowDeleting && row.status === "deleting")) throw new BrandNotFoundError(`asset ${assetId}`);
+  return row;
+}
+
 // src/routes/http.ts
+async function requireRouteAuthority(ctx, req, capability, effect, bookId) {
+  if (ctx.actor.kind !== "human")
+    throw new BrandForbiddenError("this brand effect requires a directly authenticated human");
+  const result = await ctx.authorizeCapability({
+    req,
+    actor: ctx.actor,
+    appId: ctx.appId,
+    ...bookId ? { bookId } : {},
+    capability,
+    effect
+  });
+  if (!result || result.actorPrincipalId !== ctx.actor.id || result.capability !== capability || result.effect !== effect || typeof result.authorityRef !== "string" || result.authorityRef.length < 1 || result.authorityRef.length > 200) throw new BrandForbiddenError(`human lacks ${capability} ${effect} authority`);
+  return result;
+}
 var json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
   status,
   headers: { "content-type": "application/json", ...headers }
@@ -1222,7 +1776,12 @@ var json = (body, status = 200, headers = {}) => new Response(JSON.stringify(bod
 var errorResponse = (error) => {
   if (error instanceof BrandInputError)
     return json({ error: error.message, ...error.fields ? { fields: error.fields } : {} }, 400);
+  if (error instanceof BrandForbiddenError) return json({ error: error.message }, 403);
   if (error instanceof BrandNotFoundError) return json({ error: error.message }, 404);
+  if (error instanceof BrandGoneError) return json({ error: error.message }, 410);
+  if (error instanceof BrandReviewStateChangedError)
+    return json({ error: error.message, code: error.code }, 409);
+  if (error instanceof BrandConflictError) return json({ error: error.message }, 409);
   return json({ error: "internal error" }, 500);
 };
 var methodNotAllowed = () => json({ error: "method not allowed" }, 405);
@@ -1271,86 +1830,217 @@ async function loadMemberBook(db, bookId, actorId) {
   return book;
 }
 
-// src/routes/assets.ts
+// src/routes/asset-upload.ts
 async function readForm(req) {
   try {
     return await req.formData();
   } catch {
-    throw new BrandInputError('expected a multipart/form-data body with a "file" field');
+    throw new BrandInputError(
+      'expected multipart/form-data with a "file" field'
+    );
   }
 }
+async function contentDigest(file) {
+  const hash = await crypto.subtle.digest("SHA-256", await file.arrayBuffer());
+  return `sha256:${[...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
 async function uploadAsset(ctx, req, bookId) {
   const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
   const form = await readForm(req);
   const file = form.get("file");
-  if (!(file instanceof File)) throw new BrandInputError('"file" must be an uploaded file field');
+  if (!(file instanceof File))
+    throw new BrandInputError('"file" must be an uploaded file field');
   let contentType;
   try {
     contentType = assertAssetContentType(file.type);
   } catch (error) {
-    if (error instanceof BrandInputError) return json({ error: error.message }, 415);
+    if (error instanceof BrandInputError)
+      return json({ error: error.message }, 415);
     throw error;
   }
   if (file.size > ctx.maxUploadBytes)
-    return json(
-      { error: `file is ${file.size} bytes; the upload limit is ${ctx.maxUploadBytes}` },
-      413
-    );
+    return json({ error: `file exceeds ${ctx.maxUploadBytes} bytes` }, 413);
   const kindRaw = form.get("kind");
-  const kind = typeof kindRaw === "string" && kindRaw !== "" ? kindRaw : "other";
+  const kind = typeof kindRaw === "string" && kindRaw ? kindRaw : "other";
   if (!ASSET_KINDS.includes(kind))
     throw new BrandInputError(`kind must be one of: ${ASSET_KINDS.join(", ")}`);
   const titleRaw = form.get("title");
-  const title = typeof titleRaw === "string" && titleRaw !== "" ? capString(titleRaw, "title", 160) : void 0;
+  const title = typeof titleRaw === "string" && titleRaw ? capString(titleRaw, "title", 160) : void 0;
+  const fileName = safeFileName(file.name);
   const id = ctx.newId();
-  const path = `brand/${book.id}/assets/${id}/${safeFileName(file.name)}`;
-  const record = await ctx.db.storage.upload(path, file, contentType);
-  await ctx.db.transact(
-    createAssetOps({
+  const path = `brand/${book.id}/assets/${id}/${fileName}`;
+  const authority = await requireRouteAuthority(
+    ctx,
+    req,
+    "brand.edit",
+    "internal",
+    book.id
+  );
+  const record6 = await ctx.db.storage.upload(
+    path,
+    file,
+    contentType,
+    { private: true }
+  );
+  if (record6.path !== path) {
+    await ctx.db.storage.delete(record6.path);
+    throw new BrandConflictError(
+      "private storage returned an unexpected asset path"
+    );
+  }
+  try {
+    const current = await requireRouteAuthority(
+      ctx,
+      req,
+      "brand.edit",
+      "internal",
+      book.id
+    );
+    if (current.authorityRef !== authority.authorityRef)
+      throw new BrandConflictError("brand edit authority changed during upload");
+    await ctx.db.transact(createAssetOps({
       id,
       bookId: book.id,
       kind,
-      path: record.path,
-      url: record.url,
+      path: record6.path,
+      storageObjectId: record6.id,
+      contentDigest: await contentDigest(file),
       contentType,
-      size: record.size,
+      size: record6.size,
       uploadedBy: ctx.actor.id,
+      uploadedAuthorityRef: authority.authorityRef,
       audience: book.memberIds,
       title,
       now: ctx.now()
-    }),
-    { mutationId: id }
-  );
-  const res = await ctx.db.query({ [BRAND_NS.asset]: { $: { where: { id } } } });
-  return json((res[BRAND_NS.asset] ?? [])[0], 201);
-}
-async function handleAssetsRoot(ctx, req, bookId) {
-  if (req.method === "GET") {
-    const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
-    const res = await ctx.db.query({
-      [BRAND_NS.asset]: {
-        // `deletedAt: null` matches ONLY rows without the attr — odla-db's
-        // "absence is a missing triple" semantics — i.e. not tombstoned.
-        $: { where: { bookId: book.id, deletedAt: null }, order: { createdAt: "asc" } }
-      }
+    }), {
+      mutationId: `brand:asset-upload:v1:${id}`,
+      guards: [
+        { ns: BRAND_NS.asset, id, exists: false },
+        {
+          ns: BRAND_NS.book,
+          id: book.id,
+          exists: true,
+          equals: {
+            version: book.version,
+            activationRevision: book.activationRevision,
+            memberIds: book.memberIds
+          }
+        }
+      ],
+      asUser: ctx.actor.id,
+      ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+      asPrincipalKind: "human"
     });
-    return json({ assets: res[BRAND_NS.asset] ?? [] });
+  } catch (error) {
+    await ctx.db.storage.delete(record6.path);
+    throw error;
   }
+  return json(await linkedAsset(ctx, book, id), 201);
+}
+
+// src/routes/assets.ts
+async function handleAssetsRoot(ctx, req, bookId) {
   if (req.method === "POST") return uploadAsset(ctx, req, bookId);
-  return methodNotAllowed();
+  if (req.method !== "GET") return methodNotAllowed();
+  const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
+  const result = await ctx.db.query({
+    [BRAND_NS.asset]: {
+      $: { where: { bookId: book.id, status: "live" }, order: { createdAt: "asc" } },
+      book: {}
+    }
+  });
+  const assets = (result[BRAND_NS.asset] ?? []).filter((value) => {
+    const row = value;
+    return row.bookId === book.id && Array.isArray(row.book) && row.book.length === 1 && row.book[0]?.id === book.id;
+  });
+  return json({ assets });
+}
+async function handleAssetContent(ctx, req, bookId, assetId) {
+  if (req.method !== "GET") return methodNotAllowed();
+  const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
+  const asset = await linkedAsset(ctx, book, assetId);
+  const expiresInSeconds = 300;
+  const url = await ctx.db.storage.sign(asset.path, expiresInSeconds);
+  return json(
+    { assetId, url, expiresInSeconds },
+    200,
+    { "cache-control": "private, no-store", "x-content-type-options": "nosniff" }
+  );
 }
 async function handleAssetItem(ctx, req, bookId, assetId) {
   if (req.method !== "DELETE") return methodNotAllowed();
   const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
-  const res = await ctx.db.query({
-    [BRAND_NS.asset]: { $: { where: { id: assetId, bookId: book.id } } }
-  });
-  const asset = (res[BRAND_NS.asset] ?? [])[0];
-  if (!asset || asset.deletedAt != null) throw new BrandNotFoundError(`asset ${assetId}`);
+  let asset = await linkedAsset(ctx, book, assetId, true);
+  const authority = await requireRouteAuthority(
+    ctx,
+    req,
+    "brand.edit",
+    "destructive",
+    book.id
+  );
+  const mutationBase = `brand:asset-delete:v1:${book.id}:${asset.id}`;
+  if (asset.status === "live") {
+    const deletedAt = ctx.now();
+    try {
+      await ctx.db.transact(beginAssetDeleteOps(
+        asset.id,
+        deletedAt,
+        ctx.actor.id,
+        authority.authorityRef
+      ), {
+        mutationId: `${mutationBase}:begin`,
+        guards: [
+          {
+            ns: BRAND_NS.asset,
+            id: asset.id,
+            exists: true,
+            equals: {
+              bookId: book.id,
+              path: asset.path,
+              storageObjectId: asset.storageObjectId,
+              contentDigest: asset.contentDigest,
+              status: "live"
+            }
+          },
+          {
+            ns: BRAND_NS.book,
+            id: book.id,
+            exists: true,
+            equals: { version: book.version, memberIds: book.memberIds }
+          }
+        ],
+        asUser: ctx.actor.id,
+        ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+        asPrincipalKind: "human"
+      });
+    } catch (error) {
+      if (typeof error === "object" && error !== null && error.code === "transact_guard_failed") throw new BrandConflictError("asset changed before deletion");
+      throw error;
+    }
+    asset = { ...asset, status: "deleting", deletedAt };
+  }
   await ctx.db.storage.delete(asset.path);
-  const deletedAt = ctx.now();
-  await ctx.db.transact(tombstoneAssetOps(asset.id, deletedAt));
-  return json({ id: asset.id, deletedAt });
+  await ctx.db.transact(finishAssetDeleteOps(asset.id), {
+    mutationId: `${mutationBase}:finish`,
+    guards: [{
+      ns: BRAND_NS.asset,
+      id: asset.id,
+      exists: true,
+      equals: {
+        bookId: book.id,
+        path: asset.path,
+        storageObjectId: asset.storageObjectId,
+        contentDigest: asset.contentDigest,
+        status: "deleting",
+        deletedBy: asset.deletedBy ?? ctx.actor.id,
+        deletedAuthorityRef: asset.deletedAuthorityRef ?? authority.authorityRef
+      }
+    }],
+    asUser: ctx.actor.id,
+    ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+    asPrincipalKind: "human"
+  });
+  return json({ id: asset.id, status: "deleted", deletedAt: asset.deletedAt });
 }
 
 // src/routes/books.ts
@@ -1363,73 +2053,1036 @@ async function handleBooksRoot(ctx, req) {
     return json({ books });
   }
   if (req.method === "POST") {
+    if (ctx.actor.kind !== "human")
+      throw new BrandForbiddenError("only a human can create a brand book");
     const body = await readJson(req);
     const id = ctx.newId();
+    const authority = await requireRouteAuthority(
+      ctx,
+      req,
+      "brand.edit",
+      "internal"
+    );
     const ops = createBookOps({
       id,
       slug: str(body, "slug"),
       name: str(body, "name"),
       ownerId: ctx.actor.id,
+      createdAuthorityRef: authority.authorityRef,
       memberIds: optStrArray(body, "memberIds") ?? [],
       channelId: optStr(body, "channelId"),
       now: ctx.now()
     });
-    await ctx.db.transact(ops, { mutationId: id });
+    await ctx.db.transact(ops, {
+      mutationId: id,
+      guards: [{ ns: BRAND_NS.book, id, exists: false }],
+      asUser: ctx.actor.id,
+      ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+      asPrincipalKind: "human"
+    });
     return json(await loadBook(ctx.db, id), 201);
   }
   return methodNotAllowed();
 }
+var sameStrings = (left, right) => left.length === right.length && left.every((value, index) => value === right[index]);
+var guardFailure = (error) => typeof error === "object" && error !== null && error.code === "transact_guard_failed";
+async function handleBookMembers(ctx, req, bookId) {
+  if (req.method !== "PATCH") return methodNotAllowed();
+  const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
+  if (ctx.actor.kind !== "human")
+    throw new BrandForbiddenError("only a human app owner can change members");
+  const body = await readJson(req);
+  const rawMembers = optStrArray(body, "memberIds");
+  const rawExpected = optStrArray(body, "expectedMemberIds");
+  if (!rawMembers || !rawExpected)
+    throw new BrandInputError('"memberIds" and "expectedMemberIds" are required string arrays');
+  const memberIds = Array.from(/* @__PURE__ */ new Set([
+    book.ownerId,
+    ...rawMembers.map((id, index) => capString(id, `memberIds[${index}]`, 160))
+  ]));
+  if (memberIds.length > 100)
+    throw new BrandInputError("a brand book supports at most 100 members");
+  const expectedMemberIds = rawExpected.map((id, index) => capString(id, `expectedMemberIds[${index}]`, 160));
+  if (!sameStrings(book.memberIds, expectedMemberIds) && !sameStrings(book.memberIds, memberIds))
+    throw new BrandConflictError("brand book membership changed since review");
+  const mutationId = capString(str(body, "mutationId"), "mutationId", 200);
+  const mutationKey = `brand:book-members:v1:${bookId}:${mutationId}`;
+  const authority = await requireRouteAuthority(
+    ctx,
+    req,
+    "app.manage",
+    "internal",
+    bookId
+  );
+  try {
+    const tx = await ctx.db.transact(
+      [{
+        t: "update",
+        ns: BRAND_NS.book,
+        id: bookId,
+        attrs: {
+          memberIds,
+          version: book.version + 1,
+          updatedAt: ctx.now(),
+          rosterAuthorityRef: authority.authorityRef
+        }
+      }],
+      {
+        mutationId: mutationKey,
+        guards: [{
+          ns: BRAND_NS.book,
+          id: bookId,
+          exists: true,
+          equals: { memberIds: expectedMemberIds, version: book.version }
+        }],
+        asUser: ctx.actor.id,
+        ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+        asPrincipalKind: "human"
+      }
+    );
+    return json({ bookId, memberIds, duplicate: tx.duplicate === true });
+  } catch (error) {
+    if (guardFailure(error))
+      throw new BrandConflictError("brand book membership changed since review");
+    throw error;
+  }
+}
 async function handleBookItem(ctx, req, bookId) {
   if (req.method !== "GET") return methodNotAllowed();
   return json(await loadMemberBook(ctx.db, bookId, ctx.actor.id));
 }
 
+// src/routes/proposal-input.ts
+var SNAPSHOT_KEYS = [
+  "audience",
+  "bookId",
+  "createdAt",
+  "createdAuthorityRef",
+  "createdBy",
+  "id",
+  "kind",
+  "payload",
+  "provenance",
+  "rationale",
+  "reviewDigest",
+  "status"
+];
+var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseProposalResolutionRequest(body, bookId, proposalId) {
+  const allowed = /* @__PURE__ */ new Set([
+    "mutationId",
+    "resolution",
+    "reviewedProposal",
+    "note"
+  ]);
+  if (Object.keys(body).some((key) => !allowed.has(key)))
+    throw new BrandInputError("proposal resolution body has unknown fields");
+  const mutationId = capString(str(body, "mutationId"), "mutationId", 200);
+  const rawResolution = str(body, "resolution");
+  if (rawResolution !== "accepted" && rawResolution !== "rejected")
+    throw new BrandInputError('"resolution" must be "accepted" or "rejected"');
+  const rawNote = optStr(body, "note");
+  const resolutionNote = rawNote?.trim() ? capString(rawNote, "note", 1e3) : void 0;
+  return {
+    mutationId,
+    resolution: rawResolution,
+    reviewed: parseReviewedProposal(body.reviewedProposal, bookId, proposalId),
+    ...resolutionNote ? { resolutionNote } : {}
+  };
+}
+function proposalReviewSnapshot(proposal) {
+  if (proposal.status !== "open")
+    throw new BrandConflictError(`proposal ${proposal.id} is ${proposal.status}, not open`);
+  return {
+    id: proposal.id,
+    bookId: proposal.bookId,
+    kind: proposal.kind,
+    status: "open",
+    payload: proposal.payload,
+    rationale: proposal.rationale,
+    provenance: proposal.provenance,
+    reviewDigest: proposal.reviewDigest,
+    audience: proposal.audience,
+    createdBy: proposal.createdBy,
+    createdAuthorityRef: proposal.createdAuthorityRef,
+    createdAt: proposal.createdAt
+  };
+}
+function parseReviewedProposal(value, bookId, proposalId) {
+  if (!isBoundedBrandJson(value, { maxDepth: 12, maxNodes: 1500, maxBytes: 32 * 1024 }))
+    throw new BrandInputError('"reviewedProposal" is too deeply nested, complex, or large');
+  if (!record3(value)) throw new BrandInputError('"reviewedProposal" must be an object');
+  const keys = Object.keys(value).sort();
+  if (keys.length !== SNAPSHOT_KEYS.length || !SNAPSHOT_KEYS.every((key, index) => key === keys[index])) throw new BrandInputError('"reviewedProposal" has an invalid shape');
+  if (value.id !== proposalId || value.bookId !== bookId || value.status !== "open")
+    throw new BrandInputError('"reviewedProposal" must identify this open proposal');
+  if (typeof value.kind !== "string" || !PROPOSAL_KINDS.includes(value.kind) || !record3(value.payload) || typeof value.rationale !== "string" || !Array.isArray(value.audience) || value.audience.length < 1 || value.audience.length > 100 || value.audience.some((id) => typeof id !== "string" || id.length < 1 || id.length > 200) || new Set(value.audience).size !== value.audience.length || typeof value.createdBy !== "string" || value.createdBy.length < 1 || value.createdBy.length > 200 || typeof value.createdAuthorityRef !== "string" || value.createdAuthorityRef.length < 1 || value.createdAuthorityRef.length > 200 || !Number.isSafeInteger(value.createdAt) || value.createdAt < 0 || typeof value.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.reviewDigest)) throw new BrandInputError('"reviewedProposal" has invalid fields');
+  if (!record3(value.provenance) || Object.keys(value.provenance).sort().join(",") !== "messageId,sourceAsset,sourceAssetId,taintLabels,turnId" || value.provenance.sourceAssetId !== null && (typeof value.provenance.sourceAssetId !== "string" || value.provenance.sourceAssetId.length < 1 || value.provenance.sourceAssetId.length > 200) || value.provenance.sourceAsset !== null && (!record3(value.provenance.sourceAsset) || Object.keys(value.provenance.sourceAsset).sort().join(",") !== "analysisDigest,analysisRevision,assetId,contentDigest,contentType,objectEtag,objectSize,pathDigest" || typeof value.provenance.sourceAsset.assetId !== "string" || value.provenance.sourceAsset.assetId.length < 1 || value.provenance.sourceAsset.assetId.length > 200 || typeof value.provenance.sourceAsset.objectEtag !== "string" || value.provenance.sourceAsset.objectEtag.length < 1 || value.provenance.sourceAsset.objectEtag.length > 200 || !Number.isSafeInteger(value.provenance.sourceAsset.objectSize) || value.provenance.sourceAsset.objectSize < 1 || typeof value.provenance.sourceAsset.pathDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.pathDigest) || value.provenance.sourceAsset.contentType !== null && (typeof value.provenance.sourceAsset.contentType !== "string" || value.provenance.sourceAsset.contentType.length < 1 || value.provenance.sourceAsset.contentType.length > 160) || typeof value.provenance.sourceAsset.contentDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.contentDigest) || value.provenance.sourceAsset.analysisRevision !== null && (!Number.isSafeInteger(value.provenance.sourceAsset.analysisRevision) || value.provenance.sourceAsset.analysisRevision < 0) || value.provenance.sourceAsset.analysisDigest !== null && (typeof value.provenance.sourceAsset.analysisDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(
+    value.provenance.sourceAsset.analysisDigest
+  )) || value.provenance.sourceAsset.assetId !== value.provenance.sourceAssetId) || value.provenance.sourceAssetId === null !== (value.provenance.sourceAsset === null) || value.provenance.messageId !== null && (typeof value.provenance.messageId !== "string" || value.provenance.messageId.length < 1 || value.provenance.messageId.length > 200) || value.provenance.turnId !== null && (typeof value.provenance.turnId !== "string" || value.provenance.turnId.length < 1 || value.provenance.turnId.length > 200) || !Array.isArray(value.provenance.taintLabels) || value.provenance.taintLabels.length > 16 || value.provenance.taintLabels.some((label) => typeof label !== "string" || label.length < 1 || label.length > 120) || new Set(value.provenance.taintLabels).size !== value.provenance.taintLabels.length) throw new BrandInputError('"reviewedProposal.provenance" is invalid');
+  return value;
+}
+var proposalGuardEquals = (snapshot) => ({ ...snapshot });
+
+// src/routes/proposal-effects.ts
+async function tokenSnapshot(swatches, typography, input, paletteId, paletteReceiptId, paletteActionDigest, typographyReceiptId, typographyActionDigest) {
+  const compiled = compileBrandTokens({ swatches, ...typography ? { typography } : {} });
+  const sources = {
+    paletteId,
+    paletteReceiptId,
+    paletteActionDigest,
+    typographyReceiptId: typographyReceiptId ?? null,
+    typographyActionDigest: typographyActionDigest ?? null
+  };
+  return {
+    light: compiled.light,
+    dark: compiled.dark,
+    warnings: compiled.warnings,
+    compiledAt: input.now,
+    paletteId,
+    paletteReceiptId,
+    paletteActionDigest,
+    ...typographyReceiptId ? { typographyReceiptId } : {},
+    ...typographyActionDigest ? { typographyActionDigest } : {},
+    sourceDigest: await brandJsonDigest(sources)
+  };
+}
+function stampProposal(ops, input) {
+  const op = ops.find(
+    (candidate) => candidate.t === "update" && candidate.ns === BRAND_NS.proposal && candidate.id === input.proposal.id
+  );
+  if (!op || op.t !== "update") throw new Error("proposal resolution op missing");
+  Object.assign(op.attrs, {
+    approvedBy: input.actorId,
+    appliedBy: input.actorId,
+    resolutionReceiptId: input.receiptId,
+    resolutionActionDigest: input.actionDigest
+  });
+}
+async function proposalDecisionOps(input) {
+  const common = {
+    proposal: input.proposal,
+    resolvedBy: input.actorId,
+    now: input.now,
+    resolutionNote: input.resolutionNote
+  };
+  if (input.resolution === "rejected") {
+    const ops2 = rejectProposalOps(common);
+    stampProposal(ops2, input);
+    return ops2;
+  }
+  let ops;
+  if (input.proposal.kind === "palette") {
+    if (!input.paletteId) throw new Error("accepted palette id missing");
+    ops = acceptProposalOps({
+      ...common,
+      paletteId: input.paletteId,
+      approvalReceiptId: input.receiptId,
+      approvalActionDigest: input.actionDigest
+    });
+    const swatches = assertSwatches(input.proposal.payload.swatches);
+    const tokens = await tokenSnapshot(
+      swatches,
+      input.approvedTypography?.content,
+      input,
+      input.paletteId,
+      input.receiptId,
+      input.actionDigest,
+      input.approvedTypography?.approvalReceiptId,
+      input.approvedTypography?.approvalActionDigest
+    );
+    const bookOp = ops.find(
+      (op) => op.t === "update" && op.ns === BRAND_NS.book && op.id === input.book.id
+    );
+    if (!bookOp || bookOp.t !== "update") throw new Error("book activation op missing");
+    Object.assign(bookOp.attrs, {
+      version: input.book.version + 1,
+      activationRevision: input.book.activationRevision + 1,
+      tokens
+    });
+    if (input.priorPalette && input.priorPalette.id !== input.paletteId) {
+      ops.unshift({
+        t: "update",
+        ns: BRAND_NS.palette,
+        id: input.priorPalette.id,
+        attrs: { status: "archived", updatedAt: input.now }
+      });
+    }
+  } else {
+    const content = input.proposal.payload.content;
+    if (typeof content !== "object" || content === null || Array.isArray(content))
+      throw new BrandInputError("proposal payload.content must be an object");
+    ops = [
+      ...upsertSectionOps({
+        bookId: input.book.id,
+        kind: input.proposal.kind,
+        content,
+        status: "approved",
+        audience: input.book.memberIds,
+        updatedBy: input.actorId,
+        approvalReceiptId: input.receiptId,
+        approvalActionDigest: input.actionDigest,
+        now: input.now
+      }),
+      {
+        t: "update",
+        ns: BRAND_NS.book,
+        id: input.book.id,
+        attrs: {
+          activationRevision: input.book.activationRevision + 1,
+          version: input.book.version + 1,
+          updatedAt: input.now
+        }
+      },
+      {
+        t: "update",
+        ns: BRAND_NS.proposal,
+        id: input.proposal.id,
+        attrs: {
+          status: "accepted",
+          resolvedBy: input.actorId,
+          resolvedAt: input.now,
+          ...input.resolutionNote ? { resolutionNote: input.resolutionNote } : {}
+        }
+      }
+    ];
+    if (input.proposal.kind === "typography" && input.priorPalette) {
+      const bookOp = ops.find(
+        (op) => op.t === "update" && op.ns === BRAND_NS.book && op.id === input.book.id
+      );
+      if (bookOp?.t === "update") {
+        if (!input.priorPalette.approvalReceiptId || !input.priorPalette.approvalActionDigest)
+          throw new BrandInputError("active palette is missing approval provenance");
+        bookOp.attrs.tokens = await tokenSnapshot(
+          input.priorPalette.swatches,
+          content,
+          input,
+          input.priorPalette.id,
+          input.priorPalette.approvalReceiptId,
+          input.priorPalette.approvalActionDigest,
+          input.receiptId,
+          input.actionDigest
+        );
+      }
+    }
+  }
+  stampProposal(ops, input);
+  return ops;
+}
+
+// src/routes/proposal-resolution-receipts.ts
+async function proposalResolutionMutationKey(bookId, proposalId, mutationId) {
+  const digest = await brandJsonDigest({
+    version: 3,
+    bookId,
+    proposalId,
+    mutationId
+  });
+  return `brand:proposal-resolution:v3:${digest.slice("sha256:".length)}`;
+}
+async function proposalReceiptByMutation(ctx, mutationKey) {
+  const result = await ctx.db.query({
+    [BRAND_NS.approvalReceipt]: {
+      $: { where: { mutationKey } },
+      book: {}
+    }
+  });
+  const row = (result[BRAND_NS.approvalReceipt] ?? [])[0];
+  if (!row || !Array.isArray(row.book) || row.book.length !== 1 || row.book[0]?.id !== row.bookId) return void 0;
+  const { book: _book, ...receipt2 } = row;
+  return receipt2;
+}
+async function consumeProposalAuthority(ctx, req, bookId, proposalId, actionDigest, mutationKey) {
+  const authority = await ctx.consumeHumanExact({
+    req,
+    actor: ctx.actor,
+    appId: ctx.appId,
+    capability: "brand.proposal.resolve",
+    projectCapability: "brand.approve",
+    effect: "internal",
+    resource: { bookId, proposalId },
+    actionDigest,
+    consumptionIdempotencyKey: mutationKey
+  });
+  const resourceDigest = await brandJsonDigest({ bookId, proposalId });
+  if (!isBrandHumanAuthorityConsumption(authority) || authority.actorPrincipalId !== ctx.actor.id || authority.appId !== ctx.appId || authority.actionDigest !== actionDigest || authority.resourceDigest !== resourceDigest || authority.consumptionIdempotencyKey !== mutationKey) throw new BrandForbiddenError(
+    "a verified human-exact brand approval is required"
+  );
+  return authority;
+}
+function sameProposalResolutionRequest(receipt2, reviewed, resolution, note, paletteId) {
+  return receipt2.resolution === resolution && (receipt2.resolutionNote ?? null) === (note ?? null) && (receipt2.paletteId ?? null) === (paletteId ?? null) && canonicalBrandJson(receipt2.reviewedProposal) === canonicalBrandJson(reviewed);
+}
+
+// src/routes/proposal-dependencies.ts
+async function receipt(ctx, id, actionDigest, expected) {
+  const result = await ctx.db.query({
+    [BRAND_NS.approvalReceipt]: {
+      $: { where: { id } },
+      book: {}
+    }
+  });
+  const row = (result[BRAND_NS.approvalReceipt] ?? [])[0];
+  if (!row || row.actionDigest !== actionDigest || row.resolution !== "accepted" || row.bookId !== expected.bookId || row.reviewedProposal.bookId !== expected.bookId || row.reviewedProposal.kind !== expected.kind || !Array.isArray(row.book) || row.book.length !== 1 || row.book[0]?.id !== expected.bookId || expected.paletteId !== void 0 && row.paletteId !== expected.paletteId || expected.proposalId !== void 0 && row.proposalId !== expected.proposalId || expected.content !== void 0 && canonicalBrandJson(row.reviewedProposal.payload.content) !== canonicalBrandJson(expected.content)) throw new BrandConflictError(`approval receipt ${id} is invalid`);
+  const { book: _book, ...unhydrated } = row;
+  if (!await verifyBrandApprovalReceipt(unhydrated))
+    throw new BrandConflictError(`approval receipt ${id} is invalid`);
+  return unhydrated;
+}
+async function activePalette(ctx, book) {
+  if (!book.activePaletteId) return {};
+  const result = await ctx.db.query({
+    [BRAND_NS.palette]: {
+      $: { where: { id: book.activePaletteId } },
+      book: {}
+    }
+  });
+  const palette = (result[BRAND_NS.palette] ?? [])[0];
+  if (!palette || palette.bookId !== book.id || palette.status !== "active" || !palette.proposalId || !palette.approvalReceiptId || !palette.approvalActionDigest || !Array.isArray(palette.book) || palette.book.length !== 1 || palette.book[0]?.id !== book.id) throw new BrandConflictError(
+    "active palette is missing valid approval provenance"
+  );
+  const approval = await receipt(
+    ctx,
+    palette.approvalReceiptId,
+    palette.approvalActionDigest,
+    {
+      bookId: book.id,
+      kind: "palette",
+      paletteId: palette.id,
+      proposalId: palette.proposalId
+    }
+  );
+  let expectedName;
+  let expectedSwatches;
+  let expectedSeed;
+  try {
+    expectedName = capString(
+      approval.reviewedProposal.payload.name,
+      "reviewedProposal.payload.name",
+      120
+    );
+    expectedSwatches = assertSwatches(
+      approval.reviewedProposal.payload.swatches
+    );
+    expectedSeed = approval.reviewedProposal.payload.seedHex === void 0 ? void 0 : assertHex(
+      approval.reviewedProposal.payload.seedHex,
+      "reviewedProposal.payload.seedHex"
+    );
+  } catch {
+    throw new BrandConflictError("active palette approval payload is invalid");
+  }
+  const expectedSource = approval.reviewedProposal.provenance.sourceAsset ? "extracted" : expectedSeed ? "derived" : "manual";
+  if (palette.proposalId !== approval.proposalId || palette.name !== expectedName || canonicalBrandJson(palette.swatches) !== canonicalBrandJson(expectedSwatches) || (palette.seedHex ?? null) !== (expectedSeed ?? null) || palette.source !== expectedSource || palette.rationale !== approval.reviewedProposal.rationale || canonicalBrandJson(palette.audience) !== canonicalBrandJson(approval.reviewedProposal.audience) || palette.createdAt !== approval.createdAt || palette.updatedAt !== approval.createdAt) throw new BrandConflictError(
+    "active palette does not match its approved proposal"
+  );
+  return { palette, receipt: approval };
+}
+async function approvedTypography(ctx, book) {
+  const key = `${book.id}:typography`;
+  const result = await ctx.db.query({
+    [BRAND_NS.section]: {
+      $: { where: { key } },
+      book: {}
+    }
+  });
+  const section = (result[BRAND_NS.section] ?? [])[0];
+  if (!section || section.status !== "approved") return {};
+  if (section.bookId !== book.id || section.kind !== "typography" || !section.approvalReceiptId || !section.approvalActionDigest || !Array.isArray(section.book) || section.book.length !== 1 || section.book[0]?.id !== book.id) throw new BrandConflictError(
+    "approved typography is missing valid approval provenance"
+  );
+  assertSectionContent("typography", section.content);
+  return {
+    section,
+    receipt: await receipt(
+      ctx,
+      section.approvalReceiptId,
+      section.approvalActionDigest,
+      { bookId: book.id, kind: "typography", content: section.content }
+    )
+  };
+}
+var receiptGuard = (value) => ({
+  ns: BRAND_NS.approvalReceipt,
+  id: value.id,
+  exists: true,
+  equals: {
+    actionDigest: value.actionDigest,
+    receiptDigest: value.receiptDigest,
+    resolution: "accepted"
+  }
+});
+
+// src/routes/proposal-state.ts
+async function proposalDecisionState(ctx, req, book, proposal, resolution, receiptId, paletteId) {
+  const needsPalette = resolution === "accepted" && (proposal.kind === "palette" || proposal.kind === "typography");
+  const paletteDep = needsPalette ? await activePalette(ctx, book) : {};
+  const typeDep = resolution === "accepted" && proposal.kind === "palette" ? await approvedTypography(ctx, book) : {};
+  const dependencyGuards = [];
+  const source = proposal.provenance.sourceAsset;
+  let sourceAsset;
+  if (source && resolution === "accepted") {
+    const result = await ctx.db.query({
+      [BRAND_NS.asset]: {
+        $: { where: { id: source.assetId, bookId: book.id } },
+        book: {}
+      }
+    });
+    sourceAsset = (result[BRAND_NS.asset] ?? [])[0];
+    if (!sourceAsset || sourceAsset.id !== source.assetId || sourceAsset.bookId !== book.id || sourceAsset.status !== "live" || sourceAsset.deletedAt !== void 0 || sourceAsset.contentDigest !== source.contentDigest || sourceAsset.size !== source.objectSize || sourceAsset.contentType !== source.contentType || await brandJsonDigest({ appId: ctx.appId, path: sourceAsset.path }) !== source.pathDigest || sourceAsset.analysisRevision !== source.analysisRevision || (sourceAsset.analysisDigest ?? null) !== source.analysisDigest || !Array.isArray(sourceAsset.book) || sourceAsset.book.length !== 1 || sourceAsset.book[0]?.id !== book.id) throw new BrandConflictError(
+      "source asset changed since the proposal was reviewed"
+    );
+    if (!await ctx.verifySourceAssetSnapshot({
+      req,
+      appId: ctx.appId,
+      bookId: book.id,
+      assetId: source.assetId,
+      path: sourceAsset.path,
+      snapshot: source
+    })) throw new BrandConflictError(
+      "source asset bytes changed since the proposal was reviewed"
+    );
+    dependencyGuards.push({
+      ns: BRAND_NS.asset,
+      id: sourceAsset.id,
+      exists: true,
+      equals: {
+        bookId: book.id,
+        status: "live",
+        path: sourceAsset.path,
+        storageObjectId: sourceAsset.storageObjectId,
+        contentDigest: source.contentDigest,
+        contentType: source.contentType,
+        size: source.objectSize,
+        analysisRevision: source.analysisRevision,
+        ...source.analysisDigest ? { analysisDigest: source.analysisDigest } : {}
+      }
+    });
+  }
+  if (paletteDep.palette && paletteDep.receipt) {
+    dependencyGuards.push({
+      ns: BRAND_NS.palette,
+      id: paletteDep.palette.id,
+      exists: true,
+      equals: {
+        bookId: book.id,
+        status: "active",
+        name: paletteDep.palette.name,
+        swatches: paletteDep.palette.swatches,
+        seedHex: paletteDep.palette.seedHex ?? null,
+        source: paletteDep.palette.source,
+        rationale: paletteDep.palette.rationale,
+        proposalId: paletteDep.palette.proposalId,
+        approvalReceiptId: paletteDep.palette.approvalReceiptId,
+        approvalActionDigest: paletteDep.palette.approvalActionDigest,
+        audience: paletteDep.palette.audience,
+        createdAt: paletteDep.palette.createdAt,
+        updatedAt: paletteDep.palette.updatedAt
+      }
+    }, receiptGuard(paletteDep.receipt));
+  }
+  if (typeDep.section && typeDep.receipt) {
+    dependencyGuards.push({
+      ns: BRAND_NS.section,
+      id: typeDep.section.id,
+      exists: true,
+      equals: {
+        key: typeDep.section.key,
+        bookId: book.id,
+        kind: "typography",
+        status: "approved",
+        content: typeDep.section.content,
+        approvalReceiptId: typeDep.section.approvalReceiptId,
+        approvalActionDigest: typeDep.section.approvalActionDigest,
+        updatedAt: typeDep.section.updatedAt
+      }
+    }, receiptGuard(typeDep.receipt));
+  }
+  let approvedContent = null;
+  let paletteResult = null;
+  if (resolution === "accepted" && proposal.kind === "palette") {
+    if (!paletteId) throw new BrandNotFoundError("resulting palette id");
+    paletteResult = {
+      id: paletteId,
+      name: capString(proposal.payload.name, "payload.name", 120),
+      swatches: assertSwatches(proposal.payload.swatches),
+      seedHex: proposal.payload.seedHex ?? null,
+      receiptId,
+      archivePaletteId: paletteDep.palette?.id ?? null
+    };
+  } else if (resolution === "accepted") {
+    approvedContent = assertSectionContent(
+      proposal.kind,
+      proposal.payload.content
+    );
+  }
+  const tokenSources = resolution === "accepted" && (proposal.kind === "palette" || proposal.kind === "typography") ? {
+    paletteReceiptId: proposal.kind === "palette" ? receiptId : paletteDep.palette?.approvalReceiptId ?? null,
+    paletteActionDigest: proposal.kind === "palette" ? "this-action" : paletteDep.palette?.approvalActionDigest ?? null,
+    typographyReceiptId: proposal.kind === "typography" ? receiptId : typeDep.section?.approvalReceiptId ?? null,
+    typographyActionDigest: proposal.kind === "typography" ? "this-action" : typeDep.section?.approvalActionDigest ?? null
+  } : null;
+  const effectDescriptor = {
+    proposalId: proposal.id,
+    resolution,
+    nextBookVersion: resolution === "accepted" ? book.version + 1 : null,
+    nextActivationRevision: resolution === "accepted" ? book.activationRevision + 1 : null,
+    resultingActivePaletteId: proposal.kind === "palette" && resolution === "accepted" ? paletteId ?? null : book.activePaletteId ?? null,
+    palette: paletteResult,
+    approvedSection: approvedContent ? { kind: proposal.kind, content: approvedContent, receiptId } : null,
+    tokenSources
+  };
+  const binding = {
+    version: 1,
+    bookVersion: book.version,
+    activationRevision: book.activationRevision,
+    activePaletteId: book.activePaletteId ?? null,
+    memberIdsDigest: await brandJsonDigest(book.memberIds),
+    activePaletteDigest: paletteDep.palette ? await brandJsonDigest({
+      id: paletteDep.palette.id,
+      swatches: paletteDep.palette.swatches,
+      approvalReceiptId: paletteDep.palette.approvalReceiptId,
+      approvalActionDigest: paletteDep.palette.approvalActionDigest
+    }) : null,
+    typographyDigest: typeDep.section ? await brandJsonDigest({
+      key: typeDep.section.key,
+      content: typeDep.section.content,
+      approvalReceiptId: typeDep.section.approvalReceiptId,
+      approvalActionDigest: typeDep.section.approvalActionDigest
+    }) : null,
+    sourceAssetDigest: source ? await brandJsonDigest(source) : null,
+    effectDigest: await brandJsonDigest(effectDescriptor)
+  };
+  return {
+    ...paletteDep.palette ? { priorPalette: paletteDep.palette } : {},
+    ...typeDep.section ? { approvedTypography: typeDep.section } : {},
+    binding,
+    effectDescriptor,
+    dependencyGuards
+  };
+}
+
+// src/routes/proposals.ts
+var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var sameStrings2 = (left, right) => left.length === right.length && left.every((value, index) => value === right[index]);
+var guardFailure2 = (error) => record4(error) && error.code === "transact_guard_failed";
+async function handleProposalResolution(ctx, req, bookId, proposalId) {
+  if (req.method !== "POST") return methodNotAllowed();
+  const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
+  if (ctx.actor.kind !== "human")
+    throw new BrandForbiddenError("only a directly authenticated human can resolve a proposal");
+  const body = await readJson(req);
+  const {
+    mutationId,
+    resolution,
+    reviewed,
+    resolutionNote
+  } = parseProposalResolutionRequest(body, bookId, proposalId);
+  const mutationKey = await proposalResolutionMutationKey(
+    bookId,
+    proposalId,
+    mutationId
+  );
+  const stable = (await brandJsonDigest({ mutationKey })).slice(7);
+  const receiptId = `brand-receipt-${stable.slice(0, 32)}`;
+  const paletteId = resolution === "accepted" && reviewed.kind === "palette" ? `brand-palette-${stable.slice(32)}` : void 0;
+  const existing = await proposalReceiptByMutation(ctx, mutationKey);
+  if (existing) {
+    if (!await verifyBrandApprovalReceipt(existing) || !sameProposalResolutionRequest(
+      existing,
+      reviewed,
+      resolution,
+      resolutionNote,
+      paletteId
+    )) throw new BrandConflictError("mutationId was used for another decision");
+    const replayed = await consumeProposalAuthority(
+      ctx,
+      req,
+      bookId,
+      proposalId,
+      existing.actionDigest,
+      mutationKey
+    );
+    if (canonicalBrandJson(replayed) !== canonicalBrandJson(existing.authorityConsumption)) throw new BrandConflictError("central approval receipt changed");
+    return json({ receipt: existing, duplicate: true });
+  }
+  const result = await ctx.db.query({
+    [BRAND_NS.proposal]: {
+      $: { where: { id: proposalId, bookId } },
+      book: {}
+    }
+  });
+  const proposal = (result[BRAND_NS.proposal] ?? [])[0];
+  if (!proposal || proposal.bookId !== book.id || !Array.isArray(proposal.book) || proposal.book.length !== 1 || proposal.book[0]?.id !== book.id) throw new BrandNotFoundError(`proposal ${proposalId}`);
+  const current = proposalReviewSnapshot(proposal);
+  const { reviewDigest, ...unsignedReview } = current;
+  if (await brandJsonDigest(unsignedReview) !== reviewDigest || canonicalBrandJson(current) !== canonicalBrandJson(reviewed)) throw new BrandConflictError("proposal changed since review");
+  if (resolution === "accepted" && !sameStrings2(current.audience, book.memberIds))
+    throw new BrandConflictError("book membership changed; review the proposal again");
+  const state = await proposalDecisionState(
+    ctx,
+    req,
+    book,
+    proposal,
+    resolution,
+    receiptId,
+    paletteId
+  );
+  const actionDigest = await brandJsonDigest({
+    version: 1,
+    reviewedProposal: current,
+    resolution,
+    resolutionNote: resolutionNote ?? null,
+    paletteId: paletteId ?? null,
+    decisionBinding: state.binding
+  });
+  const authority = await consumeProposalAuthority(
+    ctx,
+    req,
+    bookId,
+    proposalId,
+    actionDigest,
+    mutationKey
+  );
+  const receiptBase = {
+    version: 1,
+    id: receiptId,
+    mutationKey,
+    bookId,
+    proposalId,
+    resolution,
+    ...paletteId ? { paletteId } : {},
+    ...resolutionNote ? { resolutionNote } : {},
+    reviewedProposal: current,
+    actionDigest,
+    decisionBinding: state.binding,
+    approvedBy: ctx.actor.id,
+    approvedByKind: "human",
+    appliedBy: ctx.actor.id,
+    appliedByKind: "human",
+    authorityRef: brandAuthorityRef(authority),
+    authorityCapability: "brand.approve",
+    authorityConsumption: authority,
+    createdAt: authority.consumedAt
+  };
+  const receipt2 = {
+    ...receiptBase,
+    receiptDigest: await brandJsonDigest(receiptBase)
+  };
+  const ops = await proposalDecisionOps({
+    proposal: { ...proposal, audience: [...book.memberIds] },
+    book,
+    resolution,
+    receiptId,
+    actionDigest,
+    ...paletteId ? { paletteId } : {},
+    ...state.priorPalette ? { priorPalette: state.priorPalette } : {},
+    ...state.approvedTypography ? { approvedTypography: state.approvedTypography } : {},
+    actorId: ctx.actor.id,
+    now: authority.consumedAt,
+    resolutionNote
+  });
+  ops.push({
+    t: "update",
+    ns: BRAND_NS.approvalReceipt,
+    id: receipt2.id,
+    attrs: receipt2
+  }, {
+    t: "link",
+    ns: BRAND_NS.approvalReceipt,
+    id: receipt2.id,
+    label: "book",
+    target: bookId
+  });
+  const guards = [
+    {
+      ns: BRAND_NS.proposal,
+      id: proposalId,
+      exists: true,
+      equals: proposalGuardEquals(current)
+    },
+    { ns: BRAND_NS.approvalReceipt, id: receiptId, exists: false },
+    {
+      ns: BRAND_NS.book,
+      id: bookId,
+      exists: true,
+      equals: {
+        version: book.version,
+        activationRevision: book.activationRevision,
+        memberIds: book.memberIds
+      }
+    },
+    ...state.dependencyGuards
+  ];
+  if (paletteId) {
+    guards.push({ ns: BRAND_NS.palette, id: paletteId, exists: false });
+  }
+  try {
+    const tx = await ctx.db.transact(ops, {
+      mutationId: mutationKey,
+      guards,
+      asUser: ctx.actor.id,
+      ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+      asPrincipalKind: "human"
+    });
+    if (tx.duplicate) {
+      const replay = await proposalReceiptByMutation(ctx, mutationKey);
+      if (!replay || !await verifyBrandApprovalReceipt(replay) || !sameProposalResolutionRequest(
+        replay,
+        reviewed,
+        resolution,
+        resolutionNote,
+        paletteId
+      ) || canonicalBrandJson(replay.authorityConsumption) !== canonicalBrandJson(authority))
+        throw new BrandConflictError("proposal decision replay is invalid");
+      return json({ receipt: replay, duplicate: true });
+    }
+    return json({ receipt: receipt2, duplicate: false });
+  } catch (error) {
+    if (guardFailure2(error)) throw new BrandReviewStateChangedError();
+    throw error;
+  }
+}
+
 // src/routes/tokens.ts
-var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-async function resolveTokenMaps(db, book) {
+var record5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var missing = (bookId) => {
+  throw new BrandNotFoundError(`compiled tokens for brand book ${bookId}`);
+};
+async function acceptedReceipt(db, bookId, receiptId, actionDigest) {
+  const result = await db.query({
+    [BRAND_NS.approvalReceipt]: {
+      $: { where: { id: receiptId, bookId } },
+      book: {}
+    }
+  });
+  const receipt2 = (result[BRAND_NS.approvalReceipt] ?? [])[0];
+  if (!receipt2 || receipt2.resolution !== "accepted" || receipt2.actionDigest !== actionDigest || !Array.isArray(receipt2.book) || receipt2.book.length !== 1 || receipt2.book[0]?.id !== bookId) return missing(bookId);
+  const { book: _book, ...unhydrated } = receipt2;
+  if (!await verifyBrandApprovalReceipt(unhydrated)) return missing(bookId);
+  return unhydrated;
+}
+async function approvedCache(db, book) {
   const cache = book.tokens;
-  if (cache && isRecord2(cache.light) && isRecord2(cache.dark))
-    return { light: cache.light, dark: cache.dark };
-  if (!book.activePaletteId) throw new BrandNotFoundError(`compiled tokens for brand book ${book.id}`);
-  const pres = await db.query({
-    [BRAND_NS.palette]: { $: { where: { id: book.activePaletteId } } }
+  if (!cache || !record5(cache.light) || !record5(cache.dark) || !book.activePaletteId || cache.paletteId !== book.activePaletteId || !cache.paletteReceiptId || !cache.paletteActionDigest || !cache.sourceDigest) return missing(book.id);
+  const paletteResult = await db.query({
+    [BRAND_NS.palette]: {
+      $: { where: { id: cache.paletteId, bookId: book.id } },
+      book: {}
+    }
+  });
+  const palette = (paletteResult[BRAND_NS.palette] ?? [])[0];
+  if (!palette || palette.status !== "active" || palette.approvalReceiptId !== cache.paletteReceiptId || palette.approvalActionDigest !== cache.paletteActionDigest || !Array.isArray(palette.book) || palette.book.length !== 1 || palette.book[0]?.id !== book.id) return missing(book.id);
+  await acceptedReceipt(
+    db,
+    book.id,
+    cache.paletteReceiptId,
+    cache.paletteActionDigest
+  );
+  const hasTypeId = cache.typographyReceiptId !== void 0;
+  const hasTypeDigest = cache.typographyActionDigest !== void 0;
+  if (hasTypeId !== hasTypeDigest) return missing(book.id);
+  const sectionResult = await db.query({
+    [BRAND_NS.section]: {
+      $: { where: { key: `${book.id}:typography` } },
+      book: {}
+    }
   });
-  const palette = (pres[BRAND_NS.palette] ?? [])[0];
-  if (!palette) throw new BrandNotFoundError(`compiled tokens for brand book ${book.id}`);
-  const sres = await db.query({
-    [BRAND_NS.section]: { $: { where: { key: `${book.id}:typography` } } }
+  const typography = (sectionResult[BRAND_NS.section] ?? [])[0];
+  if (hasTypeId) {
+    if (!typography || typography.bookId !== book.id || typography.kind !== "typography" || typography.status !== "approved" || typography.approvalReceiptId !== cache.typographyReceiptId || typography.approvalActionDigest !== cache.typographyActionDigest || !Array.isArray(typography.book) || typography.book.length !== 1 || typography.book[0]?.id !== book.id) return missing(book.id);
+    await acceptedReceipt(
+      db,
+      book.id,
+      cache.typographyReceiptId,
+      cache.typographyActionDigest
+    );
+  } else if (typography?.status === "approved" && (typography.approvalReceiptId || typography.approvalActionDigest)) {
+    return missing(book.id);
+  }
+  const sourceDigest = await brandJsonDigest({
+    paletteId: cache.paletteId,
+    paletteReceiptId: cache.paletteReceiptId,
+    paletteActionDigest: cache.paletteActionDigest,
+    typographyReceiptId: cache.typographyReceiptId ?? null,
+    typographyActionDigest: cache.typographyActionDigest ?? null
   });
-  const typography = (sres[BRAND_NS.section] ?? [])[0]?.content;
-  const compiled = compileBrandTokens({ swatches: palette.swatches, typography });
-  return { light: compiled.light, dark: compiled.dark };
+  if (sourceDigest !== cache.sourceDigest) return missing(book.id);
+  return cache;
 }
 async function handleTokens(db, req, bookId, which, actor) {
   if (req.method !== "GET") return methodNotAllowed();
   const book = actor === null ? await loadBook(db, bookId) : await loadMemberBook(db, bookId, actor.id);
-  const maps = await resolveTokenMaps(db, book);
-  if (which === "tokens.json") return json({ light: maps.light, dark: maps.dark });
-  const etag = `"brand-tokens-${book.updatedAt}"`;
-  const inm = req.headers.get("if-none-match");
-  if (inm && inm.split(",").map((v) => v.trim()).includes(etag))
-    return new Response(null, { status: 304, headers: { etag } });
-  return new Response(renderTokensCss(maps.light, { dark: maps.dark }), {
+  const cache = await approvedCache(db, book);
+  const light = cache.light;
+  const dark = cache.dark;
+  if (which === "tokens.json") return json({ light, dark });
+  const etag = `"brand-tokens-${book.activationRevision}-${cache.sourceDigest.slice(7)}"`;
+  if (req.headers.get("if-none-match")?.split(",").map((value) => value.trim()).includes(etag)) return new Response(null, { status: 304, headers: { etag } });
+  return new Response(renderTokensCss(light, { dark }), {
     status: 200,
-    headers: { "content-type": "text/css; charset=utf-8", etag }
+    headers: {
+      "content-type": "text/css; charset=utf-8",
+      "cache-control": "public, max-age=0, must-revalidate",
+      etag
+    }
+  });
+}
+
+// src/routes/discussion-references.ts
+var capLimit = (raw) => {
+  const parsed = Number(raw ?? 20);
+  return Number.isInteger(parsed) ? Math.max(1, Math.min(parsed, 20)) : 20;
+};
+var targetFromQuery = (url) => {
+  const kind = url.searchParams.get("kind");
+  const id = url.searchParams.get("id");
+  if (!kind && !id) return null;
+  if (!kind || !id) return null;
+  const value = new URL("https://brand.invalid");
+  value.searchParams.set("odla-ref", `${kind}/${id}`);
+  return parseBrandDiscussionReference(value);
+};
+var childNamespace = (kind) => ({
+  "brand:asset": BRAND_NS.asset,
+  "brand:palette": BRAND_NS.palette,
+  "brand:proposal": BRAND_NS.proposal,
+  "brand:receipt": BRAND_NS.approvalReceipt
+})[kind] ?? null;
+var childTarget = (kind, row) => ({
+  kind,
+  bookId: row.bookId,
+  resourceId: row.id
+});
+var projection = (req, ctx, book, target, row) => {
+  let label = book.name;
+  let hint = `${book.status} brand book`;
+  let summary = `${book.name} brand book`;
+  let status = book.status;
+  let destination = "Brand Studio \xB7 Brand book";
+  if (target.kind === "brand:asset") {
+    const asset = row;
+    label = asset.title?.trim() || `${asset.kind} asset`;
+    hint = `${book.name} \xB7 ${asset.status}`;
+    summary = `${asset.kind} source asset in ${book.name}`;
+    status = asset.status;
+    destination = "Brand Studio \xB7 Conversation";
+  } else if (target.kind === "brand:palette") {
+    const palette = row;
+    label = palette.name;
+    hint = `${book.name} \xB7 ${palette.status} palette`;
+    summary = `${palette.swatches.length}-color palette in ${book.name}`;
+    status = palette.status;
+    destination = "Brand Studio \xB7 Review changes";
+  } else if (target.kind === "brand:proposal") {
+    const proposal = row;
+    label = `${proposal.kind} proposal`;
+    hint = `${book.name} \xB7 ${proposal.status}`;
+    summary = proposal.rationale;
+    status = proposal.status;
+    destination = "Brand Studio \xB7 Review changes";
+  } else if (target.kind === "brand:receipt") {
+    const receipt2 = row;
+    label = `${receipt2.resolution} ${receipt2.reviewedProposal.kind} change`;
+    hint = `${book.name} \xB7 approval receipt`;
+    summary = `${receipt2.resolution} ${receipt2.reviewedProposal.kind} decision`;
+    status = receipt2.resolution;
+    destination = "Brand Studio \xB7 Review changes";
+  }
+  return {
+    kind: target.kind,
+    id: brandDiscussionReferenceId(target),
+    label,
+    hint,
+    summary,
+    status,
+    destination,
+    href: brandDiscussionReferenceHref(
+      new URL(req.url),
+      target,
+      ctx.discussionBasePath
+    )
+  };
+};
+async function exact(ctx, req, target) {
+  const book = await loadMemberBook(ctx.db, target.bookId, ctx.actor.id).catch(() => null);
+  if (!book) return [];
+  if (target.kind === "brand:book") {
+    return [projection(req, ctx, book, target, book)];
+  }
+  const namespace = childNamespace(target.kind);
+  if (!namespace || !target.resourceId) return [];
+  const result = await ctx.db.query({
+    [namespace]: {
+      $: { where: { id: target.resourceId }, limit: 1 }
+    }
+  });
+  const row = (result[namespace] ?? [])[0];
+  if (!row || row.bookId !== book.id || target.kind === "brand:asset" && row.status !== "live") return [];
+  return [projection(req, ctx, book, target, row)];
+}
+var matches = (item, needle) => !needle || `${item.label}
+${item.hint}
+${item.id}`.toLowerCase().includes(needle);
+async function search(ctx, req, url) {
+  const result = await ctx.db.query({
+    [BRAND_NS.book]: { $: { order: { updatedAt: "desc" }, limit: 100 } },
+    [BRAND_NS.asset]: { $: { order: { createdAt: "desc" }, limit: 100 } },
+    [BRAND_NS.palette]: { $: { order: { updatedAt: "desc" }, limit: 100 } },
+    [BRAND_NS.proposal]: { $: { order: { createdAt: "desc" }, limit: 100 } },
+    [BRAND_NS.approvalReceipt]: {
+      $: { order: { createdAt: "desc" }, limit: 100 }
+    }
+  });
+  const books = (result[BRAND_NS.book] ?? []).filter((book) => isMember(book, ctx.actor.id));
+  const bookById = new Map(books.map((book) => [book.id, book]));
+  const items = books.map(
+    (book) => projection(req, ctx, book, { kind: "brand:book", bookId: book.id }, book)
+  );
+  const append = (kind, rows) => {
+    for (const row of rows) {
+      const book = bookById.get(row.bookId);
+      if (!book || kind === "brand:asset" && row.status !== "live") continue;
+      items.push(projection(req, ctx, book, childTarget(kind, row), row));
+    }
+  };
+  append("brand:asset", result[BRAND_NS.asset] ?? []);
+  append("brand:palette", result[BRAND_NS.palette] ?? []);
+  append("brand:proposal", result[BRAND_NS.proposal] ?? []);
+  append("brand:receipt", result[BRAND_NS.approvalReceipt] ?? []);
+  const needle = (url.searchParams.get("q") ?? "").trim().toLowerCase().slice(0, 120);
+  return items.filter((item) => matches(item, needle)).slice(0, capLimit(url.searchParams.get("limit")));
+}
+async function handleBrandDiscussionReferences(ctx, req, url) {
+  if (req.method !== "GET") return methodNotAllowed();
+  const kind = url.searchParams.get("kind");
+  const id = url.searchParams.get("id");
+  if (kind && !id || !kind && id) return json({ error: "kind and id must be paired" }, 400);
+  const target = targetFromQuery(url);
+  if ((kind || id) && !target) return json({ items: [] });
+  return json({
+    items: target ? await exact(ctx, req, target) : await search(ctx, req, url)
   });
 }
 
 // src/routes/index.ts
 var tokensFile = (seg) => seg.length === 3 && seg[0] === "books" && (seg[2] === "tokens.css" || seg[2] === "tokens.json") ? seg[2] : null;
-async function route(ctx, req, seg) {
-  const [head, id, sub, subId] = seg;
+async function route(ctx, req, url, seg) {
+  const [head, id, sub, subId, action] = seg;
+  if (head === "discussion-references" && seg.length === 1)
+    return handleBrandDiscussionReferences(ctx, req, url);
   if (head !== "books") return null;
   if (seg.length === 1) return handleBooksRoot(ctx, req);
   if (seg.length === 2) return handleBookItem(ctx, req, id);
+  if (seg.length === 3 && sub === "members") return handleBookMembers(ctx, req, id);
   if (sub === "assets") {
     if (seg.length === 3) return handleAssetsRoot(ctx, req, id);
     if (seg.length === 4) return handleAssetItem(ctx, req, id, subId);
+    if (seg.length === 5 && action === "content")
+      return handleAssetContent(ctx, req, id, subId);
     return null;
   }
+  if (sub === "proposals" && seg.length === 5 && action === "resolve")
+    return handleProposalResolution(ctx, req, id, subId);
   const file = tokensFile(seg);
   if (file) return handleTokens(ctx.db, req, id, file, ctx.actor);
   return null;
@@ -1439,9 +3092,14 @@ function createBrandRoutes(options) {
   const publicTokens = options.publicTokens === true;
   const base = {
     db: options.db,
+    appId: options.appId,
+    authorizeCapability: options.authorizeCapability,
+    consumeHumanExact: options.consumeHumanExact,
+    verifySourceAssetSnapshot: options.verifySourceAssetSnapshot,
     now: options.now ?? Date.now,
     newId: options.newId ?? (() => crypto.randomUUID()),
-    maxUploadBytes: options.maxUploadBytes ?? 8 * 1024 * 1024
+    maxUploadBytes: options.maxUploadBytes ?? 8 * 1024 * 1024,
+    discussionBasePath: options.discussionBasePath ?? "/"
   };
   return async (req) => {
     const url = new URL(req.url);
@@ -1450,15 +3108,44 @@ function createBrandRoutes(options) {
     try {
       const file = tokensFile(seg);
       if (publicTokens && file) return await handleTokens(base.db, req, seg[1], file, null);
-      const actor = await options.authorize(req);
+      const actor = await (seg[0] === "discussion-references" ? options.authorizeDiscussionReferences ?? options.authorize : options.authorize)(req);
       if (!actor) return json({ error: "unauthorized" }, 401);
-      return await route({ ...base, actor }, req, seg) ?? json({ error: "not found" }, 404);
+      return await route({ ...base, actor }, req, url, seg) ?? json({ error: "not found" }, 404);
     } catch (error) {
       return errorResponse(error);
     }
   };
 }
 
+// src/dispatch-assets.ts
+var MAX_MESSAGE_ASSETS = 12;
+function candidateAssetIds(row) {
+  const standard = Array.isArray(row.attachments) ? row.attachments.flatMap((value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return [];
+    const id = value.id;
+    return typeof id === "string" && id.length > 0 && id.length <= 200 ? [id] : [];
+  }) : [];
+  const legacy = Array.isArray(row.assetIds) ? row.assetIds.filter((value) => typeof value === "string" && value.length > 0 && value.length <= 200) : [];
+  return [.../* @__PURE__ */ new Set([...standard, ...legacy])].slice(0, MAX_MESSAGE_ASSETS);
+}
+async function attachedBrandAssetIds(db, book, row) {
+  const candidates = candidateAssetIds(row);
+  const assets = await Promise.all(candidates.map(async (id) => {
+    const result = await db.query({
+      [BRAND_NS.asset]: {
+        $: { where: { id, bookId: book.id, status: "live" }, limit: 2 },
+        book: { $: { limit: 2 } }
+      }
+    });
+    const rows = result[BRAND_NS.asset] ?? [];
+    if (rows.length !== 1) return null;
+    const asset = rows[0];
+    return asset.id === id && asset.bookId === book.id && asset.status === "live" && asset.deletedAt === void 0 && Array.isArray(asset.book) && asset.book.length === 1 && asset.book[0]?.id === book.id ? id : null;
+  }));
+  return assets.filter((id) => id !== null);
+}
+
 // src/triggers.ts
 var CHAT_MESSAGE_NS = "chat_message";
 var celString = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
@@ -1480,73 +3167,133 @@ function brandBotTrigger(opts) {
 // src/dispatch.ts
 function parseBrandDispatch(raw) {
   if (!raw || typeof raw !== "object") return null;
-  const b = raw;
-  const t = b.trigger;
-  const e = b.event;
-  if (typeof b.appId !== "string" || !b.appId) return null;
-  if (!t || typeof t.runAs?.agentId !== "string" || typeof t.runAs?.persona !== "string") return null;
-  if (!e || typeof e.id !== "string" || !e.row || typeof e.row !== "object") return null;
+  const body = raw;
+  const trigger = body.trigger;
+  const event = body.event;
+  if (body.v !== 2 || typeof body.appId !== "string" || !body.appId || typeof body.appIncarnation !== "string" || !/^[0-9a-f]{32}$/.test(body.appIncarnation) || typeof body.jobId !== "string" || !body.jobId || !trigger || typeof trigger.runAs?.agentId !== "string" || !trigger.runAs.agentId || typeof trigger.runAs.persona !== "string" || !event || typeof event.id !== "string" || !event.row || typeof event.row !== "object" || Array.isArray(event.row)) return null;
   return {
-    v: typeof b.v === "number" ? b.v : 1,
-    appId: b.appId,
+    v: 2,
+    appId: body.appId,
+    appIncarnation: body.appIncarnation,
+    jobId: body.jobId,
     trigger: {
-      id: typeof t.id === "string" ? t.id : "",
-      skill: typeof t.skill === "string" ? t.skill : "",
-      runAs: { agentId: t.runAs.agentId, persona: t.runAs.persona },
-      ...typeof t.maxDepth === "number" ? { maxDepth: t.maxDepth } : {}
+      id: typeof trigger.id === "string" ? trigger.id : "",
+      skill: typeof trigger.skill === "string" ? trigger.skill : "",
+      runAs: {
+        agentId: trigger.runAs.agentId,
+        persona: trigger.runAs.persona
+      },
+      ...typeof trigger.maxDepth === "number" ? { maxDepth: trigger.maxDepth } : {}
     },
-    event: { ns: typeof e.ns === "string" ? e.ns : CHAT_MESSAGE_NS, id: e.id, row: e.row }
+    event: {
+      ns: typeof event.ns === "string" ? event.ns : CHAT_MESSAGE_NS,
+      id: event.id,
+      row: event.row
+    }
   };
 }
 async function bookForChannel(db, channelId) {
   if (!channelId) return null;
-  const res = await db.query({ [BRAND_NS.book]: { $: { where: { channelId } } } });
-  return (res[BRAND_NS.book] ?? [])[0] ?? null;
+  const result = await db.query({
+    [BRAND_NS.book]: { $: { where: { channelId } } }
+  });
+  const books = result[BRAND_NS.book] ?? [];
+  if (books.length > 1)
+    throw new BrandConflictError(`multiple brand books claim channel ${channelId}`);
+  return books[0] ?? null;
 }
-function brandInputFor(body, attachments) {
+function brandInputFor(body, attachments, author, attachedAssetIds = []) {
   const row = body.event.row;
-  const prompt = `A new message arrived in this brand book's channel from ${String(row.authorId ?? "someone")}: "${String(row.body ?? "")}". Ground yourself first (read_brand_book, list_assets), then move the brand work forward: study the material, justify colors with the math tools, and park palette ideas as proposals \u2014 a human must explicitly approve before you resolve or compile. If you reply in chat, keep it concise.`;
+  const actor = author ? `${author.displayName} (${author.kind}${author.managerDisplayName ? `, managed by ${author.managerDisplayName}` : ""})` : row.authorKind === "bot" ? "a managed agent" : "a participant";
+  const prompt = `A new message arrived in this brand book's channel from ${actor}: "${String(row.body ?? "")}". Ground yourself first (read_brand_book, list_assets), then move the work forward. Study real material, justify colors, and park exact proposals. A human approves in the Brand surface; acceptance applies the reviewed facet and recompiles dependent tokens. ` + (attachedAssetIds.length > 0 ? `This message atomically attached Brand asset id${attachedAssetIds.length === 1 ? "" : "s"} ${attachedAssetIds.join(", ")}; use view_asset on those exact ids before drawing conclusions. ` : "") + "Keep any chat reply concise.";
   return attachments?.length ? [...attachments, { type: "text", text: prompt }] : prompt;
 }
-var PRETURN_IMAGE_TYPES = /* @__PURE__ */ new Set([
-  "image/png",
-  "image/jpeg",
-  "image/gif",
-  "image/webp"
-]);
-async function assetBlocksFor(db, fileBaseUrl, raw) {
-  if (!Array.isArray(raw)) return [];
-  const ids = raw.filter((v) => typeof v === "string");
-  if (ids.length === 0) return [];
-  const res = await db.query({ [BRAND_NS.asset]: { $: { where: { id: { $in: ids } } } } });
-  const byId = new Map((res[BRAND_NS.asset] ?? []).map((a2) => [a2.id, a2]));
-  const blocks = [];
-  for (const id of ids) {
-    const asset = byId.get(id);
-    if (!asset || asset.deletedAt != null || !PRETURN_IMAGE_TYPES.has(asset.contentType)) continue;
-    const url = asset.url.startsWith("http") ? asset.url : fileBaseUrl + asset.url;
-    blocks.push({ type: "image", source: { type: "url", url } });
-  }
-  return blocks;
-}
 async function dispatchBrandTurn(deps, body) {
+  if (body.appId !== deps.appId || body.trigger.skill !== "brand" || body.event.ns !== CHAT_MESSAGE_NS) throw new BrandForbiddenError("foreign or non-brand dispatch");
   const channelId = String(body.event.row.channelId ?? "");
   const book = await bookForChannel(deps.db, channelId);
-  if (!book) throw new BrandNotFoundError(`brand book for channel ${channelId || "(missing channelId)"}`);
-  const visionInToolResults = supportsBrandVision(deps.catalog?.[deps.model]);
+  if (!book)
+    throw new BrandNotFoundError(
+      `brand book for channel ${channelId || "(missing channelId)"}`
+    );
+  const agentId = body.trigger.runAs.agentId;
+  if (!book.memberIds.includes(agentId))
+    throw new BrandNotFoundError(`brand book for channel ${channelId}`);
+  const read = await deps.authorizeCapability({
+    agentId,
+    bookId: book.id,
+    capability: "brand.read"
+  });
+  if (!read || read.capability !== "brand.read" || !read.authorityRef)
+    throw new BrandForbiddenError("agent lacks live brand.read");
+  const authorId = typeof body.event.row.authorId === "string" ? body.event.row.authorId : "";
+  const authors = authorId ? await deps.resolvePrincipals({
+    requesterAgentId: agentId,
+    bookId: book.id,
+    principalIds: [authorId]
+  }) : [];
+  const author = authors.find((candidate) => candidate.id === authorId);
+  const attachedAssetIds = await attachedBrandAssetIds(
+    deps.db,
+    book,
+    body.event.row
+  );
+  const runtime = await deps.agentRuntimeFor({
+    appId: body.appId,
+    agentId,
+    bookId: book.id,
+    triggerId: body.trigger.id,
+    eventId: body.event.id,
+    jobId: body.jobId
+  });
+  if (!runtime.credentialRef || !runtime.jobId || runtime.jobId !== body.jobId)
+    throw new BrandForbiddenError("agent data credential is not bound");
+  let durableOutcome = false;
+  const bridge = {
+    ...runtime.bridge,
+    createProposal: async (input) => {
+      const proposal = await runtime.bridge.createProposal(input);
+      durableOutcome = true;
+      return proposal;
+    },
+    recordAssetAnalysis: async (input) => {
+      const asset = await runtime.bridge.recordAssetAnalysis(input);
+      durableOutcome = true;
+      return asset;
+    }
+  };
+  const visionInToolResults = supportsBrandVision(
+    deps.catalog?.[deps.model]
+  );
   const self = {
-    selfId: body.trigger.runAs.agentId,
+    selfId: agentId,
     kind: "bot",
     displayName: body.trigger.runAs.persona
   };
   const persona = createBrandPersona({
     model: deps.model,
-    brand: { db: deps.db, bookId: book.id, self, fileBaseUrl: deps.fileBaseUrl, visionInToolResults },
+    brand: {
+      db: runtime.db,
+      bookId: book.id,
+      self,
+      agentDbBinding: {
+        principalId: agentId,
+        credentialRef: runtime.credentialRef
+      },
+      agentJobId: runtime.jobId,
+      agentBridge: bridge,
+      authorizeCapability: deps.authorizeCapability,
+      resolvePrincipals: deps.resolvePrincipals,
+      visionInToolResults,
+      ...deps.newId ? { newId: deps.newId } : {}
+    },
     skills: deps.chatSkillFor ? [deps.chatSkillFor(channelId, self)] : []
   });
-  const attachments = visionInToolResults ? [] : await assetBlocksFor(deps.db, deps.fileBaseUrl, body.event.row.assetIds);
-  const run = await deps.runAgent(deps.inference, persona, { input: brandInputFor(body, attachments) });
-  return { finalText: run.finalText };
+  const run = await deps.runAgent(deps.inference, persona, {
+    // Models without tool-result vision receive no raw/signed fallback URL.
+    input: brandInputFor(body, void 0, author, attachedAssetIds)
+  });
+  return { finalText: run.finalText, durableOutcome };
 }
 
 // src/descriptor.ts
@@ -1574,10 +3321,12 @@ var brandIntegration = {
   schema: BRAND_SCHEMA,
   rules: brandRules(),
   triggers: [],
+  agentProfile: BRAND_AGENT_PROFILE,
   provision: {
     human: [
+      "Configure direct Clerk human approval through authorizeCapability + consumeHumanExact; delegated, machine, and agent principals must not resolve proposals.",
       'Choose the trigger mode: one global mention-gated bot (brandBotTrigger({ mention: "@brand" }), no channels) or per-book channel-scoped bots (channels: [book.channelId], no mention).',
-      "Pick the bot's model; when supportsBrandVision(catalog[model]) is false, dispatch attaches assets pre-turn instead of inside tool results.",
+      "Pick a model where supportsBrandVision(catalog[model]) is true for in-conversation asset viewing; secure dispatch never falls back to signed or persistent asset URLs.",
       "Decide whether compiled tokens are public (publicTokens serves tokens.css/tokens.json unauthenticated)."
     ],
     cli: [
@@ -1585,10 +3334,14 @@ var brandIntegration = {
       "Install brandRules() at /app/:id/admin/rules (merged with the app's existing rules).",
       "Register a brandBotTrigger(...) per bot at /app/:id/admin/triggers \u2014 global mention-gated, or channel-scoped per book.",
       "Seed the bot's agent id into each brand_book.memberIds roster (audienceFanoutOps covers existing child rows).",
-      "Provision the bot's AI provider secret (via @odla-ai/ai) and the worker's admin odla-db credential."
+      "Issue the bot brand.read + brand.edit and expose only BRAND_AGENT_PROFILE semantic operations; deny raw brand_* writes and raw file operations.",
+      "Provision private file signing and verifySourceAssetSnapshot; never expose an admin credential or persistent asset URL to the agent."
     ],
     doctor: [
-      "All five brand_* namespaces have rules installed (brand_asset fully closed \u2014 worker-mediated only).",
+      "All six brand_* namespaces have rules installed; raw browser/agent writes are denied and child reads use current linked-book membership.",
+      "The agent runtime matches BRAND_AGENT_PROFILE: brand.read/edit only, semantic operations only, no raw brand_* or file access.",
+      "Proposal decisions consume a direct-human exact brand.approve authority use and persist one guarded brand_approval_receipt.",
+      "Private source assets are signed briefly and verifySourceAssetSnapshot revalidates path, ETag, size, content type, and digest before approval.",
       "brand_book.id/slug, brand_section.key, and the other mirrored id attrs are unique.",
       "Each registered trigger's agent id is present in its target books' memberIds rosters.",
       "Books with channelId set point at real chat channels when @odla-ai/chat is installed."
@@ -1615,17 +3368,23 @@ export {
   ASSET_CONTENT_TYPES,
   ASSET_KINDS,
   BOOK_STATUSES,
+  BRAND_AGENT_PROFILE,
   BRAND_CHART_TOKENS,
   BRAND_CHAT_TOKENS,
   BRAND_DERIVED_TOKENS,
+  BRAND_DISCUSSION_REFERENCE_KINDS,
   BRAND_EMITTED_TOKENS,
   BRAND_INSTRUCTIONS,
   BRAND_NS,
   BRAND_REQUIRED_TOKENS,
   BRAND_RULES,
   BRAND_SCHEMA,
+  BrandConflictError,
+  BrandForbiddenError,
+  BrandGoneError,
   BrandInputError,
   BrandNotFoundError,
+  BrandReviewStateChangedError,
   CHART_DELTA_MIN,
   CHAT_MESSAGE_NS,
   CSS_NAMED_COLORS,
@@ -1654,15 +3413,22 @@ export {
   assertSectionContent,
   assertSwatches,
   assetTools,
+  attachedBrandAssetIds,
   audienceFanoutOps,
   base64FromBytes,
+  beginAssetDeleteOps,
   bookForChannel,
   bookTools,
+  brandAuthorityRef,
   brandBotTrigger,
+  brandDiscussionReferenceHref,
+  brandDiscussionReferenceId,
   brandInputFor,
   brandIntegration,
+  brandJsonDigest,
   brandRules,
   brandSkill,
+  canonicalBrandJson,
   capString,
   capStringArray,
   clamp01,
@@ -1681,9 +3447,13 @@ export {
   deriveDarkTokens,
   derivePalette,
   dispatchBrandTurn,
+  finishAssetDeleteOps,
+  formatBrandDiscussionReference,
   hexToOklch,
   hslToRgb,
   inSrgbGamut,
+  isBoundedBrandJson,
+  isBrandHumanAuthorityConsumption,
   linearToSrgb,
   mapPaletteToTokens,
   meetsAA,
@@ -1696,10 +3466,13 @@ export {
   oklchToHex,
   oklchToOklab,
   paletteTools,
+  parseBrandDiscussionReference,
   parseBrandDispatch,
   parseHex,
   pickTextOn,
+  proposalReviewSnapshot,
   proposePaletteOps,
+  proposeSectionOps,
   readTools,
   recordAnalysisOps,
   rejectProposalOps,
@@ -1717,9 +3490,9 @@ export {
   tetradic,
   tintShadeRamp,
   toHex,
-  tombstoneAssetOps,
   triadic,
   updateBookOps,
-  upsertSectionOps
+  upsertSectionOps,
+  verifyBrandApprovalReceipt
 };
 //# sourceMappingURL=index.js.map