@odla-ai/brand 0.2.1 → 0.4.0

package/README.md

@@ -19,9 +19,38 @@ npm i @odla-ai/brand
 
 The package is a **schema + rules + an agent skill + a color engine + a token compiler + a route factory** — not a service you run.
 
-- **Proposals are the only door to the palette.** The agent explores colors (deterministic OKLCH math: harmonies, ramps, ΔEOK dedupe, WCAG contrast) and writes every candidate as an open `brand_proposal`. A human accepts or rejects; `resolve_proposal` is instructed to fire only on explicit user confirmation. Accepted proposals become `brand_palette` rows with full provenance.
-- **Vision happens in the model's own turn.** `view_asset` fetches uploaded bytes worker-side and returns them as image/PDF blocks *inside the tool result* — gated on the model's `toolResultBlocks` catalog capability (`supportsBrandVision`), with a pre-turn attachment fallback for models without it. No AI calls inside any tool handler; every handler is deterministic and testable.
-- **Uploads are worker-mediated.** The odla-db browser client cannot write files, so `createBrandRoutes` proxies multipart uploads onto the app's `$files` storage (content-type allowlist, size cap, unguessable paths) and keeps `brand_asset` rows deny-all so they always match real storage.
+- **Proposals are the human checkpoint.** Brand direction, image/logo choices,
+  typography, voice, and colors stay proposals in the conversation. Palette
+  candidates are the executable path today: the agent explores them with
+  deterministic OKLCH/WCAG math and writes an open `brand_proposal`. A human
+  approves, rejects, or requests a revision before any palette effect. The
+  agent skill has no resolution tool: both `propose_palette` and
+  `update_section` park open proposals. A current book member who is also a
+  direct Clerk app owner/co-owner posts the exact reviewed snapshot to the
+  guarded route. It consumes one central `human_exact` `brand.approve` use and
+  atomically writes the effect plus an immutable `brand_approval_receipt`.
+  The central receipt names the exact Registry app incarnation, so an approval
+  from a purged project cannot resolve content in a same-id replacement.
+  Review clients must retain one mutation id for each exact proposal digest +
+  accepted/rejected decision across pending requests and retries. Proposal
+  author names must come from a Registry-owned principal projection; mutable
+  chat participants and raw ids are not identity presentation.
+- **Vision happens through a semantic bridge.** `view_asset` asks the trusted
+  host for bytes by asset id and returns image/PDF blocks inside the tool
+  result when the model supports them. The rules-scoped agent credential
+  cannot read raw files, mint signed URLs, or write `brand_*` rows. There is
+  no raw or signed-URL fallback. Message attachment ids are revalidated against
+  the exact live Brand book before they enter the prompt; every facet proposal
+  may preserve the source asset's immutable byte snapshot.
+- **Brand child writes are worker-mediated.** CEL permits members to read their
+  sections, palettes, proposals, and approval receipts, but all writes are
+  closed. `createBrandRoutes` owns guarded human decisions and proxies
+  private multipart uploads, short-lived signed downloads, and human effects.
+  Agent tools call only the host-provided `BrandAgentBridge` operations in
+  `BRAND_AGENT_PROFILE`.
+- **The upload surface is intentionally narrow.** Raster PNG/JPEG/GIF/WebP and
+  PDF inputs are supported. SVG active content and binary font files are not;
+  typography remains an exact, reviewable family/style proposal.
 - **Tokens compile to the @odla-ai/ui contract.** `compileBrandTokens` maps swatch roles onto `--ui-*` names — always emitting every required token plus the accent-composing derived set, so a scoped preview island never keeps stale root composites — and `renderTokensCss` emits theme-structured CSS (light, dark, invert). Dark is derived algorithmically and contrast re-tuned per token.
 - **Zero runtime dependencies.** The db client is injected structurally (a real `@odla-ai/db` `AdminDb` satisfies `BrandDb`); `@odla-ai/ai` is a types-only optional peer.
 
@@ -38,7 +67,26 @@ const db = init({ appId, adminToken, endpoint });
 
 const routes = createBrandRoutes({
   db,
-  authorize: async (req) => (await isMember(req)) ? { id: await userId(req), kind: "human" } : null,
+  appId,
+  authorize: verifyDirectCaller,
+  // Read-only: exact brand/brand.read/audience/app-incarnation assertion.
+  authorizeDiscussionReferences: verifyDiscussionReferenceAssertion,
+  // Optional test/edge fetch; it receives only a Brand-minted private URL.
+  fetchPrivateAsset: fetch,
+  authorizeCapability: verifyCurrentHumanAppOwner,
+  consumeHumanExact: async (input) =>
+    (await appsForBearer(input.req).consumeHumanExactAuthority(
+      input.appId,
+      {
+        capability: input.capability,
+        projectCapability: input.projectCapability,
+        effect: input.effect,
+        resource: input.resource,
+        actionDigest: input.actionDigest,
+        consumptionIdempotencyKey: input.consumptionIdempotencyKey,
+      },
+    )).receipt,
+  verifySourceAssetSnapshot: verifyPrivateObjectExactly,
 });
 
 export default {
@@ -48,6 +96,53 @@ export default {
 };
 ```
 
+`GET /api/brand/discussion-references?q=…` searches only books on the
+asserted principal's current roster and their live assets, palettes, proposals,
+and receipts. Supplying `kind` + `id` performs exact lookup and returns no item
+unless that row still exists in the named book. Returned links use stable
+`odla-ref=brand:kind/book-id[/resource-id]` identities; the destination calls
+`parseBrandDiscussionReference` to select the book and review surface. Each
+projection includes a bounded product-authored `summary`, `status`, and
+`destination` for people and read-only agent tools. Registry assertions bind
+the exact `brand` product, `brand.read`, current canonical endpoint audience,
+app incarnation, environment, and principal; an agent assertion also binds its
+manager and live grant revision. The host must set its current
+`ODLA_APP_INCARNATION` and fail closed on a mismatch. This assertion cannot
+authorize proposal resolution or any other Brand mutation.
+
+Palette projections additionally carry at most 24 validated semantic roles,
+normalized `#rrggbb` colors, and bounded optional names so Discussion can use
+the shared `@odla-ai/ui` `PaletteStrip` without reconstructing brand state.
+An assertion-authorized exact lookup may request
+`inspect=asset-content&kind=brand:asset&id=…`. Brand resolves the linked row,
+mints its own short-lived private-object URL, and returns only bounded PNG,
+JPEG, GIF, WebP, or PDF bytes—never the URL or a separate object path, storage
+id, app id, or book id. Only the already-discovered canonical reference id
+crosses the boundary. It validates type and magic, size, and SHA-256, then
+reloads both
+membership and the exact linked asset row after I/O. SVG, malformed, spoofed,
+changed, unsupported, and over-budget assets fail closed. Returned bytes carry
+`untrusted_project_material` taint for the hosted inference boundary; the
+native link remains navigation only and human proposal approval is unchanged.
+
+Resolve a proposal from a human review UI with one stable mutation id. Send
+back exactly the proposal snapshot that UI rendered; a stale or concurrently
+resolved snapshot answers `409`, while an identical retry returns the original
+receipt with `duplicate: true`.
+
+```ts
+await fetch(`/api/brand/books/${book.id}/proposals/${proposal.id}/resolve`, {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({
+    mutationId: crypto.randomUUID(),
+    resolution: "accepted", // or "rejected"
+    reviewedProposal: proposal,
+    note: "Approved in palette review",
+  }),
+});
+```
+
 Wire the agent by attaching `brandSkill` to a persona (or let the chat-agent worker route a `brandBotTrigger` dispatch into `dispatchBrandTurn`):
 
 ```ts
@@ -57,8 +152,14 @@ const spec = inference.catalog[model];
 const persona = createBrandPersona({
   model,
   brand: {
-    db, bookId, fileBaseUrl,
+    db: rulesScopedAgentDb,
+    bookId,
     self: { selfId: botId, kind: "bot" },
+    agentDbBinding: { principalId: botId, credentialRef },
+    agentJobId: jobId,
+    agentBridge,
+    authorizeCapability: verifyLiveAgentGrant,
+    resolvePrincipals: resolveSafeDirectoryProjection,
     visionInToolResults: supportsBrandVision(spec),
   },
 });
@@ -75,3 +176,20 @@ import { compileBrandTokens, renderTokensCss } from "@odla-ai/brand/tokens";
 const { light, dark, warnings } = compileBrandTokens({ swatches });
 const css = renderTokensCss(light, { dark }); // :root / [data-theme="dark"] / media guard
 ```
+
+## Authority and asset contract
+
+- Install `BRAND_AGENT_PROFILE`: agents receive only `brand.read` and
+  `brand.edit`, and may create proposals, record analysis, and read bounded
+  asset content only through semantic host operations. Deny raw Brand writes,
+  raw file reads, signing, and admin credentials.
+- `createBrandRoutes` requires all security seams. `authorize` derives the
+  actor from a verified bearer; `authorizeCapability` revalidates current app
+  ownership; `consumeHumanExact` consumes the exact reviewed action; and
+  `verifySourceAssetSnapshot` revalidates private path, ETag, size, media type,
+  and SHA-256 immediately before approval. The returned authority receipt must
+  carry the current 32-character app incarnation and is stored losslessly with
+  the Brand decision.
+- `409` means the review or authority conflicted, `410` means its authority or
+  source is gone, and registry/storage/network outages remain opaque `500`s.
+  Definite identity or object mismatches fail closed.

package/dist/{index-bj73h3qo.d.cts → index-CRl3IXHB.d.cts}

@@ -4,6 +4,7 @@ declare const BRAND_NS: {
     readonly section: "brand_section";
     readonly palette: "brand_palette";
     readonly proposal: "brand_proposal";
+    readonly approvalReceipt: "brand_approval_receipt";
     readonly asset: "brand_asset";
 };
 /** Brand-book lifecycle: authored → adopted → retired (delete is owner-only). */
@@ -27,8 +28,8 @@ type PaletteStatus = (typeof PALETTE_STATUSES)[number];
 declare const PALETTE_SOURCES: readonly ["extracted", "derived", "manual"];
 /** Provenance of a palette's swatches. */
 type PaletteSource = (typeof PALETTE_SOURCES)[number];
-/** What a proposal proposes (palettes are the first-class case). */
-declare const PROPOSAL_KINDS: readonly ["palette", "typography", "voice", "logo"];
+/** Every mutable brand facet uses the same proposal/approval contract. */
+declare const PROPOSAL_KINDS: readonly ["palette", "typography", "voice", "logo", "imagery"];
 /** Which brand facet a proposal targets. */
 type ProposalKind = (typeof PROPOSAL_KINDS)[number];
 /** Proposal lifecycle: open until a HUMAN accepts/rejects it (or a newer
@@ -37,56 +38,13 @@ declare const PROPOSAL_STATUSES: readonly ["open", "accepted", "rejected", "supe
 /** Where a proposal stands in the human-gated review flow. */
 type ProposalStatus = (typeof PROPOSAL_STATUSES)[number];
 /** What kind of upload an asset row records. */
-declare const ASSET_KINDS: readonly ["logo", "wordmark", "inspiration", "document", "font", "other"];
+declare const ASSET_KINDS: readonly ["logo", "wordmark", "inspiration", "document", "other"];
 /** The declared purpose of an uploaded asset. */
 type AssetKind = (typeof ASSET_KINDS)[number];
 /** Every swatch role a palette may assign. `chart` may repeat (a series);
  * `custom` is the escape hatch for roles the token compiler doesn't map. */
 declare const SWATCH_ROLES: readonly ["primary", "secondary", "highlight", "bg", "surface", "text", "neutral", "good", "warn", "danger", "chart", "custom"];
 
-/** Scalar values odla-db attrs and where-clauses accept. */
-type BrandScalar = string | number | boolean | null;
-/** Natural-key lookup ref for idempotent upserts (odla-db `Lookup` shape). */
-interface BrandLookup {
-    ns: string;
-    attr: string;
-    value: BrandScalar;
-}
-/** How an op names its row: a raw entity id, or a natural-key lookup. */
-type BrandEntityRef = string | BrandLookup;
-/** Attr payload of one op. Typed `any` on purpose: the real odla-db
- * `transact` constrains attrs to its own `Value` type, and `any` is the one
- * shape assignable in both directions with no cast. */
-type BrandAttrs = Record<string, any>;
-/** One transact operation (update = attr-merge upsert; merge = deep-merge
- * into a json attribute; retract = clear the named attributes, since a typed
- * scalar can't store null). */
-type BrandOp = {
-    t: "update";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: BrandAttrs;
-} | {
-    t: "merge";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: BrandAttrs;
-} | {
-    t: "retract";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: string[];
-} | {
-    t: "delete";
-    ns: string;
-    id: BrandEntityRef;
-};
-/** A row as odla-db returns it: hydrated id plus attrs. */
-type BrandRow = {
-    id: string;
-} & Record<string, unknown>;
-/** Query result: namespace → rows. */
-type BrandResult = Record<string, BrandRow[]>;
 /** The role a swatch plays in the palette (what the token compiler maps). */
 type SwatchRole = (typeof SWATCH_ROLES)[number];
 /** One palette color: a role, a `#rrggbb` hex, and optional naming/why. */
@@ -134,132 +92,18 @@ interface AssetAnalysis {
     dominantColors: string[];
     tags: string[];
 }
-/** The compiled-token cache stored on `brand_book.tokens`. `warnings` carries
- * the compiler's `TokenWarning[]` (typed loosely here so the row types don't
- * depend on the token compiler's module). */
+/** The compiled-token cache stored on `brand_book.tokens`. */
 interface BrandTokensSnapshot {
     light: Record<string, string>;
     dark: Record<string, string>;
     warnings: unknown[];
     compiledAt: number;
-}
-/** A brand book row: the auth roster (`memberIds`, including the bot agent
- * id) plus the active palette and compiled-token cache. */
-interface BrandBook {
-    id: string;
-    slug: string;
-    name: string;
-    status: BookStatus;
-    ownerId: string;
-    memberIds: string[];
-    channelId?: string;
-    activePaletteId?: string;
-    tokens?: BrandTokensSnapshot;
-    summary?: string;
-    createdAt: number;
-    updatedAt: number;
-}
-/** A section row — one per (book, kind), upserted by its natural `key`. */
-interface BrandSection {
-    id: string;
-    key: string;
-    bookId: string;
-    kind: SectionKind;
-    status: SectionStatus;
-    content: Record<string, unknown>;
-    audience: string[];
-    updatedBy: string;
-    updatedAt: number;
-}
-/** A palette row. Swatches are json ON the palette, not a namespace: the
- * palette is the atomic proposal/approval unit and swatches are never
- * queried across palettes. */
-interface BrandPalette {
-    id: string;
-    bookId: string;
-    name: string;
-    status: PaletteStatus;
-    swatches: Swatch[];
-    seedHex?: string;
-    source: PaletteSource;
-    rationale?: string;
-    proposalId?: string;
-    audience: string[];
-    createdAt: number;
-    updatedAt: number;
-}
-/** A proposal row: agent output parked for explicit human resolution. */
-interface BrandProposal {
-    id: string;
-    bookId: string;
-    kind: ProposalKind;
-    status: ProposalStatus;
-    payload: Record<string, unknown>;
-    rationale: string;
-    sourceAssetId?: string;
-    messageId?: string;
-    audience: string[];
-    createdBy: string;
-    createdAt: number;
-    resolvedBy?: string;
-    resolvedAt?: number;
-    resolutionNote?: string;
-}
-/** An asset row mirroring one real uploaded file (worker-mediated; rules
- * close the namespace). Delete is a tombstone (`deletedAt`), never a row
- * delete, so analyses/proposals referencing it stay coherent. */
-interface BrandAsset {
-    id: string;
-    bookId: string;
-    kind: AssetKind;
-    path: string;
-    url: string;
-    contentType: string;
-    size: number;
-    title?: string;
-    analysis?: AssetAnalysis;
-    analyzedAt?: number;
-    audience: string[];
-    uploadedBy: string;
-    createdAt: number;
-    deletedAt?: number;
-}
-/** What `db.storage.upload` resolves to (odla-db's file record shape). */
-interface BrandFileRecord {
-    id: string;
-    path: string;
-    url: string;
-    size: number;
-    contentType: string;
-}
-/** Bodies `storage.upload` accepts — a practical subset of the platform's
- * `BodyInit` (which has no ambient type under a DOM-less lib). The real
- * @odla-ai/db client accepts a superset, so it still structurally satisfies
- * {@link BrandStorage}. */
-type BrandUploadBody = string | Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>;
-/** The injected file store — @odla-ai/db's `storage` API satisfies this. */
-interface BrandStorage {
-    upload(path: string, data: BrandUploadBody, contentType?: string): Promise<BrandFileRecord>;
-    delete(path: string): Promise<void>;
-}
-/** The injected odla client (structural — a real @odla-ai/db `AdminDb`
- * satisfies it). `transact` accepts flat op arrays and `mutationId` gives
- * exactly-once application (`duplicate: true` on replay). */
-interface BrandDb {
-    query(q: Record<string, unknown>): Promise<Record<string, unknown[]>>;
-    transact(ops: unknown[], opts?: {
-        mutationId?: string;
-    }): Promise<{
-        txId: number;
-        duplicate?: boolean;
-    }>;
-    storage: BrandStorage;
-}
-/** Who is acting: a human member or the book's bot agent. */
-interface BrandActor {
-    id: string;
-    kind: "human" | "agent";
-    email?: string;
+    paletteId: string;
+    paletteReceiptId: string;
+    paletteActionDigest: string;
+    typographyReceiptId?: string;
+    typographyActionDigest?: string;
+    sourceDigest: string;
 }
 
 /**
@@ -406,4 +250,4 @@ declare function renderTokensCss(light: BrandTokens, opts?: RenderTokensCssOptio
  */
 declare function compileBrandTokens(input: CompileInput): CompiledBrandTokens;
 
-export { SWATCH_ROLES as $, type AssetAnalysis as A, type BrandDb as B, type BrandStorage as C, type BrandTokens as D, type BrandTokensSnapshot as E, type BrandUploadBody as F, type CompileInput as G, type CompiledBrandTokens as H, DARK_FLIP_L_MAX as I, DARK_FLIP_L_MIN as J, DEFAULT_ACCENT_SEED as K, type ImagerySection as L, type LogoSection as M, type MapResult as N, PALETTE_STATUSES as O, PALETTE_SOURCES as P, PROPOSAL_KINDS as Q, PROPOSAL_STATUSES as R, type Swatch as S, type PaletteSection as T, type PaletteSource as U, type PaletteStatus as V, type ProposalKind as W, type ProposalStatus as X, type RenderTokensCssOptions as Y, SECTION_KINDS as Z, SECTION_STATUSES as _, type BrandBook as a, type SwatchRole as a0, type TokenWarning as a1, type TypographySection as a2, type VoiceSection as a3, compileBrandTokens as a4, deriveDarkTokens as a5, mapPaletteToTokens as a6, renderTokensCss as a7, type BrandOp as b, type BrandEntityRef as c, type SectionKind as d, type SectionStatus as e, type BrandProposal as f, type AssetKind as g, type BrandActor as h, ASSET_KINDS as i, BOOK_STATUSES as j, BRAND_CHART_TOKENS as k, BRAND_CHAT_TOKENS as l, BRAND_DERIVED_TOKENS as m, BRAND_EMITTED_TOKENS as n, BRAND_NS as o, BRAND_REQUIRED_TOKENS as p, type BookStatus as q, type BrandAsset as r, type BrandAttrs as s, type BrandFileRecord as t, type BrandLookup as u, type BrandPalette as v, type BrandResult as w, type BrandRow as x, type BrandScalar as y, type BrandSection as z };
+export { type AssetKind as A, type BookStatus as B, type CompileInput as C, DARK_FLIP_L_MAX as D, SWATCH_ROLES as E, type SwatchRole as F, type TypographySection as G, compileBrandTokens as H, type ImagerySection as I, deriveDarkTokens as J, mapPaletteToTokens as K, type LogoSection as L, type MapResult as M, renderTokensCss as N, type ProposalKind as P, type RenderTokensCssOptions as R, type Swatch as S, type TokenWarning as T, type VoiceSection as V, type ProposalStatus as a, type AssetAnalysis as b, type BrandTokensSnapshot as c, type PaletteStatus as d, type PaletteSource as e, type SectionKind as f, type SectionStatus as g, ASSET_KINDS as h, BOOK_STATUSES as i, BRAND_CHART_TOKENS as j, BRAND_CHAT_TOKENS as k, BRAND_DERIVED_TOKENS as l, BRAND_EMITTED_TOKENS as m, BRAND_NS as n, BRAND_REQUIRED_TOKENS as o, type BrandTokens as p, type CompiledBrandTokens as q, DARK_FLIP_L_MIN as r, DEFAULT_ACCENT_SEED as s, PALETTE_SOURCES as t, PALETTE_STATUSES as u, PROPOSAL_KINDS as v, PROPOSAL_STATUSES as w, type PaletteSection as x, SECTION_KINDS as y, SECTION_STATUSES as z };

package/dist/{index-bj73h3qo.d.ts → index-CRl3IXHB.d.ts}

@@ -4,6 +4,7 @@ declare const BRAND_NS: {
     readonly section: "brand_section";
     readonly palette: "brand_palette";
     readonly proposal: "brand_proposal";
+    readonly approvalReceipt: "brand_approval_receipt";
     readonly asset: "brand_asset";
 };
 /** Brand-book lifecycle: authored → adopted → retired (delete is owner-only). */
@@ -27,8 +28,8 @@ type PaletteStatus = (typeof PALETTE_STATUSES)[number];
 declare const PALETTE_SOURCES: readonly ["extracted", "derived", "manual"];
 /** Provenance of a palette's swatches. */
 type PaletteSource = (typeof PALETTE_SOURCES)[number];
-/** What a proposal proposes (palettes are the first-class case). */
-declare const PROPOSAL_KINDS: readonly ["palette", "typography", "voice", "logo"];
+/** Every mutable brand facet uses the same proposal/approval contract. */
+declare const PROPOSAL_KINDS: readonly ["palette", "typography", "voice", "logo", "imagery"];
 /** Which brand facet a proposal targets. */
 type ProposalKind = (typeof PROPOSAL_KINDS)[number];
 /** Proposal lifecycle: open until a HUMAN accepts/rejects it (or a newer
@@ -37,56 +38,13 @@ declare const PROPOSAL_STATUSES: readonly ["open", "accepted", "rejected", "supe
 /** Where a proposal stands in the human-gated review flow. */
 type ProposalStatus = (typeof PROPOSAL_STATUSES)[number];
 /** What kind of upload an asset row records. */
-declare const ASSET_KINDS: readonly ["logo", "wordmark", "inspiration", "document", "font", "other"];
+declare const ASSET_KINDS: readonly ["logo", "wordmark", "inspiration", "document", "other"];
 /** The declared purpose of an uploaded asset. */
 type AssetKind = (typeof ASSET_KINDS)[number];
 /** Every swatch role a palette may assign. `chart` may repeat (a series);
  * `custom` is the escape hatch for roles the token compiler doesn't map. */
 declare const SWATCH_ROLES: readonly ["primary", "secondary", "highlight", "bg", "surface", "text", "neutral", "good", "warn", "danger", "chart", "custom"];
 
-/** Scalar values odla-db attrs and where-clauses accept. */
-type BrandScalar = string | number | boolean | null;
-/** Natural-key lookup ref for idempotent upserts (odla-db `Lookup` shape). */
-interface BrandLookup {
-    ns: string;
-    attr: string;
-    value: BrandScalar;
-}
-/** How an op names its row: a raw entity id, or a natural-key lookup. */
-type BrandEntityRef = string | BrandLookup;
-/** Attr payload of one op. Typed `any` on purpose: the real odla-db
- * `transact` constrains attrs to its own `Value` type, and `any` is the one
- * shape assignable in both directions with no cast. */
-type BrandAttrs = Record<string, any>;
-/** One transact operation (update = attr-merge upsert; merge = deep-merge
- * into a json attribute; retract = clear the named attributes, since a typed
- * scalar can't store null). */
-type BrandOp = {
-    t: "update";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: BrandAttrs;
-} | {
-    t: "merge";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: BrandAttrs;
-} | {
-    t: "retract";
-    ns: string;
-    id: BrandEntityRef;
-    attrs: string[];
-} | {
-    t: "delete";
-    ns: string;
-    id: BrandEntityRef;
-};
-/** A row as odla-db returns it: hydrated id plus attrs. */
-type BrandRow = {
-    id: string;
-} & Record<string, unknown>;
-/** Query result: namespace → rows. */
-type BrandResult = Record<string, BrandRow[]>;
 /** The role a swatch plays in the palette (what the token compiler maps). */
 type SwatchRole = (typeof SWATCH_ROLES)[number];
 /** One palette color: a role, a `#rrggbb` hex, and optional naming/why. */
@@ -134,132 +92,18 @@ interface AssetAnalysis {
     dominantColors: string[];
     tags: string[];
 }
-/** The compiled-token cache stored on `brand_book.tokens`. `warnings` carries
- * the compiler's `TokenWarning[]` (typed loosely here so the row types don't
- * depend on the token compiler's module). */
+/** The compiled-token cache stored on `brand_book.tokens`. */
 interface BrandTokensSnapshot {
     light: Record<string, string>;
     dark: Record<string, string>;
     warnings: unknown[];
     compiledAt: number;
-}
-/** A brand book row: the auth roster (`memberIds`, including the bot agent
- * id) plus the active palette and compiled-token cache. */
-interface BrandBook {
-    id: string;
-    slug: string;
-    name: string;
-    status: BookStatus;
-    ownerId: string;
-    memberIds: string[];
-    channelId?: string;
-    activePaletteId?: string;
-    tokens?: BrandTokensSnapshot;
-    summary?: string;
-    createdAt: number;
-    updatedAt: number;
-}
-/** A section row — one per (book, kind), upserted by its natural `key`. */
-interface BrandSection {
-    id: string;
-    key: string;
-    bookId: string;
-    kind: SectionKind;
-    status: SectionStatus;
-    content: Record<string, unknown>;
-    audience: string[];
-    updatedBy: string;
-    updatedAt: number;
-}
-/** A palette row. Swatches are json ON the palette, not a namespace: the
- * palette is the atomic proposal/approval unit and swatches are never
- * queried across palettes. */
-interface BrandPalette {
-    id: string;
-    bookId: string;
-    name: string;
-    status: PaletteStatus;
-    swatches: Swatch[];
-    seedHex?: string;
-    source: PaletteSource;
-    rationale?: string;
-    proposalId?: string;
-    audience: string[];
-    createdAt: number;
-    updatedAt: number;
-}
-/** A proposal row: agent output parked for explicit human resolution. */
-interface BrandProposal {
-    id: string;
-    bookId: string;
-    kind: ProposalKind;
-    status: ProposalStatus;
-    payload: Record<string, unknown>;
-    rationale: string;
-    sourceAssetId?: string;
-    messageId?: string;
-    audience: string[];
-    createdBy: string;
-    createdAt: number;
-    resolvedBy?: string;
-    resolvedAt?: number;
-    resolutionNote?: string;
-}
-/** An asset row mirroring one real uploaded file (worker-mediated; rules
- * close the namespace). Delete is a tombstone (`deletedAt`), never a row
- * delete, so analyses/proposals referencing it stay coherent. */
-interface BrandAsset {
-    id: string;
-    bookId: string;
-    kind: AssetKind;
-    path: string;
-    url: string;
-    contentType: string;
-    size: number;
-    title?: string;
-    analysis?: AssetAnalysis;
-    analyzedAt?: number;
-    audience: string[];
-    uploadedBy: string;
-    createdAt: number;
-    deletedAt?: number;
-}
-/** What `db.storage.upload` resolves to (odla-db's file record shape). */
-interface BrandFileRecord {
-    id: string;
-    path: string;
-    url: string;
-    size: number;
-    contentType: string;
-}
-/** Bodies `storage.upload` accepts — a practical subset of the platform's
- * `BodyInit` (which has no ambient type under a DOM-less lib). The real
- * @odla-ai/db client accepts a superset, so it still structurally satisfies
- * {@link BrandStorage}. */
-type BrandUploadBody = string | Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>;
-/** The injected file store — @odla-ai/db's `storage` API satisfies this. */
-interface BrandStorage {
-    upload(path: string, data: BrandUploadBody, contentType?: string): Promise<BrandFileRecord>;
-    delete(path: string): Promise<void>;
-}
-/** The injected odla client (structural — a real @odla-ai/db `AdminDb`
- * satisfies it). `transact` accepts flat op arrays and `mutationId` gives
- * exactly-once application (`duplicate: true` on replay). */
-interface BrandDb {
-    query(q: Record<string, unknown>): Promise<Record<string, unknown[]>>;
-    transact(ops: unknown[], opts?: {
-        mutationId?: string;
-    }): Promise<{
-        txId: number;
-        duplicate?: boolean;
-    }>;
-    storage: BrandStorage;
-}
-/** Who is acting: a human member or the book's bot agent. */
-interface BrandActor {
-    id: string;
-    kind: "human" | "agent";
-    email?: string;
+    paletteId: string;
+    paletteReceiptId: string;
+    paletteActionDigest: string;
+    typographyReceiptId?: string;
+    typographyActionDigest?: string;
+    sourceDigest: string;
 }
 
 /**
@@ -406,4 +250,4 @@ declare function renderTokensCss(light: BrandTokens, opts?: RenderTokensCssOptio
  */
 declare function compileBrandTokens(input: CompileInput): CompiledBrandTokens;
 
-export { SWATCH_ROLES as $, type AssetAnalysis as A, type BrandDb as B, type BrandStorage as C, type BrandTokens as D, type BrandTokensSnapshot as E, type BrandUploadBody as F, type CompileInput as G, type CompiledBrandTokens as H, DARK_FLIP_L_MAX as I, DARK_FLIP_L_MIN as J, DEFAULT_ACCENT_SEED as K, type ImagerySection as L, type LogoSection as M, type MapResult as N, PALETTE_STATUSES as O, PALETTE_SOURCES as P, PROPOSAL_KINDS as Q, PROPOSAL_STATUSES as R, type Swatch as S, type PaletteSection as T, type PaletteSource as U, type PaletteStatus as V, type ProposalKind as W, type ProposalStatus as X, type RenderTokensCssOptions as Y, SECTION_KINDS as Z, SECTION_STATUSES as _, type BrandBook as a, type SwatchRole as a0, type TokenWarning as a1, type TypographySection as a2, type VoiceSection as a3, compileBrandTokens as a4, deriveDarkTokens as a5, mapPaletteToTokens as a6, renderTokensCss as a7, type BrandOp as b, type BrandEntityRef as c, type SectionKind as d, type SectionStatus as e, type BrandProposal as f, type AssetKind as g, type BrandActor as h, ASSET_KINDS as i, BOOK_STATUSES as j, BRAND_CHART_TOKENS as k, BRAND_CHAT_TOKENS as l, BRAND_DERIVED_TOKENS as m, BRAND_EMITTED_TOKENS as n, BRAND_NS as o, BRAND_REQUIRED_TOKENS as p, type BookStatus as q, type BrandAsset as r, type BrandAttrs as s, type BrandFileRecord as t, type BrandLookup as u, type BrandPalette as v, type BrandResult as w, type BrandRow as x, type BrandScalar as y, type BrandSection as z };
+export { type AssetKind as A, type BookStatus as B, type CompileInput as C, DARK_FLIP_L_MAX as D, SWATCH_ROLES as E, type SwatchRole as F, type TypographySection as G, compileBrandTokens as H, type ImagerySection as I, deriveDarkTokens as J, mapPaletteToTokens as K, type LogoSection as L, type MapResult as M, renderTokensCss as N, type ProposalKind as P, type RenderTokensCssOptions as R, type Swatch as S, type TokenWarning as T, type VoiceSection as V, type ProposalStatus as a, type AssetAnalysis as b, type BrandTokensSnapshot as c, type PaletteStatus as d, type PaletteSource as e, type SectionKind as f, type SectionStatus as g, ASSET_KINDS as h, BOOK_STATUSES as i, BRAND_CHART_TOKENS as j, BRAND_CHAT_TOKENS as k, BRAND_DERIVED_TOKENS as l, BRAND_EMITTED_TOKENS as m, BRAND_NS as n, BRAND_REQUIRED_TOKENS as o, type BrandTokens as p, type CompiledBrandTokens as q, DARK_FLIP_L_MIN as r, DEFAULT_ACCENT_SEED as s, PALETTE_SOURCES as t, PALETTE_STATUSES as u, PROPOSAL_KINDS as v, PROPOSAL_STATUSES as w, type PaletteSection as x, SECTION_KINDS as y, SECTION_STATUSES as z };