@odla-ai/brand 0.2.1 → 0.4.0

package/dist/index.d.cts

@@ -1,7 +1,340 @@
-import { B as BrandDb, A as AssetAnalysis, S as Swatch, a as BrandBook, b as BrandOp, c as BrandEntityRef, d as SectionKind, e as SectionStatus, f as BrandProposal, g as AssetKind, h as BrandActor } from './index-bj73h3qo.cjs';
-export { i as ASSET_KINDS, j as BOOK_STATUSES, k as BRAND_CHART_TOKENS, l as BRAND_CHAT_TOKENS, m as BRAND_DERIVED_TOKENS, n as BRAND_EMITTED_TOKENS, o as BRAND_NS, p as BRAND_REQUIRED_TOKENS, q as BookStatus, r as BrandAsset, s as BrandAttrs, t as BrandFileRecord, u as BrandLookup, v as BrandPalette, w as BrandResult, x as BrandRow, y as BrandScalar, z as BrandSection, C as BrandStorage, D as BrandTokens, E as BrandTokensSnapshot, F as BrandUploadBody, G as CompileInput, H as CompiledBrandTokens, I as DARK_FLIP_L_MAX, J as DARK_FLIP_L_MIN, K as DEFAULT_ACCENT_SEED, L as ImagerySection, M as LogoSection, N as MapResult, P as PALETTE_SOURCES, O as PALETTE_STATUSES, Q as PROPOSAL_KINDS, R as PROPOSAL_STATUSES, T as PaletteSection, U as PaletteSource, V as PaletteStatus, W as ProposalKind, X as ProposalStatus, Y as RenderTokensCssOptions, Z as SECTION_KINDS, _ as SECTION_STATUSES, $ as SWATCH_ROLES, a0 as SwatchRole, a1 as TokenWarning, a2 as TypographySection, a3 as VoiceSection, a4 as compileBrandTokens, a5 as deriveDarkTokens, a6 as mapPaletteToTokens, a7 as renderTokensCss } from './index-bj73h3qo.cjs';
+import { P as ProposalKind, a as ProposalStatus, A as AssetKind, b as AssetAnalysis, B as BookStatus, c as BrandTokensSnapshot, d as PaletteStatus, S as Swatch, e as PaletteSource, f as SectionKind, g as SectionStatus } from './index-CRl3IXHB.cjs';
+export { h as ASSET_KINDS, i as BOOK_STATUSES, j as BRAND_CHART_TOKENS, k as BRAND_CHAT_TOKENS, l as BRAND_DERIVED_TOKENS, m as BRAND_EMITTED_TOKENS, n as BRAND_NS, o as BRAND_REQUIRED_TOKENS, p as BrandTokens, C as CompileInput, q as CompiledBrandTokens, D as DARK_FLIP_L_MAX, r as DARK_FLIP_L_MIN, s as DEFAULT_ACCENT_SEED, I as ImagerySection, L as LogoSection, M as MapResult, t as PALETTE_SOURCES, u as PALETTE_STATUSES, v as PROPOSAL_KINDS, w as PROPOSAL_STATUSES, x as PaletteSection, R as RenderTokensCssOptions, y as SECTION_KINDS, z as SECTION_STATUSES, E as SWATCH_ROLES, F as SwatchRole, T as TokenWarning, G as TypographySection, V as VoiceSection, H as compileBrandTokens, J as deriveDarkTokens, K as mapPaletteToTokens, N as renderTokensCss } from './index-CRl3IXHB.cjs';
 import { ToolHandler, Skill, ToolDef, Persona, Inference, AgentRunInput, ImageBlock, OracleContentBlock } from '@odla-ai/ai';
 
+/** Immutable storage snapshot captured by the trusted semantic Brand bridge. */
+interface BrandSourceAssetSnapshot {
+    assetId: string;
+    contentDigest: string;
+    objectEtag: string;
+    objectSize: number;
+    pathDigest: string;
+    contentType: string | null;
+    analysisRevision: number | null;
+    analysisDigest: string | null;
+}
+/** Required proposal provenance. Nulls keep the reviewed snapshot lossless. */
+interface BrandProposalProvenance {
+    sourceAssetId: string | null;
+    sourceAsset: BrandSourceAssetSnapshot | null;
+    messageId: string | null;
+    turnId: string | null;
+    taintLabels: string[];
+}
+/** Agent output parked for explicit human resolution. */
+interface BrandProposal {
+    id: string;
+    bookId: string;
+    kind: ProposalKind;
+    status: ProposalStatus;
+    payload: Record<string, unknown>;
+    rationale: string;
+    provenance: BrandProposalProvenance;
+    reviewDigest: string;
+    audience: string[];
+    createdBy: string;
+    createdAuthorityRef: string;
+    createdAt: number;
+    resolvedBy?: string;
+    resolvedAt?: number;
+    resolutionNote?: string;
+    approvedBy?: string;
+    appliedBy?: string;
+    resolutionReceiptId?: string;
+    resolutionActionDigest?: string;
+}
+/** Immutable proposal fields a human sends back when resolving it. */
+interface BrandProposalReviewSnapshot {
+    id: string;
+    bookId: string;
+    kind: ProposalKind;
+    status: "open";
+    payload: Record<string, unknown>;
+    rationale: string;
+    provenance: BrandProposalProvenance;
+    reviewDigest: string;
+    audience: string[];
+    createdBy: string;
+    createdAuthorityRef: string;
+    createdAt: number;
+}
+/** Host receipt returned after consuming one central human-exact decision. */
+interface BrandHumanAuthorityConsumption {
+    id: string;
+    grantId: string;
+    grantVersion: number;
+    useNumber: number;
+    actorPrincipalId: string;
+    actorKind: "human";
+    credentialId: string;
+    credentialKind: "clerk";
+    appId: string;
+    /** Exact Registry project lifetime authorized for this Brand decision. */
+    appIncarnation: string;
+    capability: "brand.proposal.resolve";
+    projectCapability: "brand.approve";
+    effect: "internal";
+    actionDigest: string;
+    resourceDigest: string;
+    constraintEvidence: Record<string, unknown>;
+    consumptionIdempotencyKey: string;
+    requestDigest: string;
+    consumedAt: number;
+}
+/** Live dependency revision and intended effect consumed by the decision. */
+interface BrandDecisionBinding {
+    version: 1;
+    bookVersion: number;
+    activationRevision: number;
+    activePaletteId: string | null;
+    memberIdsDigest: string;
+    activePaletteDigest: string | null;
+    typographyDigest: string | null;
+    sourceAssetDigest: string | null;
+    effectDigest: string;
+}
+/** Durable projection of one centrally authorized decision. */
+interface BrandApprovalReceipt {
+    version: 1;
+    id: string;
+    mutationKey: string;
+    bookId: string;
+    proposalId: string;
+    resolution: "accepted" | "rejected";
+    paletteId?: string;
+    resolutionNote?: string;
+    reviewedProposal: BrandProposalReviewSnapshot;
+    actionDigest: string;
+    decisionBinding: BrandDecisionBinding;
+    approvedBy: string;
+    approvedByKind: "human";
+    appliedBy: string;
+    appliedByKind: "human";
+    authorityRef: string;
+    authorityCapability: "brand.approve";
+    authorityConsumption: BrandHumanAuthorityConsumption;
+    createdAt: number;
+    receiptDigest: string;
+}
+
+/** Scalar values odla-db attrs and where-clauses accept. */
+type BrandScalar = string | number | boolean | null;
+/** Natural-key lookup ref for idempotent upserts (odla-db `Lookup` shape). */
+interface BrandLookup {
+    ns: string;
+    attr: string;
+    value: BrandScalar;
+}
+/** How an op names its row: a raw entity id, or a natural-key lookup. */
+type BrandEntityRef = string | BrandLookup;
+/** Attr payload of one op. Typed `any` on purpose: the real odla-db
+ * `transact` constrains attrs to its own `Value` type, and `any` is the one
+ * shape assignable in both directions with no cast. */
+type BrandAttrs = Record<string, any>;
+/** One transact operation (update = attr-merge upsert; merge = deep-merge
+ * into a json attribute; retract = clear the named attributes, since a typed
+ * scalar can't store null). */
+type BrandOp = {
+    t: "update";
+    ns: string;
+    id: BrandEntityRef;
+    attrs: BrandAttrs;
+} | {
+    t: "merge";
+    ns: string;
+    id: BrandEntityRef;
+    attrs: BrandAttrs;
+} | {
+    t: "retract";
+    ns: string;
+    id: BrandEntityRef;
+    attrs: string[];
+} | {
+    t: "delete";
+    ns: string;
+    id: BrandEntityRef;
+} | {
+    t: "link";
+    ns: string;
+    id: BrandEntityRef;
+    label: string;
+    target: BrandEntityRef;
+} | {
+    t: "unlink";
+    ns: string;
+    id: BrandEntityRef;
+    label: string;
+    target: BrandEntityRef;
+};
+/** A row as odla-db returns it: hydrated id plus attrs. */
+type BrandRow = {
+    id: string;
+} & Record<string, unknown>;
+/** Query result: namespace → rows. */
+type BrandResult = Record<string, BrandRow[]>;
+/** A brand book row: the auth roster (`memberIds`, including the bot agent
+ * id) plus the active palette and compiled-token cache. */
+interface BrandBook {
+    id: string;
+    /** Monotonic worker-managed metadata revision. */
+    version: number;
+    slug: string;
+    name: string;
+    status: BookStatus;
+    ownerId: string;
+    /** Host authority that allowed this worker-created book. */
+    createdAuthorityRef: string;
+    rosterAuthorityRef?: string;
+    memberIds: string[];
+    channelId?: string;
+    activePaletteId?: string;
+    /** CAS counter advanced by every accepted palette activation. */
+    activationRevision: number;
+    tokens?: BrandTokensSnapshot;
+    summary?: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/** A section row — one per (book, kind), upserted by its natural `key`. */
+interface BrandSection {
+    id: string;
+    key: string;
+    bookId: string;
+    kind: SectionKind;
+    status: SectionStatus;
+    content: Record<string, unknown>;
+    audience: string[];
+    updatedBy: string;
+    updatedAt: number;
+    /** Present on approved sections and bound to the exact human decision. */
+    approvalReceiptId?: string;
+    approvalActionDigest?: string;
+}
+/** A palette row. Swatches are json ON the palette, not a namespace: the
+ * palette is the atomic proposal/approval unit and swatches are never
+ * queried across palettes. */
+interface BrandPalette {
+    id: string;
+    bookId: string;
+    name: string;
+    status: PaletteStatus;
+    swatches: Swatch[];
+    seedHex?: string;
+    source: PaletteSource;
+    rationale?: string;
+    /** Accepted proposal whose exact reviewed payload materialized this row. */
+    proposalId: string;
+    approvalReceiptId: string;
+    approvalActionDigest: string;
+    audience: string[];
+    createdAt: number;
+    updatedAt: number;
+}
+/** An asset row mirroring one real uploaded file (worker-mediated; rules
+ * close the namespace). Delete is a tombstone (`deletedAt`), never a row
+ * delete, so analyses/proposals referencing it stay coherent. */
+interface BrandAsset {
+    id: string;
+    bookId: string;
+    kind: AssetKind;
+    path: string;
+    storageObjectId: string;
+    contentDigest: string;
+    contentType: string;
+    size: number;
+    status: "live" | "deleting" | "deleted";
+    title?: string;
+    analysis?: AssetAnalysis;
+    analyzedAt?: number;
+    analysisRevision: number;
+    analysisDigest?: string;
+    analyzedBy?: string;
+    analyzedAuthorityRef?: string;
+    audience: string[];
+    uploadedBy: string;
+    uploadedAuthorityRef: string;
+    createdAt: number;
+    deletedAt?: number;
+    deletedBy?: string;
+    deletedAuthorityRef?: string;
+}
+/** What `db.storage.upload` resolves to (odla-db's file record shape). */
+interface BrandFileRecord {
+    id: string;
+    path: string;
+    url: string;
+    size: number;
+    contentType: string;
+}
+/** Bodies `storage.upload` accepts — a practical subset of the platform's
+ * `BodyInit` (which has no ambient type under a DOM-less lib). The real
+ * @odla-ai/db client accepts a superset, so it still structurally satisfies
+ * {@link BrandStorage}. */
+type BrandUploadBody = string | Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>;
+/** The injected file store — @odla-ai/db's `storage` API satisfies this. */
+interface BrandStorage {
+    upload(path: string, data: BrandUploadBody, contentType?: string, opts?: {
+        private?: boolean;
+    }): Promise<BrandFileRecord>;
+    sign(path: string, ttlSeconds?: number): Promise<string>;
+    delete(path: string): Promise<void>;
+}
+/** One entity-state compare-and-swap condition, checked atomically with the
+ * transaction. Mirrors @odla-ai/db's structural guard contract. */
+interface BrandTransactGuard {
+    ns: string;
+    id: string;
+    exists: boolean;
+    equals?: Record<string, unknown>;
+}
+/** Attribution, idempotency, and atomic preconditions for a brand write. */
+interface BrandTransactOptions {
+    mutationId?: string;
+    guards?: BrandTransactGuard[];
+    asUser?: string;
+    asEmail?: string;
+    asPrincipalKind?: "human" | "agent" | "service";
+}
+/** The injected odla client (structural — a real @odla-ai/db `AdminDb`
+ * satisfies it). `transact` accepts flat op arrays; stable mutation ids give
+ * exactly-once application and guards bind reviewed state to its write. */
+interface BrandDb {
+    query(q: Record<string, unknown>): Promise<Record<string, unknown[]>>;
+    transact(ops: unknown[], opts?: BrandTransactOptions): Promise<{
+        txId: number;
+        duplicate?: boolean;
+    }>;
+    storage: BrandStorage;
+}
+/** Who is acting: a human member or the book's bot agent. */
+interface BrandActor {
+    id: string;
+    kind: "human" | "agent";
+    email?: string;
+}
+
+/** Canonical least-privilege runtime profile for a Brand collaborator agent. */
+interface BrandAgentProfile {
+    version: 1;
+    projectCapabilities: readonly ["brand.read", "brand.edit"];
+    semanticOperations: readonly [
+        "brand.proposal.create",
+        "brand.asset.analysis.record",
+        "brand.asset.content.read"
+    ];
+    rawBrandWrites: false;
+    rawFileOperations: false;
+    approval: {
+        principalKind: "human";
+        projectCapability: "brand.approve";
+        capability: "brand.proposal.resolve";
+        exactAction: true;
+    };
+}
+/** Install-time contract: agents use semantic Brand operations; only a direct
+ * human may consume exact approval authority for a reviewed proposal. */
+declare const BRAND_AGENT_PROFILE: BrandAgentProfile;
+
 /** Caller-fault error (bad hex, oversized payload, blocked transition…) — the
  * route layer maps it to a 400. `fields` carries per-field messages when the
  * failure came from input validation. */
@@ -13,6 +346,27 @@ declare class BrandInputError extends Error {
 declare class BrandNotFoundError extends Error {
     constructor(what: string);
 }
+/** A once-valid central authority/resource is permanently unavailable. */
+declare class BrandGoneError extends Error {
+    constructor(message?: string);
+}
+/** Authenticated principal lacks the required principal kind/capability. */
+declare class BrandForbiddenError extends Error {
+    constructor(message?: string);
+}
+/** Reviewed state or an idempotent action no longer matches current state. */
+declare class BrandConflictError extends Error {
+    constructor(message: string);
+}
+/**
+ * A proposal authority use was consumed, but the local guarded Brand write
+ * lost its compare-and-swap race. Clients must preserve the reviewed draft but
+ * rotate their idempotency key before a fresh human decision attempt.
+ */
+declare class BrandReviewStateChangedError extends BrandConflictError {
+    readonly code = "brand_review_state_changed";
+    constructor(message?: string);
+}
 
 /** What `fetchBytes` resolves to: raw bytes plus the served content type. */
 interface BrandFetchedBytes {
@@ -58,7 +412,7 @@ interface SerializedLinkEnd {
     has: "one" | "many";
     label: string;
 }
-/** A serialized schema link (unused by brand — audiences are denormalized). */
+/** A serialized schema link used for current-book authorization. */
 interface SerializedLink {
     forward: SerializedLinkEnd;
     reverse: SerializedLinkEnd;
@@ -69,7 +423,7 @@ interface SerializedSchema {
     links: Record<string, SerializedLink>;
 }
 /**
- * The pre-serialized (wire-shape) odla-db schema for the five brand
+ * The pre-serialized (wire-shape) odla-db schema for the six brand
  * namespaces; POST it to `/app/:id/schema` as `{ schema: BRAND_SCHEMA }`.
  * Natural keys (`book.slug`, `section.key`) make provisioning and section
  * upserts idempotent; mirrored `id` attrs make rows addressable by
@@ -87,11 +441,11 @@ interface BrandRule {
 /** Namespace → rule set, as installed at `/app/:id/admin/rules`. */
 type BrandRules = Record<string, BrandRule>;
 /**
- * Default-deny CEL rules for the five brand namespaces; install at
+ * Default-deny CEL rules for the six brand namespaces; install at
  * `/app/:id/admin/rules`. Books gate on the `memberIds` roster (owner-only
- * writes); sections/palettes/proposals gate on their denormalized `audience`
- * and are never client-deletable (archive via `status` instead); assets are
- * fully worker-mediated. Use {@link brandRules} for a per-install copy.
+ * writes); child rows gate reads on current linked-book membership and all
+ * writes are worker-mediated. Use
+ * {@link brandRules} for a per-install copy.
  */
 declare const BRAND_RULES: BrandRules;
 /**
@@ -134,9 +488,8 @@ declare function assertSwatches(value: unknown): Swatch[];
  */
 declare function assertSectionContent(kind: string, content: unknown): Record<string, unknown>;
 /**
- * Sanitize an upload's file name for use in an R2 key: strips path
- * separators, control characters, and leading dots, then caps at 120
- * characters. Throws when nothing survives sanitizing.
+ * Validate an upload file name for an R2 key. Path/URL delimiters and control
+ * characters are rejected; leading dots are stripped and length is capped.
  */
 declare function safeFileName(name: unknown): string;
 /**
@@ -151,6 +504,75 @@ declare function assertAssetContentType(value: unknown): string;
  */
 declare function assertAnalysis(value: unknown): AssetAnalysis;
 
+/** Stay materially below the server's whole-guards parser budget. */
+declare function isBoundedBrandJson(root: unknown, limits?: {
+    maxDepth?: number;
+    maxNodes?: number;
+    maxBytes?: number;
+}): boolean;
+/** Deterministic JSON with recursively sorted object keys. */
+declare function canonicalBrandJson(value: unknown): string;
+/** `sha256:<hex>` over {@link canonicalBrandJson}. */
+declare function brandJsonDigest(value: unknown): Promise<string>;
+
+/** Stable local reference to one immutable central grant revision. */
+declare function brandAuthorityRef(consumption: Pick<BrandHumanAuthorityConsumption, "grantId" | "grantVersion">): string;
+/** Validate the exact direct-human central authority receipt shape. */
+declare function isBrandHumanAuthorityConsumption(value: unknown): value is BrandHumanAuthorityConsumption;
+/** Verify exact shape, cross-field bindings, and every local digest. This
+ * proves receipt self-consistency only; the host must authenticate the
+ * central consumption behind `authorityConsumption.id`. */
+declare function verifyBrandApprovalReceipt(receipt: unknown): Promise<boolean>;
+
+/** Brand resources that can be shared into a Discussion message. */
+declare const BRAND_DISCUSSION_REFERENCE_KINDS: readonly ["brand:book", "brand:asset", "brand:palette", "brand:proposal", "brand:receipt"];
+/** One Brand resource kind understood by the native Brand destination. */
+type BrandDiscussionReferenceKind = (typeof BRAND_DISCUSSION_REFERENCE_KINDS)[number];
+/** Canonical Brand destination target parsed from an `odla-ref` deep link. */
+interface BrandDiscussionReferenceTarget {
+    kind: BrandDiscussionReferenceKind;
+    bookId: string;
+    resourceId?: string;
+}
+/** Bounded color projection shared with Discussion people and agents. */
+interface BrandDiscussionSwatch {
+    /** Semantic role used by the Brand token compiler. */
+    role: string;
+    /** Normalized opaque sRGB color (`#rrggbb`). */
+    hex: string;
+    /** Optional product-authored color name. */
+    name?: string;
+}
+/** Product-owned projection returned to Discussion typeahead and exact lookup. */
+interface BrandDiscussionReference {
+    /** Canonical Brand kind used in stored Discussion ref markup. */
+    kind: BrandDiscussionReferenceKind;
+    /** Opaque durable product id; never infer membership from its segments. */
+    id: string;
+    /** Product-authored primary display name. */
+    label: string;
+    /** Short product-authored secondary context for the picker. */
+    hint: string;
+    /** Bounded product-authored context safe to show an LLM or person. */
+    summary: string;
+    /** Current product status at inspection time. */
+    status: string;
+    /** Human-readable native surface the link opens. */
+    destination: string;
+    /** Same-origin native link; navigation is not mutation authority. */
+    href: string;
+    /** Present only for a validated Brand palette, capped by Brand's swatch limit. */
+    swatches?: BrandDiscussionSwatch[];
+}
+/** Durable ref id: a book id, or `bookId/resourceId` for a child resource. */
+declare function brandDiscussionReferenceId(target: BrandDiscussionReferenceTarget): string;
+/** Canonical value stored in the stable `odla-ref` query parameter. */
+declare function formatBrandDiscussionReference(target: BrandDiscussionReferenceTarget): string;
+/** Parse and validate a Brand `odla-ref`; malformed and cross-product refs fail closed. */
+declare function parseBrandDiscussionReference(input: URL | string): BrandDiscussionReferenceTarget | null;
+/** Build the native Brand deep link while preserving the deployed origin. */
+declare function brandDiscussionReferenceHref(current: URL, target: BrandDiscussionReferenceTarget, basePath?: string): string;
+
 /** Input to {@link createBookOps}. `memberIds` is the full auth roster —
  * include the bot agent's id so it can pass the audience rules. */
 interface CreateBookInput {
@@ -158,6 +580,7 @@ interface CreateBookInput {
     slug: string;
     name: string;
     ownerId: string;
+    createdAuthorityRef: string;
     memberIds: string[];
     channelId?: string;
     now: number;
@@ -212,6 +635,8 @@ interface UpsertSectionInput {
     audience: string[];
     updatedBy: string;
     now: number;
+    approvalReceiptId?: string;
+    approvalActionDigest?: string;
 }
 /**
  * Ops to create-or-replace a book's section of one kind: a single `update`
@@ -220,6 +645,24 @@ interface UpsertSectionInput {
  * snapshot, and the author/timestamp.
  */
 declare function upsertSectionOps(input: UpsertSectionInput): BrandOp[];
+/** Input for an agent-authored non-palette facet proposal. */
+interface ProposeSectionInput {
+    id: string;
+    bookId: string;
+    kind: Exclude<SectionKind, "palette">;
+    content: Record<string, unknown>;
+    rationale: string;
+    audience: string[];
+    createdBy: string;
+    createdAuthorityRef: string;
+    sourceAsset?: BrandProposal["provenance"]["sourceAsset"];
+    messageId: string;
+    turnId: string;
+    taintLabels: string[];
+    now: number;
+}
+/** Validate a facet draft and park it as an immutable OPEN proposal. */
+declare function proposeSectionOps(input: ProposeSectionInput): Promise<BrandOp[]>;
 
 /** Input to {@link proposePaletteOps}. `audience` is the book's roster
  * snapshot; `contrastReport` is stored verbatim in the payload for the
@@ -233,9 +676,12 @@ interface ProposePaletteInput {
     seedHex?: string;
     contrastReport?: unknown;
     createdBy: string;
+    createdAuthorityRef: string;
     audience: string[];
-    sourceAssetId?: string;
-    messageId?: string;
+    sourceAsset?: BrandProposal["provenance"]["sourceAsset"];
+    messageId: string;
+    turnId: string;
+    taintLabels: string[];
     now: number;
 }
 /**
@@ -243,13 +689,15 @@ interface ProposePaletteInput {
  * `kind: "palette"`, `status: "open"`, with the validated swatches (and
  * optional seed/contrast report) in `payload`.
  */
-declare function proposePaletteOps(input: ProposePaletteInput): BrandOp[];
+declare function proposePaletteOps(input: ProposePaletteInput): Promise<BrandOp[]>;
 /** Input to {@link acceptProposalOps}: the proposal row as read back, the id
  * to mint the palette under, and who resolved it. */
 interface AcceptProposalInput {
     proposal: BrandProposal;
     paletteId: string;
     resolvedBy: string;
+    approvalReceiptId: string;
+    approvalActionDigest: string;
     now: number;
     resolutionNote?: string;
 }
@@ -279,16 +727,18 @@ interface RejectProposalInput {
 declare function rejectProposalOps(input: RejectProposalInput): BrandOp[];
 
 /** Input to {@link createAssetOps} — the storage upload's receipt fields
- * (`path`/`url`/`size`) plus the declared kind and the book's audience. */
+ * (`path`/`size`) plus the declared kind and the book's audience. */
 interface CreateAssetInput {
     id: string;
     bookId: string;
     kind: AssetKind;
     path: string;
-    url: string;
+    storageObjectId: string;
+    contentDigest: string;
     contentType: string;
     size: number;
     uploadedBy: string;
+    uploadedAuthorityRef: string;
     audience: string[];
     title?: string;
     now: number;
@@ -304,12 +754,14 @@ declare function createAssetOps(input: CreateAssetInput): BrandOp[];
  * `deletedAt` in place. List reads exclude tombstoned rows; the row itself
  * stays for provenance.
  */
-declare function tombstoneAssetOps(assetId: BrandEntityRef, now: number): BrandOp[];
+declare function beginAssetDeleteOps(assetId: BrandEntityRef, now: number, deletedBy: string, deletedAuthorityRef: string): BrandOp[];
+/** Complete a previously authorized deletion after storage is tombstoned. */
+declare function finishAssetDeleteOps(assetId: BrandEntityRef): BrandOp[];
 /**
  * Ops to record an agent's analysis of an asset: the validated + capped
  * analysis json plus `analyzedAt`. Replaces any prior analysis whole.
  */
-declare function recordAnalysisOps(assetId: BrandEntityRef, analysis: unknown, now: number): BrandOp[];
+declare function recordAnalysisOps(assetId: BrandEntityRef, analysis: unknown, priorRevision: number, analyzedBy: string, analyzedAuthorityRef: string, now: number): Promise<BrandOp[]>;
 
 /** An sRGB color with channels as fractions in [0, 1]. */
 interface Rgb {
@@ -566,6 +1018,21 @@ interface DerivePaletteOptions {
  */
 declare function derivePalette(seedHex: string, opts?: DerivePaletteOptions): Swatch[];
 
+/** Semantic Brand capability granted to one live agent principal. */
+type BrandCapability = "brand.read" | "brand.edit";
+/** Host-verified evidence that an agent currently holds one Brand capability. */
+interface BrandCapabilityAuthority {
+    capability: BrandCapability;
+    authorityRef: string;
+}
+/** Safe directory projection exposed to an agent for Brand attribution. */
+interface BrandPrincipalProjection {
+    id: string;
+    displayName: string;
+    kind: "human" | "agent" | "service";
+    managerDisplayName?: string;
+}
+
 /** The bot identity the skill writes as (`selfId` = the agent id carried in
  * the book's `memberIds` roster and every audience snapshot). */
 interface BrandSkillSelf {
@@ -573,6 +1040,32 @@ interface BrandSkillSelf {
     kind: "bot";
     displayName?: string;
 }
+/** Server-enforced semantic bridge. Raw agent credentials must be denied all
+ * Brand namespace writes and raw file operations. */
+interface BrandAgentBridge {
+    createProposal(input: {
+        jobId: string;
+        bookId: string;
+        mutationId: string;
+        kind: ProposalKind;
+        payload: Record<string, unknown>;
+        rationale: string;
+        sourceAssetId?: string;
+    }): Promise<BrandProposal>;
+    recordAssetAnalysis(input: {
+        jobId: string;
+        mutationId: string;
+        bookId: string;
+        assetId: string;
+        analysis: AssetAnalysis;
+        expectedAnalysisRevision: number;
+    }): Promise<BrandAsset>;
+    readAssetContent(input: {
+        jobId: string;
+        bookId: string;
+        assetId: string;
+    }): Promise<BrandFetchedBytes>;
+}
 /** Options for {@link brandSkill}. */
 interface BrandSkillOpts {
     /** The injected odla client (a real @odla-ai/db AdminDb satisfies it). */
@@ -581,10 +1074,27 @@ interface BrandSkillOpts {
     bookId: string;
     /** The bot identity acting through these tools. */
     self: BrandSkillSelf;
-    /** Origin prefixed onto relative asset urls (`url` starting with `/`). */
-    fileBaseUrl: string;
-    /** Asset-byte fetcher override (default: global fetch via resolveDeps). */
-    fetchBytes?: (url: string) => Promise<BrandFetchedBytes>;
+    /** Host attestation for the rules-scoped credential behind `db`. */
+    agentDbBinding: {
+        principalId: string;
+        credentialRef: string;
+    };
+    /** Active verified agent job; the bridge derives message/turn provenance. */
+    agentJobId: string;
+    agentBridge: BrandAgentBridge;
+    /** Host verification against the live principal grant. Missing/denied hooks
+     * fail closed; roster membership is visibility, not authority. */
+    authorizeCapability: (input: {
+        agentId: string;
+        bookId: string;
+        capability: BrandCapability;
+    }) => Promise<BrandCapabilityAuthority | null> | BrandCapabilityAuthority | null;
+    /** Bounded host directory projection for conversational display only. */
+    resolvePrincipals: (input: {
+        requesterAgentId: string;
+        bookId: string;
+        principalIds: string[];
+    }) => Promise<BrandPrincipalProjection[]>;
     /** False when the model cannot take image/document blocks inside a
      * tool_result — view_asset then steers to the pre-turn attachment path. */
     visionInToolResults?: boolean;
@@ -598,12 +1108,27 @@ interface BrandToolCtx {
     db: BrandDb;
     bookId: string;
     self: BrandSkillSelf;
-    fileBaseUrl: string;
-    fetchBytes: (url: string) => Promise<BrandFetchedBytes>;
     /** Whether image/document blocks may be returned inside tool results. */
     visionInToolResults: boolean;
     now: () => number;
     newId: () => string;
+    agentJobId: string;
+    createProposal(input: {
+        mutationId: string;
+        kind: ProposalKind;
+        payload: Record<string, unknown>;
+        rationale: string;
+        sourceAssetId?: string;
+    }): Promise<BrandProposal>;
+    recordAssetAnalysis(input: {
+        mutationId: string;
+        assetId: string;
+        analysis: AssetAnalysis;
+        expectedAnalysisRevision: number;
+    }): Promise<BrandAsset>;
+    readAssetContent(assetId: string): Promise<BrandFetchedBytes>;
+    resolvePrincipals(ids: string[]): Promise<BrandPrincipalProjection[]>;
+    authority(capability: BrandCapability): Promise<BrandCapabilityAuthority>;
     /** Load the scoped book row; throws BrandNotFoundError when missing. */
     loadBook(): Promise<BrandBook>;
     /** Wrap a handler so Brand validation errors come back as actionable
@@ -638,17 +1163,13 @@ declare function base64FromBytes(bytes: Uint8Array): string;
  */
 declare function assetTools(ctx: BrandToolCtx): ToolDef[];
 
-/**
- * The book tools: `update_section` (validated per-kind content, upserted by
- * natural key with the book's audience snapshot) and `compile_tokens`
- * (palette + typography → light/dark token cache on the book row).
- */
+/** `update_section` validates a draft and parks it as an OPEN proposal. */
 declare function bookTools(ctx: BrandToolCtx): ToolDef[];
 
 /**
  * The palette tools: `analyze_color`, `evaluate_contrast` (pure math),
  * `propose_palette` (writes an OPEN proposal with an automatic contrast
- * report), and `resolve_proposal` (applies the human's explicit verdict).
+ * report). Resolution is deliberately not an agent tool.
  */
 declare function paletteTools(ctx: BrandToolCtx): ToolDef[];
 
@@ -699,15 +1220,76 @@ declare function supportsBrandVision(spec: BrandVisionSpec | null | undefined):
  */
 declare function readTools(ctx: BrandToolCtx): ToolDef[];
 
+type BrandRouteCapability = "brand.edit" | "app.manage";
+type BrandRouteEffect = "internal" | "destructive";
+interface BrandRouteAuthority {
+    authorityRef: string;
+    actorPrincipalId: string;
+    capability: BrandRouteCapability;
+    effect: BrandRouteEffect;
+}
 /** Everything {@link import("./index").createBrandRoutes} needs from the host worker. */
 interface BrandRouteOpts {
     /** The injected odla client (a real @odla-ai/db AdminDb satisfies it). */
     db: BrandDb;
+    /** Registry app that owns the book rows and central authority records. */
+    appId: string;
     /** Host-owned auth: resolve the request to an actor or null (→ 401). The
      * tokens routes skip this only when `publicTokens` is true. */
     authorize: (req: Request) => Promise<BrandActor | null> | BrandActor | null;
+    /** Optional host-owned authority seam for read-only Discussion reference
+     * lookup. Verify exact Brand product, brand.read capability, canonical
+     * audience, principal, current app lifetime/environment, and agent grant
+     * provenance here; when omitted, the ordinary request authorizer is used. */
+    authorizeDiscussionReferences?: (req: Request) => Promise<BrandActor | null> | BrandActor | null;
+    /** Live host verification for worker-mediated effects. The callback must
+     * verify the direct human credential, current app owner/co-owner status,
+     * exact capability/effect/resource, and return null on any uncertainty. */
+    authorizeCapability: (input: {
+        req: Request;
+        actor: BrandActor;
+        appId: string;
+        bookId?: string;
+        capability: BrandRouteCapability;
+        effect: BrandRouteEffect;
+    }) => Promise<BrandRouteAuthority | null> | BrandRouteAuthority | null;
+    /** Consume or idempotently replay one registry `human_exact` authority use,
+     * then reload and authenticate its immutable central receipt. Missing,
+     * synthetic, cached, or unverifiable authority must return null. */
+    consumeHumanExact: (input: {
+        req: Request;
+        actor: BrandActor;
+        appId: string;
+        capability: "brand.proposal.resolve";
+        projectCapability: "brand.approve";
+        effect: "internal";
+        resource: {
+            bookId: string;
+            proposalId: string;
+        };
+        actionDigest: string;
+        consumptionIdempotencyKey: string;
+    }) => Promise<BrandHumanAuthorityConsumption | null> | BrandHumanAuthorityConsumption | null;
+    /** Re-read the private object and authenticate the exact snapshot captured
+     * by the agent bridge. This must verify path, ETag, size, and SHA-256 bytes;
+     * returning false prevents authority consumption and the local effect. */
+    verifySourceAssetSnapshot: (input: {
+        req: Request;
+        appId: string;
+        bookId: string;
+        assetId: string;
+        path: string;
+        snapshot: BrandSourceAssetSnapshot;
+    }) => Promise<boolean> | boolean;
     /** Mount point. Default "/api/brand". */
     basePath?: string;
+    /** Native UI mount used by returned Discussion deep links. Default "/". */
+    discussionBasePath?: string;
+    /**
+     * Product-owned fetch used only for a short-lived URL minted from a linked
+     * private Brand asset. Callers never provide this URL or receive it back.
+     */
+    fetchPrivateAsset?: typeof fetch;
     /** Upload size cap in bytes (checked against `File.size`). Default 8 MiB. */
     maxUploadBytes?: number;
     /** Serve `GET /books/:id/tokens.css` and `tokens.json` without authorize —
@@ -721,12 +1303,21 @@ interface BrandRouteOpts {
 /** Per-request context handed to the authorized route handlers. */
 interface BrandRouteCtx {
     db: BrandDb;
+    appId: string;
     actor: BrandActor;
+    authorizeCapability: BrandRouteOpts["authorizeCapability"];
+    consumeHumanExact: BrandRouteOpts["consumeHumanExact"];
+    verifySourceAssetSnapshot: BrandRouteOpts["verifySourceAssetSnapshot"];
     now: () => number;
     newId: () => string;
     maxUploadBytes: number;
+    discussionBasePath: string;
+    fetchPrivateAsset: typeof fetch;
 }
 
+/** Freeze the exact OPEN proposal fields a reviewer sees. */
+declare function proposalReviewSnapshot(proposal: BrandProposal): BrandProposalReviewSnapshot;
+
 /**
  * Build the brand fetch handler. Returns `null` for requests outside
  * `basePath` (default `/api/brand`) so the host worker falls through to its
@@ -737,11 +1328,13 @@ interface BrandRouteCtx {
  */
 declare function createBrandRoutes(options: BrandRouteOpts): (req: Request) => Promise<Response | null>;
 
-/** The dispatch envelope odla-db's commit hook POSTs when a trigger fires —
- * the same wire shape chat-agent consumes (see the header provenance note). */
+/** Versioned, host-authenticated envelope for one Brand agent turn. */
 interface BrandDispatchBody {
-    v: number;
+    v: 2;
     appId: string;
+    /** Exact Registry app lifetime admitted by the durable Server job. */
+    appIncarnation: string;
+    jobId: string;
     trigger: {
         id: string;
         skill: string;
@@ -757,61 +1350,61 @@ interface BrandDispatchBody {
         row: Record<string, unknown>;
     };
 }
-/**
- * Validate an untrusted dispatch body; null if malformed. SHAPE-only,
- * mirroring chat-agent's parseDispatch: it does NOT gate on `trigger.skill` —
- * routing on skill is the HOST's job (a worker serving several skills checks
- * `body.trigger.skill === "brand"` before calling {@link dispatchBrandTurn}),
- * so an absent skill parses as `""`, never silently defaulted to "brand".
- */
-declare function parseBrandDispatch(raw: unknown): BrandDispatchBody | null;
-/** The brand book bound to a chat channel (`brand_book.channelId`), or null
- * when the channel id is empty or no book claims it. */
-declare function bookForChannel(db: BrandDb, channelId: string): Promise<BrandBook | null>;
-/**
- * The agent-turn input for a dispatched message: a brand-flavored prompt
- * (mirrors chat-agent's `inputFor` tone, steering into the brand workflow),
- * and — when pre-turn `attachments` are supplied (the no-vision-in-tool-
- * results path) — an explicit block array with the images BEFORE the text.
- */
-declare function brandInputFor(body: BrandDispatchBody, attachments?: ImageBlock[]): string | OracleContentBlock[];
-/** Everything {@link dispatchBrandTurn} needs from the host worker. The
- * @odla-ai/ai pieces (`inference`, `runAgent`) are injected so this module
- * keeps the package's types-only relationship with the peer. */
+/** Trusted host seams required to run one capability-bound Brand agent turn. */
 interface BrandDispatchDeps {
-    /** The injected odla client (a real @odla-ai/db AdminDb satisfies it). */
+    /** Service read client; never handed to agent tools. */
     db: BrandDb;
-    /** The @odla-ai/ai inference facade the turn runs on. */
+    appId: string;
+    /** Host-created runtime bound to this verified dispatch + exact agent. */
+    agentRuntimeFor: (input: {
+        appId: string;
+        agentId: string;
+        bookId: string;
+        triggerId: string;
+        eventId: string;
+        jobId: string;
+    }) => Promise<{
+        db: BrandDb;
+        credentialRef: string;
+        jobId: string;
+        bridge: BrandAgentBridge;
+    }>;
+    authorizeCapability: (input: {
+        agentId: string;
+        bookId: string;
+        capability: "brand.read" | "brand.edit";
+    }) => Promise<BrandCapabilityAuthority | null> | BrandCapabilityAuthority | null;
+    resolvePrincipals: (input: {
+        requesterAgentId: string;
+        bookId: string;
+        principalIds: string[];
+    }) => Promise<BrandPrincipalProjection[]>;
     inference: Inference;
-    /** Canonical model id for the persona. */
     model: string;
-    /** The agent loop — pass @odla-ai/ai's `runAgent`. */
     runAgent: (inference: Inference, persona: Persona, input: AgentRunInput) => Promise<{
         finalText: string;
     }>;
-    /** Origin prefixed onto relative asset urls (skill + pre-turn attachments). */
-    fileBaseUrl: string;
-    /** Optional stable id factory for durable whole-turn retries. */
     newId?: () => string;
-    /** Optional chat-skill factory (e.g. wrapping @odla-ai/chat's chatSkill) so
-     * the bot can reply in the triggering channel. */
     chatSkillFor?: (channelId: string, self: BrandSkillSelf) => Skill;
-    /** Model catalog slice (model id → capability spec) for the vision probe;
-     * an absent catalog or unknown model fails safe to the pre-turn path. */
     catalog?: Record<string, BrandVisionSpec>;
 }
-/**
- * Run one brand-agent turn for a dispatched chat message: resolve the book
- * via the row's `channelId` (throws {@link BrandNotFoundError} when no book
- * claims the channel), probe `supportsBrandVision(catalog[model])`, build the
- * persona (brand skill + optional chat skill, bot identity from
- * `trigger.runAs`), and run the loop. When the model can NOT take blocks in
- * tool results, assets are attached PRE-TURN as URL image blocks — v1 keeps
- * detection simple: only when the message row carries an `assetIds` array
- * (no body-text scraping), and only live image assets.
- */
+
+/** Reload message attachment ids against the exact live linked Brand book. */
+declare function attachedBrandAssetIds(db: BrandDb, book: BrandBook, row: Record<string, unknown>): Promise<string[]>;
+
+/** Strict-enough structural parse for the signed host dispatch envelope. */
+declare function parseBrandDispatch(raw: unknown): BrandDispatchBody | null;
+/** Channel ids are unique by schema, but ambiguity still fails closed if a
+ * legacy/corrupt store returns more than one row. */
+declare function bookForChannel(db: BrandDb, channelId: string): Promise<BrandBook | null>;
+/** Assemble the conversational request. Attachments remain supported as a
+ * pure helper, but secure dispatch does not pass signed/private URLs here. */
+declare function brandInputFor(body: BrandDispatchBody, attachments?: ImageBlock[], author?: BrandPrincipalProjection, attachedAssetIds?: readonly string[]): string | OracleContentBlock[];
+/** Preflight exact app/skill/channel/roster/live brand.read before the model
+ * is invoked. Every tool revalidates its own read/edit capability as well. */
 declare function dispatchBrandTurn(deps: BrandDispatchDeps, body: BrandDispatchBody): Promise<{
     finalText: string;
+    durableOutcome: boolean;
 }>;
 
 /** The odla-db namespace chat messages live in.
@@ -903,6 +1496,8 @@ interface BrandIntegrationDescriptor {
     rules: BrandRules;
     /** Commit triggers to register at /app/:id/admin/triggers (per-bot; app-supplied). */
     triggers: BrandTrigger[];
+    /** Least-privilege agent capabilities and semantic-operation boundary. */
+    agentProfile: BrandAgentProfile;
     probes?: BrandIntegrationProbe[];
     provision: IntegrationProvision;
 }
@@ -935,4 +1530,4 @@ interface CreateBrandIntegrationOptions {
  */
 declare function createBrandIntegration(options?: CreateBrandIntegrationOptions): BrandIntegrationDescriptor;
 
-export { ASSET_CONTENT_TYPES, type AcceptProposalInput, AssetAnalysis, AssetKind, type AttrType, type AudienceChildren, BRAND_INSTRUCTIONS, BRAND_RULES, BRAND_SCHEMA, BrandActor, BrandBook, type BrandBotTriggerOpts, BrandDb, type BrandDeps, type BrandDispatchBody, type BrandDispatchDeps, BrandEntityRef, type BrandFetchedBytes, BrandInputError, type BrandIntegrationDescriptor, type BrandIntegrationProbe, BrandNotFoundError, BrandOp, BrandProposal, type BrandRouteCtx, type BrandRouteOpts, type BrandRule, type BrandRules, type BrandSkillOpts, type BrandSkillSelf, type BrandToolCtx, type BrandTrigger, type BrandVisionCapabilities, type BrandVisionSpec, CHART_DELTA_MIN, CHAT_MESSAGE_NS, CSS_NAMED_COLORS, type ContrastKind, type CreateAssetInput, type CreateBookInput, type CreateBrandIntegrationOptions, type CreateBrandPersonaOpts, DEFAULT_BRAND_SYSTEM, type DeriveChartOptions, type DerivePaletteOptions, type Hsl, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type LightnessDirection, MAX_SWATCHES, MAX_VIEW_BYTES, type NamedColor, type NearestNamedColor, type Oklab, type Oklch, PICK_TEXT_DEFAULT_CANDIDATES, type ProposePaletteInput, RAMP_L_MAX, RAMP_L_MIN, type RejectProposalInput, type ResolvedBrandDeps, type Rgb, SectionKind, SectionStatus, type SerializedAttr, type SerializedEntity, type SerializedLink, type SerializedLinkEnd, type SerializedSchema, Swatch, type UpsertSectionInput, acceptProposalOps, adjustLightnessUntil, analogous, assertAnalysis, assertAssetContentType, assertHex, assertSectionContent, assertSwatches, assetTools, audienceFanoutOps, base64FromBytes, bookForChannel, bookTools, brandBotTrigger, brandInputFor, brandIntegration, brandRules, brandSkill, capString, capStringArray, clamp01, clampToGamut, complementary, contrastRatio, createAssetOps, createBookOps, createBrandIntegration, createBrandPersona, createBrandRoutes, deltaEOK, deltaEOKLab, deriveChartColors, derivePalette, dispatchBrandTurn, hexToOklch, hslToRgb, inSrgbGamut, linearToSrgb, meetsAA, meetsAAA, monochrome, nearestNamedColor, normalizeHex, oklabToOklch, oklabToRgb, oklchToHex, oklchToOklab, paletteTools, parseBrandDispatch, parseHex, pickTextOn, proposePaletteOps, readTools, recordAnalysisOps, rejectProposalOps, relativeLuminance, resolveDeps, rgbToHsl, rgbToOklab, rotateHue, safeFileName, sectionKey, splitComplementary, srgbToLinear, supportsBrandVision, tetradic, tintShadeRamp, toHex, tombstoneAssetOps, triadic, updateBookOps, upsertSectionOps };
+export { ASSET_CONTENT_TYPES, type AcceptProposalInput, AssetAnalysis, AssetKind, type AttrType, type AudienceChildren, BRAND_AGENT_PROFILE, BRAND_DISCUSSION_REFERENCE_KINDS, BRAND_INSTRUCTIONS, BRAND_RULES, BRAND_SCHEMA, BookStatus, type BrandActor, type BrandAgentBridge, type BrandAgentProfile, type BrandApprovalReceipt, type BrandAsset, type BrandAttrs, type BrandBook, type BrandBotTriggerOpts, type BrandCapabilityAuthority, BrandConflictError, type BrandDb, type BrandDecisionBinding, type BrandDeps, type BrandDiscussionReference, type BrandDiscussionReferenceKind, type BrandDiscussionReferenceTarget, type BrandDiscussionSwatch, type BrandDispatchBody, type BrandDispatchDeps, type BrandEntityRef, type BrandFetchedBytes, type BrandFileRecord, BrandForbiddenError, BrandGoneError, type BrandHumanAuthorityConsumption, BrandInputError, type BrandIntegrationDescriptor, type BrandIntegrationProbe, type BrandLookup, BrandNotFoundError, type BrandOp, type BrandPalette, type BrandPrincipalProjection, type BrandProposal, type BrandProposalProvenance, type BrandProposalReviewSnapshot, type BrandResult, BrandReviewStateChangedError, type BrandRouteCtx, type BrandRouteOpts, type BrandRow, type BrandRule, type BrandRules, type BrandScalar, type BrandSection, type BrandSkillOpts, type BrandSkillSelf, type BrandSourceAssetSnapshot, type BrandStorage, BrandTokensSnapshot, type BrandToolCtx, type BrandTransactGuard, type BrandTransactOptions, type BrandTrigger, type BrandUploadBody, type BrandVisionCapabilities, type BrandVisionSpec, CHART_DELTA_MIN, CHAT_MESSAGE_NS, CSS_NAMED_COLORS, type ContrastKind, type CreateAssetInput, type CreateBookInput, type CreateBrandIntegrationOptions, type CreateBrandPersonaOpts, DEFAULT_BRAND_SYSTEM, type DeriveChartOptions, type DerivePaletteOptions, type Hsl, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type LightnessDirection, MAX_SWATCHES, MAX_VIEW_BYTES, type NamedColor, type NearestNamedColor, type Oklab, type Oklch, PICK_TEXT_DEFAULT_CANDIDATES, PaletteSource, PaletteStatus, ProposalKind, ProposalStatus, type ProposePaletteInput, type ProposeSectionInput, RAMP_L_MAX, RAMP_L_MIN, type RejectProposalInput, type ResolvedBrandDeps, type Rgb, SectionKind, SectionStatus, type SerializedAttr, type SerializedEntity, type SerializedLink, type SerializedLinkEnd, type SerializedSchema, Swatch, type UpsertSectionInput, acceptProposalOps, adjustLightnessUntil, analogous, assertAnalysis, assertAssetContentType, assertHex, assertSectionContent, assertSwatches, assetTools, attachedBrandAssetIds, audienceFanoutOps, base64FromBytes, beginAssetDeleteOps, bookForChannel, bookTools, brandAuthorityRef, brandBotTrigger, brandDiscussionReferenceHref, brandDiscussionReferenceId, brandInputFor, brandIntegration, brandJsonDigest, brandRules, brandSkill, canonicalBrandJson, capString, capStringArray, clamp01, clampToGamut, complementary, contrastRatio, createAssetOps, createBookOps, createBrandIntegration, createBrandPersona, createBrandRoutes, deltaEOK, deltaEOKLab, deriveChartColors, derivePalette, dispatchBrandTurn, finishAssetDeleteOps, formatBrandDiscussionReference, hexToOklch, hslToRgb, inSrgbGamut, isBoundedBrandJson, isBrandHumanAuthorityConsumption, linearToSrgb, meetsAA, meetsAAA, monochrome, nearestNamedColor, normalizeHex, oklabToOklch, oklabToRgb, oklchToHex, oklchToOklab, paletteTools, parseBrandDiscussionReference, parseBrandDispatch, parseHex, pickTextOn, proposalReviewSnapshot, proposePaletteOps, proposeSectionOps, readTools, recordAnalysisOps, rejectProposalOps, relativeLuminance, resolveDeps, rgbToHsl, rgbToOklab, rotateHue, safeFileName, sectionKey, splitComplementary, srgbToLinear, supportsBrandVision, tetradic, tintShadeRamp, toHex, triadic, updateBookOps, upsertSectionOps, verifyBrandApprovalReceipt };