@odla-ai/brand 0.3.0 → 0.4.0

package/README.md

@@ -71,6 +71,8 @@ const routes = createBrandRoutes({
   authorize: verifyDirectCaller,
   // Read-only: exact brand/brand.read/audience/app-incarnation assertion.
   authorizeDiscussionReferences: verifyDiscussionReferenceAssertion,
+  // Optional test/edge fetch; it receives only a Brand-minted private URL.
+  fetchPrivateAsset: fetch,
   authorizeCapability: verifyCurrentHumanAppOwner,
   consumeHumanExact: async (input) =>
     (await appsForBearer(input.req).consumeHumanExactAuthority(
@@ -108,6 +110,21 @@ manager and live grant revision. The host must set its current
 `ODLA_APP_INCARNATION` and fail closed on a mismatch. This assertion cannot
 authorize proposal resolution or any other Brand mutation.
 
+Palette projections additionally carry at most 24 validated semantic roles,
+normalized `#rrggbb` colors, and bounded optional names so Discussion can use
+the shared `@odla-ai/ui` `PaletteStrip` without reconstructing brand state.
+An assertion-authorized exact lookup may request
+`inspect=asset-content&kind=brand:asset&id=…`. Brand resolves the linked row,
+mints its own short-lived private-object URL, and returns only bounded PNG,
+JPEG, GIF, WebP, or PDF bytes—never the URL or a separate object path, storage
+id, app id, or book id. Only the already-discovered canonical reference id
+crosses the boundary. It validates type and magic, size, and SHA-256, then
+reloads both
+membership and the exact linked asset row after I/O. SVG, malformed, spoofed,
+changed, unsupported, and over-budget assets fail closed. Returned bytes carry
+`untrusted_project_material` taint for the hosted inference boundary; the
+native link remains navigation only and human proposal approval is unchanged.
+
 Resolve a proposal from a human review UI with one stable mutation id. Send
 back exactly the proposal snapshot that UI rendered; a stale or concurrently
 resolved snapshot answers `409`, while an identical retry returns the original

package/dist/index.cjs

@@ -3426,13 +3426,13 @@ async function proposalDecisionOps(input) {
 
 // src/routes/proposal-resolution-receipts.ts
 async function proposalResolutionMutationKey(bookId, proposalId, mutationId) {
-  const digest = await brandJsonDigest({
+  const digest2 = await brandJsonDigest({
     version: 3,
     bookId,
     proposalId,
     mutationId
   });
-  return `brand:proposal-resolution:v3:${digest.slice("sha256:".length)}`;
+  return `brand:proposal-resolution:v3:${digest2.slice("sha256:".length)}`;
 }
 async function proposalReceiptByMutation(ctx, mutationKey) {
   const result = await ctx.db.query({
@@ -3982,6 +3982,130 @@ async function handleTokens(db, req, bookId, which, actor) {
   });
 }
 
+// src/routes/discussion-asset.ts
+var MAX_DISCUSSION_ASSET_BYTES = 4718592;
+var SIGN_TTL_SECONDS = 30;
+var TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "application/pdf"
+]);
+var bare = (value) => (value?.split(";", 1)[0] ?? "").trim().toLowerCase();
+var starts = (bytes, expected) => expected.every((value, index) => bytes[index] === value);
+function magicMatches(contentType, bytes) {
+  if (contentType === "image/png") {
+    return starts(bytes, [137, 80, 78, 71, 13, 10, 26, 10]);
+  }
+  if (contentType === "image/jpeg") {
+    return starts(bytes, [255, 216, 255]);
+  }
+  const prefix = new TextDecoder().decode(bytes.subarray(0, 16));
+  if (contentType === "image/gif") {
+    return prefix.startsWith("GIF87a") || prefix.startsWith("GIF89a");
+  }
+  if (contentType === "image/webp") {
+    return prefix.startsWith("RIFF") && prefix.slice(8, 12) === "WEBP";
+  }
+  return contentType === "application/pdf" && prefix.startsWith("%PDF-");
+}
+async function boundedBytes(response, max) {
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > max) return null;
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const next = await reader.read();
+    if (next.done) break;
+    total += next.value.byteLength;
+    if (total > max) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(next.value);
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
+}
+async function digest(bytes) {
+  const value = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  return `sha256:${[...new Uint8Array(value)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function exactAsset(beforeBook, before, afterBook, after) {
+  return afterBook.id === beforeBook.id && after.id === before.id && after.bookId === before.bookId && after.status === "live" && after.path === before.path && after.storageObjectId === before.storageObjectId && after.contentDigest === before.contentDigest && after.contentType === before.contentType && after.size === before.size;
+}
+function safeSignedUrl(value) {
+  try {
+    const url = new URL(value);
+    return value.length <= 4096 && url.protocol === "https:" && !url.username && !url.password ? url : null;
+  } catch {
+    return null;
+  }
+}
+async function handleBrandDiscussionAsset(ctx, req, target) {
+  const beforeBook = await loadMemberBook(ctx.db, target.bookId, ctx.actor.id);
+  const before = await linkedAsset(ctx, beforeBook, target.resourceId);
+  const contentType = bare(before.contentType);
+  if (!TYPES.has(contentType)) {
+    return json({ error: "asset content type is not viewable" }, 415);
+  }
+  if (before.size < 1 || before.size > MAX_DISCUSSION_ASSET_BYTES) {
+    return json({ error: "asset exceeds the discussion media limit" }, 413);
+  }
+  const signed = safeSignedUrl(
+    await ctx.db.storage.sign(before.path, SIGN_TTL_SECONDS)
+  );
+  if (!signed) throw new BrandInputError("private asset signing failed");
+  const response = await ctx.fetchPrivateAsset(signed, {
+    headers: { accept: contentType },
+    redirect: "manual",
+    signal: req.signal
+  });
+  if (!response.ok || response.type === "opaqueredirect") {
+    throw new BrandNotFoundError(`asset ${before.id}`);
+  }
+  const served = bare(response.headers.get("content-type"));
+  if (served === "image/svg+xml" || served && served !== "application/octet-stream" && served !== contentType) {
+    return json({ error: "asset content type is inconsistent" }, 415);
+  }
+  const bytes = await boundedBytes(response, MAX_DISCUSSION_ASSET_BYTES);
+  if (!bytes || bytes.byteLength !== before.size || !magicMatches(contentType, bytes) || await digest(bytes) !== before.contentDigest) {
+    return json({ error: "asset bytes failed validation" }, 422);
+  }
+  const afterBook = await loadMemberBook(ctx.db, target.bookId, ctx.actor.id);
+  const after = await linkedAsset(ctx, afterBook, target.resourceId);
+  if (!exactAsset(beforeBook, before, afterBook, after)) {
+    return json({ error: "asset changed during inspection" }, 409);
+  }
+  return json({
+    asset: {
+      reference: { kind: "brand:asset", id: `${before.bookId}/${before.id}` },
+      contentType,
+      byteLength: bytes.byteLength,
+      data: base64(bytes),
+      taint: "untrusted_project_material"
+    }
+  }, 200, {
+    "cache-control": "private, no-store",
+    "x-content-type-options": "nosniff"
+  });
+}
+function base64(bytes) {
+  let binary = "";
+  for (let index = 0; index < bytes.length; index += 8192) {
+    binary += String.fromCharCode(...bytes.subarray(index, index + 8192));
+  }
+  return btoa(binary);
+}
+
 // src/routes/discussion-references.ts
 var capLimit = (raw) => {
   const parsed = Number(raw ?? 20);
@@ -4013,6 +4137,7 @@ var projection = (req, ctx, book, target, row) => {
   let summary = `${book.name} brand book`;
   let status = book.status;
   let destination = "Brand Studio \xB7 Brand book";
+  let swatches;
   if (target.kind === "brand:asset") {
     const asset = row;
     label = asset.title?.trim() || `${asset.kind} asset`;
@@ -4022,6 +4147,11 @@ var projection = (req, ctx, book, target, row) => {
     destination = "Brand Studio \xB7 Conversation";
   } else if (target.kind === "brand:palette") {
     const palette = row;
+    swatches = assertSwatches(palette.swatches).map((swatch) => ({
+      role: swatch.role,
+      hex: swatch.hex,
+      ...swatch.name ? { name: swatch.name } : {}
+    }));
     label = palette.name;
     hint = `${book.name} \xB7 ${palette.status} palette`;
     summary = `${palette.swatches.length}-color palette in ${book.name}`;
@@ -4054,7 +4184,8 @@ var projection = (req, ctx, book, target, row) => {
       new URL(req.url),
       target,
       ctx.discussionBasePath
-    )
+    ),
+    ...swatches ? { swatches } : {}
   };
 };
 async function exact(ctx, req, target) {
@@ -4108,11 +4239,23 @@ async function search(ctx, req, url) {
 }
 async function handleBrandDiscussionReferences(ctx, req, url) {
   if (req.method !== "GET") return methodNotAllowed();
+  const inspect = url.searchParams.get("inspect");
   const kind = url.searchParams.get("kind");
   const id = url.searchParams.get("id");
   if (kind && !id || !kind && id) return json({ error: "kind and id must be paired" }, 400);
   const target = targetFromQuery(url);
   if ((kind || id) && !target) return json({ items: [] });
+  if (inspect === "asset-content") {
+    const allowed = /* @__PURE__ */ new Set(["inspect", "kind", "id"]);
+    if ([...url.searchParams.keys()].some((key) => !allowed.has(key)) || target?.kind !== "brand:asset" || !target.resourceId) return json({ error: "exact brand asset kind and id required" }, 400);
+    return handleBrandDiscussionAsset(ctx, req, {
+      bookId: target.bookId,
+      resourceId: target.resourceId
+    });
+  }
+  if (inspect !== null && inspect !== "1") {
+    return json({ error: "invalid inspection mode" }, 400);
+  }
   return json({
     items: target ? await exact(ctx, req, target) : await search(ctx, req, url)
   });
@@ -4153,7 +4296,8 @@ function createBrandRoutes(options) {
     now: options.now ?? Date.now,
     newId: options.newId ?? (() => crypto.randomUUID()),
     maxUploadBytes: options.maxUploadBytes ?? 8 * 1024 * 1024,
-    discussionBasePath: options.discussionBasePath ?? "/"
+    discussionBasePath: options.discussionBasePath ?? "/",
+    fetchPrivateAsset: options.fetchPrivateAsset ?? fetch
   };
   return async (req) => {
     const url = new URL(req.url);