@odla-ai/brand 0.8.4 → 0.8.5

package/dist/index.js

@@ -61,6 +61,7 @@ var BRAND_NS = {
   palette: "brand_palette",
   proposal: "brand_proposal",
   approvalReceipt: "brand_approval_receipt",
+  activationReceipt: "brand_activation_receipt",
   asset: "brand_asset"
 };
 var BOOK_STATUSES = ["draft", "active", "archived"];
@@ -185,6 +186,8 @@ var BRAND_SCHEMA = {
         activationRevision: a("number"),
         tokens: opt("json"),
         // maps + complete palette/typography receipt provenance
+        activationReceiptId: opt("string"),
+        activationActionDigest: opt("string"),
         summary: opt("string"),
         createdAt: idx("date"),
         updatedAt: idx("date")
@@ -279,6 +282,23 @@ var BRAND_SCHEMA = {
         receiptDigest: idx("string")
       }
     },
+    [BRAND_NS.activationReceipt]: {
+      attrs: {
+        id: uniq("string"),
+        version: a("number"),
+        mutationKey: uniq("string"),
+        bookId: idx("string"),
+        reviewedBook: a("json"),
+        actionDigest: idx("string"),
+        approvedBy: idx("string"),
+        approvedByKind: a("string"),
+        authorityRef: idx("string"),
+        authorityCapability: a("string"),
+        authorityConsumption: a("json"),
+        createdAt: idx("date"),
+        receiptDigest: idx("string")
+      }
+    },
     [BRAND_NS.asset]: {
       attrs: {
         id: uniq("string"),
@@ -333,6 +353,10 @@ var BRAND_SCHEMA = {
       forward: { on: BRAND_NS.approvalReceipt, has: "one", label: "book" },
       reverse: { on: BRAND_NS.book, has: "many", label: "approvalReceipts" }
     },
+    brandActivationReceiptBook: {
+      forward: { on: BRAND_NS.activationReceipt, has: "one", label: "book" },
+      reverse: { on: BRAND_NS.book, has: "many", label: "activationReceipts" }
+    },
     brandAssetBook: {
       forward: { on: BRAND_NS.asset, has: "one", label: "book" },
       reverse: { on: BRAND_NS.book, has: "many", label: "assets" }
@@ -374,6 +398,15 @@ function receiptAsWritten(row) {
   for (const key of systemAttrs) delete out[key];
   return out;
 }
+function activationReceiptAsWritten(row) {
+  const normalized = rowAsWritten(BRAND_NS.activationReceipt, row);
+  if (!record(normalized)) return normalized;
+  const systemAttrs = Object.keys(normalized).filter((key) => key.startsWith("$"));
+  if (systemAttrs.length === 0) return normalized;
+  const out = { ...normalized };
+  for (const key of systemAttrs) delete out[key];
+  return out;
+}
 function proposalAsWritten(row) {
   return rowAsWritten(BRAND_NS.proposal, row);
 }
@@ -445,6 +478,12 @@ var BRAND_RULES = {
     update: "false",
     delete: "false"
   },
+  [BRAND_NS.activationReceipt]: {
+    view: CURRENT_BOOK_MEMBER,
+    create: "false",
+    update: "false",
+    delete: "false"
+  },
   [BRAND_NS.asset]: {
     view: CURRENT_BOOK_MEMBER,
     create: "false",
@@ -686,15 +725,106 @@ async function brandJsonDigest(value) {
   return `sha256:${[...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 
-// src/review.ts
+// src/activation-review.ts
 var DIGEST = /^sha256:[0-9a-f]{64}$/;
-var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-var exactKeys = (value, required, optional = []) => {
-  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var exactKeys = (value, required) => {
+  const allowed = new Set(required);
   return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => allowed.has(key));
 };
 var boundedString = (value, max = 200) => typeof value === "string" && value.length > 0 && value.length <= max;
 var safeTime = (value) => Number.isSafeInteger(value) && value >= 0;
+var SNAPSHOT_KEYS = [
+  "version",
+  "bookId",
+  "slug",
+  "status",
+  "bookVersion",
+  "activationRevision",
+  "activePaletteId",
+  "memberIdsDigest",
+  "tokensSourceDigest",
+  "paletteReceiptId",
+  "paletteActionDigest",
+  "typographyReceiptId",
+  "typographyActionDigest",
+  "approvedSectionKeys",
+  "promotionDigest"
+];
+function validSnapshot(value) {
+  if (!record3(value) || !exactKeys(value, SNAPSHOT_KEYS)) return false;
+  const sectionKeys = value.approvedSectionKeys;
+  return value.version === 1 && boundedString(value.bookId) && boundedString(value.slug) && value.status === "draft" && Number.isSafeInteger(value.bookVersion) && value.bookVersion > 0 && Number.isSafeInteger(value.activationRevision) && value.activationRevision > 0 && boundedString(value.activePaletteId) && typeof value.memberIdsDigest === "string" && DIGEST.test(value.memberIdsDigest) && typeof value.tokensSourceDigest === "string" && DIGEST.test(value.tokensSourceDigest) && boundedString(value.paletteReceiptId) && typeof value.paletteActionDigest === "string" && DIGEST.test(value.paletteActionDigest) && boundedString(value.typographyReceiptId) && typeof value.typographyActionDigest === "string" && DIGEST.test(value.typographyActionDigest) && Array.isArray(sectionKeys) && sectionKeys.length > 0 && sectionKeys.length <= 5 && sectionKeys.every((key) => boundedString(key)) && new Set(sectionKeys).size === sectionKeys.length && [...sectionKeys].sort().every((key, index) => key === sectionKeys[index]) && typeof value.promotionDigest === "string" && DIGEST.test(value.promotionDigest);
+}
+var CONSUMPTION_KEYS = [
+  "id",
+  "grantId",
+  "grantVersion",
+  "useNumber",
+  "actorPrincipalId",
+  "actorKind",
+  "credentialId",
+  "credentialKind",
+  "appId",
+  "appIncarnation",
+  "capability",
+  "projectCapability",
+  "effect",
+  "actionDigest",
+  "resourceDigest",
+  "constraintEvidence",
+  "consumptionIdempotencyKey",
+  "requestDigest",
+  "consumedAt"
+];
+function validConsumption(value) {
+  return record3(value) && exactKeys(value, CONSUMPTION_KEYS) && boundedString(value.id) && boundedString(value.grantId) && Number.isSafeInteger(value.grantVersion) && value.grantVersion > 0 && Number.isSafeInteger(value.useNumber) && value.useNumber > 0 && boundedString(value.actorPrincipalId) && value.actorKind === "human" && boundedString(value.credentialId) && value.credentialKind === "clerk" && boundedString(value.appId) && typeof value.appIncarnation === "string" && /^[a-f0-9]{32}$/.test(value.appIncarnation) && value.capability === "brand.book.activate" && value.projectCapability === "brand.approve" && value.effect === "external" && typeof value.actionDigest === "string" && DIGEST.test(value.actionDigest) && typeof value.resourceDigest === "string" && DIGEST.test(value.resourceDigest) && record3(value.constraintEvidence) && boundedString(value.consumptionIdempotencyKey) && typeof value.requestDigest === "string" && DIGEST.test(value.requestDigest) && safeTime(value.consumedAt);
+}
+var RECEIPT_KEYS = [
+  "version",
+  "id",
+  "mutationKey",
+  "bookId",
+  "reviewedBook",
+  "actionDigest",
+  "approvedBy",
+  "approvedByKind",
+  "authorityRef",
+  "authorityCapability",
+  "authorityConsumption",
+  "createdAt",
+  "receiptDigest"
+];
+async function verifyBrandActivationReceipt(receipt2) {
+  try {
+    if (!isBoundedBrandJson(receipt2, { maxDepth: 12, maxNodes: 1e3, maxBytes: 32 * 1024 }) || !record3(receipt2) || !exactKeys(receipt2, RECEIPT_KEYS)) return false;
+    if (receipt2.version !== 1 || !boundedString(receipt2.id) || !boundedString(receipt2.mutationKey) || !boundedString(receipt2.bookId) || !validSnapshot(receipt2.reviewedBook) || typeof receipt2.actionDigest !== "string" || !DIGEST.test(receipt2.actionDigest) || !boundedString(receipt2.approvedBy) || receipt2.approvedByKind !== "human" || !boundedString(receipt2.authorityRef) || receipt2.authorityCapability !== "brand.approve" || !validConsumption(receipt2.authorityConsumption) || !safeTime(receipt2.createdAt) || typeof receipt2.receiptDigest !== "string" || !DIGEST.test(receipt2.receiptDigest)) return false;
+    const reviewed = receipt2.reviewedBook;
+    const authority = receipt2.authorityConsumption;
+    if (reviewed.bookId !== receipt2.bookId || authority.actorPrincipalId !== receipt2.approvedBy || authority.actionDigest !== receipt2.actionDigest || authority.consumptionIdempotencyKey !== receipt2.mutationKey || receipt2.authorityRef !== `authority:${authority.grantId}:v${authority.grantVersion}` || authority.consumedAt > receipt2.createdAt || await brandJsonDigest({ bookId: receipt2.bookId }) !== authority.resourceDigest) return false;
+    const expectedAction = await brandJsonDigest({
+      version: 1,
+      reviewedBook: reviewed,
+      intendedStatus: "active",
+      activationReceiptId: receipt2.id
+    });
+    if (expectedAction !== receipt2.actionDigest) return false;
+    const { receiptDigest, ...immutable } = receipt2;
+    return await brandJsonDigest(immutable) === receiptDigest;
+  } catch {
+    return false;
+  }
+}
+
+// src/review.ts
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
+var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+var exactKeys2 = (value, required, optional = []) => {
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => allowed.has(key));
+};
+var boundedString2 = (value, max = 200) => typeof value === "string" && value.length > 0 && value.length <= max;
+var safeTime2 = (value) => Number.isSafeInteger(value) && value >= 0;
 function brandAuthorityRef(consumption) {
   return `authority:${consumption.grantId}:v${consumption.grantVersion}`;
 }
@@ -713,15 +843,15 @@ var SNAPSHOT_REQUIRED = [
   "createdAt"
 ];
 function validSnapshotShape(value) {
-  if (!record3(value) || !exactKeys(value, SNAPSHOT_REQUIRED)) return false;
+  if (!record4(value) || !exactKeys2(value, SNAPSHOT_REQUIRED)) return false;
   const provenance2 = value.provenance;
-  return boundedString(value.id) && boundedString(value.bookId) && typeof value.kind === "string" && PROPOSAL_KINDS.includes(value.kind) && value.status === "open" && record3(value.payload) && boundedString(value.rationale, 2e3) && record3(provenance2) && exactKeys(provenance2, [
+  return boundedString2(value.id) && boundedString2(value.bookId) && typeof value.kind === "string" && PROPOSAL_KINDS.includes(value.kind) && value.status === "open" && record4(value.payload) && boundedString2(value.rationale, 2e3) && record4(provenance2) && exactKeys2(provenance2, [
     "sourceAssetId",
     "sourceAsset",
     "messageId",
     "turnId",
     "taintLabels"
-  ]) && (provenance2.sourceAssetId === null || boundedString(provenance2.sourceAssetId)) && (provenance2.sourceAsset === null || record3(provenance2.sourceAsset) && exactKeys(provenance2.sourceAsset, [
+  ]) && (provenance2.sourceAssetId === null || boundedString2(provenance2.sourceAssetId)) && (provenance2.sourceAsset === null || record4(provenance2.sourceAsset) && exactKeys2(provenance2.sourceAsset, [
     "assetId",
     "contentDigest",
     "objectEtag",
@@ -730,7 +860,7 @@ function validSnapshotShape(value) {
     "contentType",
     "analysisRevision",
     "analysisDigest"
-  ]) && boundedString(provenance2.sourceAsset.assetId) && typeof provenance2.sourceAsset.contentDigest === "string" && DIGEST.test(provenance2.sourceAsset.contentDigest) && boundedString(provenance2.sourceAsset.objectEtag) && Number.isSafeInteger(provenance2.sourceAsset.objectSize) && provenance2.sourceAsset.objectSize > 0 && typeof provenance2.sourceAsset.pathDigest === "string" && DIGEST.test(provenance2.sourceAsset.pathDigest) && (provenance2.sourceAsset.contentType === null || boundedString(provenance2.sourceAsset.contentType, 160)) && (provenance2.sourceAsset.analysisRevision === null || Number.isSafeInteger(provenance2.sourceAsset.analysisRevision) && provenance2.sourceAsset.analysisRevision >= 0) && (provenance2.sourceAsset.analysisDigest === null || typeof provenance2.sourceAsset.analysisDigest === "string" && DIGEST.test(provenance2.sourceAsset.analysisDigest))) && (provenance2.sourceAssetId === null && provenance2.sourceAsset === null || provenance2.sourceAssetId !== null && provenance2.sourceAsset !== null && provenance2.sourceAsset.assetId === provenance2.sourceAssetId) && (provenance2.messageId === null || boundedString(provenance2.messageId)) && (provenance2.turnId === null || boundedString(provenance2.turnId)) && Array.isArray(provenance2.taintLabels) && provenance2.taintLabels.length <= 16 && provenance2.taintLabels.every((label) => boundedString(label, 120)) && new Set(provenance2.taintLabels).size === provenance2.taintLabels.length && typeof value.reviewDigest === "string" && DIGEST.test(value.reviewDigest) && Array.isArray(value.audience) && value.audience.length > 0 && value.audience.length <= 100 && value.audience.every((id) => boundedString(id)) && new Set(value.audience).size === value.audience.length && boundedString(value.createdBy) && boundedString(value.createdAuthorityRef) && safeTime(value.createdAt);
+  ]) && boundedString2(provenance2.sourceAsset.assetId) && typeof provenance2.sourceAsset.contentDigest === "string" && DIGEST2.test(provenance2.sourceAsset.contentDigest) && boundedString2(provenance2.sourceAsset.objectEtag) && Number.isSafeInteger(provenance2.sourceAsset.objectSize) && provenance2.sourceAsset.objectSize > 0 && typeof provenance2.sourceAsset.pathDigest === "string" && DIGEST2.test(provenance2.sourceAsset.pathDigest) && (provenance2.sourceAsset.contentType === null || boundedString2(provenance2.sourceAsset.contentType, 160)) && (provenance2.sourceAsset.analysisRevision === null || Number.isSafeInteger(provenance2.sourceAsset.analysisRevision) && provenance2.sourceAsset.analysisRevision >= 0) && (provenance2.sourceAsset.analysisDigest === null || typeof provenance2.sourceAsset.analysisDigest === "string" && DIGEST2.test(provenance2.sourceAsset.analysisDigest))) && (provenance2.sourceAssetId === null && provenance2.sourceAsset === null || provenance2.sourceAssetId !== null && provenance2.sourceAsset !== null && provenance2.sourceAsset.assetId === provenance2.sourceAssetId) && (provenance2.messageId === null || boundedString2(provenance2.messageId)) && (provenance2.turnId === null || boundedString2(provenance2.turnId)) && Array.isArray(provenance2.taintLabels) && provenance2.taintLabels.length <= 16 && provenance2.taintLabels.every((label) => boundedString2(label, 120)) && new Set(provenance2.taintLabels).size === provenance2.taintLabels.length && typeof value.reviewDigest === "string" && DIGEST2.test(value.reviewDigest) && Array.isArray(value.audience) && value.audience.length > 0 && value.audience.length <= 100 && value.audience.every((id) => boundedString2(id)) && new Set(value.audience).size === value.audience.length && boundedString2(value.createdBy) && boundedString2(value.createdAuthorityRef) && safeTime2(value.createdAt);
 }
 var CONSUMPTION_REQUIRED = [
   "id",
@@ -754,8 +884,8 @@ var CONSUMPTION_REQUIRED = [
   "consumedAt"
 ];
 function isBrandHumanAuthorityConsumption(value) {
-  if (!record3(value) || !exactKeys(value, CONSUMPTION_REQUIRED)) return false;
-  return boundedString(value.id) && boundedString(value.grantId) && Number.isSafeInteger(value.grantVersion) && value.grantVersion > 0 && Number.isSafeInteger(value.useNumber) && value.useNumber > 0 && boundedString(value.actorPrincipalId) && value.actorKind === "human" && boundedString(value.credentialId) && value.credentialKind === "clerk" && boundedString(value.appId) && typeof value.appIncarnation === "string" && /^[a-f0-9]{32}$/.test(value.appIncarnation) && value.capability === "brand.proposal.resolve" && value.projectCapability === "brand.approve" && value.effect === "internal" && typeof value.actionDigest === "string" && DIGEST.test(value.actionDigest) && typeof value.resourceDigest === "string" && DIGEST.test(value.resourceDigest) && record3(value.constraintEvidence) && boundedString(value.consumptionIdempotencyKey) && typeof value.requestDigest === "string" && DIGEST.test(value.requestDigest) && safeTime(value.consumedAt);
+  if (!record4(value) || !exactKeys2(value, CONSUMPTION_REQUIRED)) return false;
+  return boundedString2(value.id) && boundedString2(value.grantId) && Number.isSafeInteger(value.grantVersion) && value.grantVersion > 0 && Number.isSafeInteger(value.useNumber) && value.useNumber > 0 && boundedString2(value.actorPrincipalId) && value.actorKind === "human" && boundedString2(value.credentialId) && value.credentialKind === "clerk" && boundedString2(value.appId) && typeof value.appIncarnation === "string" && /^[a-f0-9]{32}$/.test(value.appIncarnation) && (value.capability === "brand.proposal.resolve" || value.capability === "brand.book.activate") && value.projectCapability === "brand.approve" && (value.effect === "internal" || value.effect === "external") && typeof value.actionDigest === "string" && DIGEST2.test(value.actionDigest) && typeof value.resourceDigest === "string" && DIGEST2.test(value.resourceDigest) && record4(value.constraintEvidence) && boundedString2(value.consumptionIdempotencyKey) && typeof value.requestDigest === "string" && DIGEST2.test(value.requestDigest) && safeTime2(value.consumedAt);
 }
 var RECEIPT_REQUIRED = [
   "version",
@@ -781,10 +911,10 @@ async function verifyBrandApprovalReceipt(receipt2) {
   try {
     if (!isBoundedBrandJson(receipt2, { maxDepth: 14, maxNodes: 2500, maxBytes: 48 * 1024 }))
       return false;
-    if (!record3(receipt2) || !exactKeys(receipt2, RECEIPT_REQUIRED, ["paletteId", "resolutionNote"]))
+    if (!record4(receipt2) || !exactKeys2(receipt2, RECEIPT_REQUIRED, ["paletteId", "resolutionNote"]))
       return false;
     const binding = receipt2.decisionBinding;
-    if (receipt2.version !== 1 || !boundedString(receipt2.id) || !boundedString(receipt2.mutationKey) || !boundedString(receipt2.bookId) || !boundedString(receipt2.proposalId) || receipt2.resolution !== "accepted" && receipt2.resolution !== "rejected" || !validSnapshotShape(receipt2.reviewedProposal) || typeof receipt2.actionDigest !== "string" || !DIGEST.test(receipt2.actionDigest) || !record3(binding) || !exactKeys(binding, [
+    if (receipt2.version !== 1 || !boundedString2(receipt2.id) || !boundedString2(receipt2.mutationKey) || !boundedString2(receipt2.bookId) || !boundedString2(receipt2.proposalId) || receipt2.resolution !== "accepted" && receipt2.resolution !== "rejected" || !validSnapshotShape(receipt2.reviewedProposal) || typeof receipt2.actionDigest !== "string" || !DIGEST2.test(receipt2.actionDigest) || !record4(binding) || !exactKeys2(binding, [
       "version",
       "bookVersion",
       "activationRevision",
@@ -794,10 +924,10 @@ async function verifyBrandApprovalReceipt(receipt2) {
       "typographyDigest",
       "sourceAssetDigest",
       "effectDigest"
-    ]) || binding.version !== 1 || !Number.isSafeInteger(binding.bookVersion) || binding.bookVersion < 1 || !Number.isSafeInteger(binding.activationRevision) || binding.activationRevision < 0 || binding.activePaletteId !== null && !boundedString(binding.activePaletteId) || typeof binding.memberIdsDigest !== "string" || !DIGEST.test(binding.memberIdsDigest) || binding.activePaletteDigest !== null && (typeof binding.activePaletteDigest !== "string" || !DIGEST.test(binding.activePaletteDigest)) || binding.typographyDigest !== null && (typeof binding.typographyDigest !== "string" || !DIGEST.test(binding.typographyDigest)) || binding.sourceAssetDigest !== null && (typeof binding.sourceAssetDigest !== "string" || !DIGEST.test(binding.sourceAssetDigest)) || typeof binding.effectDigest !== "string" || !DIGEST.test(binding.effectDigest) || !boundedString(receipt2.approvedBy) || receipt2.approvedByKind !== "human" || !boundedString(receipt2.appliedBy) || receipt2.appliedByKind !== "human" || !boundedString(receipt2.authorityRef) || receipt2.authorityCapability !== "brand.approve" || !isBrandHumanAuthorityConsumption(receipt2.authorityConsumption) || !safeTime(receipt2.createdAt) || typeof receipt2.receiptDigest !== "string" || !DIGEST.test(receipt2.receiptDigest) || receipt2.paletteId !== void 0 && !boundedString(receipt2.paletteId) || receipt2.resolutionNote !== void 0 && !boundedString(receipt2.resolutionNote, 1e3)) return false;
+    ]) || binding.version !== 1 || !Number.isSafeInteger(binding.bookVersion) || binding.bookVersion < 1 || !Number.isSafeInteger(binding.activationRevision) || binding.activationRevision < 0 || binding.activePaletteId !== null && !boundedString2(binding.activePaletteId) || typeof binding.memberIdsDigest !== "string" || !DIGEST2.test(binding.memberIdsDigest) || binding.activePaletteDigest !== null && (typeof binding.activePaletteDigest !== "string" || !DIGEST2.test(binding.activePaletteDigest)) || binding.typographyDigest !== null && (typeof binding.typographyDigest !== "string" || !DIGEST2.test(binding.typographyDigest)) || binding.sourceAssetDigest !== null && (typeof binding.sourceAssetDigest !== "string" || !DIGEST2.test(binding.sourceAssetDigest)) || typeof binding.effectDigest !== "string" || !DIGEST2.test(binding.effectDigest) || !boundedString2(receipt2.approvedBy) || receipt2.approvedByKind !== "human" || !boundedString2(receipt2.appliedBy) || receipt2.appliedByKind !== "human" || !boundedString2(receipt2.authorityRef) || receipt2.authorityCapability !== "brand.approve" || !isBrandHumanAuthorityConsumption(receipt2.authorityConsumption) || !safeTime2(receipt2.createdAt) || typeof receipt2.receiptDigest !== "string" || !DIGEST2.test(receipt2.receiptDigest) || receipt2.paletteId !== void 0 && !boundedString2(receipt2.paletteId) || receipt2.resolutionNote !== void 0 && !boundedString2(receipt2.resolutionNote, 1e3)) return false;
     const reviewed = receipt2.reviewedProposal;
     const authority = receipt2.authorityConsumption;
-    if (reviewed.id !== receipt2.proposalId || reviewed.bookId !== receipt2.bookId || receipt2.approvedBy !== receipt2.appliedBy || authority.actorPrincipalId !== receipt2.approvedBy || authority.actionDigest !== receipt2.actionDigest || authority.consumptionIdempotencyKey !== receipt2.mutationKey || receipt2.authorityRef !== brandAuthorityRef(authority) || authority.consumedAt > receipt2.createdAt || receipt2.resolution === "rejected" && receipt2.paletteId !== void 0 || receipt2.resolution === "accepted" && reviewed.kind === "palette" && !receipt2.paletteId || reviewed.kind !== "palette" && receipt2.paletteId !== void 0) return false;
+    if (authority.capability !== "brand.proposal.resolve" || authority.effect !== "internal" || reviewed.id !== receipt2.proposalId || reviewed.bookId !== receipt2.bookId || receipt2.approvedBy !== receipt2.appliedBy || authority.actorPrincipalId !== receipt2.approvedBy || authority.actionDigest !== receipt2.actionDigest || authority.consumptionIdempotencyKey !== receipt2.mutationKey || receipt2.authorityRef !== brandAuthorityRef(authority) || authority.consumedAt > receipt2.createdAt || receipt2.resolution === "rejected" && receipt2.paletteId !== void 0 || receipt2.resolution === "accepted" && reviewed.kind === "palette" && !receipt2.paletteId || reviewed.kind !== "palette" && receipt2.paletteId !== void 0) return false;
     const { reviewDigest, ...unsignedReview } = reviewed;
     if (await brandJsonDigest(unsignedReview) !== reviewDigest) return false;
     const expectedAction = await brandJsonDigest({
@@ -2685,14 +2815,14 @@ async function uploadAsset(ctx, req, bookId) {
     "internal",
     book.id
   );
-  const record7 = await ctx.db.storage.upload(
+  const record9 = await ctx.db.storage.upload(
     path,
     file,
     contentType,
     { private: true }
   );
-  if (record7.path !== path) {
-    await ctx.db.storage.delete(record7.path);
+  if (record9.path !== path) {
+    await ctx.db.storage.delete(record9.path);
     throw new BrandConflictError(
       "private storage returned an unexpected asset path"
     );
@@ -2711,11 +2841,11 @@ async function uploadAsset(ctx, req, bookId) {
       id,
       bookId: book.id,
       kind,
-      path: record7.path,
-      storageObjectId: record7.id,
+      path: record9.path,
+      storageObjectId: record9.id,
       contentDigest: await contentDigest(file),
       contentType,
-      size: record7.size,
+      size: record9.size,
       uploadedBy: ctx.actor.id,
       uploadedAuthorityRef: authority.authorityRef,
       audience: book.memberIds,
@@ -2742,7 +2872,7 @@ async function uploadAsset(ctx, req, bookId) {
       asPrincipalKind: "human"
     });
   } catch (error) {
-    await ctx.db.storage.delete(record7.path);
+    await ctx.db.storage.delete(record9.path);
     throw error;
   }
   return json(await linkedAsset(ctx, book, id), 201);
@@ -3009,7 +3139,7 @@ async function handleDesignDigest(ctx, req, bookId, assetId) {
 }
 
 // src/routes/proposal-input.ts
-var SNAPSHOT_KEYS = [
+var SNAPSHOT_KEYS2 = [
   "audience",
   "bookId",
   "createdAt",
@@ -3023,7 +3153,7 @@ var SNAPSHOT_KEYS = [
   "reviewDigest",
   "status"
 ];
-var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 function parseProposalResolutionRequest(body, bookId, proposalId) {
   const allowed = /* @__PURE__ */ new Set([
     "mutationId",
@@ -3067,13 +3197,13 @@ function proposalReviewSnapshot(proposal) {
 function parseReviewedProposal(value, bookId, proposalId) {
   if (!isBoundedBrandJson(value, { maxDepth: 12, maxNodes: 1500, maxBytes: 32 * 1024 }))
     throw new BrandInputError('"reviewedProposal" is too deeply nested, complex, or large');
-  if (!record4(value)) throw new BrandInputError('"reviewedProposal" must be an object');
+  if (!record5(value)) throw new BrandInputError('"reviewedProposal" must be an object');
   const keys = Object.keys(value).sort();
-  if (keys.length !== SNAPSHOT_KEYS.length || !SNAPSHOT_KEYS.every((key, index) => key === keys[index])) throw new BrandInputError('"reviewedProposal" has an invalid shape');
+  if (keys.length !== SNAPSHOT_KEYS2.length || !SNAPSHOT_KEYS2.every((key, index) => key === keys[index])) throw new BrandInputError('"reviewedProposal" has an invalid shape');
   if (value.id !== proposalId || value.bookId !== bookId || value.status !== "open")
     throw new BrandInputError('"reviewedProposal" must identify this open proposal');
-  if (typeof value.kind !== "string" || !PROPOSAL_KINDS.includes(value.kind) || !record4(value.payload) || typeof value.rationale !== "string" || !Array.isArray(value.audience) || value.audience.length < 1 || value.audience.length > 100 || value.audience.some((id) => typeof id !== "string" || id.length < 1 || id.length > 200) || new Set(value.audience).size !== value.audience.length || typeof value.createdBy !== "string" || value.createdBy.length < 1 || value.createdBy.length > 200 || typeof value.createdAuthorityRef !== "string" || value.createdAuthorityRef.length < 1 || value.createdAuthorityRef.length > 200 || !Number.isSafeInteger(value.createdAt) || value.createdAt < 0 || typeof value.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.reviewDigest)) throw new BrandInputError('"reviewedProposal" has invalid fields');
-  if (!record4(value.provenance) || Object.keys(value.provenance).sort().join(",") !== "messageId,sourceAsset,sourceAssetId,taintLabels,turnId" || value.provenance.sourceAssetId !== null && (typeof value.provenance.sourceAssetId !== "string" || value.provenance.sourceAssetId.length < 1 || value.provenance.sourceAssetId.length > 200) || value.provenance.sourceAsset !== null && (!record4(value.provenance.sourceAsset) || Object.keys(value.provenance.sourceAsset).sort().join(",") !== "analysisDigest,analysisRevision,assetId,contentDigest,contentType,objectEtag,objectSize,pathDigest" || typeof value.provenance.sourceAsset.assetId !== "string" || value.provenance.sourceAsset.assetId.length < 1 || value.provenance.sourceAsset.assetId.length > 200 || typeof value.provenance.sourceAsset.objectEtag !== "string" || value.provenance.sourceAsset.objectEtag.length < 1 || value.provenance.sourceAsset.objectEtag.length > 200 || !Number.isSafeInteger(value.provenance.sourceAsset.objectSize) || value.provenance.sourceAsset.objectSize < 1 || typeof value.provenance.sourceAsset.pathDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.pathDigest) || value.provenance.sourceAsset.contentType !== null && (typeof value.provenance.sourceAsset.contentType !== "string" || value.provenance.sourceAsset.contentType.length < 1 || value.provenance.sourceAsset.contentType.length > 160) || typeof value.provenance.sourceAsset.contentDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.contentDigest) || value.provenance.sourceAsset.analysisRevision !== null && (!Number.isSafeInteger(value.provenance.sourceAsset.analysisRevision) || value.provenance.sourceAsset.analysisRevision < 0) || value.provenance.sourceAsset.analysisDigest !== null && (typeof value.provenance.sourceAsset.analysisDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(
+  if (typeof value.kind !== "string" || !PROPOSAL_KINDS.includes(value.kind) || !record5(value.payload) || typeof value.rationale !== "string" || !Array.isArray(value.audience) || value.audience.length < 1 || value.audience.length > 100 || value.audience.some((id) => typeof id !== "string" || id.length < 1 || id.length > 200) || new Set(value.audience).size !== value.audience.length || typeof value.createdBy !== "string" || value.createdBy.length < 1 || value.createdBy.length > 200 || typeof value.createdAuthorityRef !== "string" || value.createdAuthorityRef.length < 1 || value.createdAuthorityRef.length > 200 || !Number.isSafeInteger(value.createdAt) || value.createdAt < 0 || typeof value.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.reviewDigest)) throw new BrandInputError('"reviewedProposal" has invalid fields');
+  if (!record5(value.provenance) || Object.keys(value.provenance).sort().join(",") !== "messageId,sourceAsset,sourceAssetId,taintLabels,turnId" || value.provenance.sourceAssetId !== null && (typeof value.provenance.sourceAssetId !== "string" || value.provenance.sourceAssetId.length < 1 || value.provenance.sourceAssetId.length > 200) || value.provenance.sourceAsset !== null && (!record5(value.provenance.sourceAsset) || Object.keys(value.provenance.sourceAsset).sort().join(",") !== "analysisDigest,analysisRevision,assetId,contentDigest,contentType,objectEtag,objectSize,pathDigest" || typeof value.provenance.sourceAsset.assetId !== "string" || value.provenance.sourceAsset.assetId.length < 1 || value.provenance.sourceAsset.assetId.length > 200 || typeof value.provenance.sourceAsset.objectEtag !== "string" || value.provenance.sourceAsset.objectEtag.length < 1 || value.provenance.sourceAsset.objectEtag.length > 200 || !Number.isSafeInteger(value.provenance.sourceAsset.objectSize) || value.provenance.sourceAsset.objectSize < 1 || typeof value.provenance.sourceAsset.pathDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.pathDigest) || value.provenance.sourceAsset.contentType !== null && (typeof value.provenance.sourceAsset.contentType !== "string" || value.provenance.sourceAsset.contentType.length < 1 || value.provenance.sourceAsset.contentType.length > 160) || typeof value.provenance.sourceAsset.contentDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.provenance.sourceAsset.contentDigest) || value.provenance.sourceAsset.analysisRevision !== null && (!Number.isSafeInteger(value.provenance.sourceAsset.analysisRevision) || value.provenance.sourceAsset.analysisRevision < 0) || value.provenance.sourceAsset.analysisDigest !== null && (typeof value.provenance.sourceAsset.analysisDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(
     value.provenance.sourceAsset.analysisDigest
   )) || value.provenance.sourceAsset.assetId !== value.provenance.sourceAssetId) || value.provenance.sourceAssetId === null !== (value.provenance.sourceAsset === null) || value.provenance.messageId !== null && (typeof value.provenance.messageId !== "string" || value.provenance.messageId.length < 1 || value.provenance.messageId.length > 200) || value.provenance.turnId !== null && (typeof value.provenance.turnId !== "string" || value.provenance.turnId.length < 1 || value.provenance.turnId.length > 200) || !Array.isArray(value.provenance.taintLabels) || value.provenance.taintLabels.length > 16 || value.provenance.taintLabels.some((label) => typeof label !== "string" || label.length < 1 || label.length > 120) || new Set(value.provenance.taintLabels).size !== value.provenance.taintLabels.length) throw new BrandInputError('"reviewedProposal.provenance" is invalid');
   return value;
@@ -3150,11 +3280,11 @@ async function proposalDecisionOps(input) {
       input.approvedTypography?.approvalReceiptId,
       input.approvedTypography?.approvalActionDigest
     );
-    const bookOp = ops.find(
+    const bookOp2 = ops.find(
       (op) => op.t === "update" && op.ns === BRAND_NS.book && op.id === input.book.id
     );
-    if (!bookOp || bookOp.t !== "update") throw new Error("book activation op missing");
-    Object.assign(bookOp.attrs, {
+    if (!bookOp2 || bookOp2.t !== "update") throw new Error("book activation op missing");
+    Object.assign(bookOp2.attrs, {
       version: input.book.version + 1,
       activationRevision: input.book.activationRevision + 1,
       tokens
@@ -3206,13 +3336,13 @@ async function proposalDecisionOps(input) {
       }
     ];
     if (input.proposal.kind === "typography" && input.priorPalette) {
-      const bookOp = ops.find(
+      const bookOp2 = ops.find(
         (op) => op.t === "update" && op.ns === BRAND_NS.book && op.id === input.book.id
       );
-      if (bookOp?.t === "update") {
+      if (bookOp2?.t === "update") {
         if (!input.priorPalette.approvalReceiptId || !input.priorPalette.approvalActionDigest)
           throw new BrandInputError("active palette is missing approval provenance");
-        bookOp.attrs.tokens = await tokenSnapshot(
+        bookOp2.attrs.tokens = await tokenSnapshot(
           input.priorPalette.swatches,
           content,
           input,
@@ -3225,6 +3355,19 @@ async function proposalDecisionOps(input) {
       }
     }
   }
+  const bookOp = ops.find(
+    (candidate) => candidate.t === "update" && candidate.ns === BRAND_NS.book && candidate.id === input.book.id
+  );
+  if (!bookOp || bookOp.t !== "update") throw new Error("book approval op missing");
+  bookOp.attrs.status = "draft";
+  if (input.book.activationReceiptId || input.book.activationActionDigest) {
+    ops.push({
+      t: "retract",
+      ns: BRAND_NS.book,
+      id: input.book.id,
+      attrs: ["activationReceiptId", "activationActionDigest"]
+    });
+  }
   stampProposal(ops, input);
   return ops;
 }
@@ -3264,7 +3407,7 @@ async function consumeProposalAuthority(ctx, req, bookId, proposalId, actionDige
     consumptionIdempotencyKey: mutationKey
   });
   const resourceDigest = await brandJsonDigest({ bookId, proposalId });
-  if (!isBrandHumanAuthorityConsumption(authority) || authority.actorPrincipalId !== ctx.actor.id || authority.appId !== ctx.appId || authority.actionDigest !== actionDigest || authority.resourceDigest !== resourceDigest || authority.consumptionIdempotencyKey !== mutationKey) throw new BrandForbiddenError(
+  if (!isBrandHumanAuthorityConsumption(authority) || authority.capability !== "brand.proposal.resolve" || authority.projectCapability !== "brand.approve" || authority.effect !== "internal" || authority.actorPrincipalId !== ctx.actor.id || authority.appId !== ctx.appId || authority.actionDigest !== actionDigest || authority.resourceDigest !== resourceDigest || authority.consumptionIdempotencyKey !== mutationKey) throw new BrandForbiddenError(
     "a verified human-exact brand approval is required"
   );
   return authority;
@@ -3528,9 +3671,9 @@ async function proposalDecisionState(ctx, req, book, proposal, resolution, recei
 }
 
 // src/routes/proposals.ts
-var record5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var sameStrings2 = (left, right) => left.length === right.length && left.every((value, index) => value === right[index]);
-var guardFailure2 = (error) => record5(error) && error.code === "transact_guard_failed";
+var guardFailure2 = (error) => record6(error) && error.code === "transact_guard_failed";
 async function handleProposalResolution(ctx, req, bookId, proposalId) {
   if (req.method !== "POST") return methodNotAllowed();
   const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
@@ -3710,7 +3853,7 @@ async function handleProposalResolution(ctx, req, bookId, proposalId) {
 }
 
 // src/routes/tokens.ts
-var record6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var missing = (bookId) => {
   throw new BrandNotFoundError(`compiled tokens for brand book ${bookId}`);
 };
@@ -3730,7 +3873,7 @@ async function acceptedReceipt(db, bookId, receiptId, actionDigest) {
 }
 async function approvedCache(db, book) {
   const cache = book.tokens;
-  if (!cache || !record6(cache.light) || !record6(cache.dark) || !book.activePaletteId || cache.paletteId !== book.activePaletteId || !cache.paletteReceiptId || !cache.paletteActionDigest || !cache.sourceDigest) return missing(book.id);
+  if (!cache || !record7(cache.light) || !record7(cache.dark) || !book.activePaletteId || cache.paletteId !== book.activePaletteId || !cache.paletteReceiptId || !cache.paletteActionDigest || !cache.sourceDigest) return missing(book.id);
   const paletteResult = await db.query({
     [BRAND_NS.palette]: {
       $: { where: { id: cache.paletteId, bookId: book.id } },
@@ -4075,6 +4218,413 @@ async function handleBrandDiscussionReferences(ctx, req, url) {
   });
 }
 
+// src/promotion.ts
+import {
+  canonicalPromotionValue
+} from "@odla-ai/promotion";
+var BRAND_PROMOTION_ADAPTER = "@odla-ai/brand/v1";
+var provenance = (book, sourceIds, receiptDigests = []) => ({
+  adapter: BRAND_PROMOTION_ADAPTER,
+  sourceIds: [
+    ...sourceIds,
+    ...book.activationReceiptId ? [book.activationReceiptId] : []
+  ].sort(),
+  receiptDigests: [
+    ...receiptDigests,
+    ...book.activationActionDigest ? [book.activationActionDigest] : []
+  ].sort()
+});
+var exclusions = (book) => [
+  {
+    kind: "brand.runtime",
+    id: book.slug,
+    reason: "environment_local",
+    paths: [`${BRAND_NS.book}.ownerId`, `${BRAND_NS.book}.memberIds`, `${BRAND_NS.book}.channelId`, `${BRAND_NS.book}.*At`],
+    detail: "Ownership, roster, channel, and timestamps remain local to the target environment."
+  },
+  {
+    kind: "brand.drafts",
+    id: book.slug,
+    reason: "draft_state",
+    paths: [`${BRAND_NS.proposal}.*`, `${BRAND_NS.section}[status=draft]`],
+    detail: "Open proposals and unapproved sections are review state, not published brand content."
+  },
+  {
+    kind: "brand.assets",
+    id: book.slug,
+    reason: "provider_identity",
+    paths: [`${BRAND_NS.asset}.storageObjectId`, `${BRAND_NS.asset}.path`, `${BRAND_NS.asset}.*AuthorityRef`],
+    detail: "Stored files and provider object identities require a separate asset-transfer contract."
+  },
+  {
+    kind: "brand.authority",
+    id: book.slug,
+    reason: "authority_history",
+    paths: [
+      `${BRAND_NS.approvalReceipt}.*`,
+      `${BRAND_NS.activationReceipt}.*`,
+      `${BRAND_NS.palette}.audience`
+    ],
+    detail: "Authority rows stay immutable in their source environment; artifacts retain only receipt digests and ids."
+  }
+];
+function buildBrandPromotion(input) {
+  const { book } = input;
+  const revision = `brand:${book.slug}:${book.activationRevision}`;
+  const artifacts = [];
+  if (book.tokens) {
+    const {
+      compiledAt: _compiledAt,
+      paletteReceiptId,
+      paletteActionDigest,
+      typographyReceiptId,
+      typographyActionDigest,
+      sourceDigest,
+      ...stableTokens
+    } = book.tokens;
+    artifacts.push({
+      kind: "brand.tokens",
+      id: book.slug,
+      sourceRevision: revision,
+      provenance: provenance(
+        book,
+        [book.id, book.tokens.paletteId, paletteReceiptId, typographyReceiptId].filter((value) => Boolean(value)),
+        [sourceDigest, paletteActionDigest, typographyActionDigest].filter((value) => Boolean(value))
+      ),
+      content: canonicalPromotionValue({ bookSlug: book.slug, tokens: stableTokens })
+    });
+  }
+  for (const section of input.sections.filter((row) => row.bookId === book.id && row.status === "approved")) {
+    if (!section.approvalReceiptId || !section.approvalActionDigest) {
+      throw new TypeError(`approved brand section ${section.key} lacks approval provenance`);
+    }
+    artifacts.push({
+      kind: "brand.section",
+      id: `${book.slug}/${section.kind}`,
+      sourceRevision: revision,
+      provenance: provenance(book, [book.id, section.id, section.approvalReceiptId], [section.approvalActionDigest]),
+      content: canonicalPromotionValue({ bookSlug: book.slug, kind: section.kind, content: section.content })
+    });
+  }
+  const activePalette2 = input.palettes.find((row) => row.bookId === book.id && row.id === book.activePaletteId && row.status === "active");
+  if (book.activePaletteId && !activePalette2) throw new TypeError(`active palette ${book.activePaletteId} is unavailable`);
+  if (activePalette2) {
+    artifacts.push({
+      kind: "brand.palette",
+      id: `${book.slug}/${activePalette2.id}`,
+      sourceRevision: revision,
+      provenance: provenance(book, [book.id, activePalette2.id, activePalette2.proposalId, activePalette2.approvalReceiptId], [activePalette2.approvalActionDigest]),
+      content: canonicalPromotionValue({
+        bookSlug: book.slug,
+        name: activePalette2.name,
+        swatches: activePalette2.swatches,
+        source: activePalette2.source,
+        ...activePalette2.seedHex ? { seedHex: activePalette2.seedHex } : {},
+        ...activePalette2.rationale ? { rationale: activePalette2.rationale } : {}
+      })
+    });
+  }
+  return {
+    adapter: BRAND_PROMOTION_ADAPTER,
+    artifacts,
+    exclusions: exclusions(book),
+    preconditions: [{
+      code: "brand.schema",
+      path: "services.brand.schemaVersion",
+      expected: 1,
+      detail: "The target must expose the Brand v1 approved-content schema."
+    }]
+  };
+}
+function exportBrandPromotionCandidate(input) {
+  if (input.book.status !== "draft")
+    throw new TypeError(`brand book ${input.book.slug} is not draft`);
+  return buildBrandPromotion({
+    ...input,
+    book: { ...input.book, status: "active" }
+  });
+}
+function exportBrandPromotion(input) {
+  const { book } = input;
+  if (book.status !== "active") throw new TypeError(`brand book ${book.slug} is not active`);
+  if (!book.activationReceiptId || !book.activationActionDigest)
+    throw new TypeError(`active brand book ${book.slug} lacks activation provenance`);
+  return buildBrandPromotion(input);
+}
+
+// src/routes/activation-state.ts
+async function activationReceiptByMutation(ctx, mutationKey) {
+  const result = await ctx.db.query({
+    [BRAND_NS.activationReceipt]: {
+      $: { where: { mutationKey } },
+      book: {}
+    }
+  });
+  const row = (result[BRAND_NS.activationReceipt] ?? [])[0];
+  if (!row || !hasExactOneLink(row.book, row.bookId)) return void 0;
+  const { book: _book, ...receipt2 } = row;
+  return activationReceiptAsWritten(receipt2);
+}
+async function approvalReceipt(ctx, bookId, receiptId) {
+  const result = await ctx.db.query({
+    [BRAND_NS.approvalReceipt]: {
+      $: { where: { id: receiptId, bookId } },
+      book: {}
+    }
+  });
+  const row = (result[BRAND_NS.approvalReceipt] ?? [])[0];
+  if (!row || !hasExactOneLink(row.book, bookId))
+    throw new BrandInputError(`approval receipt ${receiptId} is unavailable`);
+  const { book: _book, ...stored } = row;
+  const receipt2 = receiptAsWritten(stored);
+  if (!await verifyBrandApprovalReceipt(receipt2))
+    throw new BrandInputError(`approval receipt ${receiptId} is invalid`);
+  return receipt2;
+}
+async function activationState(ctx, book) {
+  if (book.status !== "draft")
+    throw new BrandConflictError(`brand book ${book.slug} is already ${book.status}`);
+  const tokens = book.tokens;
+  if (!book.activePaletteId || !tokens || tokens.paletteId !== book.activePaletteId || !tokens.paletteReceiptId || !tokens.paletteActionDigest || !tokens.typographyReceiptId || !tokens.typographyActionDigest) throw new BrandInputError(
+    "brand book activation requires approved palette and typography tokens"
+  );
+  const result = await ctx.db.query({
+    [BRAND_NS.section]: { $: { where: { bookId: book.id } }, book: {} },
+    [BRAND_NS.palette]: { $: { where: { bookId: book.id } }, book: {} }
+  });
+  const sections = (result[BRAND_NS.section] ?? []).map((row) => rowAsWritten(BRAND_NS.section, row));
+  const palettes = (result[BRAND_NS.palette] ?? []).map((row) => rowAsWritten(BRAND_NS.palette, row));
+  const activePalette2 = palettes.find((row) => row.id === book.activePaletteId && row.status === "active");
+  const typography = sections.find((row) => row.kind === "typography" && row.status === "approved");
+  if (!activePalette2 || activePalette2.approvalReceiptId !== tokens.paletteReceiptId || activePalette2.approvalActionDigest !== tokens.paletteActionDigest) throw new BrandInputError("active palette does not match compiled token provenance");
+  if (!typography || typography.approvalReceiptId !== tokens.typographyReceiptId || typography.approvalActionDigest !== tokens.typographyActionDigest) throw new BrandInputError("approved typography does not match compiled token provenance");
+  const [paletteReceipt, typographyReceipt] = await Promise.all([
+    approvalReceipt(ctx, book.id, tokens.paletteReceiptId),
+    approvalReceipt(ctx, book.id, tokens.typographyReceiptId)
+  ]);
+  if (paletteReceipt.resolution !== "accepted" || paletteReceipt.actionDigest !== tokens.paletteActionDigest || typographyReceipt.resolution !== "accepted" || typographyReceipt.actionDigest !== tokens.typographyActionDigest) throw new BrandInputError("compiled tokens are not backed by accepted approvals");
+  const candidateBook = { ...book, status: "draft" };
+  delete candidateBook.activationReceiptId;
+  delete candidateBook.activationActionDigest;
+  const promotion = exportBrandPromotionCandidate({ book: candidateBook, sections, palettes });
+  const approved = sections.filter((row) => row.status === "approved").sort((left, right) => left.key.localeCompare(right.key));
+  const reviewed = {
+    version: 1,
+    bookId: book.id,
+    slug: book.slug,
+    status: "draft",
+    bookVersion: book.version,
+    activationRevision: book.activationRevision,
+    activePaletteId: book.activePaletteId,
+    memberIdsDigest: await brandJsonDigest(book.memberIds),
+    tokensSourceDigest: tokens.sourceDigest,
+    paletteReceiptId: tokens.paletteReceiptId,
+    paletteActionDigest: tokens.paletteActionDigest,
+    typographyReceiptId: tokens.typographyReceiptId,
+    typographyActionDigest: tokens.typographyActionDigest,
+    approvedSectionKeys: approved.map((row) => row.key),
+    promotionDigest: await brandJsonDigest(promotion)
+  };
+  return {
+    reviewed,
+    sections,
+    palettes,
+    guards: [
+      {
+        ns: BRAND_NS.book,
+        id: book.id,
+        exists: true,
+        equals: {
+          version: book.version,
+          status: "draft",
+          activationRevision: book.activationRevision,
+          activePaletteId: book.activePaletteId,
+          memberIds: book.memberIds,
+          tokens: book.tokens
+        }
+      },
+      {
+        ns: BRAND_NS.palette,
+        id: activePalette2.id,
+        exists: true,
+        equals: {
+          status: "active",
+          approvalReceiptId: activePalette2.approvalReceiptId,
+          approvalActionDigest: activePalette2.approvalActionDigest,
+          swatches: activePalette2.swatches
+        }
+      },
+      ...approved.map((row) => ({
+        ns: BRAND_NS.section,
+        id: row.id,
+        exists: true,
+        equals: {
+          status: "approved",
+          content: row.content,
+          approvalReceiptId: row.approvalReceiptId,
+          approvalActionDigest: row.approvalActionDigest
+        }
+      })),
+      ...[paletteReceipt, typographyReceipt].map((row) => ({
+        ns: BRAND_NS.approvalReceipt,
+        id: row.id,
+        exists: true,
+        equals: { receiptDigest: row.receiptDigest }
+      }))
+    ]
+  };
+}
+
+// src/routes/activation.ts
+var record8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var guardFailure3 = (error) => record8(error) && error.code === "transact_guard_failed";
+async function activationMutationKey(bookId, mutationId) {
+  const digest2 = await brandJsonDigest({ version: 1, bookId, mutationId });
+  return `brand:book-activation:v1:${digest2.slice("sha256:".length)}`;
+}
+async function consumeActivationAuthority(ctx, req, bookId, actionDigest, mutationKey) {
+  const authority = await ctx.consumeHumanExact({
+    req,
+    actor: ctx.actor,
+    appId: ctx.appId,
+    capability: "brand.book.activate",
+    projectCapability: "brand.approve",
+    effect: "external",
+    resource: { bookId },
+    actionDigest,
+    consumptionIdempotencyKey: mutationKey
+  });
+  if (!authority || authority.capability !== "brand.book.activate" || authority.projectCapability !== "brand.approve" || authority.effect !== "external" || authority.actorKind !== "human" || authority.credentialKind !== "clerk" || authority.actorPrincipalId !== ctx.actor.id || authority.appId !== ctx.appId || authority.actionDigest !== actionDigest || authority.resourceDigest !== await brandJsonDigest({ bookId }) || authority.consumptionIdempotencyKey !== mutationKey) throw new BrandForbiddenError("a verified human-exact Brand activation is required");
+  return authority;
+}
+async function handleBookActivation(ctx, req, bookId) {
+  const book = await loadMemberBook(ctx.db, bookId, ctx.actor.id);
+  if (ctx.actor.kind !== "human")
+    throw new BrandForbiddenError("only a directly authenticated human can activate a brand book");
+  if (req.method === "GET") {
+    if (book.status === "active") return json({ status: "active", book });
+    const state2 = await activationState(ctx, book);
+    return json({ status: "draft", reviewedBook: state2.reviewed });
+  }
+  if (req.method !== "POST") return methodNotAllowed();
+  const body = await readJson(req);
+  if (!record8(body.reviewedBook))
+    throw new BrandInputError('"reviewedBook" is required');
+  const reviewed = body.reviewedBook;
+  const mutationId = capString(str(body, "mutationId"), "mutationId", 200);
+  const mutationKey = await activationMutationKey(bookId, mutationId);
+  const stable = (await brandJsonDigest({ mutationKey })).slice(7);
+  const receiptId = `brand-activation-${stable.slice(0, 32)}`;
+  const existing = await activationReceiptByMutation(ctx, mutationKey);
+  if (existing) {
+    if (!await verifyBrandActivationReceipt(existing) || canonicalBrandJson(existing.reviewedBook) !== canonicalBrandJson(reviewed)) throw new BrandConflictError("mutationId was used for another activation");
+    const replayed = await consumeActivationAuthority(
+      ctx,
+      req,
+      bookId,
+      existing.actionDigest,
+      mutationKey
+    );
+    if (canonicalBrandJson(replayed) !== canonicalBrandJson(existing.authorityConsumption))
+      throw new BrandConflictError("central activation receipt changed");
+    if (book.status !== "active" || book.activationReceiptId !== existing.id || book.activationActionDigest !== existing.actionDigest) throw new BrandConflictError("activated Brand revision is no longer current");
+    const result = await ctx.db.query({
+      [BRAND_NS.section]: { $: { where: { bookId } } },
+      [BRAND_NS.palette]: { $: { where: { bookId } } }
+    });
+    const promotion2 = exportBrandPromotion({
+      book,
+      sections: result[BRAND_NS.section] ?? [],
+      palettes: result[BRAND_NS.palette] ?? []
+    });
+    return json({ receipt: existing, promotion: promotion2, promotionDigest: await brandJsonDigest(promotion2), duplicate: true });
+  }
+  const state = await activationState(ctx, book);
+  if (canonicalBrandJson(state.reviewed) !== canonicalBrandJson(reviewed))
+    throw new BrandConflictError("brand book changed since activation review");
+  const actionDigest = await brandJsonDigest({
+    version: 1,
+    reviewedBook: state.reviewed,
+    intendedStatus: "active",
+    activationReceiptId: receiptId
+  });
+  const authority = await consumeActivationAuthority(
+    ctx,
+    req,
+    bookId,
+    actionDigest,
+    mutationKey
+  );
+  const receiptBase = {
+    version: 1,
+    id: receiptId,
+    mutationKey,
+    bookId,
+    reviewedBook: state.reviewed,
+    actionDigest,
+    approvedBy: ctx.actor.id,
+    approvedByKind: "human",
+    authorityRef: brandAuthorityRef(authority),
+    authorityCapability: "brand.approve",
+    authorityConsumption: authority,
+    createdAt: authority.consumedAt
+  };
+  const receipt2 = {
+    ...receiptBase,
+    receiptDigest: await brandJsonDigest(receiptBase)
+  };
+  try {
+    const tx = await ctx.db.transact([
+      {
+        t: "update",
+        ns: BRAND_NS.book,
+        id: bookId,
+        attrs: {
+          status: "active",
+          version: book.version + 1,
+          activationReceiptId: receipt2.id,
+          activationActionDigest: receipt2.actionDigest,
+          updatedAt: authority.consumedAt
+        }
+      },
+      { t: "update", ns: BRAND_NS.activationReceipt, id: receipt2.id, attrs: receipt2 },
+      { t: "link", ns: BRAND_NS.activationReceipt, id: receipt2.id, label: "book", target: bookId }
+    ], {
+      mutationId: mutationKey,
+      guards: [
+        ...state.guards,
+        { ns: BRAND_NS.activationReceipt, id: receipt2.id, exists: false }
+      ],
+      asUser: ctx.actor.id,
+      ...ctx.actor.email ? { asEmail: ctx.actor.email } : {},
+      asPrincipalKind: "human"
+    });
+    if (tx.duplicate) throw new BrandConflictError("activation replay was not observable");
+  } catch (error) {
+    if (guardFailure3(error)) throw new BrandReviewStateChangedError();
+    throw error;
+  }
+  const activeBook = {
+    ...book,
+    status: "active",
+    version: book.version + 1,
+    activationReceiptId: receipt2.id,
+    activationActionDigest: receipt2.actionDigest,
+    updatedAt: authority.consumedAt
+  };
+  const promotion = exportBrandPromotion({
+    book: activeBook,
+    sections: state.sections,
+    palettes: state.palettes
+  });
+  return json({
+    receipt: receipt2,
+    promotion,
+    promotionDigest: await brandJsonDigest(promotion),
+    duplicate: false
+  });
+}
+
 // src/routes/index.ts
 var tokensFile = (seg) => seg.length === 3 && seg[0] === "books" && (seg[2] === "tokens.css" || seg[2] === "tokens.json") ? seg[2] : null;
 async function route(ctx, req, url, seg) {
@@ -4085,6 +4635,7 @@ async function route(ctx, req, url, seg) {
   if (seg.length === 1) return handleBooksRoot(ctx, req);
   if (seg.length === 2) return handleBookItem(ctx, req, id);
   if (seg.length === 3 && sub === "members") return handleBookMembers(ctx, req, id);
+  if (seg.length === 3 && sub === "activate") return handleBookActivation(ctx, req, id);
   if (sub === "assets") {
     if (seg.length === 3) return handleAssetsRoot(ctx, req, id);
     if (seg.length === 4) return handleAssetItem(ctx, req, id, subId);
@@ -4344,7 +4895,7 @@ var brandIntegration = {
   agentProfile: BRAND_AGENT_PROFILE,
   provision: {
     human: [
-      "Configure direct Clerk human approval through authorizeCapability + consumeHumanExact; delegated, machine, and agent principals must not resolve proposals.",
+      "Configure direct Clerk human approval through authorizeCapability + consumeHumanExact; delegated, machine, and agent principals must not resolve proposals or activate books.",
       'Choose the trigger mode: one global mention-gated bot (brandBotTrigger({ mention: "@brand" }), no channels) or per-book channel-scoped bots (channels: [book.channelId], no mention).',
       "Pick a model where supportsBrandVision(catalog[model]) is true for in-conversation asset viewing; secure dispatch never falls back to signed or persistent asset URLs.",
       "Decide whether compiled tokens are public (publicTokens serves tokens.css/tokens.json unauthenticated)."
@@ -4358,9 +4909,10 @@ var brandIntegration = {
       "Provision private file signing and verifySourceAssetSnapshot; never expose an admin credential or persistent asset URL to the agent."
     ],
     doctor: [
-      "All six brand_* namespaces have rules installed; raw browser/agent writes are denied and child reads use current linked-book membership.",
+      "All seven brand_* namespaces have rules installed; raw browser/agent writes are denied and child reads use current linked-book membership.",
       "The agent runtime matches BRAND_AGENT_PROFILE: brand.read/edit only, semantic operations only, no raw brand_* or file access.",
       "Proposal decisions consume a direct-human exact brand.approve authority use and persist one guarded brand_approval_receipt.",
+      "Book activation consumes a direct-human exact external brand.approve authority use and persists one guarded brand_activation_receipt before promotion export opens.",
       "Private source assets are signed briefly and verifySourceAssetSnapshot revalidates path, ETag, size, content type, and digest before approval.",
       "brand_book.id/slug, brand_section.key, and the other mirrored id attrs are unique.",
       "Each registered trigger's agent id is present in its target books' memberIds rosters.",
@@ -4384,115 +4936,6 @@ function createBrandIntegration(options = {}) {
     probes: [{ path: `${basePath}/books`, expectedStatus: 401 }]
   };
 }
-
-// src/promotion.ts
-import {
-  canonicalPromotionValue
-} from "@odla-ai/promotion";
-var BRAND_PROMOTION_ADAPTER = "@odla-ai/brand/v1";
-var provenance = (sourceIds, receiptDigests = []) => ({
-  adapter: BRAND_PROMOTION_ADAPTER,
-  sourceIds: [...sourceIds].sort(),
-  receiptDigests: [...receiptDigests].sort()
-});
-var exclusions = (book) => [
-  {
-    kind: "brand.runtime",
-    id: book.slug,
-    reason: "environment_local",
-    paths: [`${BRAND_NS.book}.ownerId`, `${BRAND_NS.book}.memberIds`, `${BRAND_NS.book}.channelId`, `${BRAND_NS.book}.*At`],
-    detail: "Ownership, roster, channel, and timestamps remain local to the target environment."
-  },
-  {
-    kind: "brand.drafts",
-    id: book.slug,
-    reason: "draft_state",
-    paths: [`${BRAND_NS.proposal}.*`, `${BRAND_NS.section}[status=draft]`],
-    detail: "Open proposals and unapproved sections are review state, not published brand content."
-  },
-  {
-    kind: "brand.assets",
-    id: book.slug,
-    reason: "provider_identity",
-    paths: [`${BRAND_NS.asset}.storageObjectId`, `${BRAND_NS.asset}.path`, `${BRAND_NS.asset}.*AuthorityRef`],
-    detail: "Stored files and provider object identities require a separate asset-transfer contract."
-  },
-  {
-    kind: "brand.authority",
-    id: book.slug,
-    reason: "authority_history",
-    paths: [`${BRAND_NS.approvalReceipt}.*`, `${BRAND_NS.palette}.audience`],
-    detail: "Authority rows stay immutable in their source environment; artifacts retain only receipt digests and ids."
-  }
-];
-function exportBrandPromotion(input) {
-  const { book } = input;
-  if (book.status !== "active") throw new TypeError(`brand book ${book.slug} is not active`);
-  const revision = `brand:${book.slug}:${book.activationRevision}`;
-  const artifacts = [];
-  if (book.tokens) {
-    const {
-      compiledAt: _compiledAt,
-      paletteReceiptId,
-      paletteActionDigest,
-      typographyReceiptId,
-      typographyActionDigest,
-      sourceDigest,
-      ...stableTokens
-    } = book.tokens;
-    artifacts.push({
-      kind: "brand.tokens",
-      id: book.slug,
-      sourceRevision: revision,
-      provenance: provenance(
-        [book.id, book.tokens.paletteId, paletteReceiptId, typographyReceiptId].filter((value) => Boolean(value)),
-        [sourceDigest, paletteActionDigest, typographyActionDigest].filter((value) => Boolean(value))
-      ),
-      content: canonicalPromotionValue({ bookSlug: book.slug, tokens: stableTokens })
-    });
-  }
-  for (const section of input.sections.filter((row) => row.bookId === book.id && row.status === "approved")) {
-    if (!section.approvalReceiptId || !section.approvalActionDigest) {
-      throw new TypeError(`approved brand section ${section.key} lacks approval provenance`);
-    }
-    artifacts.push({
-      kind: "brand.section",
-      id: `${book.slug}/${section.kind}`,
-      sourceRevision: revision,
-      provenance: provenance([book.id, section.id, section.approvalReceiptId], [section.approvalActionDigest]),
-      content: canonicalPromotionValue({ bookSlug: book.slug, kind: section.kind, content: section.content })
-    });
-  }
-  const activePalette2 = input.palettes.find((row) => row.bookId === book.id && row.id === book.activePaletteId && row.status === "active");
-  if (book.activePaletteId && !activePalette2) throw new TypeError(`active palette ${book.activePaletteId} is unavailable`);
-  if (activePalette2) {
-    artifacts.push({
-      kind: "brand.palette",
-      id: `${book.slug}/${activePalette2.id}`,
-      sourceRevision: revision,
-      provenance: provenance([book.id, activePalette2.id, activePalette2.proposalId, activePalette2.approvalReceiptId], [activePalette2.approvalActionDigest]),
-      content: canonicalPromotionValue({
-        bookSlug: book.slug,
-        name: activePalette2.name,
-        swatches: activePalette2.swatches,
-        source: activePalette2.source,
-        ...activePalette2.seedHex ? { seedHex: activePalette2.seedHex } : {},
-        ...activePalette2.rationale ? { rationale: activePalette2.rationale } : {}
-      })
-    });
-  }
-  return {
-    adapter: BRAND_PROMOTION_ADAPTER,
-    artifacts,
-    exclusions: exclusions(book),
-    preconditions: [{
-      code: "brand.schema",
-      path: "services.brand.schemaVersion",
-      expected: 1,
-      detail: "The target must expose the Brand v1 approved-content schema."
-    }]
-  };
-}
 export {
   ASSET_CONTENT_TYPES,
   ASSET_KINDS,
@@ -4545,6 +4988,7 @@ export {
   SECTION_STATUSES,
   SWATCH_ROLES,
   acceptProposalOps,
+  activationReceiptAsWritten,
   adjustLightnessUntil,
   analogous,
   assertAnalysis,
@@ -4661,6 +5105,7 @@ export {
   triadic,
   updateBookOps,
   upsertSectionOps,
+  verifyBrandActivationReceipt,
   verifyBrandApprovalReceipt
 };
 //# sourceMappingURL=index.js.map