# Visual Identity Architecture > How v10r resolves a visitor's palette, typography and border-radius — and why there is deliberately **no** site-wide brand lock. An earlier design shipped an admin "visual identity" lock: a `brand_settings` singleton that overrode every visitor's style. It was removed. v10r's whole point is that the interface is not stiff, and a switch that pins all visitors to one palette contradicts that. What remains is per-visitor: a randomizer, a manual picker, and optional custom palettes. ## Decision Summary | Tension | Decision | Rationale | |---------|----------|-----------| | Site-wide brand vs per-visitor style | **Per-visitor only** | No lock, no singleton, no override. Every visitor owns their own look | | Where a visitor's choice lives | **`v10r_style` cookie**, mirrored to `app.user_preferences` for signed-in users | Non-httpOnly so the blocking script can apply it before first paint | | Build-time CSS vs runtime injection | **Neither — reuse the `data-palette` attribute cascade** | The CSS already lives in `app.css`; only the attribute value changes | | Random vs manual | **Both, side by side** | `POST /api/style/roll` rolls all three at once; `POST /api/style/pick` sets one dimension at a time | | Custom palette persistence | **Client-side for everyone, DB for signed-in users** | Crafting needs no account; saving does | | UI location | **`/showcases/shell/style`** | Public, and the showcase *is* the feature test | --- ## 1. Resolution cascade `loadStyle` in `src/hooks.server.ts` runs early in the handle chain — notably **before** `sessionPopulate`, so it structurally cannot know who the user is. It resolves in this order: 1. **`v10r_style` cookie** — `{pid, tid, rid, v:1}`, parsed by `parseStyleCookie`. 2. **Custom palette lookup** — only when `pid` starts with `CP_`. `getCustomPaletteById()` reads the row and stamps `locals.customPaletteColors`. 3. **Randomizer fallback** — no cookie, or one that no longer resolves → `generateRandomStyle()`, written back so the next visit is stable. The resolved style lands on `locals.style` and is stamped onto `` as `data-palette` / `data-typography` / `data-radius` via `transformPageChunk`. ### Why `getCustomPaletteById` has no ownership check Because it cannot. `loadStyle` runs before auth is populated, so at that point there is no user to compare against. A `CP_` id is therefore globally readable by anyone who puts it in their own cookie. This is accepted, and the mitigation is placed where it can actually work: **ownership is enforced at the write and pick boundaries**, never at render. See §3. The function is also TTL-cached (60s, 1000-entry cap, negative results included). The style cookie is read on *every* request before any auth or rate limit, so an uncached `CP_` path would let a forged cookie turn each request into a Neon round-trip. --- ## 2. Custom palettes `app.custom_palettes` — per-user rows, derived from a preset. ``` src/lib/server/db/schema/app/custom-palettes.ts ``` ```typescript export const customPalettes = appSchema.table('custom_palettes', { id: text('id').primaryKey(), // CP_{nanoid(12)} name: text('name').notNull(), description: text('description').notNull().default(''), basePaletteId: text('base_palette_id').notNull(), // P0-P7 source preset lightColors: jsonb('light_colors').notNull().$type>(), darkColors: jsonb('dark_colors').notNull().$type>(), accentOffset: integer('accent_offset').notNull().default(0), createdBy: text('created_by').notNull().references(() => user.id, { onDelete: 'cascade' }), createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(), updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(), }); ``` CRUD lives in `src/lib/server/branding/palette-crud.ts`. Every mutation carries an `AND created_by = :userId` predicate, so a mismatched id simply affects no rows and returns `null` — which is how the endpoints collapse "doesn't exist" and "isn't yours" into a single 404. `countCustomPalettes()` backs `MAX_CUSTOM_PALETTES_PER_USER`. Creation used to be admin-only and so carried no ceiling; open to every account it needs one. ### SSR-only CSS injection — the constraint that shapes the UI A custom palette has no rule in `app.css`. Its CSS is a `