fix(templates): valid reading-list gallery covers + integrity guard

[eliotlim]

Problem

The Reading list template's Gallery view names a coverPropertyId, but its
seeded rows shipped no covers — so the gallery rendered as empty cover slots
(placeholder document icons), looking broken out of the box. A first pass seeded
inline PNG covers, but one of the three (COVER_TEAL, on "Thinking, Fast and
Slow" — the lead card of the To read shelf) was a corrupt PNG: its IDAT
zlib stream failed its Adler-32 check, so it rendered as colour-noise instead of a
book cover. The existing tests false-greened on it — a bare toBeVisible()
never decodes the image.

Notion epic: Epic: Templates that showcase OpenBook — interactive + slides (IA 2026-07) · closes TPL-7.

Solution

• Seed three valid inline PNG data-URI book covers (one per shelf: teal /
  orange / blue), regenerated with a reliable encoder (zlib.deflateSync IDAT +
  correct per-chunk CRC-32 + a valid Adler-32) and verified to decode before
  embedding. Consistent layout: colored fill + darker left spine + light title
  band + small author-label block.
• Broaden isImageUrl so a data:image/* cover renders straight into the
  gallery/thumbnail <img src> — display-only, no asset-store write, no upload
  allowlist change. Tightened to exclude the svg subtype
  (/^data:image\/(?!svg)/i), matching the code's own "PNG, never SVG" intent
  (Quinn's optional hardening).
• Add an image-integrity test guard so a cover can't silently rot again: each
  seeded cover is base64-decoded, its IDAT inflated, and checked for the exact
  raw-scanline byte count plus a recomputed Adler-32 match.
• No new deps (the integrity check reuses the existing fflate dependency).

The 50/50 coverage per shelf (one covered card + one placeholder) is intentional —
it keeps the placeholder/fallback path exercised and reads as a realistic library.

Before / After

Behaviour	Before	After
To read shelf — "Thinking, Fast and Slow" cover	empty cover slot (placeholder icon); the teal cover was a corrupt PNG rendering as colour-noise	a proper teal book cover (spine + title band)
Full shelf-grouped gallery	every card a placeholder slot	teal / orange / blue covers, one per shelf

Test procedure

• pnpm verify — green: sdk 171 + ui 968 + server 645 unit tests pass; MCP e2e 40 checks pass; typecheck + lint clean.
• Reading-list web e2e (templates.spec.ts) — green: covers render as <img> and the first cover asserts naturalWidth > 0 (a decode failure now reddens the suite).
• The new per-cover IDAT-integrity unit assertion passes: each seeded cover inflates to exactly height*(width*3+1) bytes with a matching Adler-32. (Fed the old corrupt teal it fails — 21,812 ≠ 28,920 decoded bytes + Adler mismatch — proving the guard bites.)
• Table view still lists 6 rows (row count unchanged).

Operational notes

• No migrations, no env changes. Covers are inline data: URIs, not
  asset-store objects — they seed identically on both transports (web PGlite +
  desktop IPC) with no upload call.
• The isImageUrl change is a display-only broadening of which URL strings
  render in an <img src>; a data: URL in an <img> executes no script, and
  the svg-subtype exclusion keeps it in step with the store's image allowlist —
  no new XSS/exfil surface (Quinn's security-lens verdict).
• Gates: code review ✓ Quinn (approved; this folds in his optional hardening),
  design review ✓ Devon (after the corrupt-cover fix).

---

pnpm verify green · gates: code ✓ Quinn · design ✓ Devon

🤖 Generated with Claude Code

https://claude.ai/code/session_01KFk2T9k3p7ghCjdzMfkA5w

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app.book.pub	Ready	Preview, Comment	Jul 12, 2026 4:20am