@marver-design/marver 0.10.2 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,149 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.11.0 - 2026-08-27
+
+### Added
+
+- **Marver Sign In: a canvas can ask people who they are, instead of asking for a shared
+  password.** Set `MARVER_ID_ISSUER=https://id.marver.design` (plus `MARVER_PUBLIC_ORIGIN`
+  and `MARVER_DATA_DIR`) and the gate becomes an identity gate. People sign in once - with
+  Google, or a code emailed to them - and every canvas gated this way opens without another
+  password. Nobody types a canvas password, so there is none to leak, rotate, or forget, and
+  revoking one person revokes exactly them. This is the better default for a team, and the
+  one we run ourselves.
+
+  **Your guest list stays yours.** The identity service proves *who somebody is* and has no
+  say in *where they may go*: an address gets in if it already has an account on your canvas,
+  holds an unexpired invite, or is `MARVER_OWNER_EMAIL` on a canvas with no accounts yet.
+  That decision is made on your disk, and the identity service is never told the answer.
+  Somebody with a perfectly valid Marver account who is not on your list gets nothing.
+
+  **The sovereign path is unchanged and is not going anywhere.** `MARVER_PASSWORD` still
+  gates a canvas with accounts that live entirely in your `MARVER_DATA_DIR`, and a served
+  canvas with no `MARVER_ID_ISSUER` set makes no outbound request at all - nothing to depend
+  on, nothing to phone home to. (Stated precisely, because it is the kind of promise that
+  should be: `marver serve` is silent. `marver dev` still makes the one anonymous registry
+  request it always has, once a day, to notice a new version - `MARVER_NO_UPDATE_CHECK=1`
+  turns it off - and a workspace you have connected to a published canvas still syncs its
+  comments with that canvas.) The two are alternatives rather than layers: running both
+  would weaken your invite list to "an account OR whoever has the password", so the identity
+  gate replaces the password gate rather than sitting beside it.
+
+  How it works, for anyone who wants to check rather than trust: the canvas mints a
+  single-use nonce bound to the browser that started the sign-in, the tab visits the identity
+  service and comes back with a short-lived ES256 assertion in the URL fragment - the one
+  part of a link no server ever receives - and the canvas verifies it against published JWKS
+  before issuing its own ordinary session. The assertion's audience is the canvas's exact
+  origin, port included, so one minted for one canvas is inert at another. The verifying half
+  is dependency-free and lives in this repo (`src/server/marver-id.ts`), which is why
+  pointing a canvas at a different issuer is a configuration change rather than a fork.
+
+  `MARVER_PUBLIC_ORIGIN` is required and the canvas will not start without it, in
+  development too. The audience cannot be inferred safely: nginx's documented
+  `proxy_pass http://localhost:PORT` rewrites `Host` and adds no `X-Forwarded-*`, so a
+  request from the internet is indistinguishable from a local one - and a canvas that
+  guessed would hand its caller a `http://localhost` audience and a cookie with no Secure
+  flag.
+
+  Sign-in fails closed: if the identity service is unreachable, existing sessions keep
+  working and new ones are refused. Nothing falls back to open.
+
+  **Managing people from the repo needs `MARVER_CLI_TOKEN`.** `marver comments invite`,
+  `revoke` and `sync` authenticate the CLI with a password, and an identity account has none -
+  so set `MARVER_CLI_TOKEN` on the canvas to a *generated* secret of 32 characters or more
+  (`openssl rand -hex 24`) and pass the same value back:
+
+  ```
+  MARVER_CLI_TOKEN='<that same value>' marver comments connect https://canvas.example.com
+  ```
+
+  (`--token` works too, but a secret on the command line is visible to anything that can
+  list processes.)
+
+  It acts as whoever owns the canvas, so it does nothing until somebody has signed in and
+  claimed it. Generate it rather than choosing one: nothing rate-limits this credential and
+  nothing slows a guess down, so its entropy is the whole defence, and a length floor is the
+  only part of entropy a program can check. The canvas refuses to start on a value that is too
+  short, and on one containing characters an `Authorization` header cannot carry - hex rather
+  than base64, so that a canvas never boots holding a secret it would go on to reject.
+
+  `connect` trades that secret for an ordinary session and stores THAT in
+  `~/.marver/canvases/`, so neither the secret nor the session lands in your repo. **Rotate
+  `MARVER_CLI_TOKEN` to revoke it**: every session it minted stops working the moment the
+  variable changes, and sessions people hold in their browsers are untouched. That is the
+  lever rather than `comments revoke`, because the session acts as the owner and a canvas
+  refuses to remove its last owner.
+
+  It is an environment variable, and not a page that hands out tokens to whoever is signed in,
+  for a reason worth stating plainly: authored frames run same-origin in a canvas. That is
+  deliberate and documented, and it means frame JavaScript can read `mv_c` and ride the
+  viewer's session - so any browser-reachable way to mint a durable credential is a way for a
+  frame to mint one silently and carry it off, an owner's if an owner is the one looking. A
+  browser-approved device flow was built for exactly this job and pulled before release for
+  exactly that reason; requiring a real top-level navigation narrowed it and did not close it,
+  because `Sec-Fetch-Site: same-origin` proves where a request came from and never that a
+  person meant it. An environment variable is on the other side of that line: it is never
+  sent to a page, and reaching it already means reaching the deployment.
+
+  The cost is honest. It is a static secret that rotates by redeploying, and it acts as the
+  owner rather than as a person, so it is an operator's credential and belongs with your other
+  deployment secrets. Per-member CLI credentials still want the frame isolation this release
+  does not have.
+
+### Changed
+
+- **The gate refuses to be framed** - every gate response now carries
+  `Content-Security-Policy: frame-ancestors 'none'` and `X-Frame-Options: DENY`. A
+  credential form inside somebody else's page, under a transparent button, is the classic
+  clickjack, and `SameSite=Lax` does not help because a framed page on the same site still
+  carries its cookies. Called out because it is a behaviour change rather than an addition:
+  if you were embedding a password-gated canvas in an iframe, that stops working. Embedding
+  a canvas people have already signed into is unaffected - it is the gate itself that
+  refuses.
+
+### Fixed
+
+- **`Secure` on the session cookie no longer depends on a header your proxy may not send.**
+  A canvas decided whether it was on https by reading `X-Forwarded-Proto`, and nginx's own
+  documented `proxy_pass http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas
+  served over https behind that configuration saw no header, concluded "not secure", and
+  issued a thirty-day session cookie the browser would happily send over plain http. Where
+  `MARVER_PUBLIC_ORIGIN` is set it now decides - a deliberate statement by whoever deployed
+  the canvas, rather than a guess about a proxy that may not be speaking. The header remains
+  the fallback only where there is nothing better, which is development on loopback.
+
+- **The collaboration credential has moved out of your repository, because `marver dev` was
+  serving it.** It lived at `design/.local/collab.json`, and the dev server puts the repository
+  on the web so frames can import from it. Authored frames run same-origin, so any frame could
+  `fetch('/design/.local/collab.json')` and carry off a live session for your published canvas.
+
+  It now lives in `~/.marver/canvases/`, keyed by the project's path - one file per canvas per
+  machine, outside anything that is served. `connect` writes there, `dev` moves an older
+  credential out of the repo the first time it runs, and nothing needs doing by hand.
+
+  Guarding the old location was tried first and is the reason for the move: a deny rule matched
+  the path asked for rather than the file served, so a repository containing
+  `leak.json -> design/.local/collab.json` walked straight past it - and after that was fixed,
+  `public/` and Vite's derived `index.html` candidates each did the same. Enumerating a
+  bundler's resolution rules is not a thing anyone finishes. Those guards stayed as depth,
+  `design/.local` is still never served whatever route a request takes, and Vite's own default
+  deny list is no longer replaced by ours.
+
+  If you have ever run `marver dev` on a repository you did not write, treat that credential as
+  exposed: change `MARVER_CLI_TOKEN` on the canvas, which ends every session it minted, or on a
+  password-account canvas `marver comments revoke` and reconnect.
+
+- **A gated canvas is no longer publicly cacheable in identity mode.** The `Cache-Control`
+  decision keyed off the password verifier alone, so an identity-gated canvas marked its
+  assets `public, immutable` - an invitation for a shared CDN to serve somebody's private
+  frames to anybody who asked. Both modes are now `private, no-store`.
+
+- **A missing cosmetic file no longer falls through to the bundle.** Favicon and logo paths
+  are allowed past the gate on the promise that they are favicons and logos; when no such
+  file existed, the hash-routing fallback handed an unauthenticated caller `index.html`
+  instead. For those paths a miss is now a miss.
+
 ## 0.10.2 - 2026-08-24
 
 ### Fixed

package/dist/auth-B5yuwnOq.mjs

@@ -0,0 +1,494 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/server/auth.ts
+/**
+* Accounts, invites, sessions - the minimal credible implementation,
+* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
+* opaque session tokens stored hashed, single-use invite links as the identity
+* bootstrap (no email infrastructure anywhere).
+*
+* Password = read, account = comment: everything here concerns accounts only; the
+* shared gate password (serve.ts) remains the outer READ boundary.
+*
+* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
+* users change rarely; the event-log treatment is reserved for comments.
+*/
+var auth_exports = /* @__PURE__ */ __exportAll({
+	CLI_TOKEN_CHARS: () => CLI_TOKEN_CHARS,
+	MIN_CLI_TOKEN: () => 32,
+	attachAvatar: () => attachAvatar,
+	avatarSourceFor: () => avatarSourceFor,
+	claimInvite: () => claimInvite,
+	cliTokenProblem: () => cliTokenProblem,
+	createInvite: () => createInvite,
+	inviteInfo: () => inviteInfo,
+	issueDeviceSession: () => issueDeviceSession,
+	loadStore: () => loadStore,
+	normEmail: () => normEmail,
+	operatorUser: () => operatorUser,
+	ownerName: () => ownerName,
+	provisionFromMarverId: () => provisionFromMarverId,
+	publicUser: () => publicUser,
+	revokeUser: () => revokeUser,
+	sessionUser: () => sessionUser,
+	signIn: () => signIn,
+	signOut: () => signOut,
+	updateProfile: () => updateProfile
+});
+const SCRYPT = {
+	N: 2 ** 15,
+	r: 8,
+	p: 1,
+	keylen: 32,
+	maxmem: 67108864
+};
+const INVITE_TTL = 6048e5;
+const SESSION_TTL = 2592e6;
+const normEmail = (e) => e.trim().toLowerCase();
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+const token = () => randomBytes(32).toString("base64url");
+const storeFile = (dir) => join(dir, "auth.json");
+/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
+*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
+*  a later save overwrite every account. */
+function loadStore(dir) {
+	let raw;
+	try {
+		raw = readFileSync(storeFile(dir), "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			users: [],
+			invites: [],
+			sessions: []
+		};
+		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
+	}
+	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
+	return parsed;
+}
+/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
+*  0600 throughout: the store holds emails and password verifiers. */
+function saveStore(dir, store) {
+	const file = storeFile(dir);
+	mkdirSync(dirname(file), { recursive: true });
+	const now = Date.now();
+	store.invites = store.invites.filter((i) => i.exp > now);
+	store.sessions = store.sessions.filter((s) => s.exp > now);
+	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+	const fd = openSync(tmp, "wx", 384);
+	try {
+		writeSync(fd, JSON.stringify(store, null, 2));
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	renameSync(tmp, file);
+}
+/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
+*  the store mutations are already synchronous and atomic; this covers deploy overlap
+*  and any accidental multi-instance run (the supported setup is single-instance) -
+*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
+*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
+*  fails loudly rather than hanging. */
+function withLock(dir, fn) {
+	mkdirSync(dir, { recursive: true });
+	const lock = join(dir, ".auth.lock");
+	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	const deadline = Date.now() + 5e3;
+	for (;;) try {
+		closeSync(openSync(lock, "wx"));
+		break;
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		try {
+			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
+				unlinkSync(lock);
+				continue;
+			}
+		} catch {
+			continue;
+		}
+		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
+		nap(25);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			unlinkSync(lock);
+		} catch {}
+	}
+}
+const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
+/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
+*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
+*  token is returned exactly once; only its hash is stored. */
+/** The owner's display name - public-safe (never the email). Null before claim. */
+function ownerName(dir) {
+	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
+}
+/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
+*  token is the proof - holding it means the owner sent it to you. */
+function inviteInfo(dir, rawToken) {
+	const hash = sha256(rawToken);
+	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+	return invite ? { email: invite.emailNorm } : null;
+}
+function createInvite(dir, email) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
+		const raw = token();
+		const exp = Date.now() + INVITE_TTL;
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		store.invites.push({
+			emailNorm: normEmail(email),
+			tokenHash: sha256(raw),
+			exp
+		});
+		saveStore(dir, store);
+		return {
+			token: raw,
+			exp
+		};
+	});
+}
+/** Claim an invite: burns it, creates the account, opens the first session. */
+function claimInvite(dir, rawToken, profile) {
+	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
+	if (!profile.name.trim()) throw new Error("a display name is required");
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
+		if (findUser(store, invite.emailNorm)) {
+			store.invites = store.invites.filter((i) => i !== invite);
+			saveStore(dir, store);
+			throw new Error("an account already exists for this address - sign in instead");
+		}
+		store.invites = store.invites.filter((i) => i !== invite);
+		const salt = randomBytes(16).toString("hex");
+		const user = {
+			email: invite.emailNorm,
+			name: profile.name.trim(),
+			avatar: profile.avatar,
+			role: store.users.length ? "member" : "owner",
+			salt,
+			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
+			params: SCRYPT,
+			createdAt: Date.now()
+		};
+		store.users.push(user);
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+/** Password sign-in. One generic failure - never reveal whether the email exists. */
+function signIn(dir, email, password) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const found = findUser(store, email);
+		const user = found && found.auth !== "marver-id" && found.salt && found.hash ? found : null;
+		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
+		const params = user?.params ?? SCRYPT;
+		const got = scryptSync(password, salt, params.keylen, params);
+		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
+		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+/**
+* Turn a verified Marver ID identity into a local session.
+*
+* The identity service has already proved who this person is; this function
+* decides whether they may in - and that decision is LOCAL, which is the whole
+* shape of L1a. The identity service knows nothing about who is allowed where.
+*
+* `allowed` is the owner's allowlist. An email that is not on it gets no account
+* and no session: being able to prove you are someone is not the same as being
+* invited. The first allowed account to arrive owns the canvas, matching the
+* invite flow's rule.
+*
+* No password is fabricated. A marver-id account carries no salt or hash at all,
+* so there is no second, weaker door into it.
+*/
+function provisionFromMarverId(dir, identity, opts = {}) {
+	const emailNorm = normEmail(identity.email);
+	if (!emailNorm) return null;
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const qualified = `${identity.issuer}#${identity.subject}`;
+		const bound = store.users.find((u) => u.idSubject === qualified);
+		const existing = bound ?? findUser(store, emailNorm);
+		if (bound && normEmail(bound.email) !== emailNorm) {
+			const clash = findUser(store, emailNorm);
+			if (clash && clash !== bound) return null;
+			const vacated = normEmail(bound.email);
+			bound.email = emailNorm;
+			store.sessions = store.sessions.filter((s) => s.emailNorm !== vacated);
+		}
+		const invite = store.invites.find((i) => i.emailNorm === emailNorm && i.exp > Date.now());
+		const ownerNorm = opts.ownerEmail ? normEmail(opts.ownerEmail) : "";
+		const reservedForOwner = !!ownerNorm && !store.users.length && ownerNorm !== emailNorm;
+		const isBootstrapOwner = !!ownerNorm && !store.users.length && ownerNorm === emailNorm;
+		if (reservedForOwner) return null;
+		if (!existing && !invite && !isBootstrapOwner) return null;
+		if (invite) store.invites = store.invites.filter((i) => i !== invite);
+		let user = existing;
+		if (user) {
+			if (!user.idSubject) user.idSubject = qualified;
+			else if (user.idSubject === identity.subject) user.idSubject = qualified;
+			else if (user.idSubject !== qualified) return null;
+		} else {
+			user = {
+				email: emailNorm,
+				name: identity.name || emailNorm.split("@")[0] || emailNorm,
+				role: store.users.length ? "member" : "owner",
+				auth: "marver-id",
+				idSubject: `${identity.issuer}#${identity.subject}`,
+				createdAt: Date.now()
+			};
+			store.users.push(user);
+		}
+		if (identity.name && (!user.name || user.name === emailNorm.split("@")[0])) user.name = identity.name;
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+/**
+* Attach a picture the identity service supplied.
+*
+* Separate from provisioning because the fetch happens after admission and
+* outside the lock, so by the time there are bytes the account already exists.
+*
+* `avatarSource` is what makes this safe to repeat: its presence means "this
+* picture came from the identity service", and only such a picture may be
+* replaced. An avatar with no source was chosen HERE, by the person, and the
+* identity service does not get to overwrite it - which is the same rule the
+* name follows.
+*
+* Replacing a rotated one is the point. Refusing to, as an earlier version did,
+* meant the stored source never caught up with the assertion, so every single
+* sign-in fetched the new picture and then threw it away.
+*/
+function attachAvatar(dir, subjectQualified, avatar, source, expected) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = store.users.find((u) => u.idSubject === subjectQualified);
+		if (!user) return;
+		if (user.avatar && !user.avatarSource) return;
+		if (user.avatarSource !== expected) return;
+		user.avatar = avatar;
+		user.avatarSource = source;
+		saveStore(dir, store);
+	});
+}
+/**
+* Would a picture from the identity service actually be used?
+*
+* Read-only and outside the lock, so the gate can decide whether a network
+* fetch is worth making before it commits to one. Worst case it is wrong and we
+* fetch a picture that then gets discarded - which costs one request, versus
+* fetching an avatar on every single sign-in forever.
+*/
+function avatarSourceFor(dir, subjectQualified, email, pictureUrl) {
+	const store = loadStore(dir);
+	const user = store.users.find((u) => u.idSubject === subjectQualified) ?? findUser(store, normEmail(email));
+	if (!user) return {
+		wanted: true,
+		source: void 0
+	};
+	if (!user.avatar) return {
+		wanted: true,
+		source: user.avatarSource
+	};
+	if (!user.avatarSource) return {
+		wanted: false,
+		source: void 0
+	};
+	return {
+		wanted: user.avatarSource !== pictureUrl,
+		source: user.avatarSource
+	};
+}
+function pushSession(store, user) {
+	const raw = token();
+	store.sessions.push({
+		tokenHash: sha256(raw),
+		emailNorm: normEmail(user.email),
+		exp: Date.now() + SESSION_TTL
+	});
+	return raw;
+}
+function sessionUser(dir, rawToken) {
+	const store = loadStore(dir);
+	const hash = sha256(rawToken);
+	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
+	if (!s) return null;
+	if (s.via && s.via !== operatorFingerprint()) return null;
+	return store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null;
+}
+/** The alphabet a bearer token can actually travel in: both the gate and the API
+*  parse `Authorization` with `[\w-]+`, so a secret containing anything else is
+*  accepted at boot and then silently unusable. Checked HERE as well as at boot so
+*  the two can never drift apart. */
+const CLI_TOKEN_CHARS = /^[\w-]+$/;
+/**
+* The operator's own credential, read from the deployment environment.
+*
+* `comments connect` authenticates with a password, and an identity account has
+* none by design - so on an identity-gated canvas the whole CLI surface (invite,
+* revoke, and the comment sync the agent loop runs on) had no reachable
+* credential. This is the door, and where it lives is the entire point.
+*
+* The obvious alternative - a page that mints a token for whoever is signed in -
+* is the device flow this project already built and pulled (2d0850c). Authored
+* frames run same-origin in a canvas: frame JavaScript reads `mv_c`, every
+* request it makes carries the viewer's session, so any browser-reachable way to
+* mint a durable token is a way for a frame to mint one silently and carry it
+* off. There is no header that separates a frame from its own origin.
+*
+* An environment variable is on the other side of that line. It is never sent to
+* a page, no frame can read it, and reaching it already means reaching the
+* deployment - at which point the canvas was never the weakest thing in the room.
+* The cost is honest: it is a static secret that rotates by redeploying, and it
+* acts as the owner, so it is an operator credential rather than a person's.
+*/
+function operatorUser(dir, presented) {
+	return operatorMatch(presented) ? ownerOf(dir) : null;
+}
+/** The owner's account, or null on a canvas nobody has claimed yet. Chosen by
+*  stored ROLE, never by array order or by whatever MARVER_OWNER_EMAIL currently
+*  says - that variable only ever nominated a bootstrap account, and honouring it
+*  afterwards would let a changed environment repoint this at a different person. */
+const ownerOf = (dir) => loadStore(dir).users.find((u) => u.role === "owner") ?? null;
+/**
+* Why a configured `MARVER_CLI_TOKEN` is unusable, or null when it is fine.
+*
+* One function so that boot and the matcher can never disagree. They did: boot
+* trimmed the value before checking it while `comments connect` sent the shell's
+* value as-is, so `" abcd... "` started a canvas that then refused the operator's
+* own token with no explanation anywhere. Surrounding whitespace is now a refusal
+* rather than something quietly repaired on one side of the wire.
+*/
+function cliTokenProblem(raw) {
+	if (!raw) return null;
+	if (raw !== raw.trim()) return "MARVER_CLI_TOKEN has whitespace around it - quote it, or drop the quotes that put it there";
+	if (raw.length < 32) return `MARVER_CLI_TOKEN is too short to be a bearer credential (${raw.length} chars, needs 32)`;
+	if (!CLI_TOKEN_CHARS.test(raw)) return "MARVER_CLI_TOKEN contains characters that cannot travel in an Authorization header";
+	return null;
+}
+/** The configured secret, or '' when there is none worth honouring. Never trimmed
+*  into shape: a value that needed trimming was refused at boot. */
+const operatorSecret = () => {
+	const raw = process.env.MARVER_CLI_TOKEN ?? "";
+	return raw && !cliTokenProblem(raw) ? raw : "";
+};
+/** A fingerprint of the current secret, so a session can record WHICH one minted
+*  it. The hash, never the value: this is written to auth.json, and a store that
+*  quietly contains the operator's credential is the thing being avoided. */
+const operatorFingerprint = () => {
+	const secret = operatorSecret();
+	return secret ? sha256(`cli-generation:${secret}`) : "";
+};
+function operatorMatch(presented) {
+	const secret = operatorSecret();
+	if (!secret || !presented) return false;
+	return timingSafeEqual(Buffer.from(sha256(presented), "hex"), Buffer.from(sha256(secret), "hex"));
+}
+/**
+* Trade the operator's secret for an ordinary session, once, from the terminal.
+*
+* The secret itself must not become the thing a repo carries. `connect` persists
+* whatever it is given, and that file sits on a developer's disk for as long as
+* the project lasts - a non-expiring master key is the wrong shape for it. What comes back here expires, dies with
+* `comments revoke`, and can be replaced without touching the deployment.
+*
+* Only the operator secret opens this. Deliberately NOT any signed-in session:
+* authored frames run same-origin and ride the viewer's cookies, so a route that
+* minted sessions for whoever was signed in would be the pulled device flow
+* (2d0850c) with a different name. A frame cannot present this Bearer, because
+* the value it needs was never in the browser.
+*/
+function issueDeviceSession(dir, presented) {
+	if (!operatorMatch(presented)) return null;
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = store.users.find((u) => u.role === "owner");
+		if (!user) return null;
+		const token = pushSession(store, user);
+		store.sessions[store.sessions.length - 1].via = operatorFingerprint();
+		saveStore(dir, store);
+		return {
+			token,
+			exp: Date.now() + SESSION_TTL,
+			user
+		};
+	});
+}
+function signOut(dir, rawToken) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
+		saveStore(dir, store);
+	});
+}
+/** Update name/avatar on an existing account. */
+function updateProfile(dir, email, patch) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = findUser(store, email);
+		if (!user) throw new Error("no such account");
+		if (patch.name?.trim()) user.name = patch.name.trim();
+		if (patch.avatar !== void 0) {
+			user.avatar = patch.avatar || void 0;
+			user.avatarSource = void 0;
+		}
+		saveStore(dir, store);
+		return user;
+	});
+}
+/** Remove an account and all its sessions (owner action). The LAST owner cannot be
+*  removed - a store with members but no owner has no one left to administer it,
+*  and bootstrap will not re-run while any user exists. */
+function revokeUser(dir, email) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
+		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
+		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		saveStore(dir, store);
+	});
+}
+/** The public shape of a user - what other viewers (and events) may see. */
+const publicUser = (u) => ({
+	email: u.email,
+	name: u.name,
+	avatar: u.avatar
+});
+//#endregion
+export { claimInvite as a, issueDeviceSession as c, publicUser as d, revokeUser as f, updateProfile as g, signOut as h, avatarSourceFor as i, ownerName as l, signIn as m, attachAvatar as n, createInvite as o, sessionUser as p, auth_exports as r, inviteInfo as s, CLI_TOKEN_CHARS as t, provisionFromMarverId as u };

package/dist/{build-zUf_kwKp.mjs → build-Cr_ZLMdq.mjs}

@@ -1,6 +1,7 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-DIsp3ldB.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-C1sDewZ3.mjs";
+import { i as detectHost, n as loadConfig } from "./config-t9coJ-Pq.mjs";
+import { r as scanFrames } from "./manifest-C2tzkNaC.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-vE7sxEeT.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";