@marver-design/marver 0.10.2 → 0.11.0

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DwV0_d9G.mjs");
+	const { init } = await import("./init-BSclDg4I.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-D2PG6igI.mjs");
+	const { dev } = await import("./dev-CLBjRs0J.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-zUf_kwKp.mjs");
+	const { buildSite } = await import("./build-Cr_ZLMdq.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-CZqPnj19.mjs");
+	const { serve } = await import("./serve-CZ1KEQxd.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -74,8 +74,8 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	}
 	serve(resolve(opts.root), port);
 });
-cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-J06jqCVV.mjs");
+cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--token <token>", "connect: the canvas's MARVER_CLI_TOKEN (default $MARVER_CLI_TOKEN) - the identity-mode path").option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
+	const { commentsCommand } = await import("./comments-CRqaO2MH.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {

package/dist/{collab-s3k5byM1.mjs → collab-C-n-uQdm.mjs}

@@ -1,8 +1,33 @@
-import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
-import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-KQ9Aj-nB.mjs";
+import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
+import { a as claimInvite, c as issueDeviceSession, d as publicUser, f as revokeUser, g as updateProfile, h as signOut, l as ownerName, m as signIn, o as createInvite, p as sessionUser, s as inviteInfo } from "./auth-B5yuwnOq.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
+//#region src/server/secure-cookie.ts
+/**
+* Is this deployment https, for the purpose of setting `Secure` on a cookie?
+*
+* The obvious answer - read `X-Forwarded-Proto` - is wrong in exactly the case
+* that matters, and it is the same trap that made `MARVER_PUBLIC_ORIGIN`
+* mandatory for identity mode: nginx's own documented `proxy_pass
+* http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas served over
+* https behind that config sees no header, decides "not secure", and issues a
+* thirty-day session cookie the browser will happily send over plain http.
+*
+* So the pinned origin wins whenever it is set. It is a deliberate statement by
+* whoever deployed the canvas, rather than a guess about a proxy that may not be
+* speaking. The header remains the fallback for a canvas with no pinned origin,
+* where a guess is all there is - and http on loopback is the ordinary
+* development case, where `Secure` would break the cookie entirely.
+*/
+function isSecureDeployment(req) {
+	const pinned = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim();
+	if (pinned) return pinned.toLowerCase().startsWith("https://");
+	return req.headers["x-forwarded-proto"] === "https";
+}
+/** `; Secure`, or nothing - the suffix a Set-Cookie line wants. */
+const secureSuffix = (req) => isSecureDeployment(req) ? "; Secure" : "";
+//#endregion
 //#region src/server/collab.ts
 const MONTH = 2592e3;
 const MAX_BODY = 262144;
@@ -146,8 +171,11 @@ function collabHandler(dataDir, distDir) {
 		return hit;
 	};
 	const cookie = (req, name) => new RegExp(`(?:^|;\\s*)${name}=([\\w-]+)`).exec(String(req.headers.cookie ?? ""))?.[1];
+	/** browser session cookie, or a bearer token (the dev proxy / agent CLI path -
+	*  same session store, held server-side by the Vite process, never by a page) */
+	const sessionToken = (req) => /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? cookie(req, "mv_s") ?? null;
 	const currentUser = (req) => {
-		const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? cookie(req, "mv_s");
+		const tok = sessionToken(req);
 		return tok ? sessionUser(dataDir, tok) : null;
 	};
 	const json = (res, code, body) => {
@@ -159,23 +187,36 @@ function collabHandler(dataDir, distDir) {
 	const readBody = (req) => new Promise((resolve, reject) => {
 		if (!/^application\/json\b/.test(String(req.headers["content-type"] ?? ""))) return reject(/* @__PURE__ */ new Error("content-type must be application/json"));
 		let body = "";
+		let done = false;
+		const settle = (fn) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const timer = setTimeout(() => settle(() => {
+			req.destroy();
+			reject(/* @__PURE__ */ new Error("body timed out"));
+		}), 1e4);
+		if (typeof timer.unref === "function") timer.unref();
 		req.on("data", (c) => {
 			body += c;
-			if (body.length > MAX_BODY) {
-				reject(/* @__PURE__ */ new Error("body too large"));
+			if (body.length > MAX_BODY) settle(() => {
 				req.destroy();
-			}
+				reject(/* @__PURE__ */ new Error("body too large"));
+			});
 		});
-		req.on("end", () => {
+		req.on("end", () => settle(() => {
 			try {
 				resolve(body ? JSON.parse(body) : {});
 			} catch {
 				reject(/* @__PURE__ */ new Error("bad json"));
 			}
-		});
+		}));
+		req.on("error", () => settle(() => reject(/* @__PURE__ */ new Error("request failed"))));
 	});
 	const setSession = (req, res, token) => {
-		const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
+		const secure = secureSuffix(req);
 		res.setHeader("set-cookie", [`mv_s=${token}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`, `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${MONTH}; SameSite=Lax${secure}`]);
 	};
 	const csrfOk = (req) => !!/^Bearer /.test(String(req.headers.authorization ?? "")) || !cookie(req, "mv_s") || !!cookie(req, "mv_c") && req.headers["x-mv-c"] === cookie(req, "mv_c");
@@ -235,7 +276,7 @@ function collabHandler(dataDir, distDir) {
 				return false;
 			}
 			if (req.method !== "POST") return false;
-			if (path !== "auth/claim" && path !== "auth/signin" && !csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
+			if (!(path === "auth/claim" || path === "auth/signin") && !csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
 			if (path === "auth/claim") {
 				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
 				const b = await readBody(req);
@@ -272,12 +313,27 @@ function collabHandler(dataDir, distDir) {
 				});
 				return json(res, 200, { user: publicUser(next) }), true;
 			}
+			if (path === "cli-session") {
+				const bearer = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const issued = issueDeviceSession(dataDir, bearer);
+				if (!issued) return json(res, 401, { error: "MARVER_CLI_TOKEN was refused, or nobody owns this canvas yet" }), true;
+				return json(res, 200, {
+					token: issued.token,
+					exp: issued.exp,
+					user: publicUser(issued.user)
+				}), true;
+			}
 			if (path === "invite") {
 				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
 				const b = await readBody(req);
 				const email = String(b.email ?? "");
 				if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return json(res, 400, { error: "a valid email is required" }), true;
-				return json(res, 200, createInvite(dataDir, email)), true;
+				const idMode = !!process.env.MARVER_ID_ISSUER;
+				return json(res, 200, {
+					...createInvite(dataDir, email),
+					idMode
+				}), true;
 			}
 			if (path === "revoke") {
 				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;

package/dist/{comments-J06jqCVV.mjs → comments-CRqaO2MH.mjs}

@@ -1,8 +1,7 @@
 import { n as NAME } from "./cli.mjs";
-import { n as replay } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
-import { connect, connectClaim, loadCollab, syncOnce } from "./sync-BJKKmy1n.mjs";
-import { n as localProfile } from "./profile-BkiWglVE.mjs";
+import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, s as replay, t as connect } from "./sync-DELGomPk.mjs";
+import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
+import { n as localProfile } from "./profile-DcsJyppw.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
@@ -10,8 +9,11 @@ import { randomUUID } from "node:crypto";
 /**
 * `marver comments <action>` - the collaboration CLI.
 *
-* connect <url>   sign in (or --invite <token> to claim) against a published canvas;
-*                 stores the device credential in design/.local/collab.json
+* connect <url>   sign in against a published canvas and store the device credential
+*                 in ~/.marver/canvases/ (outside the repo - `dev` serves the repo).
+*                 Three ways in: --token <t>, the
+*                 canvas's MARVER_CLI_TOKEN (the only one an identity-mode canvas
+*                 has), --invite <t> to claim an invite, or email + password.
 * sync            one full exchange with the publish target (agent/CI path)
 * list            threads from design/comments/ (--open, --board, --json)
 * reply <thread>  append a reply (--body) - the agent's voice in the loop
@@ -53,6 +55,13 @@ async function commentsCommand(root, action, value, opts) {
 	switch (action) {
 		case "connect": {
 			if (!value) throw new Error("usage: comments connect <published-url>");
+			const cliToken = opts.token ?? process.env.MARVER_CLI_TOKEN;
+			if (cliToken) {
+				await connectToken(root, value, String(cliToken));
+				console.log(`[${NAME}] connected - the device credential is in ~/.marver/canvases/, outside this repo`);
+				console.log(`[${NAME}] \`${NAME} dev\` now syncs comments every 30s; \`${NAME} comments sync\` does one exchange`);
+				return;
+			}
 			const canvasPassword = opts.canvasPassword ?? process.env.MARVER_PASSWORD ?? await ask("canvas password (blank if the canvas is ungated): ", true);
 			if (opts.invite) {
 				const name = opts.name ?? await ask("display name: ");
@@ -66,7 +75,7 @@ async function commentsCommand(root, action, value, opts) {
 				const password = opts.password ?? await ask("password: ", true);
 				await connect(root, value, email, password, canvasPassword || void 0);
 			}
-			console.log(`[${NAME}] connected - design/.local/collab.json holds the device credential (gitignored)`);
+			console.log(`[${NAME}] connected - the device credential is in ~/.marver/canvases/, outside this repo`);
 			console.log(`[${NAME}] \`${NAME} dev\` now syncs comments every 30s; \`${NAME} comments sync\` does one exchange`);
 			return;
 		}
@@ -123,12 +132,18 @@ async function commentsCommand(root, action, value, opts) {
 		}
 		case "invite": {
 			if (!value || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) throw new Error("usage: comments invite <email>");
-			const { token } = await ownerApi(root, "invite", { email: value });
+			const { token, idMode } = await ownerApi(root, "invite", { email: value });
 			const url = loadCollab(root).url.replace(/\/+$/, "");
 			console.log(`  invite for ${value} (single-use, 7 days):`);
-			console.log(`    ${url}/#/i/${token}`);
-			console.log(`  send them that link (plus the canvas password) - it opens straight into`);
-			console.log(`  "pick your name and password".`);
+			if (idMode) {
+				console.log(`    ${url}`);
+				console.log(`  send them that address - they sign in with ${value} and they are in.`);
+				console.log(`  no link to forward, no password: the invitation IS the email address.`);
+			} else {
+				console.log(`    ${url}/#/i/${token}`);
+				console.log(`  send them that link (plus the canvas password) - it opens straight into`);
+				console.log(`  "pick your name and password".`);
+			}
 			return;
 		}
 		case "revoke":

package/dist/{comments-BZBKhKRO.mjs → comments-DZyobpxG.mjs}

@@ -1,4 +1,4 @@
-import "./events-BMtBvvgU.mjs";
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, writeSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/comments.ts
@@ -11,6 +11,12 @@ import { join } from "node:path";
 * state is derived by replaying events (ordered by ts then id, last writer wins per
 * field). Files, not a database - tens to low hundreds of events per board.
 */
+var comments_exports = /* @__PURE__ */ __exportAll({
+	appendEvents: () => appendEvents,
+	dataDir: () => dataDir,
+	listBoards: () => listBoards,
+	readLog: () => readLog
+});
 const BOARD_RE = /^[a-z0-9][a-z0-9-]*$/;
 const boardFile = (dir, board) => {
 	if (!BOARD_RE.test(board)) throw new Error(`bad board name: ${board}`);
@@ -81,4 +87,4 @@ function dataDir() {
 	return dir;
 }
 //#endregion
-export { appendEvents, dataDir, listBoards, readLog };
+export { readLog as i, comments_exports as n, listBoards as r, appendEvents as t };

package/dist/{manifest-DIsp3ldB.mjs → config-t9coJ-Pq.mjs}

@@ -1,8 +1,6 @@
-import { r as PKG, t as CONTENT_WIDTH } from "./cli.mjs";
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { delimiter, isAbsolute, join, relative, sep } from "node:path";
+import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
 //#region src/server/detect.ts
 function readJson(file) {
 	try {
@@ -368,232 +366,4 @@ function validViewports(v) {
 	return Object.keys(out).length ? out : null;
 }
 //#endregion
-//#region src/server/manifest.ts
-const FRAME_EXT = /\.(tsx|jsx|html)$/;
-const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
-/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
-function extractMeta(src) {
-	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
-	if (!m) return {};
-	const body = m[1];
-	const pick = (key) => {
-		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
-		return r ? r[2] : void 0;
-	};
-	const out = {};
-	const title = pick("title");
-	if (title) out.title = title;
-	const viewport = pick("viewport");
-	if (viewport) out.viewport = viewport;
-	const theme = pick("theme");
-	if (theme) out.theme = theme;
-	const of = pick("of");
-	if (of) out.of = of;
-	const variant = pick("variant");
-	if (variant) out.variant = variant;
-	const intent = pick("intent");
-	if (intent) out.intent = intent;
-	return out;
-}
-/** Content-frame detection: LEXICAL by convention - the frame file
-*  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
-*  string in a UI frame can never misbadge it; barrels/re-exports are not
-*  detected - meta.intent is the taught path and always works). Returns the
-*  inferred intent + natural width, or null for UI frames. */
-const CONTENT_IMPORT = new RegExp(`from\\s+['"]${PKG}/content['"]`);
-const WIDE_DOC = /<Doc\b[^>]*\blayout\s*=\s*["']wide["']/;
-const contentWidthOf = (src) => WIDE_DOC.test(src) ? CONTENT_WIDTH.wide : CONTENT_WIDTH.document;
-function contentScan(src) {
-	if (!CONTENT_IMPORT.test(src)) return null;
-	const count = (re) => (src.match(re) ?? []).length;
-	const diagrams = count(/<Diagram[\s>/]/g);
-	const imgs = count(/<Img[\s>/]/g);
-	const mds = count(/<Md[\s>/]/g);
-	return {
-		intent: diagrams > 0 ? "diagram" : imgs > mds ? "moodboard" : "spec",
-		width: contentWidthOf(src)
-	};
-}
-/** id = path relative to design/, extension dropped, `scenes/` prefix dropped. Always `/`-separated. */
-function toFrameId(designRelPath) {
-	const noExt = designRelPath.split(sep).join("/").replace(FRAME_EXT, "");
-	return noExt.startsWith("scenes/") ? noExt.slice(7) : noExt;
-}
-/**
-* A7: which frames does a changed `design/**` file affect? Manifest + directory conventions,
-* NOT a module-graph walk (deterministic, cheap, may over-reload but never misses a
-* conventionally-affected frame). Returns:
-*   null  -> uncontrolled: leave to default Vite HMR (src/** deps, theme.css, config, assets)
-*   []    -> controlled but affects no current frame (e.g. a layout in an empty dir)
-*   [ids] -> controlled: the shell drives a rev-stamped reload of these frames
-*/
-function affectedFrameIds(absFile, root, manifest) {
-	const design = join(root, "design");
-	if (absFile !== design && !absFile.startsWith(design + sep)) return null;
-	const rel = relative(design, absFile).split(sep).join("/");
-	const name = rel.split("/").pop() ?? rel;
-	const designRel = `design/${rel}`;
-	const tsxFrames = manifest.frames.filter((f) => f.kind === "tsx");
-	if (name === "theme.css") return null;
-	if (rel === "providers.tsx" || rel === "providers.jsx") return tsxFrames.map((f) => f.id);
-	if (/(^|\/)(_layout\.(tsx|jsx)|_fixtures\.(ts|tsx|js|jsx|json))$/.test(rel)) {
-		const prefix = `design/${rel.slice(0, rel.length - name.length)}`;
-		return tsxFrames.filter((f) => f.file.startsWith(prefix)).map((f) => f.id);
-	}
-	const direct = manifest.frames.find((f) => f.file === designRel);
-	if (direct) return [direct.id];
-	return null;
-}
-function walk(dir, out = []) {
-	if (!existsSync(dir)) return out;
-	for (const e of readdirSync(dir, { withFileTypes: true })) {
-		if (e.name.startsWith(".")) continue;
-		const p = join(dir, e.name);
-		if (e.isDirectory()) walk(p, out);
-		else out.push(p);
-	}
-	return out;
-}
-function scanFrames(root) {
-	const design = join(root, "design");
-	const frames = [];
-	for (const base of ["scenes", "components"]) for (const abs of walk(join(design, base))) {
-		const name = abs.split(sep).pop();
-		if (name.startsWith("_") || !FRAME_EXT.test(name)) continue;
-		const rel = relative(design, abs).split(sep).join("/");
-		const id = toFrameId(rel);
-		const scene = id.includes("/") ? id.split("/")[0] : "";
-		if (base === "scenes" && RESERVED_SCENES.has(scene)) {
-			console.error(`[marver] scene "${scene}" is a reserved name - "${rel}" skipped. Rename the scene.`);
-			continue;
-		}
-		const kind = name.endsWith(".html") ? "html" : "tsx";
-		const entry = {
-			id,
-			file: `design/${rel}`,
-			kind,
-			scene
-		};
-		if (kind === "tsx") {
-			const src = readFileSync(abs, "utf8");
-			const meta = extractMeta(src);
-			if (meta.title) entry.title = meta.title;
-			if (meta.viewport) entry.viewport = meta.viewport;
-			if (meta.theme) entry.theme = meta.theme;
-			if (meta.of) entry.variantGroup = meta.of;
-			if (meta.variant) entry.variant = meta.variant;
-			const content = contentScan(src);
-			if (content || meta.intent) {
-				entry.intent = meta.intent ?? content.intent;
-				entry.contentWidth = content?.width ?? contentWidthOf(src);
-			}
-		}
-		frames.push(entry);
-	}
-	const extRank = (file) => file.endsWith(".tsx") ? 0 : file.endsWith(".jsx") ? 1 : 2;
-	frames.sort((a, b) => a.id.localeCompare(b.id) || extRank(a.file) - extRank(b.file) || a.file.localeCompare(b.file));
-	const seen = /* @__PURE__ */ new Map();
-	const deduped = frames.filter((f) => {
-		const prev = seen.get(f.id);
-		if (prev) {
-			console.error(`[marver] duplicate frame id "${f.id}" (${prev} vs ${f.file}) - keeping ${prev}.`);
-			return false;
-		}
-		seen.set(f.id, f.file);
-		return true;
-	});
-	frames.length = 0;
-	frames.push(...deduped);
-	inferVariantGroups(frames);
-	const sceneCounts = /* @__PURE__ */ new Map();
-	for (const f of frames) sceneCounts.set(f.scene, (sceneCounts.get(f.scene) ?? 0) + 1);
-	return {
-		frames,
-		scenes: [...sceneCounts.entries()].map(([name, n]) => ({
-			name,
-			frames: n
-		})).sort((a, b) => a.name.localeCompare(b.name))
-	};
-}
-/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
-*  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
-*  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
-*  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).
-*  States (empty.tsx, error.tsx) never letter-prefix, so they never misgroup.
-*  Mutates entries in place: only frames whose group materializes keep the fields. */
-function inferVariantGroups(frames) {
-	const dirOf = (id) => {
-		const i = id.lastIndexOf("/");
-		return i >= 0 ? id.slice(0, i) : "";
-	};
-	const candidates = /* @__PURE__ */ new Map();
-	for (const f of frames) {
-		if (f.kind !== "tsx") {
-			delete f.variantGroup;
-			delete f.variant;
-			continue;
-		}
-		let group = f.variantGroup;
-		let key = f.variant;
-		if (!group) {
-			const base = f.id.slice(f.id.lastIndexOf("/") + 1);
-			const m = /^([a-z])-.+$/.exec(base);
-			if (!m) continue;
-			group = dirOf(f.id);
-			if (!group) continue;
-			key = key ?? m[1];
-		} else if (!key) {
-			const m = /^([a-z])-.+$/.exec(f.id.slice(f.id.lastIndexOf("/") + 1));
-			if (!m) {
-				console.warn(`[marver] ${f.file} declares of:"${group}" but no variant key (add meta.variant or a letter prefix) - not grouped.`);
-				delete f.variantGroup;
-				delete f.variant;
-				continue;
-			}
-			key = m[1];
-		}
-		f.variantGroup = group;
-		f.variant = key;
-		candidates.set(group, [...candidates.get(group) ?? [], f]);
-	}
-	for (const [group, members] of candidates) {
-		if (new Set(members.map((m) => dirOf(m.id))).size > 1) {
-			console.warn(`[marver] group "${group}" spans directories - variants must be siblings; not grouped.`);
-			for (const m of members) {
-				delete m.variantGroup;
-				delete m.variant;
-			}
-			continue;
-		}
-		const seen = /* @__PURE__ */ new Set();
-		const kept = [];
-		for (const m of members.sort((a, b) => (a.variant ?? "").localeCompare(b.variant ?? ""))) {
-			if (seen.has(m.variant)) {
-				console.warn(`[marver] duplicate variant "${m.variant}" in group "${group}" (${m.file}) - not grouped.`);
-				delete m.variantGroup;
-				delete m.variant;
-				continue;
-			}
-			seen.add(m.variant);
-			kept.push(m);
-		}
-		if (kept.length < 2) for (const m of kept) {
-			delete m.variantGroup;
-			delete m.variant;
-		}
-	}
-	for (const f of frames) if (f.variant && !f.variantGroup) delete f.variant;
-}
-/** Write design/manifest.json only when content changed. Returns the manifest either way. */
-function writeManifest(root, manifest) {
-	const file = join(root, "design", "manifest.json");
-	const next = JSON.stringify(manifest, null, 2) + "\n";
-	const prev = existsSync(file) ? readFileSync(file, "utf8") : "";
-	if (hash(prev) === hash(next)) return false;
-	mkdirSync(join(root, "design"), { recursive: true });
-	writeFileSync(file, next);
-	return true;
-}
-const hash = (s) => createHash("sha256").update(s).digest("hex");
-//#endregion
-export { writeManifest as a, detectAgent as c, toFrameId as i, detectHost as l, hash as n, DEFAULTS as o, scanFrames as r, loadConfig as s, affectedFrameIds as t, readJson as u };
+export { readJson as a, detectHost as i, loadConfig as n, detectAgent as r, DEFAULTS as t };

package/dist/{daemon-BpKBJZee.mjs → daemon-DSmaS453.mjs}

@@ -1,7 +1,7 @@
-import { n as replay } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
-import { n as localProfile } from "./profile-BkiWglVE.mjs";
-import { i as toFrameId } from "./manifest-DIsp3ldB.mjs";
+import { s as replay } from "./sync-DELGomPk.mjs";
+import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
+import { n as localProfile } from "./profile-DcsJyppw.mjs";
+import { i as toFrameId } from "./manifest-C2tzkNaC.mjs";
 import { workActivity } from "./work-CLrmY-vQ.mjs";
 import { r as deviceId, t as has } from "./ledger-Bu0BjqIe.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync, writeSync } from "node:fs";
@@ -938,6 +938,24 @@ const fenceGroup = (pid) => {
 		if (pid) process.kill(-pid, "SIGKILL");
 	} catch {}
 };
+/**
+* What a spawned agent is allowed to inherit.
+*
+* Agents get the environment because they need it - PATH, HOME, the API key
+* their own CLI signs in with. `MARVER_CLI_TOKEN` is the exception: it is the
+* operator's credential for the PUBLISHED canvas, it is accepted as a shell
+* fallback by `comments connect`, and an agent is the one process on this machine
+* that is running somebody else's instructions. Handing it over would let a
+* prompt-injected agent take the published canvas, which is a much larger blast
+* radius than the frames it was asked to edit.
+*
+* Exported so the removal is testable: a spawn option nobody asserts is a spawn
+* option that quietly grows back.
+*/
+function agentEnv(from = process.env) {
+	const { MARVER_CLI_TOKEN: _withheld, ...rest } = from;
+	return rest;
+}
 const FRAME_FILE = /\.(tsx|jsx|html)$/;
 /** Every frame FILE under design/scenes, as `frame id -> mtimeMs`. Used to see which frames the
 *  agent creates or edits mid-job (so the working glow can follow the work, not sit on the frame
@@ -987,7 +1005,7 @@ function createJam(root, cfg, adapter, log = () => {}, hooks = {}) {
 					"ignore"
 				],
 				env: {
-					...process.env,
+					...agentEnv(),
 					...env,
 					PWD: root
 				}