@marver-design/marver 0.10.2 → 0.11.0

package/dist/auth-KQ9Aj-nB.mjs

@@ -1,245 +0,0 @@
-import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-//#region src/server/auth.ts
-/**
-* Accounts, invites, sessions - the minimal credible implementation,
-* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
-* opaque session tokens stored hashed, single-use invite links as the identity
-* bootstrap (no email infrastructure anywhere).
-*
-* Password = read, account = comment: everything here concerns accounts only; the
-* shared gate password (serve.ts) remains the outer READ boundary.
-*
-* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
-* users change rarely; the event-log treatment is reserved for comments.
-*/
-const SCRYPT = {
-	N: 2 ** 15,
-	r: 8,
-	p: 1,
-	keylen: 32,
-	maxmem: 67108864
-};
-const INVITE_TTL = 6048e5;
-const SESSION_TTL = 2592e6;
-const normEmail = (e) => e.trim().toLowerCase();
-const sha256 = (s) => createHash("sha256").update(s).digest("hex");
-const token = () => randomBytes(32).toString("base64url");
-const storeFile = (dir) => join(dir, "auth.json");
-/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
-*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
-*  a later save overwrite every account. */
-function loadStore(dir) {
-	let raw;
-	try {
-		raw = readFileSync(storeFile(dir), "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return {
-			users: [],
-			invites: [],
-			sessions: []
-		};
-		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
-	}
-	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
-	return parsed;
-}
-/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
-*  0600 throughout: the store holds emails and password verifiers. */
-function saveStore(dir, store) {
-	const file = storeFile(dir);
-	mkdirSync(dirname(file), { recursive: true });
-	const now = Date.now();
-	store.invites = store.invites.filter((i) => i.exp > now);
-	store.sessions = store.sessions.filter((s) => s.exp > now);
-	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
-	const fd = openSync(tmp, "wx", 384);
-	try {
-		writeSync(fd, JSON.stringify(store, null, 2));
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
-	}
-	renameSync(tmp, file);
-}
-/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
-*  the store mutations are already synchronous and atomic; this covers deploy overlap
-*  and any accidental multi-instance run (the supported setup is single-instance) -
-*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
-*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
-*  fails loudly rather than hanging. */
-function withLock(dir, fn) {
-	mkdirSync(dir, { recursive: true });
-	const lock = join(dir, ".auth.lock");
-	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	const deadline = Date.now() + 5e3;
-	for (;;) try {
-		closeSync(openSync(lock, "wx"));
-		break;
-	} catch (e) {
-		if (e.code !== "EEXIST") throw e;
-		try {
-			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
-				unlinkSync(lock);
-				continue;
-			}
-		} catch {
-			continue;
-		}
-		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
-		nap(25);
-	}
-	try {
-		return fn();
-	} finally {
-		try {
-			unlinkSync(lock);
-		} catch {}
-	}
-}
-const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
-/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
-*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
-*  token is returned exactly once; only its hash is stored. */
-/** The owner's display name - public-safe (never the email). Null before claim. */
-function ownerName(dir) {
-	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
-}
-/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
-*  token is the proof - holding it means the owner sent it to you. */
-function inviteInfo(dir, rawToken) {
-	const hash = sha256(rawToken);
-	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-	return invite ? { email: invite.emailNorm } : null;
-}
-function createInvite(dir, email) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
-		const raw = token();
-		const exp = Date.now() + INVITE_TTL;
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		store.invites.push({
-			emailNorm: normEmail(email),
-			tokenHash: sha256(raw),
-			exp
-		});
-		saveStore(dir, store);
-		return {
-			token: raw,
-			exp
-		};
-	});
-}
-/** Claim an invite: burns it, creates the account, opens the first session. */
-function claimInvite(dir, rawToken, profile) {
-	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
-	if (!profile.name.trim()) throw new Error("a display name is required");
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
-		store.invites = store.invites.filter((i) => i !== invite);
-		const salt = randomBytes(16).toString("hex");
-		const user = {
-			email: invite.emailNorm,
-			name: profile.name.trim(),
-			avatar: profile.avatar,
-			role: store.users.length ? "member" : "owner",
-			salt,
-			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
-			params: SCRYPT,
-			createdAt: Date.now()
-		};
-		store.users.push(user);
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-/** Password sign-in. One generic failure - never reveal whether the email exists. */
-function signIn(dir, email, password) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = findUser(store, email);
-		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
-		const params = user?.params ?? SCRYPT;
-		const got = scryptSync(password, salt, params.keylen, params);
-		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
-		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-function pushSession(store, user) {
-	const raw = token();
-	store.sessions.push({
-		tokenHash: sha256(raw),
-		emailNorm: normEmail(user.email),
-		exp: Date.now() + SESSION_TTL
-	});
-	return raw;
-}
-/** Resolve a session token to its user; null when unknown or expired. */
-function sessionUser(dir, rawToken) {
-	const store = loadStore(dir);
-	const hash = sha256(rawToken);
-	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
-	return s ? store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null : null;
-}
-function signOut(dir, rawToken) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
-		saveStore(dir, store);
-	});
-}
-/** Update name/avatar on an existing account. */
-function updateProfile(dir, email, patch) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = findUser(store, email);
-		if (!user) throw new Error("no such account");
-		if (patch.name?.trim()) user.name = patch.name.trim();
-		if (patch.avatar !== void 0) user.avatar = patch.avatar || void 0;
-		saveStore(dir, store);
-		return user;
-	});
-}
-/** Remove an account and all its sessions (owner action). The LAST owner cannot be
-*  removed - a store with members but no owner has no one left to administer it,
-*  and bootstrap will not re-run while any user exists. */
-function revokeUser(dir, email) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
-		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
-		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		saveStore(dir, store);
-	});
-}
-/** The public shape of a user - what other viewers (and events) may see. */
-const publicUser = (u) => ({
-	email: u.email,
-	name: u.name,
-	avatar: u.avatar
-});
-//#endregion
-export { claimInvite, createInvite, inviteInfo, loadStore, normEmail, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile };

package/dist/events-BMtBvvgU.mjs

@@ -1,101 +0,0 @@
-//#region src/shared/events.ts
-/** Events the other side lacks, by id - the sync payload in either direction. */
-function diffEvents(mine, theirIds) {
-	const have = new Set(theirIds);
-	return mine.filter((e) => !have.has(e.id));
-}
-/** Replay a board's events into current thread state. Deterministic: replay order is
-*  (ts, id) so two stores holding the same event SET always derive the same state.
-*  TWO passes - creates first, then everything else - so a reply whose author's clock
-*  ran ahead of the creator's still lands instead of being dropped forever. */
-function replay(events) {
-	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
-	const threads = /* @__PURE__ */ new Map();
-	for (const ev of ordered) {
-		if (ev.type !== "create") continue;
-		if (!ev.commentId || threads.has(ev.commentId)) continue;
-		threads.set(ev.commentId, {
-			id: ev.commentId,
-			board: ev.board,
-			nodeKey: ev.nodeKey,
-			frame: ev.frame,
-			anchor: ev.anchor,
-			author: ev.author,
-			body: ev.body,
-			ts: ev.ts,
-			resolved: false,
-			agent: ev.agent,
-			agentMeta: ev.agentMeta,
-			replies: [],
-			reactions: {}
-		});
-	}
-	for (const ev of ordered) switch (ev.type) {
-		case "reply": {
-			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
-			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
-			t.replies.push({
-				id: ev.commentId,
-				author: ev.author,
-				body: ev.body,
-				ts: ev.ts,
-				agent: ev.agent,
-				agentMeta: ev.agentMeta
-			});
-			break;
-		}
-		case "edit": {
-			if (!ev.commentId || ev.body === void 0) break;
-			const t = threads.get(ev.commentId);
-			if (t) {
-				t.body = ev.body;
-				break;
-			}
-			for (const th of threads.values()) {
-				const r = th.replies.find((r) => r.id === ev.commentId);
-				if (r) {
-					r.body = ev.body;
-					break;
-				}
-			}
-			break;
-		}
-		case "resolve": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = true;
-				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
-			}
-			break;
-		}
-		case "reopen": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = false;
-				t.addressedIn = void 0;
-			}
-			break;
-		}
-		case "reanchor": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t && ev.anchor != null) t.anchor = ev.anchor;
-			break;
-		}
-		case "react": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			const who = ev.author?.email;
-			if (!t || !who || !ev.emoji) break;
-			const users = t.reactions[ev.emoji] ??= [];
-			const at = users.indexOf(who);
-			if (at === -1) users.push(who);
-			else {
-				users.splice(at, 1);
-				if (!users.length) delete t.reactions[ev.emoji];
-			}
-			break;
-		}
-	}
-	return [...threads.values()];
-}
-//#endregion
-export { replay as n, diffEvents as t };

package/dist/sync-BJKKmy1n.mjs

@@ -1,150 +0,0 @@
-import { t as diffEvents } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-//#region src/server/sync.ts
-/**
-* Dev ↔ published comment sync - one merge rule, run from the dev side.
-*
-* The published serve is the canonical home; the repo's design/comments/ is the
-* mirror the agent reads. Each exchange is: pull remote events → union into local
-* files; push the local events the remote lacks (chunked - the server unions too).
-* Idempotent and retry-safe by construction, so a dropped exchange costs nothing.
-*
-* Credentials: design/.local/collab.json {url, token} written by `comments connect`.
-* The token is a server session held by the DEV PROCESS only - pages never see it.
-*/
-const collabFile = (root) => join(root, "design", ".local", "collab.json");
-function loadCollab(root) {
-	try {
-		const c = JSON.parse(readFileSync(collabFile(root), "utf8"));
-		return typeof c?.url === "string" && typeof c?.token === "string" ? c : null;
-	} catch {
-		return null;
-	}
-}
-function saveCollab(root, collab) {
-	mkdirSync(join(root, "design", ".local"), { recursive: true });
-	writeFileSync(collabFile(root), JSON.stringify(collab, null, 2) + "\n", { mode: 384 });
-}
-/** One full exchange. Returns per-board counts, or throws on auth/network failure. */
-async function syncOnce(root, collab) {
-	const dir = join(root, "design", "comments");
-	const auth = { authorization: `Bearer ${collab.token}` };
-	const base = collab.url.replace(/\/+$/, "");
-	const bres = await fetch(`${base}/__mv/api/boards`, { headers: auth });
-	if (bres.status === 401) throw new Error("the connect token was rejected - run `comments connect` again");
-	if (!bres.ok) throw new Error(`published canvas answered ${bres.status} - is it up?`);
-	const { rights } = await bres.json();
-	const boards = [.../* @__PURE__ */ new Set([...Object.keys(rights), ...listBoards(dir)])];
-	const out = {};
-	const failures = [];
-	for (const board of boards) {
-		if (!(board in rights)) continue;
-		const res = await fetch(`${base}/__mv/api/comments/${board}`, { headers: auth });
-		if (!res.ok) {
-			failures.push(`${board}: pull ${res.status}`);
-			continue;
-		}
-		const { events: remote } = await res.json();
-		const pulled = appendEvents(dir, board, remote).length;
-		let pushed = 0;
-		if (rights[board] === "comment") {
-			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id)).filter((e) => !e.agent);
-			for (let i = 0; i < missing.length; i += 100) {
-				const r = await fetch(`${base}/__mv/api/comments/${board}`, {
-					method: "POST",
-					headers: {
-						...auth,
-						"content-type": "application/json"
-					},
-					body: JSON.stringify({ events: missing.slice(i, i + 100) })
-				});
-				if (r.ok) pushed += (await r.json()).accepted ?? 0;
-				else failures.push(`${board}: push ${r.status} ${(await r.json().catch(() => null))?.error ?? ""}`.trim());
-			}
-		}
-		out[board] = {
-			pulled,
-			pushed
-		};
-	}
-	if (failures.length) throw new Error(`sync incomplete - ${failures.join(" · ")}`);
-	return out;
-}
-/** The account endpoints live BEHIND the canvas gate (the outer READ boundary), so
-*  connecting passes the gate first when a canvas password is set. */
-async function gateCookie(base, canvasPassword) {
-	if (!canvasPassword) return "";
-	const cookie = (await fetch(`${base}/__mv/auth`, {
-		method: "POST",
-		redirect: "manual",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body: `password=${encodeURIComponent(canvasPassword)}&next=`
-	})).headers.getSetCookie?.().find((c) => c.startsWith("mv_a=")) ?? "";
-	const tok = /^mv_a=([^;]+)/.exec(cookie)?.[1];
-	if (!tok) throw new Error("the canvas password was not accepted");
-	return `mv_a=${tok}`;
-}
-async function sessionFrom(res, ctx) {
-	if (!res.ok) {
-		const err = (await res.json().catch(() => null))?.error;
-		throw new Error(err ?? `${ctx} failed (${res.status})`);
-	}
-	const cookie = res.headers.getSetCookie?.().find((c) => c.startsWith("mv_s=")) ?? "";
-	const token = /^mv_s=([\w-]+)/.exec(cookie)?.[1];
-	if (!token) throw new Error("the canvas did not issue a session - is collaboration enabled on it (MARVER_DATA_DIR)?");
-	return token;
-}
-/** Sign in against a published canvas and persist the device credential. The account's
-*  identity rides along: locally-born events carry it as their author snapshot (the
-*  server validates the claim against the session - it never rewrites events). */
-async function connect(root, url, email, password, canvasPassword) {
-	const base = url.replace(/\/+$/, "");
-	const gate = await gateCookie(base, canvasPassword);
-	const res = await fetch(`${base}/__mv/api/auth/signin`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			...gate ? { cookie: gate } : {}
-		},
-		body: JSON.stringify({
-			email,
-			password
-		})
-	});
-	const token = await sessionFrom(res, "sign-in");
-	const user = (await res.clone().json().catch(() => null))?.user;
-	saveCollab(root, {
-		url: base,
-		token,
-		email: user?.email ?? email,
-		name: user?.name
-	});
-}
-/** Claim an invite from the CLI (the dev-first path - no published UI needed). */
-async function connectClaim(root, url, invite, profile, canvasPassword) {
-	const base = url.replace(/\/+$/, "");
-	const gate = await gateCookie(base, canvasPassword);
-	const res = await fetch(`${base}/__mv/api/auth/claim`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			...gate ? { cookie: gate } : {}
-		},
-		body: JSON.stringify({
-			token: invite,
-			...profile
-		})
-	});
-	const token = await sessionFrom(res, "claim");
-	const user = (await res.clone().json().catch(() => null))?.user;
-	saveCollab(root, {
-		url: base,
-		token,
-		email: user?.email,
-		name: user?.name ?? profile.name
-	});
-}
-//#endregion
-export { connect, connectClaim, loadCollab, syncOnce };

package/dist/{shot-D7I0MCLu.mjs → shot-Cyv3GN79.mjs}

@@ -1,8 +1,8 @@
 import { i as ROUTE } from "./cli.mjs";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
+import { spawn } from "node:child_process";
 //#region src/server/shot.ts
 /**
 * Frame screenshots without a dependency - the system's own Chrome, driven over CDP