@marver-design/marver 0.10.2 → 0.11.1

package/dist/{plugin-C1sDewZ3.mjs → plugin-DjBFxEQ7.mjs}

@@ -1,10 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { n as localProfile, t as isConnected } from "./profile-BkiWglVE.mjs";
-import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-DIsp3ldB.mjs";
+import { n as localProfile, t as isConnected } from "./profile-DcsJyppw.mjs";
+import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-C2tzkNaC.mjs";
+import { n as installedVersion, t as checkUpdate } from "./update-DuWDj5nR.mjs";
 import { copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
+import { basename, join, resolve, sep } from "node:path";
 import { randomBytes } from "node:crypto";
 //#region src/server/api.ts
 const BOARD_NAME = /^[a-z0-9][a-z0-9-]*$/;
@@ -266,7 +265,7 @@ function apiMiddleware(root, opts = {}) {
 				const frameId = url.searchParams.get("frame") ?? "";
 				const theme = url.searchParams.get("theme") ?? "light";
 				const origin = opts.origin?.() ?? `http://${req.headers.host ?? "localhost"}`;
-				const { shootFrame } = await import("./shot-D7I0MCLu.mjs");
+				const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
 				const r = await shootFrame({
 					root,
 					viewports: opts.viewports ?? {},
@@ -306,7 +305,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-s3k5byM1.mjs");
+				const { validAvatar } = await import("./collab-CWaG3Q4w.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -353,7 +352,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 			}
 			if (path === "boards.rights" && req.method === "GET") {
-				const { listBoards } = await import("./comments-BZBKhKRO.mjs");
+				const { listBoards } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 				return json(res, 200, {
 					local: true,
 					stored: listBoards(join(root, "design", "comments"))
@@ -361,7 +360,7 @@ function apiMiddleware(root, opts = {}) {
 			}
 			const cm = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
 			if (cm) {
-				const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
+				const { appendEvents, readLog } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 				const dir = join(root, "design", "comments");
 				if (req.method === "GET") return json(res, 200, { events: readLog(dir, cm[1]) });
 				if (req.method === "POST") {
@@ -397,7 +396,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
+				const { loadCollab, syncOnce } = await import("./sync-DELGomPk.mjs").then((n) => n.o);
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -426,7 +425,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
+			const { loadCollab, syncOnce } = await import("./sync-DELGomPk.mjs").then((n) => n.o);
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -484,77 +483,6 @@ function routesMiddleware(server, clientDir) {
 	};
 }
 //#endregion
-//#region src/server/update.ts
-/**
-* Update discovery - dev only, and deliberately boring about privacy: one anonymous
-* registry metadata GET per day (the same request `npm view` makes), cached in
-* design/.local/, nothing sent beyond the request itself. Offline, slow, or
-* firewalled registries degrade to silence. MARVER_NO_UPDATE_CHECK=1 disables it.
-* Published bundles never check anything - viewers are not the owner.
-*/
-var update_exports = /* @__PURE__ */ __exportAll({
-	checkUpdate: () => checkUpdate,
-	installedVersion: () => installedVersion
-});
-const TTL = 864e5;
-/** Installed version: walk up from this module to the package's own package.json
-*  (one level from dist/, two from src/server/ - the walk covers both). */
-function installedVersion() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (let i = 0; i < 4; i++) {
-		try {
-			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-			if (pkg.name === "@marver-design/marver") return pkg.version;
-		} catch {}
-		dir = dirname(dir);
-	}
-	return null;
-}
-/** Strictly-newer numeric compare; anything non-numeric (prerelease tags) compares false. */
-const newer = (a, b) => {
-	const pa = a.split(".").map((n) => parseInt(n, 10));
-	const pb = b.split(".").map((n) => parseInt(n, 10));
-	for (let i = 0; i < 3; i++) {
-		const x = pa[i] ?? 0, y = pb[i] ?? 0;
-		if (!Number.isFinite(x) || !Number.isFinite(y)) return false;
-		if (x !== y) return x > y;
-	}
-	return false;
-};
-/** The latest published version when strictly newer than installed, else null. Never throws. */
-async function checkUpdate(root) {
-	if (process.env.MARVER_NO_UPDATE_CHECK) return null;
-	const current = installedVersion();
-	if (!current) return null;
-	const latest = await latestVersion(root);
-	return latest && newer(latest, current) ? latest : null;
-}
-async function latestVersion(root) {
-	const cacheFile = join(root, "design", ".local", "update-check.json");
-	const wellFormed = (v) => typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v);
-	try {
-		const c = JSON.parse(readFileSync(cacheFile, "utf8"));
-		const age = Date.now() - c.checkedAt;
-		if (typeof c.checkedAt === "number" && age >= 0 && age < TTL) return wellFormed(c.latest) ? c.latest : null;
-	} catch {}
-	let latest = null;
-	try {
-		const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`, { signal: AbortSignal.timeout(3e3) });
-		if (res.ok) {
-			const v = (await res.json())?.version;
-			if (wellFormed(v)) latest = v;
-		}
-	} catch {}
-	try {
-		mkdirSync(join(root, "design", ".local"), { recursive: true });
-		writeFileSync(cacheFile, JSON.stringify({
-			checkedAt: Date.now(),
-			latest
-		}) + "\n");
-	} catch {}
-	return latest;
-}
-//#endregion
 //#region src/server/plugin.ts
 const VIRTUAL_THEME = "virtual:sh-theme";
 const VIRTUAL_CONFIG = "virtual:sh-config";
@@ -798,7 +726,7 @@ function marverPlugin(ctx) {
 								});
 								return;
 							}
-							const { shootFrame } = await import("./shot-D7I0MCLu.mjs");
+							const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
 							write(await shootFrame({
 								root,
 								viewports: config.viewports,
@@ -878,4 +806,4 @@ async function tailwind3Css(root) {
 	return null;
 }
 //#endregion
-export { update_exports as i, tailwind3Css as n, tailwind4Plugin as r, marverPlugin as t };
+export { tailwind3Css as n, tailwind4Plugin as r, marverPlugin as t };

package/dist/{profile-BkiWglVE.mjs → profile-DcsJyppw.mjs}

@@ -1,12 +1,15 @@
+import { i as loadCollab } from "./sync-DELGomPk.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/profile.ts
 /**
 * The dev identity - ONE resolver for every server-side consumer (api, jam daemon, CLI).
 *
-* Two sources merge in design/.local/:
-*  - profile.json  {name, email?, avatar?} - set from the composer's avatar popover
-*  - collab.json   {email, name}           - the connect account, written by `comments connect`
+* Two sources merge:
+*  - design/.local/profile.json  {name, email?, avatar?} - set from the composer's
+*    avatar popover
+*  - the connect account {email, name}, written by `comments connect` into
+*    ~/.marver/canvases/ - outside the repo, because `marver dev` serves the repo
 *
 * The connect account wins name + email (published serves validate author == session, so
 * events born here must carry an identity the remote will accept). The avatar always comes
@@ -23,16 +26,16 @@ const readJson = (path) => {
 const str = (v) => typeof v === "string" ? v.trim() : "";
 /** True when a connect account provides the identity - name/email are then read-only in dev. */
 function isConnected(root) {
-	return !!str(readJson(join(root, "design", ".local", "collab.json")).email);
+	return !!str(loadCollab(root)?.email);
 }
 function localProfile(root) {
 	const dir = join(root, "design", ".local");
 	const prof = readJson(join(dir, "profile.json"));
-	const collab = readJson(join(dir, "collab.json"));
+	const collab = loadCollab(root) ?? {};
 	return {
 		name: str(collab.name) || str(prof.name) || "You",
 		email: str(collab.email) || str(prof.email),
-		avatar: str(prof.avatar) || void 0
+		avatar: str(collab.avatar) || str(prof.avatar) || void 0
 	};
 }
 //#endregion

package/dist/secure-cookie-_K1Hsx8H.mjs

@@ -0,0 +1,26 @@
+//#region src/server/secure-cookie.ts
+/**
+* Is this deployment https, for the purpose of setting `Secure` on a cookie?
+*
+* The obvious answer - read `X-Forwarded-Proto` - is wrong in exactly the case
+* that matters, and it is the same trap that made `MARVER_PUBLIC_ORIGIN`
+* mandatory for identity mode: nginx's own documented `proxy_pass
+* http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas served over
+* https behind that config sees no header, decides "not secure", and issues a
+* thirty-day session cookie the browser will happily send over plain http.
+*
+* So the pinned origin wins whenever it is set. It is a deliberate statement by
+* whoever deployed the canvas, rather than a guess about a proxy that may not be
+* speaking. The header remains the fallback for a canvas with no pinned origin,
+* where a guess is all there is - and http on loopback is the ordinary
+* development case, where `Secure` would break the cookie entirely.
+*/
+function isSecureDeployment(req) {
+	const pinned = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim();
+	if (pinned) return pinned.toLowerCase().startsWith("https://");
+	return req.headers["x-forwarded-proto"] === "https";
+}
+/** `; Secure`, or nothing - the suffix a Set-Cookie line wants. */
+const secureSuffix = (req) => isSecureDeployment(req) ? "; Secure" : "";
+//#endregion
+export { secureSuffix as t };

package/dist/{serve-CZqPnj19.mjs → serve-3APqaNSB.mjs}

@@ -1,27 +1,10 @@
 import { n as NAME } from "./cli.mjs";
+import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
+import { t as poweredByUrl } from "./utm-CxC3QN5X.mjs";
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-//#region src/shared/utm.ts
-/** Automatic attribution for the powered-by links: every canvas tags its marver.design
-*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
-*  Conventional UTM semantics (stable groupings first, the variable last):
-*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
-*    utm_medium   = the link unit ('powered-by')
-*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
-*    utm_content  = the placement ('gate' badge | 'shell' wordmark)
-*/
-function poweredByUrl(canvasName, source, content) {
-	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	return `https://marver.design/?${new URLSearchParams({
-		utm_source: source,
-		utm_medium: "powered-by",
-		...slug ? { utm_campaign: slug } : {},
-		utm_content: content
-	}).toString()}`;
-}
-//#endregion
 //#region src/server/serve.ts
 /**
 * `marver serve` - a zero-dependency static server for design/.dist with an optional
@@ -66,11 +49,12 @@ async function serve(root, portFlag) {
 	} catch {}
 	let collab = null;
 	let bearerCheck = null;
+	let operatorCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-s3k5byM1.mjs");
-		const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
-		const { dataDir } = await import("./comments-BZBKhKRO.mjs");
+		const { collabHandler } = await import("./collab-CWaG3Q4w.mjs");
+		const { appendEvents, readLog } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
+		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const dir = dataDir();
 		const seedDir = join(dist, "design", "comments");
 		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {
@@ -79,13 +63,14 @@ async function serve(root, portFlag) {
 			appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
 		}
 		collab = collabHandler(dir, dist);
-		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-KQ9Aj-nB.mjs");
+		const { loadStore, createInvite, normEmail, operatorUser, sessionUser } = await import("./auth-B5yuwnOq.mjs").then((n) => n.r);
 		bearerCheck = (token) => sessionUser(dir, token);
+		operatorCheck = (token, req, url) => req.method === "POST" && url.pathname === "/__mv/api/cli-session" && !!operatorUser(dir, token);
 		sessionCheck = (req) => {
 			const tok = /(?:^|;\s*)mv_s=([\w-]+)/.exec(String(req.headers.cookie ?? ""))?.[1];
 			return tok ? sessionUser(dir, tok) : null;
 		};
-		const owner = process.env.MARVER_OWNER_EMAIL;
+		const owner = process.env.MARVER_ID_ISSUER ? "" : process.env.MARVER_OWNER_EMAIL;
 		if (owner) {
 			const store = loadStore(dir);
 			if (!store.users.length && !store.invites.some((i) => i.emailNorm === normEmail(owner))) {
@@ -96,7 +81,42 @@ async function serve(root, portFlag) {
 			}
 		}
 	}
-	const password = process.env.MARVER_PASSWORD ?? "";
+	const cliToken = process.env.MARVER_CLI_TOKEN ?? "";
+	if (cliToken) {
+		const { cliTokenProblem } = await import("./auth-B5yuwnOq.mjs").then((n) => n.r);
+		if (!process.env.MARVER_DATA_DIR) {
+			console.error(`[${NAME}] MARVER_CLI_TOKEN needs MARVER_DATA_DIR - there are no accounts for it to act as otherwise.`);
+			process.exit(1);
+		}
+		const problem = cliTokenProblem(cliToken);
+		if (problem) {
+			console.error(`[${NAME}] ${problem}.\n  Nothing rate-limits this credential and nothing slows a guess down, so its entropy is the\n  whole defence. Generate one rather than choosing one, in hex rather than base64:\n    MARVER_CLI_TOKEN=$(openssl rand -hex 24)`);
+			process.exit(1);
+		}
+	}
+	const rawIssuer = (process.env.MARVER_ID_ISSUER ?? "").trim();
+	const { normalizeIssuer } = await import("./marver-id-B8-3WiHk.mjs");
+	const idIssuer = normalizeIssuer(rawIssuer);
+	if (rawIssuer && !idIssuer) {
+		console.error(`[${NAME}] MARVER_ID_ISSUER is not a usable issuer: ${rawIssuer}\n  It must be a bare https origin - https://id.marver.design - with no path, query or credentials.\n  http:// is accepted only for localhost, while developing against a local identity service.`);
+		process.exit(1);
+	}
+	let idHandler = null;
+	if (idIssuer) {
+		if (!process.env.MARVER_DATA_DIR) {
+			console.error(`[${NAME}] MARVER_ID_ISSUER needs MARVER_DATA_DIR - identity accounts need somewhere to live.`);
+			process.exit(1);
+		}
+		if (!process.env.MARVER_PUBLIC_ORIGIN) {
+			console.error(`[${NAME}] MARVER_ID_ISSUER is set but MARVER_PUBLIC_ORIGIN is not.\n  Every assertion is bound to this canvas's exact origin, and it cannot be\n  inferred from request headers - a proxy can make any request look local.\n  Set it to the origin people actually reach this canvas on:\n    MARVER_PUBLIC_ORIGIN=https://canvas.example.com\n    MARVER_PUBLIC_ORIGIN=http://localhost:${portFlag ?? (Number(process.env.PORT) || 4199)} (development)`);
+			process.exit(1);
+		}
+		const { marverIdHandler } = await import("./marver-id-gate-BDzW6ahN.mjs");
+		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
+		const canvasName = humanName(meta.name);
+		idHandler = marverIdHandler(dataDir(), idIssuer, canvasName, meta.branding);
+	}
+	const password = idIssuer ? "" : process.env.MARVER_PASSWORD ?? "";
 	const verifier = password ? scryptSync(password, "marver-gate", 32) : null;
 	const cookieKey = randomBytes(32);
 	const sign = (exp) => createHmac("sha256", cookieKey).update(`v1.${exp}`).digest("hex");
@@ -108,10 +128,11 @@ async function serve(root, portFlag) {
 		const want = Buffer.from(sign(exp)), got = Buffer.from(m[2]);
 		return want.length === got.length && timingSafeEqual(want, got);
 	};
+	const gated = Boolean(verifier || idIssuer);
 	const server = createServer((req, res) => {
 		const url = new URL(req.url ?? "/", "http://x");
-		if (verifier) {
-			if (req.method === "POST" && url.pathname === "/__mv/auth") {
+		if (gated) {
+			if (verifier && req.method === "POST" && url.pathname === "/__mv/auth") {
 				let body = "";
 				req.on("data", (c) => {
 					body += c;
@@ -122,31 +143,39 @@ async function serve(root, portFlag) {
 					const given = form.get("password") ?? "";
 					if (timingSafeEqual(scryptSync(given, "marver-gate", 32), verifier)) {
 						const exp = Math.floor(Date.now() / 1e3) + MONTH;
-						const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
+						const secure = secureSuffix(req);
 						res.setHeader("set-cookie", `${COOKIE}=${exp}.${sign(exp)}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`);
 						const next = form.get("next") ?? "";
 						res.statusCode = 303;
 						res.setHeader("location", /^#\/[\w\/?&=%.,~-]*$/.test(next) ? `/${next}` : "/");
 						return res.end();
 					}
-					return gate(res, meta, !!collab, "Wrong canvas password - try again");
+					return gate(res, meta, !!collab, "Wrong canvas password - try again", !!idIssuer);
 				});
 				return;
 			}
-			let decoded = url.pathname;
-			try {
-				decoded = decodeURIComponent(url.pathname);
-			} catch {}
-			const cosmetic = /^\/__mv\/favicon\/[\w-]+(?:\.[\w-]+)+$/.test(decoded) || /^\/__mv\/logo\.(?:svg|png)$/.test(decoded);
+			const cosmetic = isCosmetic(url.pathname);
 			if (!authed(req) && !cosmetic && !sessionCheck?.(req)) {
 				const bearerOk = collab && url.pathname.startsWith("/__mv/api/") && (() => {
 					const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
-					return !!tok && !!bearerCheck?.(tok);
+					if (!tok) return false;
+					return !!bearerCheck?.(tok) || !!operatorCheck?.(tok, req, url);
 				})();
-				const preGate = collab && (req.method === "POST" && (url.pathname === "/__mv/api/auth/signin" || url.pathname === "/__mv/api/auth/claim") || req.method === "GET" && url.pathname === "/__mv/api/invite-info");
-				if (!bearerOk && !preGate) return gate(res, meta, !!collab);
+				const preGate = collab && !idIssuer && (req.method === "POST" && (url.pathname === "/__mv/api/auth/signin" || url.pathname === "/__mv/api/auth/claim") || req.method === "GET" && url.pathname === "/__mv/api/invite-info") || !!idIssuer && (req.method === "GET" && url.pathname === "/__mv/id/start" || req.method === "GET" && url.pathname === "/__mv/id/finish" || req.method === "POST" && url.pathname === "/__mv/id/callback");
+				if (!bearerOk && !preGate) return gate(res, meta, !!collab, void 0, !!idIssuer);
 			}
 		}
+		if (idHandler && url.pathname.startsWith("/__mv/id/")) {
+			idHandler(req, res, url).catch((err) => {
+				console.error(`[${NAME}] marver-id handler failed:`, err?.message ?? err);
+				if (!res.headersSent) {
+					res.statusCode = 500;
+					res.setHeader("content-type", "application/json");
+					res.end("{\"error\":\"internal\"}");
+				}
+			});
+			return;
+		}
 		if (url.pathname.startsWith("/__mv/api/")) {
 			if (!collab) {
 				res.statusCode = 404;
@@ -179,13 +208,21 @@ async function serve(root, portFlag) {
 			if (rel.startsWith("..") || isAbsolute(rel)) throw new Error("outside dist");
 			file = real;
 		} catch {
+			if (gated && isCosmetic(url.pathname)) {
+				res.statusCode = 404;
+				return res.end("not found");
+			}
 			file = join(dist, "index.html");
 		}
+		if (gated && isCosmetic(url.pathname) && !file.startsWith(join(dist, "__mv")) && relative(realDist, file) === "index.html") {
+			res.statusCode = 404;
+			return res.end("not found");
+		}
 		if (!extname(file)) file = join(dist, "index.html");
 		try {
 			const content = readFileSync(file);
 			res.setHeader("content-type", MIME[extname(file)] ?? "application/octet-stream");
-			const cache = verifier ? "private, no-store" : file.startsWith(join(dist, "assets")) ? "public, max-age=31536000, immutable" : "no-store";
+			const cache = gated ? "private, no-store" : file.startsWith(join(dist, "assets")) ? "public, max-age=31536000, immutable" : "no-store";
 			res.setHeader("cache-control", cache);
 			res.end(content);
 		} catch {
@@ -203,10 +240,30 @@ async function serve(root, portFlag) {
 	});
 	server.listen(port, () => {
 		console.log(`\n  ${NAME} serving design/.dist → http://localhost:${port}/`);
-		console.log(verifier ? "  gate: ON (MARVER_PASSWORD set)\n" : "  gate: off - set MARVER_PASSWORD to require a password\n");
+		console.log(idIssuer ? `  gate: ON - Marver ID (${idIssuer})` : verifier ? "  gate: ON (MARVER_PASSWORD set)" : "  gate: off - set MARVER_PASSWORD or MARVER_ID_ISSUER to require sign-in");
+		if (cliToken) console.log(`  CLI: MARVER_CLI_TOKEN accepted (acts as the canvas owner)\n`);
+		else if (idIssuer) console.log(`  CLI: set MARVER_CLI_TOKEN to invite or sync from the repo\n`);
+		else console.log("");
 	});
 	return server;
 }
+/**
+* Paths the gate lets through unauthenticated: the favicons and logo the gate
+* page itself wears. They carry no design data.
+*
+* Matched against the DECODED path, because the static handler decodes too - a
+* raw-encoded `/__mv/favicon/%2f..%2f..%2findex.html` must not slip through as
+* "cosmetic". And because these paths skip the gate, a request for one that does
+* NOT exist must 404 rather than falling back to the shell; that fallback was a
+* complete bundle disclosure on any gated canvas.
+*/
+function isCosmetic(pathname) {
+	let decoded = pathname;
+	try {
+		decoded = decodeURIComponent(pathname);
+	} catch {}
+	return /^\/__mv\/favicon\/[\w-]+(?:\.[\w-]+)+$/.test(decoded) || /^\/__mv\/logo\.(?:svg|png)$/.test(decoded);
+}
 /** The Marver logo mark (ParallelogramDuo, same as the shell's sidebar). */
 const MARK_AT = (size) => `<svg viewBox="0 0 256 256" width="${size}" height="${size}" fill="currentColor" aria-hidden><path d="M239.29,59.28l-64.8,144a8,8,0,0,1-7.3,4.72H24a8,8,0,0,1-7.3-11.28l64.8-144A8,8,0,0,1,88.81,48H232A8,8,0,0,1,239.29,59.28Z" opacity=".1"/><path d="M245.43,47.31A15.94,15.94,0,0,0,232,40H88.81a16,16,0,0,0-14.59,9.43l-64.8,144A16,16,0,0,0,24,216H167.19a16,16,0,0,0,14.59-9.43l64.8-144A16,16,0,0,0,245.43,47.31ZM167.19,200H24L88.81,56H232Z"/></svg>`;
 const MARK = MARK_AT(17);
@@ -216,14 +273,81 @@ const MARK_LG = MARK_AT(24);
 *  guests pay the canvas password, members sign in with their OWN password, and an
 *  invite link (#/i/<token>) opens straight into the claim. The member and claim
 *  states exist only on collaboration canvases - a static canvas keeps one field. */
-function gate(res, meta, collabOn, error) {
-	const name = meta.name ? meta.name[0].toUpperCase() + meta.name.slice(1) : "Marver";
+/**
+* Marver ID needs no client script at all, and that is the point.
+*
+* Continue is a plain GET form to /__mv/id/start, which redirects the tab to the
+* identity service; the tab returns to /__mv/id/finish, which completes the
+* sign-in. Nothing depends on JavaScript to leave, so no popup blocker,
+* extension or CSP can strand somebody on the gate.
+*
+* What this replaced was a popup, a postMessage listener, and a poll on the
+* popup's closed flag. It could not work for social sign-in: Google serves
+* Cross-Origin-Opener-Policy: same-origin, which permanently severs the opener
+* relationship, so the assertion had nowhere to go and the button sat on
+* "Opening..." for ever while the console filled with COOP warnings. Found by
+* signing in with a real Google account, which no test had done.
+*/
+/**
+* A canvas name a person would recognise.
+*
+* meta.name comes from the host package.json, so it arrives in package shape -
+* "marver-strategy", "acme_q3_review". Capitalising the first letter alone left
+* "Marver-strategy" on the sign-in card, which reads as a slug rather than as
+* the name of the thing somebody is opening.
+*
+* Only separators are touched. Words already carrying their own capitals keep
+* them - "myApp-billing" stays "myApp Billing" rather than being flattened to
+* "Myapp Billing".
+*/
+function humanName(raw) {
+	if (!raw) return void 0;
+	const words = raw.split(/[-_.\s]+/).filter(Boolean);
+	if (!words.length) return void 0;
+	return words.map((w) => /[A-Z]/.test(w) ? w : w[0].toUpperCase() + w.slice(1)).join(" ");
+}
+/**
+* "A terminal is asking to sign in as you."
+*
+* The browser half of the device flow, and the only place authority enters it.
+* Deliberately server-rendered rather than a shell route: it has to work on a
+* canvas whose bundle the visitor may not be allowed to load yet, and it is a
+* security prompt - the fewer moving parts between the code and the person
+* reading it, the better.
+*
+* The code is shown, large, and the copy asks the reader to CHECK it against
+* their terminal. That comparison is the whole defence. Somebody who can be
+* talked into approving a code they did not generate has handed over a session,
+* so the page never approves anything by merely being opened - the click is
+* required, and it is refused outright unless a real session is behind it.
+*/
+/**
+* Refuse to be framed.
+*
+* Every HTML page this server serves is either a credential prompt or the
+* private canvas itself, and neither has any business inside somebody else's
+* frame. The approval page made the cost concrete: an attacker starts a device
+* flow of their own, frames the approval URL under an unrelated button, and
+* polls their device code after the victim clicks - collecting the victim's
+* real session. SameSite=Lax does not help, because a framed page on the same
+* site still carries its cookies.
+*
+* Both headers, because the CSP directive is the modern one and X-Frame-Options
+* is what older clients actually enforce.
+*/
+function denyFraming(res) {
+	res.setHeader("content-security-policy", "frame-ancestors 'none'");
+	res.setHeader("x-frame-options", "DENY");
+}
+function gate(res, meta, collabOn, error, idOn = false) {
+	const name = humanName(meta.name) ?? "Marver";
 	const appMark = meta.logo ? `<img src="${esc(meta.logo)}" alt="" width="24" height="24" />` : MARK_LG;
 	const title = meta.branding ? `${name} | Marver - Visualize your software` : name;
 	const desc = meta.branding ? `${name}, shared as a live Marver canvas - real screens and prototypes, built from the codebase. Marver is the agent-native design canvas.` : `${name} - a private design canvas.`;
 	res.statusCode = 200;
 	res.setHeader("content-type", "text/html; charset=utf-8");
 	res.setHeader("cache-control", "no-store");
+	denyFraming(res);
 	res.end(`<!doctype html>
 <html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${esc(title)}</title>
@@ -315,6 +439,18 @@ ${meta.branding ? "<meta property=\"og:site_name\" content=\"Marver\" />" : ""}
   <div class="card">
 
     <section id="guest" class="on">
+${idOn ? `
+      <div style="display:flex;flex-direction:column;gap:14px" id="id-card">
+        <header>${appMark}<h1>${esc(name)}</h1></header>
+        <p class="lead">This canvas is private. Taking you to Marver to sign in...</p>
+        <div class="err" id="id-err">${error ? esc(error) : ""}</div>
+        <div class="ctawrap">
+          <form method="get" action="/__mv/id/start" style="width:100%">
+            <input type="hidden" name="next" id="id-next" />
+            <button class="cta" id="id-go" type="submit">Continue</button>
+          </form>
+        </div>
+      </div>` : `
       <form method="post" action="/__mv/auth" style="display:flex;flex-direction:column;gap:14px">
         <header>${appMark}<h1>${esc(name)}</h1></header>
         <p class="lead">You're one step from the canvas. This space is private - enter the canvas password to step inside.</p>
@@ -326,7 +462,7 @@ ${meta.branding ? "<meta property=\"og:site_name\" content=\"Marver\" />" : ""}
           <span class="tip">Enter the canvas password first</span>
         </div>
         ${collabOn ? "<div class=\"swap\"><span style=\"font:500 12px -apple-system,system-ui,sans-serif;color:rgba(24,24,27,.45)\">Member? <a data-go=\"member\">Sign in instead</a></span></div>" : ""}
-      </form>
+      </form>`}
     </section>
 ${collabOn ? `
     <section id="member">
@@ -370,10 +506,27 @@ ${collabOn ? `
     const $ = (id) => document.getElementById(id)
     const next = document.querySelector('[name=next]')
     if (next) next.value = location.hash
+
+    // Marver ID: carry the deep link, then go. The card is a fallback for
+    // somebody without JavaScript, not a step - it is replaced immediately.
+    //
+    // The hash is why this page exists at all. A canvas link keeps its board and
+    // thread in the fragment, which no server ever receives, so a plain redirect
+    // from the server would drop every shared link. Reading it here is the only
+    // chance anybody gets.
+    const idNext = $('id-next')
+    if (idNext) {
+      idNext.value = location.hash
+      const to = '/__mv/id/start' + (location.hash ? '?next=' + encodeURIComponent(location.hash) : '')
+      // replace, not assign: Back should go where they came from, not bounce
+      // them forward into the redirect again.
+      location.replace(to)
+    }
+
     // the guest CTA follows its field (server-side form, client-side gating)
     const gpass = document.querySelector('#guest input[type=password]')
     const gbtn = document.querySelector('#guest button.cta')
-    gpass.addEventListener('input', () => { gbtn.disabled = !gpass.value })
+    if (gpass && gbtn) gpass.addEventListener('input', () => { gbtn.disabled = !gpass.value })
     ${collabOn ? `
     const show = (id) => {
       for (const s of document.querySelectorAll('section')) s.classList.toggle('on', s.id === id)