@marver-design/marver 0.10.2 → 0.11.1

package/templates/instructions/publish.md

@@ -18,11 +18,32 @@ vars if the host has no CLI.
    `--boards a,b` overrides ad hoc (grants comment), `--all-boards` ships
    everything loudly.
 
-2. **The canvas password** - `MARVER_PASSWORD` at serve time. This is the READ
-   boundary: one shared password for GUESTS. Members never need it - their own
-   account signs them in at the gate, and invite links skip it entirely (the
-   token is the authorization). Rotating it therefore only affects guests.
-   No env var = an open canvas.
+2. **Who gets in** - pick ONE of two gates at serve time. They are alternatives,
+   not layers; setting both weakens the invite list to "an account OR whoever
+   has the password". No env var at all = an open canvas.
+
+   **Marver Sign In - `MARVER_ID_ISSUER`. Use this by default.** People sign in
+   as themselves (Google, or an emailed code) instead of sharing a secret. One
+   sign-in opens every canvas gated this way, there is no password to leak or
+   rotate, and removing one person removes exactly them. Needs
+   `MARVER_PUBLIC_ORIGIN` set to the canvas's exact public origin, and
+   `MARVER_DATA_DIR`.
+
+   ```
+   MARVER_ID_ISSUER=https://id.marver.design
+   MARVER_PUBLIC_ORIGIN=https://<the deployed url>
+   ```
+
+   **The canvas password - `MARVER_PASSWORD`.** The sovereign option, and the
+   right one when the canvas must depend on nothing outside itself: no outbound
+   request of any kind. One shared password for GUESTS; members never need it,
+   since their own account signs them in and invite links skip it entirely.
+   Choose it deliberately - offline or air-gapped hosting, or an explicit
+   preference for no third party in the sign-in path - not by default.
+
+   **Who may enter is decided by the canvas either way**, from the invite list
+   the owner keeps. Marver Sign In proves who somebody is; it has no say in
+   where they may go, and is never told the answer.
 
 3. **Collaboration on or off** - `MARVER_DATA_DIR` at serve time. Set it to a
    path on a PERSISTENT disk and the serve grows accounts + live comments.
@@ -35,9 +56,12 @@ vars if the host has no CLI.
 | Var | Meaning |
 |---|---|
 | `PORT` | listen port (hosts inject this) |
-| `MARVER_PASSWORD` | canvas password (guests' read credential); unset = open |
+| `MARVER_ID_ISSUER` | `https://id.marver.design` - people sign in as themselves (**preferred**) |
+| `MARVER_PUBLIC_ORIGIN` | REQUIRED with `MARVER_ID_ISSUER`: this canvas's exact public origin |
+| `MARVER_PASSWORD` | the sovereign alternative: one shared password; unset = open |
 | `MARVER_DATA_DIR` | persistent dir for `comments/` + `auth.json`; unset = no collaboration |
-| `MARVER_OWNER_EMAIL` | prints a single-use OWNER claim link in the deploy logs on first boot |
+| `MARVER_OWNER_EMAIL` | who owns an empty canvas. With Marver Sign In they just sign in; with a password, a single-use claim link prints in the deploy logs on first boot |
+| `MARVER_CLI_TOKEN` | generated 32+ char secret (`openssl rand -hex 24`) that lets this repo run `comments invite`/`revoke`/`sync` as the owner. Required with `MARVER_ID_ISSUER` - identity accounts have no password for the CLI to use |
 | `MARVER_TRUSTED_PROXY` | set to `1` behind a reverse proxy (Railway, Fly) so rate limits see real IPs |
 
 ## The host contract (works on any volume-capable host)
@@ -71,10 +95,17 @@ Then, once per service:
 ```bash
 railway init                      # or `railway link` an existing service
 railway volume add --mount-path /data
-railway variables --set MARVER_PASSWORD=<pw> --set MARVER_DATA_DIR=/data \
-  --set MARVER_OWNER_EMAIL=<owner@email> --set MARVER_TRUSTED_PROXY=1
+# The default gate: people sign in as themselves.
+railway variables --set MARVER_ID_ISSUER=https://id.marver.design \
+  --set MARVER_PUBLIC_ORIGIN=https://<the deployed url> --set MARVER_DATA_DIR=/data \
+  --set MARVER_OWNER_EMAIL=<owner@email> --set MARVER_TRUSTED_PROXY=1 \
+  --set MARVER_CLI_TOKEN="$(openssl rand -hex 24)"
+# ...or the sovereign alternative, if this canvas must depend on nothing external:
+#   --set MARVER_PASSWORD=<pw>   (instead of MARVER_ID_ISSUER/MARVER_PUBLIC_ORIGIN)
 railway up                        # uploads the repo; Railway runs build then start
-railway logs                      # ← the owner claim LINK prints here, once (see below)
+railway logs                      # with a PASSWORD gate, the owner claim link prints
+                                  # here once. With Marver Sign In there is no link -
+                                  # the owner simply signs in. See below.
 ```
 
 Republishing is just `railway up` again: the server unions the seeded logs on
@@ -83,7 +114,12 @@ the event log is single-writer by design.
 
 ## What the deployed gate offers (so you know what you're wiring)
 
-On a collaboration canvas the gate has three doors, one credential each:
+**With `MARVER_ID_ISSUER`** there is one door: people sign in at
+id.marver.design with Google or an emailed code, come back, and are let in if
+the owner's list has their address. Nobody types a canvas password because there
+isn't one. An address that is not on the list is refused by name, on screen.
+
+**With `MARVER_PASSWORD`** the gate has three doors, one credential each:
 - **Guest** - the canvas password → read-only across published boards.
 - **Member** - "Sign in instead" → their own email + password → read + comment.
   A member session IS gate passage; they never touch the shared password again.
@@ -92,9 +128,51 @@ On a collaboration canvas the gate has three doors, one credential each:
 
 ## Wiring people up (after first deploy)
 
-`MARVER_OWNER_EMAIL` makes the first boot print an owner bootstrap in the logs:
-a browser link (`<url>/#/i/<token>`) AND the exact repo command. The token is
-single-use. Claim it from the repo so this machine can mint invites:
+**With Marver Sign In**, the owner just signs in - `MARVER_OWNER_EMAIL` claims an
+empty canvas for that address, with no token to pass around.
+
+**To manage people from this machine, the canvas needs `MARVER_CLI_TOKEN`.**
+`comments invite`, `revoke` and `sync` sign the CLI in with a password, and
+identity mode has none. Generate a secret - do not choose one, nothing
+rate-limits this and nothing slows a guess down - set it on the canvas, and hand
+the same value back:
+
+```bash
+# on the canvas (deployment environment):  MARVER_CLI_TOKEN=$(openssl rand -hex 24)
+MARVER_CLI_TOKEN='<that same value>' marver comments connect https://canvas.example.com
+```
+
+Hex, not base64: an `Authorization` header carries letters, digits, `_` and `-`,
+and the canvas refuses to start on a value it could never accept. `--token` works
+too, but a value on the command line is visible to anything that can list
+processes, so prefer the variable.
+
+It acts as whoever owns the canvas, so let the owner sign in once first - until
+somebody owns it there is nobody for the token to be. `connect` trades it for an
+ordinary session and stores THAT, so the secret never lands in your repo.
+Rotating `MARVER_CLI_TOKEN` ends every session it minted.
+
+Then invite people by address, and send them nothing:
+
+```bash
+marver comments invite colleague@company.com
+#    → in identity mode the ADDRESS is the invitation. They open the canvas URL,
+#      sign in as themselves, and the invite is spent by that sign-in. There is
+#      no link to forward and no canvas password to send with it - the claim link
+#      is deliberately shut off in identity mode, so do not go looking for one.
+```
+
+It is a deployment variable and not something a page hands out, because authored
+frames run same-origin in a canvas: frame code can read `mv_c` and ride the
+viewer's session, so anything a browser can mint, a frame can mint silently. A
+browser-approved device flow was built for this job and removed before release for
+that reason. Do not reintroduce one, and do not invent a workaround that posts to
+internal endpoints.
+
+**With a canvas password**, `MARVER_OWNER_EMAIL` makes the first boot print an
+owner bootstrap in the logs: a browser link (`<url>/#/i/<token>`) AND the exact
+repo command. The token is single-use. Claim it from the repo so this machine can
+mint invites:
 
 ```bash
 # 1. claim the owner account - copy the command the deploy logs printed:
@@ -124,6 +202,11 @@ through sign-in.
 - `<MARVER_DATA_DIR>/comments/<board>.jsonl` - the live event log, on the volume.
 - `<MARVER_DATA_DIR>/auth.json` - accounts (scrypt), sessions, invites, on the volume.
 - `design/comments/<board>.jsonl` - the dev-side mirror, git-tracked: feedback
-  has history, and the volume has an off-site replica for free.
-- `design/.local/collab.json` - THIS machine's device credential. Gitignored;
+  has history, and the volume has an off-site replica for free. **Each event
+  carries its author's email address** - that is how the canvas decides who may
+  edit or resolve their own thread. Harmless in a private repo; if yours is
+  public, or may become public, gitignore `design/comments/` and let the volume
+  be the record. The canvas keeps its own copy either way, so nothing is lost.
+- `~/.marver/canvases/<project-hash>.json` - THIS machine's device credential, kept
+  OUTSIDE the repo because `marver dev` serves the repo;
   never commit it.

package/dist/auth-KQ9Aj-nB.mjs

@@ -1,245 +0,0 @@
-import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-//#region src/server/auth.ts
-/**
-* Accounts, invites, sessions - the minimal credible implementation,
-* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
-* opaque session tokens stored hashed, single-use invite links as the identity
-* bootstrap (no email infrastructure anywhere).
-*
-* Password = read, account = comment: everything here concerns accounts only; the
-* shared gate password (serve.ts) remains the outer READ boundary.
-*
-* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
-* users change rarely; the event-log treatment is reserved for comments.
-*/
-const SCRYPT = {
-	N: 2 ** 15,
-	r: 8,
-	p: 1,
-	keylen: 32,
-	maxmem: 67108864
-};
-const INVITE_TTL = 6048e5;
-const SESSION_TTL = 2592e6;
-const normEmail = (e) => e.trim().toLowerCase();
-const sha256 = (s) => createHash("sha256").update(s).digest("hex");
-const token = () => randomBytes(32).toString("base64url");
-const storeFile = (dir) => join(dir, "auth.json");
-/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
-*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
-*  a later save overwrite every account. */
-function loadStore(dir) {
-	let raw;
-	try {
-		raw = readFileSync(storeFile(dir), "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return {
-			users: [],
-			invites: [],
-			sessions: []
-		};
-		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
-	}
-	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
-	return parsed;
-}
-/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
-*  0600 throughout: the store holds emails and password verifiers. */
-function saveStore(dir, store) {
-	const file = storeFile(dir);
-	mkdirSync(dirname(file), { recursive: true });
-	const now = Date.now();
-	store.invites = store.invites.filter((i) => i.exp > now);
-	store.sessions = store.sessions.filter((s) => s.exp > now);
-	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
-	const fd = openSync(tmp, "wx", 384);
-	try {
-		writeSync(fd, JSON.stringify(store, null, 2));
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
-	}
-	renameSync(tmp, file);
-}
-/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
-*  the store mutations are already synchronous and atomic; this covers deploy overlap
-*  and any accidental multi-instance run (the supported setup is single-instance) -
-*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
-*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
-*  fails loudly rather than hanging. */
-function withLock(dir, fn) {
-	mkdirSync(dir, { recursive: true });
-	const lock = join(dir, ".auth.lock");
-	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	const deadline = Date.now() + 5e3;
-	for (;;) try {
-		closeSync(openSync(lock, "wx"));
-		break;
-	} catch (e) {
-		if (e.code !== "EEXIST") throw e;
-		try {
-			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
-				unlinkSync(lock);
-				continue;
-			}
-		} catch {
-			continue;
-		}
-		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
-		nap(25);
-	}
-	try {
-		return fn();
-	} finally {
-		try {
-			unlinkSync(lock);
-		} catch {}
-	}
-}
-const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
-/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
-*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
-*  token is returned exactly once; only its hash is stored. */
-/** The owner's display name - public-safe (never the email). Null before claim. */
-function ownerName(dir) {
-	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
-}
-/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
-*  token is the proof - holding it means the owner sent it to you. */
-function inviteInfo(dir, rawToken) {
-	const hash = sha256(rawToken);
-	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-	return invite ? { email: invite.emailNorm } : null;
-}
-function createInvite(dir, email) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
-		const raw = token();
-		const exp = Date.now() + INVITE_TTL;
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		store.invites.push({
-			emailNorm: normEmail(email),
-			tokenHash: sha256(raw),
-			exp
-		});
-		saveStore(dir, store);
-		return {
-			token: raw,
-			exp
-		};
-	});
-}
-/** Claim an invite: burns it, creates the account, opens the first session. */
-function claimInvite(dir, rawToken, profile) {
-	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
-	if (!profile.name.trim()) throw new Error("a display name is required");
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
-		store.invites = store.invites.filter((i) => i !== invite);
-		const salt = randomBytes(16).toString("hex");
-		const user = {
-			email: invite.emailNorm,
-			name: profile.name.trim(),
-			avatar: profile.avatar,
-			role: store.users.length ? "member" : "owner",
-			salt,
-			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
-			params: SCRYPT,
-			createdAt: Date.now()
-		};
-		store.users.push(user);
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-/** Password sign-in. One generic failure - never reveal whether the email exists. */
-function signIn(dir, email, password) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = findUser(store, email);
-		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
-		const params = user?.params ?? SCRYPT;
-		const got = scryptSync(password, salt, params.keylen, params);
-		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
-		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-function pushSession(store, user) {
-	const raw = token();
-	store.sessions.push({
-		tokenHash: sha256(raw),
-		emailNorm: normEmail(user.email),
-		exp: Date.now() + SESSION_TTL
-	});
-	return raw;
-}
-/** Resolve a session token to its user; null when unknown or expired. */
-function sessionUser(dir, rawToken) {
-	const store = loadStore(dir);
-	const hash = sha256(rawToken);
-	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
-	return s ? store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null : null;
-}
-function signOut(dir, rawToken) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
-		saveStore(dir, store);
-	});
-}
-/** Update name/avatar on an existing account. */
-function updateProfile(dir, email, patch) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = findUser(store, email);
-		if (!user) throw new Error("no such account");
-		if (patch.name?.trim()) user.name = patch.name.trim();
-		if (patch.avatar !== void 0) user.avatar = patch.avatar || void 0;
-		saveStore(dir, store);
-		return user;
-	});
-}
-/** Remove an account and all its sessions (owner action). The LAST owner cannot be
-*  removed - a store with members but no owner has no one left to administer it,
-*  and bootstrap will not re-run while any user exists. */
-function revokeUser(dir, email) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
-		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
-		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		saveStore(dir, store);
-	});
-}
-/** The public shape of a user - what other viewers (and events) may see. */
-const publicUser = (u) => ({
-	email: u.email,
-	name: u.name,
-	avatar: u.avatar
-});
-//#endregion
-export { claimInvite, createInvite, inviteInfo, loadStore, normEmail, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile };

package/dist/events-BMtBvvgU.mjs

@@ -1,101 +0,0 @@
-//#region src/shared/events.ts
-/** Events the other side lacks, by id - the sync payload in either direction. */
-function diffEvents(mine, theirIds) {
-	const have = new Set(theirIds);
-	return mine.filter((e) => !have.has(e.id));
-}
-/** Replay a board's events into current thread state. Deterministic: replay order is
-*  (ts, id) so two stores holding the same event SET always derive the same state.
-*  TWO passes - creates first, then everything else - so a reply whose author's clock
-*  ran ahead of the creator's still lands instead of being dropped forever. */
-function replay(events) {
-	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
-	const threads = /* @__PURE__ */ new Map();
-	for (const ev of ordered) {
-		if (ev.type !== "create") continue;
-		if (!ev.commentId || threads.has(ev.commentId)) continue;
-		threads.set(ev.commentId, {
-			id: ev.commentId,
-			board: ev.board,
-			nodeKey: ev.nodeKey,
-			frame: ev.frame,
-			anchor: ev.anchor,
-			author: ev.author,
-			body: ev.body,
-			ts: ev.ts,
-			resolved: false,
-			agent: ev.agent,
-			agentMeta: ev.agentMeta,
-			replies: [],
-			reactions: {}
-		});
-	}
-	for (const ev of ordered) switch (ev.type) {
-		case "reply": {
-			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
-			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
-			t.replies.push({
-				id: ev.commentId,
-				author: ev.author,
-				body: ev.body,
-				ts: ev.ts,
-				agent: ev.agent,
-				agentMeta: ev.agentMeta
-			});
-			break;
-		}
-		case "edit": {
-			if (!ev.commentId || ev.body === void 0) break;
-			const t = threads.get(ev.commentId);
-			if (t) {
-				t.body = ev.body;
-				break;
-			}
-			for (const th of threads.values()) {
-				const r = th.replies.find((r) => r.id === ev.commentId);
-				if (r) {
-					r.body = ev.body;
-					break;
-				}
-			}
-			break;
-		}
-		case "resolve": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = true;
-				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
-			}
-			break;
-		}
-		case "reopen": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = false;
-				t.addressedIn = void 0;
-			}
-			break;
-		}
-		case "reanchor": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t && ev.anchor != null) t.anchor = ev.anchor;
-			break;
-		}
-		case "react": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			const who = ev.author?.email;
-			if (!t || !who || !ev.emoji) break;
-			const users = t.reactions[ev.emoji] ??= [];
-			const at = users.indexOf(who);
-			if (at === -1) users.push(who);
-			else {
-				users.splice(at, 1);
-				if (!users.length) delete t.reactions[ev.emoji];
-			}
-			break;
-		}
-	}
-	return [...threads.values()];
-}
-//#endregion
-export { replay as n, diffEvents as t };

package/dist/sync-BJKKmy1n.mjs

@@ -1,150 +0,0 @@
-import { t as diffEvents } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-//#region src/server/sync.ts
-/**
-* Dev ↔ published comment sync - one merge rule, run from the dev side.
-*
-* The published serve is the canonical home; the repo's design/comments/ is the
-* mirror the agent reads. Each exchange is: pull remote events → union into local
-* files; push the local events the remote lacks (chunked - the server unions too).
-* Idempotent and retry-safe by construction, so a dropped exchange costs nothing.
-*
-* Credentials: design/.local/collab.json {url, token} written by `comments connect`.
-* The token is a server session held by the DEV PROCESS only - pages never see it.
-*/
-const collabFile = (root) => join(root, "design", ".local", "collab.json");
-function loadCollab(root) {
-	try {
-		const c = JSON.parse(readFileSync(collabFile(root), "utf8"));
-		return typeof c?.url === "string" && typeof c?.token === "string" ? c : null;
-	} catch {
-		return null;
-	}
-}
-function saveCollab(root, collab) {
-	mkdirSync(join(root, "design", ".local"), { recursive: true });
-	writeFileSync(collabFile(root), JSON.stringify(collab, null, 2) + "\n", { mode: 384 });
-}
-/** One full exchange. Returns per-board counts, or throws on auth/network failure. */
-async function syncOnce(root, collab) {
-	const dir = join(root, "design", "comments");
-	const auth = { authorization: `Bearer ${collab.token}` };
-	const base = collab.url.replace(/\/+$/, "");
-	const bres = await fetch(`${base}/__mv/api/boards`, { headers: auth });
-	if (bres.status === 401) throw new Error("the connect token was rejected - run `comments connect` again");
-	if (!bres.ok) throw new Error(`published canvas answered ${bres.status} - is it up?`);
-	const { rights } = await bres.json();
-	const boards = [.../* @__PURE__ */ new Set([...Object.keys(rights), ...listBoards(dir)])];
-	const out = {};
-	const failures = [];
-	for (const board of boards) {
-		if (!(board in rights)) continue;
-		const res = await fetch(`${base}/__mv/api/comments/${board}`, { headers: auth });
-		if (!res.ok) {
-			failures.push(`${board}: pull ${res.status}`);
-			continue;
-		}
-		const { events: remote } = await res.json();
-		const pulled = appendEvents(dir, board, remote).length;
-		let pushed = 0;
-		if (rights[board] === "comment") {
-			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id)).filter((e) => !e.agent);
-			for (let i = 0; i < missing.length; i += 100) {
-				const r = await fetch(`${base}/__mv/api/comments/${board}`, {
-					method: "POST",
-					headers: {
-						...auth,
-						"content-type": "application/json"
-					},
-					body: JSON.stringify({ events: missing.slice(i, i + 100) })
-				});
-				if (r.ok) pushed += (await r.json()).accepted ?? 0;
-				else failures.push(`${board}: push ${r.status} ${(await r.json().catch(() => null))?.error ?? ""}`.trim());
-			}
-		}
-		out[board] = {
-			pulled,
-			pushed
-		};
-	}
-	if (failures.length) throw new Error(`sync incomplete - ${failures.join(" · ")}`);
-	return out;
-}
-/** The account endpoints live BEHIND the canvas gate (the outer READ boundary), so
-*  connecting passes the gate first when a canvas password is set. */
-async function gateCookie(base, canvasPassword) {
-	if (!canvasPassword) return "";
-	const cookie = (await fetch(`${base}/__mv/auth`, {
-		method: "POST",
-		redirect: "manual",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body: `password=${encodeURIComponent(canvasPassword)}&next=`
-	})).headers.getSetCookie?.().find((c) => c.startsWith("mv_a=")) ?? "";
-	const tok = /^mv_a=([^;]+)/.exec(cookie)?.[1];
-	if (!tok) throw new Error("the canvas password was not accepted");
-	return `mv_a=${tok}`;
-}
-async function sessionFrom(res, ctx) {
-	if (!res.ok) {
-		const err = (await res.json().catch(() => null))?.error;
-		throw new Error(err ?? `${ctx} failed (${res.status})`);
-	}
-	const cookie = res.headers.getSetCookie?.().find((c) => c.startsWith("mv_s=")) ?? "";
-	const token = /^mv_s=([\w-]+)/.exec(cookie)?.[1];
-	if (!token) throw new Error("the canvas did not issue a session - is collaboration enabled on it (MARVER_DATA_DIR)?");
-	return token;
-}
-/** Sign in against a published canvas and persist the device credential. The account's
-*  identity rides along: locally-born events carry it as their author snapshot (the
-*  server validates the claim against the session - it never rewrites events). */
-async function connect(root, url, email, password, canvasPassword) {
-	const base = url.replace(/\/+$/, "");
-	const gate = await gateCookie(base, canvasPassword);
-	const res = await fetch(`${base}/__mv/api/auth/signin`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			...gate ? { cookie: gate } : {}
-		},
-		body: JSON.stringify({
-			email,
-			password
-		})
-	});
-	const token = await sessionFrom(res, "sign-in");
-	const user = (await res.clone().json().catch(() => null))?.user;
-	saveCollab(root, {
-		url: base,
-		token,
-		email: user?.email ?? email,
-		name: user?.name
-	});
-}
-/** Claim an invite from the CLI (the dev-first path - no published UI needed). */
-async function connectClaim(root, url, invite, profile, canvasPassword) {
-	const base = url.replace(/\/+$/, "");
-	const gate = await gateCookie(base, canvasPassword);
-	const res = await fetch(`${base}/__mv/api/auth/claim`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			...gate ? { cookie: gate } : {}
-		},
-		body: JSON.stringify({
-			token: invite,
-			...profile
-		})
-	});
-	const token = await sessionFrom(res, "claim");
-	const user = (await res.clone().json().catch(() => null))?.user;
-	saveCollab(root, {
-		url: base,
-		token,
-		email: user?.email,
-		name: user?.name ?? profile.name
-	});
-}
-//#endregion
-export { connect, connectClaim, loadCollab, syncOnce };

package/dist/{shot-D7I0MCLu.mjs → shot-Cyv3GN79.mjs}

@@ -1,8 +1,8 @@
 import { i as ROUTE } from "./cli.mjs";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
+import { spawn } from "node:child_process";
 //#region src/server/shot.ts
 /**
 * Frame screenshots without a dependency - the system's own Chrome, driven over CDP