@marver-design/marver 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.11.1 - 2026-08-27
+
+### Fixed
+
+- **The password gate's cookie now gets `Secure` from the pinned origin too.** 0.11.0 fixed
+  this for the collaboration session cookie and missed the gate's own, which is set in a
+  different file and is the one most likely to be sitting behind a plain `proxy_pass` - it is
+  the door on every password-mode canvas. Same rule, same reason: `MARVER_PUBLIC_ORIGIN`
+  decides when it is set, and `X-Forwarded-Proto` is the fallback only when there is nothing
+  better. Set `MARVER_PUBLIC_ORIGIN=https://your-canvas.example.com` and the thirty-day gate
+  cookie is https-only regardless of what your proxy tells the process.
+
+  Canvases behind a proxy that does send `X-Forwarded-Proto` - Railway, Fly, Vercel, Caddy,
+  and nginx configured with `proxy_set_header` - were never affected.
+
 ## 0.11.0 - 2026-08-27
 
 ### Added
@@ -105,15 +120,18 @@ Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](ht
 
 ### Fixed
 
-- **`Secure` on the session cookie no longer depends on a header your proxy may not send.**
-  A canvas decided whether it was on https by reading `X-Forwarded-Proto`, and nginx's own
-  documented `proxy_pass http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas
-  served over https behind that configuration saw no header, concluded "not secure", and
-  issued a thirty-day session cookie the browser would happily send over plain http. Where
+- **`Secure` on the collaboration session cookie no longer depends on a header your proxy may
+  not send.** A canvas decided whether it was on https by reading `X-Forwarded-Proto`, and
+  nginx's own documented `proxy_pass http://localhost:PORT` sets no `X-Forwarded-*` at all. A
+  canvas served over https behind that configuration saw no header, concluded "not secure",
+  and issued a thirty-day session cookie the browser would happily send over plain http. Where
   `MARVER_PUBLIC_ORIGIN` is set it now decides - a deliberate statement by whoever deployed
   the canvas, rather than a guess about a proxy that may not be speaking. The header remains
   the fallback only where there is nothing better, which is development on loopback.
 
+  This release fixed the collaboration session cookie only. The password gate's own cookie
+  still guessed from the header - see 0.11.1.
+
 - **The collaboration credential has moved out of your repository, because `marver dev` was
   serving it.** It lived at `design/.local/collab.json`, and the dev server puts the repository
   on the web so frames can import from it. Authored frames run same-origin, so any frame could

package/README.md

@@ -28,6 +28,7 @@ Frames appear on the canvas the moment the files land. That's the loop.
 - **Everything hot-reloads.** The agent writes, you watch it land - live.
 - **True viewports.** Each frame is a real iframe: drag its edge and your actual breakpoints fire.
 - **Your agent answers on the canvas.** Tag `@marver` in a comment and it picks up the job, edits the real source, and replies in the thread - no wiring, on by default. See [Live Jam](#live-jam).
+- **Feedback without a signup wall.** Publish the canvas, invite people by email, and they sign in as themselves - one free Marver account, Google or an emailed code, and it opens every canvas you ever share with them. Or keep it entirely self-hosted behind a shared password. See [Collaboration](#collaboration).
 - **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates the `design/AGENTS.md` contract that teaches it the whole workflow.
 
 ## The canvas
@@ -40,9 +41,21 @@ Frames appear on the canvas the moment the files land. That's the loop.
 
 ## Collaboration
 
-- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure). `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
+- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Viewers on a published canvas comment with real names and avatars - either a Marver account they already have, or an invite-link account on that canvas alone. `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
 - **Laser mode.** Press `l`: every element in every frame gets depth-hued outlines plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent.
-- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships); `npx marver serve` hosts it with an optional password gate. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships, and whether each board is `read` or `comment`); `npx marver serve` hosts it. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+
+- **Two ways to let people in.** They are alternatives, not layers - pick one per canvas.
+
+  **Marver Sign In** (new in 0.11). Set `MARVER_ID_ISSUER=https://id.marver.design` and reviewers sign in as themselves, with Google or a six-digit code emailed to them. One free Marver account opens *every* canvas gated this way, so the second board you share costs them nothing: no new signup, no new password, no link to keep. You invite an email address and they are in.
+
+  That is the whole difference, and it is the difference between "I'll look later" and a comment actually landing on the board. It also means their real name and face ride along, so a thread is from a person rather than from an address.
+
+  **A shared password** (`MARVER_PASSWORD`). Fully self-hosted, no account anywhere but your own volume, nothing about your reviewers leaves your infrastructure - and still fully supported, not a legacy path. The trade is that every canvas is an island: reviewers claim an invite link and pick a name and password *on that canvas*, and do it again for the next one. Fine for one board, a toll on the fifth.
+
+  Either way the canvas runs on your infrastructure and stores its own comments and members. With Marver Sign In the identity service only ever tells your canvas that a verified address matched an entry on your invite list - it never sees your frames, your files, or your comments. Rights stay yours: `design/publish.json` decides which boards are readable and which are commentable, and `marver comments invite`/`revoke` decides who is on the list.
+
+  *Coming next:* one home for your account - every canvas you have been invited to, every canvas you have shared, and the access each one carries, in a single list. Today the account page at `id.marver.design` shows the canvases you have approved and lets you revoke them.
 
 ## Live Jam
 
@@ -61,7 +74,7 @@ The same glow, driven from the terminal. When your agent takes a request, it cre
 | `npx marver init` | Scaffold `design/` in this repo (safe to re-run; refreshes managed files) |
 | `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam armed (`--port`, default 5199) |
 | `npx marver build` | Static export → `design/.dist`; what ships comes from `design/publish.json` (default-closed) |
-| `npx marver serve` | Serve the export; `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
+| `npx marver serve` | Serve the export; `MARVER_ID_ISSUER` or `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
 | `npx marver comments …` | The agent's queue: `connect <url>` · `sync` · `list` · `reply` · `resolve` · `invite <email>` · `revoke <email>` |
 | `npx marver work …` | Working glow from the terminal: `start <scene/frame …>` · `done … \| --all` · `list` |
 

package/dist/{build-Cr_ZLMdq.mjs → build-DI31MFTB.mjs}

@@ -1,7 +1,7 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
 import { i as detectHost, n as loadConfig } from "./config-t9coJ-Pq.mjs";
 import { r as scanFrames } from "./manifest-C2tzkNaC.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-vE7sxEeT.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-DjBFxEQ7.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/cli.mjs

@@ -46,7 +46,7 @@ cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "st
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-CLBjRs0J.mjs");
+	const { dev } = await import("./dev-BWIL2ewj.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-Cr_ZLMdq.mjs");
+	const { buildSite } = await import("./build-DI31MFTB.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-CZ1KEQxd.mjs");
+	const { serve } = await import("./serve-3APqaNSB.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);

package/dist/{collab-C-n-uQdm.mjs → collab-CWaG3Q4w.mjs}

@@ -1,33 +1,9 @@
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
 import { a as claimInvite, c as issueDeviceSession, d as publicUser, f as revokeUser, g as updateProfile, h as signOut, l as ownerName, m as signIn, o as createInvite, p as sessionUser, s as inviteInfo } from "./auth-B5yuwnOq.mjs";
+import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
-//#region src/server/secure-cookie.ts
-/**
-* Is this deployment https, for the purpose of setting `Secure` on a cookie?
-*
-* The obvious answer - read `X-Forwarded-Proto` - is wrong in exactly the case
-* that matters, and it is the same trap that made `MARVER_PUBLIC_ORIGIN`
-* mandatory for identity mode: nginx's own documented `proxy_pass
-* http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas served over
-* https behind that config sees no header, decides "not secure", and issues a
-* thirty-day session cookie the browser will happily send over plain http.
-*
-* So the pinned origin wins whenever it is set. It is a deliberate statement by
-* whoever deployed the canvas, rather than a guess about a proxy that may not be
-* speaking. The header remains the fallback for a canvas with no pinned origin,
-* where a guess is all there is - and http on loopback is the ordinary
-* development case, where `Secure` would break the cookie entirely.
-*/
-function isSecureDeployment(req) {
-	const pinned = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim();
-	if (pinned) return pinned.toLowerCase().startsWith("https://");
-	return req.headers["x-forwarded-proto"] === "https";
-}
-/** `; Secure`, or nothing - the suffix a Set-Cookie line wants. */
-const secureSuffix = (req) => isSecureDeployment(req) ? "; Secure" : "";
-//#endregion
 //#region src/server/collab.ts
 const MONTH = 2592e3;
 const MAX_BODY = 262144;

package/dist/{dev-CLBjRs0J.mjs → dev-BWIL2ewj.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
 import { i as detectHost, n as loadConfig } from "./config-t9coJ-Pq.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-vE7sxEeT.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-DjBFxEQ7.mjs";
 import { realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/{plugin-vE7sxEeT.mjs → plugin-DjBFxEQ7.mjs}

@@ -305,7 +305,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-C-n-uQdm.mjs");
+				const { validAvatar } = await import("./collab-CWaG3Q4w.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));

package/dist/secure-cookie-_K1Hsx8H.mjs

@@ -0,0 +1,26 @@
+//#region src/server/secure-cookie.ts
+/**
+* Is this deployment https, for the purpose of setting `Secure` on a cookie?
+*
+* The obvious answer - read `X-Forwarded-Proto` - is wrong in exactly the case
+* that matters, and it is the same trap that made `MARVER_PUBLIC_ORIGIN`
+* mandatory for identity mode: nginx's own documented `proxy_pass
+* http://localhost:PORT` sets no `X-Forwarded-*` at all. A canvas served over
+* https behind that config sees no header, decides "not secure", and issues a
+* thirty-day session cookie the browser will happily send over plain http.
+*
+* So the pinned origin wins whenever it is set. It is a deliberate statement by
+* whoever deployed the canvas, rather than a guess about a proxy that may not be
+* speaking. The header remains the fallback for a canvas with no pinned origin,
+* where a guess is all there is - and http on loopback is the ordinary
+* development case, where `Secure` would break the cookie entirely.
+*/
+function isSecureDeployment(req) {
+	const pinned = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim();
+	if (pinned) return pinned.toLowerCase().startsWith("https://");
+	return req.headers["x-forwarded-proto"] === "https";
+}
+/** `; Secure`, or nothing - the suffix a Set-Cookie line wants. */
+const secureSuffix = (req) => isSecureDeployment(req) ? "; Secure" : "";
+//#endregion
+export { secureSuffix as t };

package/dist/{serve-CZ1KEQxd.mjs → serve-3APqaNSB.mjs}

@@ -1,4 +1,5 @@
 import { n as NAME } from "./cli.mjs";
+import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
 import { t as poweredByUrl } from "./utm-CxC3QN5X.mjs";
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
@@ -51,7 +52,7 @@ async function serve(root, portFlag) {
 	let operatorCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-C-n-uQdm.mjs");
+		const { collabHandler } = await import("./collab-CWaG3Q4w.mjs");
 		const { appendEvents, readLog } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const dir = dataDir();
@@ -142,7 +143,7 @@ async function serve(root, portFlag) {
 					const given = form.get("password") ?? "";
 					if (timingSafeEqual(scryptSync(given, "marver-gate", 32), verifier)) {
 						const exp = Math.floor(Date.now() / 1e3) + MONTH;
-						const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
+						const secure = secureSuffix(req);
 						res.setHeader("set-cookie", `${COOKIE}=${exp}.${sign(exp)}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`);
 						const next = form.get("next") ?? "";
 						res.statusCode = 303;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marver-design/marver",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components - comment @marver and your own coding agent does the work. The tool ships no AI.",
   "type": "module",
   "private": false,

package/templates/instructions/publish.md

@@ -152,6 +152,16 @@ somebody owns it there is nobody for the token to be. `connect` trades it for an
 ordinary session and stores THAT, so the secret never lands in your repo.
 Rotating `MARVER_CLI_TOKEN` ends every session it minted.
 
+Then invite people by address, and send them nothing:
+
+```bash
+marver comments invite colleague@company.com
+#    → in identity mode the ADDRESS is the invitation. They open the canvas URL,
+#      sign in as themselves, and the invite is spent by that sign-in. There is
+#      no link to forward and no canvas password to send with it - the claim link
+#      is deliberately shut off in identity mode, so do not go looking for one.
+```
+
 It is a deployment variable and not something a page hands out, because authored
 frames run same-origin in a canvas: frame code can read `mv_c` and ride the
 viewer's session, so anything a browser can mint, a frame can mint silently. A
@@ -192,7 +202,11 @@ through sign-in.
 - `<MARVER_DATA_DIR>/comments/<board>.jsonl` - the live event log, on the volume.
 - `<MARVER_DATA_DIR>/auth.json` - accounts (scrypt), sessions, invites, on the volume.
 - `design/comments/<board>.jsonl` - the dev-side mirror, git-tracked: feedback
-  has history, and the volume has an off-site replica for free.
+  has history, and the volume has an off-site replica for free. **Each event
+  carries its author's email address** - that is how the canvas decides who may
+  edit or resolve their own thread. Harmless in a private repo; if yours is
+  public, or may become public, gitignore `design/comments/` and let the volume
+  be the record. The canvas keeps its own copy either way, so nothing is lost.
 - `~/.marver/canvases/<project-hash>.json` - THIS machine's device credential, kept
   OUTSIDE the repo because `marver dev` serves the repo;
   never commit it.