@marver-design/marver 0.11.0 → 0.12.0

package/dist/collab-BmaOjwP1.mjs

@@ -0,0 +1,781 @@
+import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
+import { A as reconfirmGrant, C as commentAllowed, D as operativeMode, E as loadShare, F as setBlocked, I as setGeneralMode, L as shareState, M as resolveAccess, N as resolveRequest, O as provisionVerdict, P as rosterEtag, S as ceilingsFromRights, T as loadRequests, _ as sessionUser, a as claimInvite, b as updateProfile, c as issueDeviceSession, d as opaqueId, f as ownerName, g as sessionIsOperator, h as revokeUser, j as removeGrant, k as putRequest, l as loadStore, m as publicUser, o as createInvite, s as inviteInfo, u as normEmail, v as signIn, w as entryAllowed, y as signOut, z as upsertGrant } from "./auth-DdUKeVKt.mjs";
+import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-Bf9tiGrE.mjs";
+import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/server/notify.ts
+/**
+* The canvas's half of the notification relay (04-solution §2.3, §9.5).
+*
+* Three transactional moments, exactly: you were invited (a view/comment grant
+* landed on an address), your request was approved, someone asked for access
+* (to the owner - and that mail carries only "someone"). Delivery is the ID
+* service's relay; the canvas never talks to Resend. The action token is
+* signed by the canvas identity key - owner authorization is implicit in the
+* signature, since only the canvas server holds it.
+*
+* Fire-and-forget, always: a notification that failed must never be the reason
+* a grant did not land. Idempotency lives at the relay, keyed on
+* (origin, template, eventId) - the eventId is derived from the STATE
+* TRANSITION, so a re-invite at the same role sends nothing and a role change
+* sends one.
+*/
+const transitionId = (...parts) => createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 32);
+function relayNotify(ctx, template, recipient, eventId) {
+	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
+	if (recipient.startsWith("@") || !recipient.includes("@")) return;
+	const now = Math.floor(Date.now() / 1e3);
+	let token;
+	try {
+		token = signCanvasJws(ctx.dataDir, {
+			origin: ctx.origin,
+			template,
+			recipient,
+			eventId,
+			iat: now,
+			exp: now + 600
+		}, "marver-relay+jwt");
+	} catch {
+		return;
+	}
+	fetch(`${ctx.issuer.replace(/\/+$/, "")}/relay/notify`, {
+		method: "POST",
+		headers: { authorization: `Bearer ${token}` },
+		signal: AbortSignal.timeout(5e3)
+	}).catch(() => {});
+}
+//#endregion
+//#region src/server/collab.ts
+const MONTH = 2592e3;
+const MAX_BODY = 262144;
+/** The permission seam, per-person since the sharing release: `read` stays
+*  board-level (is it published - no read-privacy claim in v1), `admin` stays
+*  the owner role, and `comment` (which resolve/reopen ride, 01-sharing §7.4)
+*  asks the resolver - blocklist, grants, expiry, ceiling - freshly on every
+*  call, so a revocation or an expiry crossing bites on the next request.
+*  `dataDir` is what connects the seam to the roster; without a roster the
+*  legacy rule (any signed-in user on a comment board) is exactly what runs. */
+function can(user, rights, board, action, dataDir) {
+	if (action === "read") return board in rights;
+	if (action === "admin") return user?.role === "owner";
+	if (!user || rights[board] !== "comment") return false;
+	if (!dataDir) return true;
+	return commentAllowed(dataDir, user, board, ceilingsFromRights(rights));
+}
+const EVENT_TYPES = /* @__PURE__ */ new Set([
+	"create",
+	"reply",
+	"edit",
+	"resolve",
+	"reopen",
+	"react",
+	"profile",
+	"reanchor"
+]);
+const ID_RE = /^[\w-]{8,64}$/;
+const MAX_BODY_TEXT = 1e4;
+/** An avatar the server will store: a raster data-URI whose ACTUAL decoded bytes
+*  match the declared type. The declared MIME alone is a lie an attacker controls
+*  (base64 SVG labelled image/png); the magic bytes are the truth. Capped small -
+*  the client downscales to a 128px jpeg (~15KB), 64KB is generous headroom. */
+function validAvatar(s) {
+	if (typeof s !== "string" || s.length > 65536) return false;
+	const m = /^data:image\/(jpeg|png|webp|gif);base64,([A-Za-z0-9+/]+={0,2})$/.exec(s);
+	if (!m) return false;
+	let head;
+	try {
+		head = Buffer.from(m[2].slice(0, 24), "base64");
+	} catch {
+		return false;
+	}
+	return {
+		jpeg: (b) => b[0] === 255 && b[1] === 216 && b[2] === 255,
+		png: (b) => b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71,
+		gif: (b) => b.toString("latin1", 0, 4) === "GIF8",
+		webp: (b) => b.toString("latin1", 0, 4) === "RIFF" && b.toString("latin1", 8, 12) === "WEBP"
+	}[m[1]]?.(head) ?? false;
+}
+/** Reject anything the log must not absorb. Returns an error string or null.
+*  Events are append-only and synced by id, so acceptance is forever - validate hard. */
+function validateEvents(incoming, log, u, board) {
+	const now = Date.now();
+	const creates = /* @__PURE__ */ new Map();
+	const authors = /* @__PURE__ */ new Map();
+	for (const ev of log) {
+		if (ev.type === "create" && ev.commentId && !creates.has(ev.commentId)) creates.set(ev.commentId, ev);
+		if ((ev.type === "create" || ev.type === "reply") && ev.commentId && ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+	}
+	const me = u.email.toLowerCase();
+	for (const ev of incoming) {
+		if (!ev || typeof ev !== "object") return "malformed event";
+		if (typeof ev.id !== "string" || !ID_RE.test(ev.id)) return "event id must be an 8-64 char token";
+		if (!EVENT_TYPES.has(ev.type)) return `unknown event type "${ev.type}"`;
+		if (ev.agent !== void 0 || ev.agentMeta !== void 0) return "agent provenance is daemon-only";
+		if (ev.author && ev.author.id !== void 0) return "author id is server-assigned";
+		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
+		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
+		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
+			if (ev.type !== "profile") return "event needs a commentId";
+		}
+		switch (ev.type) {
+			case "create":
+				if (creates.has(ev.commentId)) return "a thread with that id already exists";
+				creates.set(ev.commentId, ev);
+				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
+				break;
+			case "reply":
+				if (typeof ev.parentId !== "string" || !creates.has(ev.parentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.parentId)) return "reply parent does not exist";
+				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
+				break;
+			case "edit": {
+				const owner = authors.get(ev.commentId);
+				if (!owner) return "cannot edit a comment that does not exist";
+				if (owner !== me) return "only the author can edit a comment";
+				break;
+			}
+			case "resolve":
+			case "reopen":
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+				break;
+			case "reanchor": {
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot reanchor a thread that does not exist";
+				if (ev.anchor == null) return "reanchor needs a new anchor";
+				const owner = authors.get(ev.commentId);
+				if (owner && owner !== me) return "only the thread author can reanchor";
+				break;
+			}
+		}
+	}
+	return null;
+}
+function collabHandler(dataDir, distDir) {
+	let rights = {};
+	let meta = {};
+	try {
+		meta = JSON.parse(readFileSync(join(distDir, "meta.json"), "utf8"));
+		rights = meta.rights ?? {};
+	} catch {}
+	const commentsDir = join(dataDir, "comments");
+	const idIssuer = (process.env.MARVER_ID_ISSUER ?? "").trim() || null;
+	const publicOrigin = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim() || null;
+	const appOrigin = (process.env.MARVER_APP_ORIGIN ?? "").trim() || "https://app.marver.design";
+	const frontDoorOn = !!idIssuer && !!publicOrigin && meta.frontDoor !== false;
+	const notifyCtx = {
+		dataDir,
+		issuer: idIssuer,
+		origin: publicOrigin,
+		enabled: meta.notify !== false
+	};
+	const threads = /* @__PURE__ */ new Map();
+	for (const b of Object.keys(rights)) threads.set(b, deriveThreads(readLog(commentsDir, b)));
+	const summaryJtis = /* @__PURE__ */ new Map();
+	const boardType = (b) => meta.boards?.[b]?.type ?? "mix";
+	const cors = (res) => {
+		res.setHeader("access-control-allow-origin", appOrigin);
+		res.setHeader("vary", "origin");
+		res.setHeader("access-control-allow-methods", "GET, OPTIONS");
+		res.setHeader("access-control-allow-headers", "authorization");
+		res.setHeader("access-control-max-age", "600");
+	};
+	const bootEpoch = randomBytes(4).toString("hex");
+	let seq = 0;
+	const ring = [];
+	const clients = /* @__PURE__ */ new Map();
+	const broadcast = (board, events) => {
+		for (const ev of events) {
+			const frame = `id: ${bootEpoch}-${++seq}\nevent: comment\ndata: ${JSON.stringify({
+				board,
+				ev
+			})}\n\n`;
+			ring.push({
+				seq,
+				data: frame
+			});
+			if (ring.length > 500) ring.shift();
+			for (const res of clients.keys()) res.write(frame);
+		}
+	};
+	setInterval(() => {
+		for (const res of clients.keys()) res.write(": keepalive\n\n");
+	}, 24e4).unref();
+	const ceilings = ceilingsFromRights(rights);
+	const streamAllowed = (tok) => {
+		const store = shareState(dataDir);
+		if (!store) return true;
+		if (!tok) return store.general.mode !== "private";
+		const u = sessionUser(dataDir, tok);
+		return !!u && entryAllowed(dataDir, u, ceilings);
+	};
+	setInterval(() => {
+		for (const [res, c] of clients) {
+			if (streamAllowed(c.tok)) continue;
+			clients.delete(res);
+			try {
+				res.end();
+			} catch {}
+		}
+	}, 6e4).unref();
+	const attempts = /* @__PURE__ */ new Map();
+	const limited = (...keys) => {
+		const now = Date.now();
+		if (attempts.size > 1e4) {
+			for (const [k, a] of attempts) if (a.reset < now) attempts.delete(k);
+		}
+		if (attempts.size > 2e4) return true;
+		let hit = false;
+		for (const key of keys) {
+			const a = attempts.get(key);
+			if (!a || a.reset < now) attempts.set(key, {
+				n: 1,
+				reset: now + 6e4
+			});
+			else if (++a.n > 10) hit = true;
+		}
+		return hit;
+	};
+	const project = (ev) => {
+		if (!ev.author?.email) return ev;
+		const { email, ...rest } = ev.author;
+		return {
+			...ev,
+			author: {
+				...rest,
+				id: opaqueId(dataDir, email)
+			}
+		};
+	};
+	const rawTransport = (req) => {
+		const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
+		return tok ? sessionIsOperator(dataDir, tok) : false;
+	};
+	const cookie = (req, name) => new RegExp(`(?:^|;\\s*)${name}=([\\w-]+)`).exec(String(req.headers.cookie ?? ""))?.[1];
+	/** browser session cookie, or a bearer token (the dev proxy / agent CLI path -
+	*  same session store, held server-side by the Vite process, never by a page) */
+	const sessionToken = (req) => /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? cookie(req, "mv_s") ?? null;
+	const currentUser = (req) => {
+		const tok = sessionToken(req);
+		return tok ? sessionUser(dataDir, tok) : null;
+	};
+	const json = (res, code, body) => {
+		res.statusCode = code;
+		res.setHeader("content-type", "application/json");
+		res.setHeader("cache-control", "no-store");
+		res.end(JSON.stringify(body));
+	};
+	const readBody = (req) => new Promise((resolve, reject) => {
+		if (!/^application\/json\b/.test(String(req.headers["content-type"] ?? ""))) return reject(/* @__PURE__ */ new Error("content-type must be application/json"));
+		let body = "";
+		let done = false;
+		const settle = (fn) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const timer = setTimeout(() => settle(() => {
+			req.destroy();
+			reject(/* @__PURE__ */ new Error("body timed out"));
+		}), 1e4);
+		if (typeof timer.unref === "function") timer.unref();
+		req.on("data", (c) => {
+			body += c;
+			if (body.length > MAX_BODY) settle(() => {
+				req.destroy();
+				reject(/* @__PURE__ */ new Error("body too large"));
+			});
+		});
+		req.on("end", () => settle(() => {
+			try {
+				resolve(body ? JSON.parse(body) : {});
+			} catch {
+				reject(/* @__PURE__ */ new Error("bad json"));
+			}
+		}));
+		req.on("error", () => settle(() => reject(/* @__PURE__ */ new Error("request failed"))));
+	});
+	const setSession = (req, res, token) => {
+		const secure = secureSuffix(req);
+		res.setHeader("set-cookie", [`mv_s=${token}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`, `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${MONTH}; SameSite=Lax${secure}`]);
+	};
+	const csrfOk = (req) => !!/^Bearer /.test(String(req.headers.authorization ?? "")) || !cookie(req, "mv_s") || !!cookie(req, "mv_c") && req.headers["x-mv-c"] === cookie(req, "mv_c");
+	/** Returns true when the request was handled. Mounted behind the gate by serve. */
+	return async (req, res, url) => {
+		if (!url.pathname.startsWith("/__mv/api/")) return false;
+		const path = url.pathname.slice(10);
+		const ip = process.env.MARVER_TRUSTED_PROXY ? String(req.headers["x-forwarded-for"] ?? req.socket.remoteAddress ?? "?").split(",")[0].trim() : String(req.socket.remoteAddress ?? "?");
+		try {
+			if (frontDoorOn && path === "summary" && req.method === "OPTIONS") {
+				cors(res);
+				res.statusCode = 204;
+				return res.end(), true;
+			}
+			if (frontDoorOn && path === "identity" && req.method === "GET") {
+				cors(res);
+				const id = canvasIdentity(dataDir);
+				return json(res, 200, {
+					kid: id.kid,
+					jwk: id.publicJwk
+				}), true;
+			}
+			if (frontDoorOn && path === "summary" && req.method === "GET") {
+				cors(res);
+				if (String(req.headers.cookie ?? "").trim()) return json(res, 401, { error: "not authorized" }), true;
+				if (limited(`sum:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const tok = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				const { verifyBearerJwt } = await import("./marver-id-CVCoaMGI.mjs");
+				const v = await verifyBearerJwt({
+					token: tok,
+					origin: publicOrigin,
+					issuer: idIssuer,
+					typ: "marver-summary+jwt",
+					azp: appOrigin,
+					maxAgeS: 120
+				});
+				if (!v.ok) return json(res, 401, { error: "not authorized" }), true;
+				const jti = typeof v.claims.jti === "string" ? v.claims.jti : "";
+				if (!jti) return json(res, 401, { error: "not authorized" }), true;
+				{
+					const now = Date.now();
+					for (const [k, e] of summaryJtis) if (e < now) summaryJtis.delete(k);
+					if (summaryJtis.has(jti)) return json(res, 401, { error: "not authorized" }), true;
+					summaryJtis.set(jti, now + 15e4);
+				}
+				const share = shareState(dataDir);
+				const ceilings = ceilingsFromRights(rights);
+				const account = loadStore(dataDir).users.find((u) => normEmail(u.email) === normEmail(v.email));
+				const role = account?.role === "owner" ? "owner" : "member";
+				const resolution = share ? resolveAccess({
+					email: v.email,
+					userRole: account?.role,
+					store: share,
+					ceilings
+				}) : null;
+				if (!(share ? role === "owner" || resolution.entry : !!account)) return json(res, 404, { error: "not found" }), true;
+				const marks = loadSeen(dataDir)[normEmail(v.email)] ?? {};
+				let open = 0, unread = 0;
+				for (const [b, st] of threads) {
+					open += st.open.size;
+					unread += unreadCount(st, marks[b]);
+				}
+				const boardNames = Object.keys(rights);
+				const payload = {
+					v: 1,
+					name: meta.name ?? "Marver",
+					role: resolution?.role ?? (account ? "comment" : "view"),
+					type: boardType(boardNames[0] ?? ""),
+					boards: boardNames.map((b) => ({
+						name: b,
+						role: resolution?.boards[b] ?? (rights[b] === "comment" ? "comment" : "view"),
+						type: boardType(b)
+					})),
+					threads: {
+						open,
+						unread
+					},
+					owner: role === "owner",
+					...role === "owner" ? { people: loadStore(dataDir).users.length } : {},
+					kid: canvasIdentity(dataDir).kid
+				};
+				res.statusCode = 200;
+				res.setHeader("content-type", "application/jose");
+				res.setHeader("cache-control", "no-store");
+				return res.end(signCanvasJws(dataDir, payload)), true;
+			}
+			if (idIssuer && publicOrigin && path === "request-access" && req.method === "POST") {
+				if (limited(`req:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const b = await readBody(req).catch(() => null);
+				const requestedRole = b?.requestedRole === "comment" ? "comment" : "view";
+				const note = typeof b?.note === "string" ? b.note.slice(0, 500) : void 0;
+				const share = shareState(dataDir);
+				const notBlocked = (email) => !share || provisionVerdict(share, email) !== "blocked";
+				const tok0 = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
+				const tok = tok0?.includes(".") ? tok0 : void 0;
+				const sessionCaller = tok || !b ? null : currentUser(req);
+				const tellOwner = (asker, put) => {
+					if (!put.fresh) return;
+					const owner = loadStore(dataDir).users.find((u) => u.role === "owner");
+					if (owner) relayNotify(notifyCtx, "access-requested", owner.email, transitionId("asked", asker, put.at));
+				};
+				if (b && tok) {
+					const v = verifyCanvasJws(dataDir, tok, "marver-reqaccess+jwt", publicOrigin);
+					if (v.ok && typeof v.claims.email === "string" && notBlocked(v.claims.email)) {
+						const put = putRequest(dataDir, {
+							email: v.claims.email,
+							name: typeof v.claims.name === "string" ? v.claims.name : void 0,
+							picture: typeof v.claims.picture === "string" ? v.claims.picture : void 0,
+							requestedRole,
+							target: typeof v.claims.target === "string" && v.claims.target ? v.claims.target.slice(0, 300) : void 0,
+							note
+						});
+						tellOwner(v.claims.email, put);
+					}
+				} else if (sessionCaller && csrfOk(req) && notBlocked(sessionCaller.email)) tellOwner(sessionCaller.email, putRequest(dataDir, {
+					email: sessionCaller.email,
+					name: sessionCaller.name,
+					requestedRole,
+					note
+				}));
+				return json(res, 202, { ok: true }), true;
+			}
+			if (path.startsWith("share/")) {
+				if (req.method === "OPTIONS") {
+					cors(res);
+					res.setHeader("access-control-allow-methods", "GET, PUT, POST, DELETE, OPTIONS");
+					res.setHeader("access-control-allow-headers", "authorization, content-type, x-mv-salt");
+					res.statusCode = 204;
+					return res.end(), true;
+				}
+				if (String(req.headers.cookie ?? "").trim()) {
+					cors(res);
+					return json(res, 403, { error: "owner only" }), true;
+				}
+				let bodyBuf;
+				try {
+					bodyBuf = req.method === "GET" ? Buffer.alloc(0) : await new Promise((resolve, reject) => {
+						const chunks = [];
+						let size = 0;
+						const onData = (c) => {
+							chunks.push(c);
+							size += c.length;
+							if (size > MAX_BODY) {
+								req.removeListener("data", onData);
+								req.pause();
+								reject(/* @__PURE__ */ new Error("body too large"));
+							}
+						};
+						req.on("data", onData);
+						req.on("end", () => resolve(Buffer.concat(chunks)));
+						req.on("error", () => reject(/* @__PURE__ */ new Error("request failed")));
+					});
+				} catch (err) {
+					cors(res);
+					res.setHeader("connection", "close");
+					return json(res, 422, { error: err.message }), true;
+				}
+				const body = bodyBuf.toString("utf8");
+				const tok = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				const owner = loadStore(dataDir).users.find((u) => u.role === "owner");
+				let allowed = false;
+				const su = tok ? sessionUser(dataDir, tok) : null;
+				if (su && su.role === "owner") allowed = true;
+				if (!allowed && tok && idIssuer && publicOrigin) {
+					const { verifyBearerJwt } = await import("./marver-id-CVCoaMGI.mjs");
+					const v = await verifyBearerJwt({
+						token: tok,
+						origin: publicOrigin,
+						issuer: idIssuer,
+						typ: "marver-owner-api+jwt",
+						azp: appOrigin,
+						maxAgeS: 300
+					});
+					const subjectOk = owner?.idSubject ? owner.idSubject === `${idIssuer}#${v.ok ? v.sub : ""}` : true;
+					if (v.ok && owner && subjectOk && normEmail(v.email) === normEmail(owner.email)) {
+						if (req.method === "GET") allowed = true;
+						else {
+							const etag = rosterEtag(dataDir);
+							const claimedEtag = typeof v.claims.etag === "string" ? v.claims.etag : "";
+							if (claimedEtag && claimedEtag !== etag) {
+								cors(res);
+								return json(res, 409, { error: "roster changed - re-read and retry" }), true;
+							}
+							const salt = String(req.headers["x-mv-salt"] ?? "");
+							const bodyHash = createHash("sha256").update(bodyBuf).digest("hex");
+							const want = createHash("sha256").update(`${req.method}\n${url.pathname}\n${bodyHash}\n${etag}${salt ? `\n${salt}` : ""}`).digest("hex");
+							if (v.claims.digest === want) allowed = true;
+						}
+					}
+				}
+				cors(res);
+				if (!allowed) return json(res, 403, { error: "owner only" }), true;
+				const b = body ? (() => {
+					try {
+						return JSON.parse(body);
+					} catch {
+						return null;
+					}
+				})() : {};
+				if (b === null) return json(res, 422, { error: "bad json" }), true;
+				const ceilings = ceilingsFromRights(rights);
+				const roster = () => {
+					const s = loadShare(dataDir);
+					const history = {};
+					const allAuthors = /* @__PURE__ */ new Set();
+					for (const [b, st] of threads) {
+						const authors = /* @__PURE__ */ new Set();
+						for (const e of st.events) if (e.author?.email) {
+							authors.add(e.author.email.toLowerCase());
+							allAuthors.add(e.author.email.toLowerCase());
+						}
+						if (authors.size) history[b] = authors.size;
+					}
+					return {
+						general: s?.general ?? {
+							mode: "private",
+							role: "view"
+						},
+						blocked: s?.blocked ?? [],
+						grants: s?.grants ?? [],
+						requests: loadRequests(dataDir).map(({ exp, ...r }) => r),
+						etag: rosterEtag(dataDir),
+						ceilings,
+						history,
+						historyAuthors: allAuthors.size,
+						gate: idIssuer ? "identity" : process.env.MARVER_PASSWORD ? "password" : "open"
+					};
+				};
+				const withEtag = (r) => {
+					res.setHeader("etag", `"${r.etag}"`);
+					return r;
+				};
+				try {
+					const sub = path.slice(6);
+					if (sub === "roster" && req.method === "GET") return json(res, 200, withEtag(roster())), true;
+					if (sub === "explain" && req.method === "GET") {
+						const who = String(url.searchParams.get("who") ?? "");
+						if (!who) return json(res, 422, { error: "who is required" }), true;
+						const s = loadShare(dataDir);
+						if (!s) return json(res, 422, { error: "no roster yet" }), true;
+						const asEmail = who.startsWith("@") ? `probe-${randomBytes(8).toString("hex")}${who}` : who;
+						const account = loadStore(dataDir).users.find((u) => normEmail(u.email) === normEmail(asEmail));
+						const r = resolveAccess({
+							email: asEmail,
+							userRole: account?.role,
+							store: s,
+							ceilings
+						});
+						return json(res, 200, {
+							who,
+							entry: r.entry,
+							role: r.role,
+							boards: r.boards,
+							trace: r.trace
+						}), true;
+					}
+					if (sub === "grant" && req.method === "PUT") {
+						const g = upsertGrant(dataDir, ceilings, {
+							principal: String(b.principal ?? ""),
+							scope: b.scope === "canvas" ? "canvas" : String(b.scope ?? ""),
+							assigned: b.assigned === "comment" ? "comment" : "view",
+							expires: typeof b.expires === "string" ? b.expires : null,
+							by: owner?.email ?? "owner"
+						}, { identityMode: !!idIssuer });
+						if (g.changed) relayNotify(notifyCtx, "invited", g.principal, transitionId("invited", g.principal, g.assigned, g.at));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "grant" && req.method === "DELETE") {
+						removeGrant(dataDir, String(b.principal ?? ""), b.scope === "canvas" ? "canvas" : String(b.scope ?? ""));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "reconfirm" && req.method === "POST") {
+						reconfirmGrant(dataDir, ceilings, String(b.principal ?? ""), b.scope === "canvas" ? "canvas" : String(b.scope ?? ""), String(b.board ?? ""));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "general" && req.method === "PUT") {
+						const mode = String(b.mode ?? "");
+						if (mode !== "private" && mode !== "password" && mode !== "public") return json(res, 422, { error: "mode must be private | password | public" }), true;
+						const operative = operativeMode(mode, {
+							password: !!process.env.MARVER_PASSWORD && !idIssuer,
+							issuer: !!idIssuer
+						});
+						setGeneralMode(dataDir, operative);
+						const r = withEtag(roster());
+						return json(res, 200, operative === mode ? r : {
+							...r,
+							clamped: {
+								asked: mode,
+								operative
+							}
+						}), true;
+					}
+					if (sub === "block" && (req.method === "PUT" || req.method === "DELETE")) {
+						const address = String(b.address ?? "");
+						if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(address)) return json(res, 422, { error: "a valid address is required" }), true;
+						setBlocked(dataDir, address, req.method === "PUT");
+						return json(res, 200, withEtag(roster())), true;
+					}
+					const rm = /^request\/(.+)$/.exec(sub);
+					if (rm && req.method === "POST") {
+						const email = decodeURIComponent(rm[1]);
+						const approved = b.approve === true ? {
+							assigned: b.assigned === "comment" ? "comment" : "view",
+							by: owner?.email ?? "owner"
+						} : null;
+						if (!resolveRequest(dataDir, ceilings, email, approved)) return json(res, 422, { error: "no pending request for that address" }), true;
+						if (approved) relayNotify(notifyCtx, "request-approved", email, transitionId("approved", email, approved.assigned, (/* @__PURE__ */ new Date()).toISOString()));
+						return json(res, 200, withEtag(roster())), true;
+					}
+				} catch (err) {
+					return json(res, 422, { error: err.message }), true;
+				}
+				return json(res, 422, { error: "no such share route" }), true;
+			}
+			if (path === "seen" && req.method === "POST") {
+				if (!csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
+				const u = currentUser(req);
+				if (!u) return json(res, 401, { error: "sign in first" }), true;
+				const b = await readBody(req);
+				const board = String(b.board ?? "");
+				const st = threads.get(board);
+				if (!st) return json(res, 422, { error: "unknown board" }), true;
+				const latest = st.events[st.events.length - 1]?.id;
+				if (latest) markSeen(dataDir, normEmail(u.email), board, latest);
+				res.statusCode = 204;
+				return res.end(), true;
+			}
+			if (req.method === "GET") {
+				if (path === "me") {
+					const u = currentUser(req);
+					if (!u) return json(res, 401, { error: "signed out" }), true;
+					const share = shareState(dataDir);
+					const boards = share ? resolveAccess({
+						email: u.email,
+						userRole: u.role,
+						store: share,
+						ceilings: ceilingsFromRights(rights)
+					}).boards : Object.fromEntries(Object.entries(rights).map(([b, r]) => [b, r === "comment" ? "comment" : "view"]));
+					return json(res, 200, {
+						user: publicUser(u),
+						role: u.role,
+						id: opaqueId(dataDir, u.email),
+						boards
+					}), true;
+				}
+				if (path === "boards") {
+					const name = ownerName(dataDir);
+					return json(res, 200, {
+						rights,
+						stored: listBoards(commentsDir),
+						...name ? { owner: { name } } : {}
+					}), true;
+				}
+				const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
+				if (m) {
+					if (!can(currentUser(req), rights, m[1], "read")) return json(res, 404, { error: "no such board" }), true;
+					const events = readLog(commentsDir, m[1]);
+					return json(res, 200, { events: rawTransport(req) ? events : events.map(project) }), true;
+				}
+				if (path === "invite-info") {
+					if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+					const info = inviteInfo(dataDir, String(url.searchParams.get("token") ?? ""));
+					return json(res, info ? 200 : 404, info ?? { error: "this invite link is invalid, expired, or already used" }), true;
+				}
+				if (path === "events") {
+					const tok = sessionToken(req);
+					if (!streamAllowed(tok)) return json(res, 401, { error: "not authorized" }), true;
+					res.statusCode = 200;
+					res.setHeader("content-type", "text/event-stream");
+					res.setHeader("cache-control", "no-store");
+					res.setHeader("x-accel-buffering", "no");
+					res.write(": connected\n\n");
+					const lastRaw = String(req.headers["last-event-id"] ?? "");
+					const lm = /^([0-9a-f]{8})-(\d+)$/.exec(lastRaw);
+					if (lastRaw) {
+						const last = lm && lm[1] === bootEpoch ? Number(lm[2]) : NaN;
+						if (!Number.isFinite(last)) res.write("event: resync\ndata: {}\n\n");
+						else {
+							const missed = ring.filter((r) => r.seq > last);
+							if (missed.length && missed[0].seq !== last + 1) res.write("event: resync\ndata: {}\n\n");
+							else for (const r of missed) res.write(r.data);
+						}
+					}
+					clients.set(res, { tok });
+					req.on("close", () => clients.delete(res));
+					return true;
+				}
+				return false;
+			}
+			if (req.method !== "POST") return false;
+			if (!(path === "auth/claim" || path === "auth/signin") && !csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
+			if (path === "auth/claim") {
+				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const b = await readBody(req);
+				const { user, session } = claimInvite(dataDir, String(b.token ?? ""), {
+					password: String(b.password ?? ""),
+					name: String(b.name ?? ""),
+					avatar: validAvatar(b.avatar) ? b.avatar : void 0
+				}, ceilings);
+				setSession(req, res, session);
+				return json(res, 200, { user: publicUser(user) }), true;
+			}
+			if (path === "auth/signin") {
+				const b = await readBody(req);
+				const email = String(b.email ?? "").trim().toLowerCase();
+				if (limited(`ip:${ip}`, `em:${email}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const hit = signIn(dataDir, email, String(b.password ?? ""), ceilings);
+				if (!hit) return json(res, 401, { error: "wrong email or password" }), true;
+				setSession(req, res, hit.session);
+				return json(res, 200, { user: publicUser(hit.user) }), true;
+			}
+			if (path === "auth/signout") {
+				const tok = cookie(req, "mv_s");
+				if (tok) signOut(dataDir, tok);
+				res.setHeader("set-cookie", ["mv_s=; Path=/; Max-Age=0; HttpOnly", "mv_c=; Path=/; Max-Age=0"]);
+				return json(res, 200, {}), true;
+			}
+			if (path === "profile") {
+				const u = currentUser(req);
+				if (!u) return json(res, 401, { error: "sign in first" }), true;
+				const b = await readBody(req);
+				const next = updateProfile(dataDir, u.email, {
+					name: typeof b.name === "string" ? b.name : void 0,
+					avatar: b.avatar === "" ? "" : validAvatar(b.avatar) ? b.avatar : void 0
+				});
+				return json(res, 200, { user: publicUser(next) }), true;
+			}
+			if (path === "cli-session") {
+				const bearer = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const issued = issueDeviceSession(dataDir, bearer);
+				if (!issued) return json(res, 401, { error: "MARVER_CLI_TOKEN was refused, or nobody owns this canvas yet" }), true;
+				return json(res, 200, {
+					token: issued.token,
+					exp: issued.exp,
+					user: publicUser(issued.user)
+				}), true;
+			}
+			if (path === "invite") {
+				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
+				const b = await readBody(req);
+				const email = String(b.email ?? "");
+				if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return json(res, 400, { error: "a valid email is required" }), true;
+				const idMode = !!process.env.MARVER_ID_ISSUER;
+				return json(res, 200, {
+					...createInvite(dataDir, email),
+					idMode
+				}), true;
+			}
+			if (path === "revoke") {
+				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
+				const b = await readBody(req);
+				revokeUser(dataDir, String(b.email ?? ""));
+				return json(res, 200, {}), true;
+			}
+			const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
+			if (m) {
+				const u = currentUser(req);
+				if (!can(u, rights, m[1], "comment", dataDir)) return json(res, u ? 403 : 401, { error: u ? `this board is read-only - ask ${ownerName(dataDir) ?? "the canvas owner"} for commenting access` : "sign in to comment" }), true;
+				const b = await readBody(req);
+				const incoming = Array.isArray(b.events) ? b.events : [];
+				if (incoming.length > 100) return json(res, 400, { error: "too many events in one push" }), true;
+				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1]);
+				if (bad) return json(res, 400, { error: bad }), true;
+				const fresh = appendEvents(commentsDir, m[1], incoming);
+				if (fresh.length) {
+					const st = threads.get(m[1]);
+					threads.set(m[1], deriveThreads([...st?.events ?? [], ...fresh]));
+				}
+				broadcast(m[1], fresh.map(project));
+				return json(res, 200, { accepted: fresh.length }), true;
+			}
+			return false;
+		} catch (err) {
+			return json(res, 400, { error: err.message }), true;
+		}
+	};
+}
+//#endregion
+export { collabHandler, validAvatar };