@marver-design/marver 0.11.0 → 0.12.0

package/templates/instructions/publish.md

@@ -152,6 +152,16 @@ somebody owns it there is nobody for the token to be. `connect` trades it for an
 ordinary session and stores THAT, so the secret never lands in your repo.
 Rotating `MARVER_CLI_TOKEN` ends every session it minted.
 
+Then invite people by address, and send them nothing:
+
+```bash
+marver comments invite colleague@company.com
+#    → in identity mode the ADDRESS is the invitation. They open the canvas URL,
+#      sign in as themselves, and the invite is spent by that sign-in. There is
+#      no link to forward and no canvas password to send with it - the claim link
+#      is deliberately shut off in identity mode, so do not go looking for one.
+```
+
 It is a deployment variable and not something a page hands out, because authored
 frames run same-origin in a canvas: frame code can read `mv_c` and ride the
 viewer's session, so anything a browser can mint, a frame can mint silently. A
@@ -192,7 +202,11 @@ through sign-in.
 - `<MARVER_DATA_DIR>/comments/<board>.jsonl` - the live event log, on the volume.
 - `<MARVER_DATA_DIR>/auth.json` - accounts (scrypt), sessions, invites, on the volume.
 - `design/comments/<board>.jsonl` - the dev-side mirror, git-tracked: feedback
-  has history, and the volume has an off-site replica for free.
+  has history, and the volume has an off-site replica for free. **Each event
+  carries its author's email address** - that is how the canvas decides who may
+  edit or resolve their own thread. Harmless in a private repo; if yours is
+  public, or may become public, gitignore `design/comments/` and let the volume
+  be the record. The canvas keeps its own copy either way, so nothing is lost.
 - `~/.marver/canvases/<project-hash>.json` - THIS machine's device credential, kept
   OUTSIDE the repo because `marver dev` serves the repo;
   never commit it.

package/dist/auth-B5yuwnOq.mjs

@@ -1,494 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-//#region src/server/auth.ts
-/**
-* Accounts, invites, sessions - the minimal credible implementation,
-* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
-* opaque session tokens stored hashed, single-use invite links as the identity
-* bootstrap (no email infrastructure anywhere).
-*
-* Password = read, account = comment: everything here concerns accounts only; the
-* shared gate password (serve.ts) remains the outer READ boundary.
-*
-* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
-* users change rarely; the event-log treatment is reserved for comments.
-*/
-var auth_exports = /* @__PURE__ */ __exportAll({
-	CLI_TOKEN_CHARS: () => CLI_TOKEN_CHARS,
-	MIN_CLI_TOKEN: () => 32,
-	attachAvatar: () => attachAvatar,
-	avatarSourceFor: () => avatarSourceFor,
-	claimInvite: () => claimInvite,
-	cliTokenProblem: () => cliTokenProblem,
-	createInvite: () => createInvite,
-	inviteInfo: () => inviteInfo,
-	issueDeviceSession: () => issueDeviceSession,
-	loadStore: () => loadStore,
-	normEmail: () => normEmail,
-	operatorUser: () => operatorUser,
-	ownerName: () => ownerName,
-	provisionFromMarverId: () => provisionFromMarverId,
-	publicUser: () => publicUser,
-	revokeUser: () => revokeUser,
-	sessionUser: () => sessionUser,
-	signIn: () => signIn,
-	signOut: () => signOut,
-	updateProfile: () => updateProfile
-});
-const SCRYPT = {
-	N: 2 ** 15,
-	r: 8,
-	p: 1,
-	keylen: 32,
-	maxmem: 67108864
-};
-const INVITE_TTL = 6048e5;
-const SESSION_TTL = 2592e6;
-const normEmail = (e) => e.trim().toLowerCase();
-const sha256 = (s) => createHash("sha256").update(s).digest("hex");
-const token = () => randomBytes(32).toString("base64url");
-const storeFile = (dir) => join(dir, "auth.json");
-/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
-*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
-*  a later save overwrite every account. */
-function loadStore(dir) {
-	let raw;
-	try {
-		raw = readFileSync(storeFile(dir), "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return {
-			users: [],
-			invites: [],
-			sessions: []
-		};
-		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
-	}
-	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
-	return parsed;
-}
-/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
-*  0600 throughout: the store holds emails and password verifiers. */
-function saveStore(dir, store) {
-	const file = storeFile(dir);
-	mkdirSync(dirname(file), { recursive: true });
-	const now = Date.now();
-	store.invites = store.invites.filter((i) => i.exp > now);
-	store.sessions = store.sessions.filter((s) => s.exp > now);
-	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
-	const fd = openSync(tmp, "wx", 384);
-	try {
-		writeSync(fd, JSON.stringify(store, null, 2));
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
-	}
-	renameSync(tmp, file);
-}
-/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
-*  the store mutations are already synchronous and atomic; this covers deploy overlap
-*  and any accidental multi-instance run (the supported setup is single-instance) -
-*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
-*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
-*  fails loudly rather than hanging. */
-function withLock(dir, fn) {
-	mkdirSync(dir, { recursive: true });
-	const lock = join(dir, ".auth.lock");
-	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	const deadline = Date.now() + 5e3;
-	for (;;) try {
-		closeSync(openSync(lock, "wx"));
-		break;
-	} catch (e) {
-		if (e.code !== "EEXIST") throw e;
-		try {
-			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
-				unlinkSync(lock);
-				continue;
-			}
-		} catch {
-			continue;
-		}
-		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
-		nap(25);
-	}
-	try {
-		return fn();
-	} finally {
-		try {
-			unlinkSync(lock);
-		} catch {}
-	}
-}
-const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
-/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
-*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
-*  token is returned exactly once; only its hash is stored. */
-/** The owner's display name - public-safe (never the email). Null before claim. */
-function ownerName(dir) {
-	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
-}
-/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
-*  token is the proof - holding it means the owner sent it to you. */
-function inviteInfo(dir, rawToken) {
-	const hash = sha256(rawToken);
-	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-	return invite ? { email: invite.emailNorm } : null;
-}
-function createInvite(dir, email) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
-		const raw = token();
-		const exp = Date.now() + INVITE_TTL;
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		store.invites.push({
-			emailNorm: normEmail(email),
-			tokenHash: sha256(raw),
-			exp
-		});
-		saveStore(dir, store);
-		return {
-			token: raw,
-			exp
-		};
-	});
-}
-/** Claim an invite: burns it, creates the account, opens the first session. */
-function claimInvite(dir, rawToken, profile) {
-	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
-	if (!profile.name.trim()) throw new Error("a display name is required");
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
-		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
-		if (findUser(store, invite.emailNorm)) {
-			store.invites = store.invites.filter((i) => i !== invite);
-			saveStore(dir, store);
-			throw new Error("an account already exists for this address - sign in instead");
-		}
-		store.invites = store.invites.filter((i) => i !== invite);
-		const salt = randomBytes(16).toString("hex");
-		const user = {
-			email: invite.emailNorm,
-			name: profile.name.trim(),
-			avatar: profile.avatar,
-			role: store.users.length ? "member" : "owner",
-			salt,
-			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
-			params: SCRYPT,
-			createdAt: Date.now()
-		};
-		store.users.push(user);
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-/** Password sign-in. One generic failure - never reveal whether the email exists. */
-function signIn(dir, email, password) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const found = findUser(store, email);
-		const user = found && found.auth !== "marver-id" && found.salt && found.hash ? found : null;
-		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
-		const params = user?.params ?? SCRYPT;
-		const got = scryptSync(password, salt, params.keylen, params);
-		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
-		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-/**
-* Turn a verified Marver ID identity into a local session.
-*
-* The identity service has already proved who this person is; this function
-* decides whether they may in - and that decision is LOCAL, which is the whole
-* shape of L1a. The identity service knows nothing about who is allowed where.
-*
-* `allowed` is the owner's allowlist. An email that is not on it gets no account
-* and no session: being able to prove you are someone is not the same as being
-* invited. The first allowed account to arrive owns the canvas, matching the
-* invite flow's rule.
-*
-* No password is fabricated. A marver-id account carries no salt or hash at all,
-* so there is no second, weaker door into it.
-*/
-function provisionFromMarverId(dir, identity, opts = {}) {
-	const emailNorm = normEmail(identity.email);
-	if (!emailNorm) return null;
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const qualified = `${identity.issuer}#${identity.subject}`;
-		const bound = store.users.find((u) => u.idSubject === qualified);
-		const existing = bound ?? findUser(store, emailNorm);
-		if (bound && normEmail(bound.email) !== emailNorm) {
-			const clash = findUser(store, emailNorm);
-			if (clash && clash !== bound) return null;
-			const vacated = normEmail(bound.email);
-			bound.email = emailNorm;
-			store.sessions = store.sessions.filter((s) => s.emailNorm !== vacated);
-		}
-		const invite = store.invites.find((i) => i.emailNorm === emailNorm && i.exp > Date.now());
-		const ownerNorm = opts.ownerEmail ? normEmail(opts.ownerEmail) : "";
-		const reservedForOwner = !!ownerNorm && !store.users.length && ownerNorm !== emailNorm;
-		const isBootstrapOwner = !!ownerNorm && !store.users.length && ownerNorm === emailNorm;
-		if (reservedForOwner) return null;
-		if (!existing && !invite && !isBootstrapOwner) return null;
-		if (invite) store.invites = store.invites.filter((i) => i !== invite);
-		let user = existing;
-		if (user) {
-			if (!user.idSubject) user.idSubject = qualified;
-			else if (user.idSubject === identity.subject) user.idSubject = qualified;
-			else if (user.idSubject !== qualified) return null;
-		} else {
-			user = {
-				email: emailNorm,
-				name: identity.name || emailNorm.split("@")[0] || emailNorm,
-				role: store.users.length ? "member" : "owner",
-				auth: "marver-id",
-				idSubject: `${identity.issuer}#${identity.subject}`,
-				createdAt: Date.now()
-			};
-			store.users.push(user);
-		}
-		if (identity.name && (!user.name || user.name === emailNorm.split("@")[0])) user.name = identity.name;
-		const session = pushSession(store, user);
-		saveStore(dir, store);
-		return {
-			user,
-			session
-		};
-	});
-}
-/**
-* Attach a picture the identity service supplied.
-*
-* Separate from provisioning because the fetch happens after admission and
-* outside the lock, so by the time there are bytes the account already exists.
-*
-* `avatarSource` is what makes this safe to repeat: its presence means "this
-* picture came from the identity service", and only such a picture may be
-* replaced. An avatar with no source was chosen HERE, by the person, and the
-* identity service does not get to overwrite it - which is the same rule the
-* name follows.
-*
-* Replacing a rotated one is the point. Refusing to, as an earlier version did,
-* meant the stored source never caught up with the assertion, so every single
-* sign-in fetched the new picture and then threw it away.
-*/
-function attachAvatar(dir, subjectQualified, avatar, source, expected) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = store.users.find((u) => u.idSubject === subjectQualified);
-		if (!user) return;
-		if (user.avatar && !user.avatarSource) return;
-		if (user.avatarSource !== expected) return;
-		user.avatar = avatar;
-		user.avatarSource = source;
-		saveStore(dir, store);
-	});
-}
-/**
-* Would a picture from the identity service actually be used?
-*
-* Read-only and outside the lock, so the gate can decide whether a network
-* fetch is worth making before it commits to one. Worst case it is wrong and we
-* fetch a picture that then gets discarded - which costs one request, versus
-* fetching an avatar on every single sign-in forever.
-*/
-function avatarSourceFor(dir, subjectQualified, email, pictureUrl) {
-	const store = loadStore(dir);
-	const user = store.users.find((u) => u.idSubject === subjectQualified) ?? findUser(store, normEmail(email));
-	if (!user) return {
-		wanted: true,
-		source: void 0
-	};
-	if (!user.avatar) return {
-		wanted: true,
-		source: user.avatarSource
-	};
-	if (!user.avatarSource) return {
-		wanted: false,
-		source: void 0
-	};
-	return {
-		wanted: user.avatarSource !== pictureUrl,
-		source: user.avatarSource
-	};
-}
-function pushSession(store, user) {
-	const raw = token();
-	store.sessions.push({
-		tokenHash: sha256(raw),
-		emailNorm: normEmail(user.email),
-		exp: Date.now() + SESSION_TTL
-	});
-	return raw;
-}
-function sessionUser(dir, rawToken) {
-	const store = loadStore(dir);
-	const hash = sha256(rawToken);
-	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
-	if (!s) return null;
-	if (s.via && s.via !== operatorFingerprint()) return null;
-	return store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null;
-}
-/** The alphabet a bearer token can actually travel in: both the gate and the API
-*  parse `Authorization` with `[\w-]+`, so a secret containing anything else is
-*  accepted at boot and then silently unusable. Checked HERE as well as at boot so
-*  the two can never drift apart. */
-const CLI_TOKEN_CHARS = /^[\w-]+$/;
-/**
-* The operator's own credential, read from the deployment environment.
-*
-* `comments connect` authenticates with a password, and an identity account has
-* none by design - so on an identity-gated canvas the whole CLI surface (invite,
-* revoke, and the comment sync the agent loop runs on) had no reachable
-* credential. This is the door, and where it lives is the entire point.
-*
-* The obvious alternative - a page that mints a token for whoever is signed in -
-* is the device flow this project already built and pulled (2d0850c). Authored
-* frames run same-origin in a canvas: frame JavaScript reads `mv_c`, every
-* request it makes carries the viewer's session, so any browser-reachable way to
-* mint a durable token is a way for a frame to mint one silently and carry it
-* off. There is no header that separates a frame from its own origin.
-*
-* An environment variable is on the other side of that line. It is never sent to
-* a page, no frame can read it, and reaching it already means reaching the
-* deployment - at which point the canvas was never the weakest thing in the room.
-* The cost is honest: it is a static secret that rotates by redeploying, and it
-* acts as the owner, so it is an operator credential rather than a person's.
-*/
-function operatorUser(dir, presented) {
-	return operatorMatch(presented) ? ownerOf(dir) : null;
-}
-/** The owner's account, or null on a canvas nobody has claimed yet. Chosen by
-*  stored ROLE, never by array order or by whatever MARVER_OWNER_EMAIL currently
-*  says - that variable only ever nominated a bootstrap account, and honouring it
-*  afterwards would let a changed environment repoint this at a different person. */
-const ownerOf = (dir) => loadStore(dir).users.find((u) => u.role === "owner") ?? null;
-/**
-* Why a configured `MARVER_CLI_TOKEN` is unusable, or null when it is fine.
-*
-* One function so that boot and the matcher can never disagree. They did: boot
-* trimmed the value before checking it while `comments connect` sent the shell's
-* value as-is, so `" abcd... "` started a canvas that then refused the operator's
-* own token with no explanation anywhere. Surrounding whitespace is now a refusal
-* rather than something quietly repaired on one side of the wire.
-*/
-function cliTokenProblem(raw) {
-	if (!raw) return null;
-	if (raw !== raw.trim()) return "MARVER_CLI_TOKEN has whitespace around it - quote it, or drop the quotes that put it there";
-	if (raw.length < 32) return `MARVER_CLI_TOKEN is too short to be a bearer credential (${raw.length} chars, needs 32)`;
-	if (!CLI_TOKEN_CHARS.test(raw)) return "MARVER_CLI_TOKEN contains characters that cannot travel in an Authorization header";
-	return null;
-}
-/** The configured secret, or '' when there is none worth honouring. Never trimmed
-*  into shape: a value that needed trimming was refused at boot. */
-const operatorSecret = () => {
-	const raw = process.env.MARVER_CLI_TOKEN ?? "";
-	return raw && !cliTokenProblem(raw) ? raw : "";
-};
-/** A fingerprint of the current secret, so a session can record WHICH one minted
-*  it. The hash, never the value: this is written to auth.json, and a store that
-*  quietly contains the operator's credential is the thing being avoided. */
-const operatorFingerprint = () => {
-	const secret = operatorSecret();
-	return secret ? sha256(`cli-generation:${secret}`) : "";
-};
-function operatorMatch(presented) {
-	const secret = operatorSecret();
-	if (!secret || !presented) return false;
-	return timingSafeEqual(Buffer.from(sha256(presented), "hex"), Buffer.from(sha256(secret), "hex"));
-}
-/**
-* Trade the operator's secret for an ordinary session, once, from the terminal.
-*
-* The secret itself must not become the thing a repo carries. `connect` persists
-* whatever it is given, and that file sits on a developer's disk for as long as
-* the project lasts - a non-expiring master key is the wrong shape for it. What comes back here expires, dies with
-* `comments revoke`, and can be replaced without touching the deployment.
-*
-* Only the operator secret opens this. Deliberately NOT any signed-in session:
-* authored frames run same-origin and ride the viewer's cookies, so a route that
-* minted sessions for whoever was signed in would be the pulled device flow
-* (2d0850c) with a different name. A frame cannot present this Bearer, because
-* the value it needs was never in the browser.
-*/
-function issueDeviceSession(dir, presented) {
-	if (!operatorMatch(presented)) return null;
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = store.users.find((u) => u.role === "owner");
-		if (!user) return null;
-		const token = pushSession(store, user);
-		store.sessions[store.sessions.length - 1].via = operatorFingerprint();
-		saveStore(dir, store);
-		return {
-			token,
-			exp: Date.now() + SESSION_TTL,
-			user
-		};
-	});
-}
-function signOut(dir, rawToken) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		const hash = sha256(rawToken);
-		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
-		saveStore(dir, store);
-	});
-}
-/** Update name/avatar on an existing account. */
-function updateProfile(dir, email, patch) {
-	return withLock(dir, () => {
-		const store = loadStore(dir);
-		const user = findUser(store, email);
-		if (!user) throw new Error("no such account");
-		if (patch.name?.trim()) user.name = patch.name.trim();
-		if (patch.avatar !== void 0) {
-			user.avatar = patch.avatar || void 0;
-			user.avatarSource = void 0;
-		}
-		saveStore(dir, store);
-		return user;
-	});
-}
-/** Remove an account and all its sessions (owner action). The LAST owner cannot be
-*  removed - a store with members but no owner has no one left to administer it,
-*  and bootstrap will not re-run while any user exists. */
-function revokeUser(dir, email) {
-	withLock(dir, () => {
-		const store = loadStore(dir);
-		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
-		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
-		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
-		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
-		saveStore(dir, store);
-	});
-}
-/** The public shape of a user - what other viewers (and events) may see. */
-const publicUser = (u) => ({
-	email: u.email,
-	name: u.name,
-	avatar: u.avatar
-});
-//#endregion
-export { claimInvite as a, issueDeviceSession as c, publicUser as d, revokeUser as f, updateProfile as g, signOut as h, avatarSourceFor as i, ownerName as l, signIn as m, attachAvatar as n, createInvite as o, sessionUser as p, auth_exports as r, inviteInfo as s, CLI_TOKEN_CHARS as t, provisionFromMarverId as u };