@marver-design/marver 0.11.1 → 0.12.0

package/dist/collab-CWaG3Q4w.mjs

@@ -1,340 +0,0 @@
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { a as claimInvite, c as issueDeviceSession, d as publicUser, f as revokeUser, g as updateProfile, h as signOut, l as ownerName, m as signIn, o as createInvite, p as sessionUser, s as inviteInfo } from "./auth-B5yuwnOq.mjs";
-import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { randomBytes } from "node:crypto";
-//#region src/server/collab.ts
-const MONTH = 2592e3;
-const MAX_BODY = 262144;
-/** The permission seam: v1 derives from publish policy + membership;
-*  a per-user ACL can replace the internals without touching a single route. */
-function can(user, rights, board, action) {
-	if (action === "read") return board in rights;
-	if (action === "admin") return user?.role === "owner";
-	return !!user && rights[board] === "comment";
-}
-const EVENT_TYPES = /* @__PURE__ */ new Set([
-	"create",
-	"reply",
-	"edit",
-	"resolve",
-	"reopen",
-	"react",
-	"profile",
-	"reanchor"
-]);
-const ID_RE = /^[\w-]{8,64}$/;
-const MAX_BODY_TEXT = 1e4;
-/** An avatar the server will store: a raster data-URI whose ACTUAL decoded bytes
-*  match the declared type. The declared MIME alone is a lie an attacker controls
-*  (base64 SVG labelled image/png); the magic bytes are the truth. Capped small -
-*  the client downscales to a 128px jpeg (~15KB), 64KB is generous headroom. */
-function validAvatar(s) {
-	if (typeof s !== "string" || s.length > 65536) return false;
-	const m = /^data:image\/(jpeg|png|webp|gif);base64,([A-Za-z0-9+/]+={0,2})$/.exec(s);
-	if (!m) return false;
-	let head;
-	try {
-		head = Buffer.from(m[2].slice(0, 24), "base64");
-	} catch {
-		return false;
-	}
-	return {
-		jpeg: (b) => b[0] === 255 && b[1] === 216 && b[2] === 255,
-		png: (b) => b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71,
-		gif: (b) => b.toString("latin1", 0, 4) === "GIF8",
-		webp: (b) => b.toString("latin1", 0, 4) === "RIFF" && b.toString("latin1", 8, 12) === "WEBP"
-	}[m[1]]?.(head) ?? false;
-}
-/** Reject anything the log must not absorb. Returns an error string or null.
-*  Events are append-only and synced by id, so acceptance is forever - validate hard. */
-function validateEvents(incoming, log, u, board) {
-	const now = Date.now();
-	const creates = /* @__PURE__ */ new Map();
-	const authors = /* @__PURE__ */ new Map();
-	for (const ev of log) {
-		if (ev.type === "create" && ev.commentId && !creates.has(ev.commentId)) creates.set(ev.commentId, ev);
-		if ((ev.type === "create" || ev.type === "reply") && ev.commentId && ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
-	}
-	const me = u.email.toLowerCase();
-	for (const ev of incoming) {
-		if (!ev || typeof ev !== "object") return "malformed event";
-		if (typeof ev.id !== "string" || !ID_RE.test(ev.id)) return "event id must be an 8-64 char token";
-		if (!EVENT_TYPES.has(ev.type)) return `unknown event type "${ev.type}"`;
-		if (ev.agent !== void 0 || ev.agentMeta !== void 0) return "agent provenance is daemon-only";
-		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
-		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
-		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
-		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
-		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
-			if (ev.type !== "profile") return "event needs a commentId";
-		}
-		switch (ev.type) {
-			case "create":
-				if (creates.has(ev.commentId)) return "a thread with that id already exists";
-				creates.set(ev.commentId, ev);
-				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
-				break;
-			case "reply":
-				if (typeof ev.parentId !== "string" || !creates.has(ev.parentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.parentId)) return "reply parent does not exist";
-				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
-				break;
-			case "edit": {
-				const owner = authors.get(ev.commentId);
-				if (!owner) return "cannot edit a comment that does not exist";
-				if (owner !== me) return "only the author can edit a comment";
-				break;
-			}
-			case "resolve":
-			case "reopen":
-				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
-				break;
-			case "reanchor": {
-				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot reanchor a thread that does not exist";
-				if (ev.anchor == null) return "reanchor needs a new anchor";
-				const owner = authors.get(ev.commentId);
-				if (owner && owner !== me) return "only the thread author can reanchor";
-				break;
-			}
-		}
-	}
-	return null;
-}
-function collabHandler(dataDir, distDir) {
-	let rights = {};
-	try {
-		rights = JSON.parse(readFileSync(join(distDir, "meta.json"), "utf8")).rights ?? {};
-	} catch {}
-	const commentsDir = join(dataDir, "comments");
-	const bootEpoch = randomBytes(4).toString("hex");
-	let seq = 0;
-	const ring = [];
-	const clients = /* @__PURE__ */ new Set();
-	const broadcast = (board, events) => {
-		for (const ev of events) {
-			const frame = `id: ${bootEpoch}-${++seq}\nevent: comment\ndata: ${JSON.stringify({
-				board,
-				ev
-			})}\n\n`;
-			ring.push({
-				seq,
-				data: frame
-			});
-			if (ring.length > 500) ring.shift();
-			for (const res of clients) res.write(frame);
-		}
-	};
-	setInterval(() => {
-		for (const res of clients) res.write(": keepalive\n\n");
-	}, 24e4).unref();
-	const attempts = /* @__PURE__ */ new Map();
-	const limited = (...keys) => {
-		const now = Date.now();
-		if (attempts.size > 1e4) {
-			for (const [k, a] of attempts) if (a.reset < now) attempts.delete(k);
-		}
-		if (attempts.size > 2e4) return true;
-		let hit = false;
-		for (const key of keys) {
-			const a = attempts.get(key);
-			if (!a || a.reset < now) attempts.set(key, {
-				n: 1,
-				reset: now + 6e4
-			});
-			else if (++a.n > 10) hit = true;
-		}
-		return hit;
-	};
-	const cookie = (req, name) => new RegExp(`(?:^|;\\s*)${name}=([\\w-]+)`).exec(String(req.headers.cookie ?? ""))?.[1];
-	/** browser session cookie, or a bearer token (the dev proxy / agent CLI path -
-	*  same session store, held server-side by the Vite process, never by a page) */
-	const sessionToken = (req) => /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? cookie(req, "mv_s") ?? null;
-	const currentUser = (req) => {
-		const tok = sessionToken(req);
-		return tok ? sessionUser(dataDir, tok) : null;
-	};
-	const json = (res, code, body) => {
-		res.statusCode = code;
-		res.setHeader("content-type", "application/json");
-		res.setHeader("cache-control", "no-store");
-		res.end(JSON.stringify(body));
-	};
-	const readBody = (req) => new Promise((resolve, reject) => {
-		if (!/^application\/json\b/.test(String(req.headers["content-type"] ?? ""))) return reject(/* @__PURE__ */ new Error("content-type must be application/json"));
-		let body = "";
-		let done = false;
-		const settle = (fn) => {
-			if (done) return;
-			done = true;
-			clearTimeout(timer);
-			fn();
-		};
-		const timer = setTimeout(() => settle(() => {
-			req.destroy();
-			reject(/* @__PURE__ */ new Error("body timed out"));
-		}), 1e4);
-		if (typeof timer.unref === "function") timer.unref();
-		req.on("data", (c) => {
-			body += c;
-			if (body.length > MAX_BODY) settle(() => {
-				req.destroy();
-				reject(/* @__PURE__ */ new Error("body too large"));
-			});
-		});
-		req.on("end", () => settle(() => {
-			try {
-				resolve(body ? JSON.parse(body) : {});
-			} catch {
-				reject(/* @__PURE__ */ new Error("bad json"));
-			}
-		}));
-		req.on("error", () => settle(() => reject(/* @__PURE__ */ new Error("request failed"))));
-	});
-	const setSession = (req, res, token) => {
-		const secure = secureSuffix(req);
-		res.setHeader("set-cookie", [`mv_s=${token}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`, `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${MONTH}; SameSite=Lax${secure}`]);
-	};
-	const csrfOk = (req) => !!/^Bearer /.test(String(req.headers.authorization ?? "")) || !cookie(req, "mv_s") || !!cookie(req, "mv_c") && req.headers["x-mv-c"] === cookie(req, "mv_c");
-	/** Returns true when the request was handled. Mounted behind the gate by serve. */
-	return async (req, res, url) => {
-		if (!url.pathname.startsWith("/__mv/api/")) return false;
-		const path = url.pathname.slice(10);
-		const ip = process.env.MARVER_TRUSTED_PROXY ? String(req.headers["x-forwarded-for"] ?? req.socket.remoteAddress ?? "?").split(",")[0].trim() : String(req.socket.remoteAddress ?? "?");
-		try {
-			if (req.method === "GET") {
-				if (path === "me") {
-					const u = currentUser(req);
-					return json(res, u ? 200 : 401, u ? {
-						user: publicUser(u),
-						role: u.role
-					} : { error: "signed out" }), true;
-				}
-				if (path === "boards") {
-					const name = ownerName(dataDir);
-					return json(res, 200, {
-						rights,
-						stored: listBoards(commentsDir),
-						...name ? { owner: { name } } : {}
-					}), true;
-				}
-				const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
-				if (m) {
-					if (!can(currentUser(req), rights, m[1], "read")) return json(res, 404, { error: "no such board" }), true;
-					return json(res, 200, { events: readLog(commentsDir, m[1]) }), true;
-				}
-				if (path === "invite-info") {
-					if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
-					const info = inviteInfo(dataDir, String(url.searchParams.get("token") ?? ""));
-					return json(res, info ? 200 : 404, info ?? { error: "this invite link is invalid, expired, or already used" }), true;
-				}
-				if (path === "events") {
-					res.statusCode = 200;
-					res.setHeader("content-type", "text/event-stream");
-					res.setHeader("cache-control", "no-store");
-					res.setHeader("x-accel-buffering", "no");
-					res.write(": connected\n\n");
-					const lastRaw = String(req.headers["last-event-id"] ?? "");
-					const lm = /^([0-9a-f]{8})-(\d+)$/.exec(lastRaw);
-					if (lastRaw) {
-						const last = lm && lm[1] === bootEpoch ? Number(lm[2]) : NaN;
-						if (!Number.isFinite(last)) res.write("event: resync\ndata: {}\n\n");
-						else {
-							const missed = ring.filter((r) => r.seq > last);
-							if (missed.length && missed[0].seq !== last + 1) res.write("event: resync\ndata: {}\n\n");
-							else for (const r of missed) res.write(r.data);
-						}
-					}
-					clients.add(res);
-					req.on("close", () => clients.delete(res));
-					return true;
-				}
-				return false;
-			}
-			if (req.method !== "POST") return false;
-			if (!(path === "auth/claim" || path === "auth/signin") && !csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
-			if (path === "auth/claim") {
-				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
-				const b = await readBody(req);
-				const { user, session } = claimInvite(dataDir, String(b.token ?? ""), {
-					password: String(b.password ?? ""),
-					name: String(b.name ?? ""),
-					avatar: validAvatar(b.avatar) ? b.avatar : void 0
-				});
-				setSession(req, res, session);
-				return json(res, 200, { user: publicUser(user) }), true;
-			}
-			if (path === "auth/signin") {
-				const b = await readBody(req);
-				const email = String(b.email ?? "").trim().toLowerCase();
-				if (limited(`ip:${ip}`, `em:${email}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
-				const hit = signIn(dataDir, email, String(b.password ?? ""));
-				if (!hit) return json(res, 401, { error: "wrong email or password" }), true;
-				setSession(req, res, hit.session);
-				return json(res, 200, { user: publicUser(hit.user) }), true;
-			}
-			if (path === "auth/signout") {
-				const tok = cookie(req, "mv_s");
-				if (tok) signOut(dataDir, tok);
-				res.setHeader("set-cookie", ["mv_s=; Path=/; Max-Age=0; HttpOnly", "mv_c=; Path=/; Max-Age=0"]);
-				return json(res, 200, {}), true;
-			}
-			if (path === "profile") {
-				const u = currentUser(req);
-				if (!u) return json(res, 401, { error: "sign in first" }), true;
-				const b = await readBody(req);
-				const next = updateProfile(dataDir, u.email, {
-					name: typeof b.name === "string" ? b.name : void 0,
-					avatar: b.avatar === "" ? "" : validAvatar(b.avatar) ? b.avatar : void 0
-				});
-				return json(res, 200, { user: publicUser(next) }), true;
-			}
-			if (path === "cli-session") {
-				const bearer = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
-				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
-				const issued = issueDeviceSession(dataDir, bearer);
-				if (!issued) return json(res, 401, { error: "MARVER_CLI_TOKEN was refused, or nobody owns this canvas yet" }), true;
-				return json(res, 200, {
-					token: issued.token,
-					exp: issued.exp,
-					user: publicUser(issued.user)
-				}), true;
-			}
-			if (path === "invite") {
-				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
-				const b = await readBody(req);
-				const email = String(b.email ?? "");
-				if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return json(res, 400, { error: "a valid email is required" }), true;
-				const idMode = !!process.env.MARVER_ID_ISSUER;
-				return json(res, 200, {
-					...createInvite(dataDir, email),
-					idMode
-				}), true;
-			}
-			if (path === "revoke") {
-				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
-				const b = await readBody(req);
-				revokeUser(dataDir, String(b.email ?? ""));
-				return json(res, 200, {}), true;
-			}
-			const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
-			if (m) {
-				const u = currentUser(req);
-				if (!can(u, rights, m[1], "comment")) return json(res, u ? 403 : 401, { error: u ? `this board is read-only - ask ${ownerName(dataDir) ?? "the canvas owner"} for commenting access` : "sign in to comment" }), true;
-				const b = await readBody(req);
-				const incoming = Array.isArray(b.events) ? b.events : [];
-				if (incoming.length > 100) return json(res, 400, { error: "too many events in one push" }), true;
-				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1]);
-				if (bad) return json(res, 400, { error: bad }), true;
-				const fresh = appendEvents(commentsDir, m[1], incoming);
-				broadcast(m[1], fresh);
-				return json(res, 200, { accepted: fresh.length }), true;
-			}
-			return false;
-		} catch (err) {
-			return json(res, 400, { error: err.message }), true;
-		}
-	};
-}
-//#endregion
-export { collabHandler, validAvatar };

package/dist/manifest-C2tzkNaC.mjs

@@ -1,233 +0,0 @@
-import { r as PKG, t as CONTENT_WIDTH } from "./cli.mjs";
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join, relative, sep } from "node:path";
-import { createHash } from "node:crypto";
-//#region src/server/manifest.ts
-const FRAME_EXT = /\.(tsx|jsx|html)$/;
-const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
-/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
-function extractMeta(src) {
-	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
-	if (!m) return {};
-	const body = m[1];
-	const pick = (key) => {
-		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
-		return r ? r[2] : void 0;
-	};
-	const out = {};
-	const title = pick("title");
-	if (title) out.title = title;
-	const viewport = pick("viewport");
-	if (viewport) out.viewport = viewport;
-	const theme = pick("theme");
-	if (theme) out.theme = theme;
-	const of = pick("of");
-	if (of) out.of = of;
-	const variant = pick("variant");
-	if (variant) out.variant = variant;
-	const intent = pick("intent");
-	if (intent) out.intent = intent;
-	return out;
-}
-/** Content-frame detection: LEXICAL by convention - the frame file
-*  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
-*  string in a UI frame can never misbadge it; barrels/re-exports are not
-*  detected - meta.intent is the taught path and always works). Returns the
-*  inferred intent + natural width, or null for UI frames. */
-const CONTENT_IMPORT = new RegExp(`from\\s+['"]${PKG}/content['"]`);
-const WIDE_DOC = /<Doc\b[^>]*\blayout\s*=\s*["']wide["']/;
-const contentWidthOf = (src) => WIDE_DOC.test(src) ? CONTENT_WIDTH.wide : CONTENT_WIDTH.document;
-function contentScan(src) {
-	if (!CONTENT_IMPORT.test(src)) return null;
-	const count = (re) => (src.match(re) ?? []).length;
-	const diagrams = count(/<Diagram[\s>/]/g);
-	const imgs = count(/<Img[\s>/]/g);
-	const mds = count(/<Md[\s>/]/g);
-	return {
-		intent: diagrams > 0 ? "diagram" : imgs > mds ? "moodboard" : "spec",
-		width: contentWidthOf(src)
-	};
-}
-/** id = path relative to design/, extension dropped, `scenes/` prefix dropped. Always `/`-separated. */
-function toFrameId(designRelPath) {
-	const noExt = designRelPath.split(sep).join("/").replace(FRAME_EXT, "");
-	return noExt.startsWith("scenes/") ? noExt.slice(7) : noExt;
-}
-/**
-* A7: which frames does a changed `design/**` file affect? Manifest + directory conventions,
-* NOT a module-graph walk (deterministic, cheap, may over-reload but never misses a
-* conventionally-affected frame). Returns:
-*   null  -> uncontrolled: leave to default Vite HMR (src/** deps, theme.css, config, assets)
-*   []    -> controlled but affects no current frame (e.g. a layout in an empty dir)
-*   [ids] -> controlled: the shell drives a rev-stamped reload of these frames
-*/
-function affectedFrameIds(absFile, root, manifest) {
-	const design = join(root, "design");
-	if (absFile !== design && !absFile.startsWith(design + sep)) return null;
-	const rel = relative(design, absFile).split(sep).join("/");
-	const name = rel.split("/").pop() ?? rel;
-	const designRel = `design/${rel}`;
-	const tsxFrames = manifest.frames.filter((f) => f.kind === "tsx");
-	if (name === "theme.css") return null;
-	if (rel === "providers.tsx" || rel === "providers.jsx") return tsxFrames.map((f) => f.id);
-	if (/(^|\/)(_layout\.(tsx|jsx)|_fixtures\.(ts|tsx|js|jsx|json))$/.test(rel)) {
-		const prefix = `design/${rel.slice(0, rel.length - name.length)}`;
-		return tsxFrames.filter((f) => f.file.startsWith(prefix)).map((f) => f.id);
-	}
-	const direct = manifest.frames.find((f) => f.file === designRel);
-	if (direct) return [direct.id];
-	return null;
-}
-function walk(dir, out = []) {
-	if (!existsSync(dir)) return out;
-	for (const e of readdirSync(dir, { withFileTypes: true })) {
-		if (e.name.startsWith(".")) continue;
-		const p = join(dir, e.name);
-		if (e.isDirectory()) walk(p, out);
-		else out.push(p);
-	}
-	return out;
-}
-function scanFrames(root) {
-	const design = join(root, "design");
-	const frames = [];
-	for (const base of ["scenes", "components"]) for (const abs of walk(join(design, base))) {
-		const name = abs.split(sep).pop();
-		if (name.startsWith("_") || !FRAME_EXT.test(name)) continue;
-		const rel = relative(design, abs).split(sep).join("/");
-		const id = toFrameId(rel);
-		const scene = id.includes("/") ? id.split("/")[0] : "";
-		if (base === "scenes" && RESERVED_SCENES.has(scene)) {
-			console.error(`[marver] scene "${scene}" is a reserved name - "${rel}" skipped. Rename the scene.`);
-			continue;
-		}
-		const kind = name.endsWith(".html") ? "html" : "tsx";
-		const entry = {
-			id,
-			file: `design/${rel}`,
-			kind,
-			scene
-		};
-		if (kind === "tsx") {
-			const src = readFileSync(abs, "utf8");
-			const meta = extractMeta(src);
-			if (meta.title) entry.title = meta.title;
-			if (meta.viewport) entry.viewport = meta.viewport;
-			if (meta.theme) entry.theme = meta.theme;
-			if (meta.of) entry.variantGroup = meta.of;
-			if (meta.variant) entry.variant = meta.variant;
-			const content = contentScan(src);
-			if (content || meta.intent) {
-				entry.intent = meta.intent ?? content.intent;
-				entry.contentWidth = content?.width ?? contentWidthOf(src);
-			}
-		}
-		frames.push(entry);
-	}
-	const extRank = (file) => file.endsWith(".tsx") ? 0 : file.endsWith(".jsx") ? 1 : 2;
-	frames.sort((a, b) => a.id.localeCompare(b.id) || extRank(a.file) - extRank(b.file) || a.file.localeCompare(b.file));
-	const seen = /* @__PURE__ */ new Map();
-	const deduped = frames.filter((f) => {
-		const prev = seen.get(f.id);
-		if (prev) {
-			console.error(`[marver] duplicate frame id "${f.id}" (${prev} vs ${f.file}) - keeping ${prev}.`);
-			return false;
-		}
-		seen.set(f.id, f.file);
-		return true;
-	});
-	frames.length = 0;
-	frames.push(...deduped);
-	inferVariantGroups(frames);
-	const sceneCounts = /* @__PURE__ */ new Map();
-	for (const f of frames) sceneCounts.set(f.scene, (sceneCounts.get(f.scene) ?? 0) + 1);
-	return {
-		frames,
-		scenes: [...sceneCounts.entries()].map(([name, n]) => ({
-			name,
-			frames: n
-		})).sort((a, b) => a.name.localeCompare(b.name))
-	};
-}
-/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
-*  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
-*  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
-*  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).
-*  States (empty.tsx, error.tsx) never letter-prefix, so they never misgroup.
-*  Mutates entries in place: only frames whose group materializes keep the fields. */
-function inferVariantGroups(frames) {
-	const dirOf = (id) => {
-		const i = id.lastIndexOf("/");
-		return i >= 0 ? id.slice(0, i) : "";
-	};
-	const candidates = /* @__PURE__ */ new Map();
-	for (const f of frames) {
-		if (f.kind !== "tsx") {
-			delete f.variantGroup;
-			delete f.variant;
-			continue;
-		}
-		let group = f.variantGroup;
-		let key = f.variant;
-		if (!group) {
-			const base = f.id.slice(f.id.lastIndexOf("/") + 1);
-			const m = /^([a-z])-.+$/.exec(base);
-			if (!m) continue;
-			group = dirOf(f.id);
-			if (!group) continue;
-			key = key ?? m[1];
-		} else if (!key) {
-			const m = /^([a-z])-.+$/.exec(f.id.slice(f.id.lastIndexOf("/") + 1));
-			if (!m) {
-				console.warn(`[marver] ${f.file} declares of:"${group}" but no variant key (add meta.variant or a letter prefix) - not grouped.`);
-				delete f.variantGroup;
-				delete f.variant;
-				continue;
-			}
-			key = m[1];
-		}
-		f.variantGroup = group;
-		f.variant = key;
-		candidates.set(group, [...candidates.get(group) ?? [], f]);
-	}
-	for (const [group, members] of candidates) {
-		if (new Set(members.map((m) => dirOf(m.id))).size > 1) {
-			console.warn(`[marver] group "${group}" spans directories - variants must be siblings; not grouped.`);
-			for (const m of members) {
-				delete m.variantGroup;
-				delete m.variant;
-			}
-			continue;
-		}
-		const seen = /* @__PURE__ */ new Set();
-		const kept = [];
-		for (const m of members.sort((a, b) => (a.variant ?? "").localeCompare(b.variant ?? ""))) {
-			if (seen.has(m.variant)) {
-				console.warn(`[marver] duplicate variant "${m.variant}" in group "${group}" (${m.file}) - not grouped.`);
-				delete m.variantGroup;
-				delete m.variant;
-				continue;
-			}
-			seen.add(m.variant);
-			kept.push(m);
-		}
-		if (kept.length < 2) for (const m of kept) {
-			delete m.variantGroup;
-			delete m.variant;
-		}
-	}
-	for (const f of frames) if (f.variant && !f.variantGroup) delete f.variant;
-}
-/** Write design/manifest.json only when content changed. Returns the manifest either way. */
-function writeManifest(root, manifest) {
-	const file = join(root, "design", "manifest.json");
-	const next = JSON.stringify(manifest, null, 2) + "\n";
-	const prev = existsSync(file) ? readFileSync(file, "utf8") : "";
-	if (hash(prev) === hash(next)) return false;
-	mkdirSync(join(root, "design"), { recursive: true });
-	writeFileSync(file, next);
-	return true;
-}
-const hash = (s) => createHash("sha256").update(s).digest("hex");
-//#endregion
-export { writeManifest as a, toFrameId as i, hash as n, scanFrames as r, affectedFrameIds as t };

package/dist/update-DuWDj5nR.mjs

@@ -1,77 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { r as PKG } from "./cli.mjs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-//#region src/server/update.ts
-/**
-* Update discovery - dev only, and deliberately boring about privacy: one anonymous
-* registry metadata GET per day (the same request `npm view` makes), cached in
-* design/.local/, nothing sent beyond the request itself. Offline, slow, or
-* firewalled registries degrade to silence. MARVER_NO_UPDATE_CHECK=1 disables it.
-* Published bundles never check anything - viewers are not the owner.
-*/
-var update_exports = /* @__PURE__ */ __exportAll({
-	checkUpdate: () => checkUpdate,
-	installedVersion: () => installedVersion
-});
-const TTL = 864e5;
-/** Installed version: walk up from this module to the package's own package.json
-*  (one level from dist/, two from src/server/ - the walk covers both). */
-function installedVersion() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (let i = 0; i < 4; i++) {
-		try {
-			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-			if (pkg.name === "@marver-design/marver") return pkg.version;
-		} catch {}
-		dir = dirname(dir);
-	}
-	return null;
-}
-/** Strictly-newer numeric compare; anything non-numeric (prerelease tags) compares false. */
-const newer = (a, b) => {
-	const pa = a.split(".").map((n) => parseInt(n, 10));
-	const pb = b.split(".").map((n) => parseInt(n, 10));
-	for (let i = 0; i < 3; i++) {
-		const x = pa[i] ?? 0, y = pb[i] ?? 0;
-		if (!Number.isFinite(x) || !Number.isFinite(y)) return false;
-		if (x !== y) return x > y;
-	}
-	return false;
-};
-/** The latest published version when strictly newer than installed, else null. Never throws. */
-async function checkUpdate(root) {
-	if (process.env.MARVER_NO_UPDATE_CHECK) return null;
-	const current = installedVersion();
-	if (!current) return null;
-	const latest = await latestVersion(root);
-	return latest && newer(latest, current) ? latest : null;
-}
-async function latestVersion(root) {
-	const cacheFile = join(root, "design", ".local", "update-check.json");
-	const wellFormed = (v) => typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v);
-	try {
-		const c = JSON.parse(readFileSync(cacheFile, "utf8"));
-		const age = Date.now() - c.checkedAt;
-		if (typeof c.checkedAt === "number" && age >= 0 && age < TTL) return wellFormed(c.latest) ? c.latest : null;
-	} catch {}
-	let latest = null;
-	try {
-		const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`, { signal: AbortSignal.timeout(3e3) });
-		if (res.ok) {
-			const v = (await res.json())?.version;
-			if (wellFormed(v)) latest = v;
-		}
-	} catch {}
-	try {
-		mkdirSync(join(root, "design", ".local"), { recursive: true });
-		writeFileSync(cacheFile, JSON.stringify({
-			checkedAt: Date.now(),
-			latest
-		}) + "\n");
-	} catch {}
-	return latest;
-}
-//#endregion
-export { installedVersion as n, update_exports as r, checkUpdate as t };

package/dist/utm-CxC3QN5X.mjs

@@ -1,20 +0,0 @@
-//#region src/shared/utm.ts
-/** Automatic attribution for the powered-by links: every canvas tags its marver.design
-*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
-*  Conventional UTM semantics (stable groupings first, the variable last):
-*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
-*    utm_medium   = the link unit ('powered-by')
-*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
-*    utm_content  = the placement ('gate' badge | 'shell' wordmark | 'sign-in' finish page)
-*/
-function poweredByUrl(canvasName, source, content) {
-	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	return `https://marver.design/?${new URLSearchParams({
-		utm_source: source,
-		utm_medium: "powered-by",
-		...slug ? { utm_campaign: slug } : {},
-		utm_content: content
-	}).toString()}`;
-}
-//#endregion
-export { poweredByUrl as t };