@marver-design/marver 0.11.1 → 0.13.0

package/dist/collab-mAiNZlDj.mjs

@@ -0,0 +1,970 @@
+import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
+import { A as reconfirmGrant, C as commentAllowed, D as operativeMode, E as loadShare, F as setBlocked, I as setGeneralMode, L as shareState, M as resolveAccess, N as resolveRequest, O as provisionVerdict, P as rosterEtag, S as ceilingsFromRights, T as loadRequests, _ as sessionUser, a as claimInvite, b as updateProfile, c as issueDeviceSession, d as opaqueId, f as ownerName, g as sessionIsOperator, h as revokeUser, j as removeGrant, k as putRequest, l as loadStore, m as publicUser, o as createInvite, s as inviteInfo, u as normEmail, v as signIn, w as entryAllowed, y as signOut, z as upsertGrant } from "./auth-DdUKeVKt.mjs";
+import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-C7CAypbB.mjs";
+import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/server/notify.ts
+/**
+* The canvas's half of the notification relay (04-solution §2.3, §9.5; v1.1
+* additions in 07-v1.1 §A/§B).
+*
+* Transactional moments: you were invited, your request was approved, someone
+* asked for access. Activity moments (v1.1): a thread you are in moved
+* (`reply`), somebody named you (`mentioned`). Delivery is the ID service's
+* relay; the canvas never talks to Resend. The action token is signed by the
+* canvas identity key - owner authorization is implicit in the signature,
+* since only the canvas server holds it.
+*
+* Fire-and-forget, always: a notification that failed must never be the reason
+* a comment or grant did not land - delivery is best-effort at this boundary,
+* durable only once the relay's outbox row exists. Idempotency lives at the
+* relay, keyed on (origin, template, eventId) - the eventId is derived from
+* the STATE TRANSITION, so a re-invite at the same role sends nothing, a
+* mention mails once per person per comment ever, and replies throttle to one
+* mail per recipient per thread per window.
+*
+* All relay requests ride ONE promise chain: however wide a reply fans out,
+* this process holds at most one in-flight relay request (each bounded by its
+* own 5s timeout) - a comment-authorized caller cannot burst sockets.
+*/
+const transitionId = (...parts) => createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 32);
+let chain = Promise.resolve();
+const capped = (s, cap) => {
+	const t = s?.replace(/\s+/g, " ").trim();
+	return t ? t.length > cap ? `${t.slice(0, cap - 1)}…` : t : void 0;
+};
+function relayNotify(ctx, template, recipient, eventId, content) {
+	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
+	if (recipient.startsWith("@") || !recipient.includes("@")) return;
+	const { dataDir, origin } = ctx;
+	const actor = capped(content?.actor, 60);
+	const snippet = capped(content?.snippet, 180);
+	const link = content?.link && content.link.length <= 160 ? content.link : void 0;
+	const url = `${ctx.issuer.replace(/\/+$/, "")}/relay/notify`;
+	chain = chain.then(() => {
+		const now = Math.floor(Date.now() / 1e3);
+		let token;
+		try {
+			token = signCanvasJws(dataDir, {
+				origin,
+				template,
+				recipient,
+				eventId,
+				iat: now,
+				exp: now + 600,
+				...actor ? { actor } : {},
+				...snippet ? { snippet } : {},
+				...link ? { link } : {}
+			}, "marver-relay+jwt");
+		} catch {
+			return;
+		}
+		return fetch(url, {
+			method: "POST",
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(5e3)
+		}).then(() => void 0, () => void 0);
+	});
+}
+const FRESH_MS = 9e5;
+const REPLY_WINDOW_MS = 216e5;
+const MAX_REPLY_RECIPIENTS = 10;
+/**
+* Mail the people a fresh comment batch concerns. `accepted` is what
+* appendEvents actually took (never the raw POST body); `log` is the board's
+* full event list including them; `allowed` is the resolver's answer for THIS
+* board (≥ view), injected so this stays pure of store plumbing. Recipients
+* are canonical emails - by the time events land here the write boundary has
+* already inverted the projection.
+*
+* Windows use SERVER time, never ev.ts - a client-datable timestamp must not
+* pick its own throttle bucket. The board is in every key because comment ids
+* are only board-local.
+*/
+function notifyCommentActivity(ctx, board, accepted, log, allowed) {
+	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
+	for (const [eventId, job] of activityJobs(board, accepted, log, allowed, Date.now())) relayNotify(ctx, job.template, job.recipient, eventId, {
+		actor: job.actor,
+		snippet: job.snippet,
+		link: job.link
+	});
+}
+/** The pure half: which (template, recipient, transition) a batch owes. Split
+*  out so the fan-out rules are testable without a relay or a signing key. */
+function activityJobs(board, accepted, log, allowed, now) {
+	const jobs = /* @__PURE__ */ new Map();
+	const threadLink = (threadId) => threadId ? `/#/b/${encodeURIComponent(board)}?c=${encodeURIComponent(threadId)}` : void 0;
+	for (const ev of accepted) {
+		if (ev.type !== "create" && ev.type !== "reply" || Math.abs(now - ev.ts) > FRESH_MS) continue;
+		const author = ev.author?.email?.toLowerCase();
+		const mentioned = /* @__PURE__ */ new Set();
+		for (const m of ev.mentions ?? []) {
+			const email = m.email?.toLowerCase();
+			if (!email || email === author || !allowed(email)) continue;
+			mentioned.add(email);
+			jobs.set(transitionId("mention", email, board, ev.commentId ?? ev.id), {
+				template: "mentioned",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.type === "reply" ? ev.parentId : ev.commentId)
+			});
+		}
+		if (ev.type !== "reply" || !ev.parentId) continue;
+		const recent = [];
+		for (let i = log.length - 1; i >= 0 && recent.length < MAX_REPLY_RECIPIENTS; i--) {
+			const p = log[i];
+			if (p.id === ev.id) continue;
+			const email = (p.type === "reply" ? p.parentId === ev.parentId : p.type === "create" && p.commentId === ev.parentId) ? p.author?.email?.toLowerCase() : void 0;
+			if (email && email !== author && !mentioned.has(email) && !recent.includes(email)) recent.push(email);
+		}
+		const window = String(Math.floor(now / REPLY_WINDOW_MS));
+		for (const email of recent) {
+			if (!allowed(email)) continue;
+			jobs.set(transitionId("reply", email, board, ev.parentId, window), {
+				template: "reply",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.parentId)
+			});
+		}
+	}
+	return jobs;
+}
+//#endregion
+//#region src/server/collab.ts
+const MONTH = 2592e3;
+const MAX_BODY = 262144;
+/** The permission seam, per-person since the sharing release: `read` stays
+*  board-level (is it published - no read-privacy claim in v1), `admin` stays
+*  the owner role, and `comment` (which resolve/reopen ride, 01-sharing §7.4)
+*  asks the resolver - blocklist, grants, expiry, ceiling - freshly on every
+*  call, so a revocation or an expiry crossing bites on the next request.
+*  `dataDir` is what connects the seam to the roster; without a roster the
+*  legacy rule (any signed-in user on a comment board) is exactly what runs. */
+function can(user, rights, board, action, dataDir) {
+	if (action === "read") return board in rights;
+	if (action === "admin") return user?.role === "owner";
+	if (!user || rights[board] !== "comment") return false;
+	if (!dataDir) return true;
+	return commentAllowed(dataDir, user, board, ceilingsFromRights(rights));
+}
+const EVENT_TYPES = /* @__PURE__ */ new Set([
+	"create",
+	"reply",
+	"edit",
+	"resolve",
+	"reopen",
+	"react",
+	"profile",
+	"reanchor"
+]);
+const ID_RE = /^[\w-]{8,64}$/;
+const MAX_BODY_TEXT = 1e4;
+/** An avatar the server will store: a raster data-URI whose ACTUAL decoded bytes
+*  match the declared type. The declared MIME alone is a lie an attacker controls
+*  (base64 SVG labelled image/png); the magic bytes are the truth. Capped small -
+*  the client downscales to a 128px jpeg (~15KB), 64KB is generous headroom. */
+function validAvatar(s) {
+	if (typeof s !== "string" || s.length > 65536) return false;
+	const m = /^data:image\/(jpeg|png|webp|gif);base64,([A-Za-z0-9+/]+={0,2})$/.exec(s);
+	if (!m) return false;
+	let head;
+	try {
+		head = Buffer.from(m[2].slice(0, 24), "base64");
+	} catch {
+		return false;
+	}
+	return {
+		jpeg: (b) => b[0] === 255 && b[1] === 216 && b[2] === 255,
+		png: (b) => b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71,
+		gif: (b) => b.toString("latin1", 0, 4) === "GIF8",
+		webp: (b) => b.toString("latin1", 0, 4) === "RIFF" && b.toString("latin1", 8, 12) === "WEBP"
+	}[m[1]]?.(head) ?? false;
+}
+const EMAIL_SHAPE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+const OPAQUE_ID = /^[0-9a-f]{24}$/;
+/** Mention shape rules (07-v1.1 §B). One generic refusal for every violation -
+*  no per-cause oracle. The browser form carries the opaque `id` and NEVER an
+*  email (a browser-supplied email is a membership probe); the operator form
+*  (CLI sync - canonical bytes) carries `email` and never an id. */
+function badMentions(ev, operator) {
+	if (ev.mentions === void 0) return false;
+	if (ev.type !== "create" && ev.type !== "reply") return true;
+	if (!Array.isArray(ev.mentions) || ev.mentions.length > 8) return true;
+	const seen = /* @__PURE__ */ new Set();
+	for (const m of ev.mentions) {
+		if (!m || typeof m !== "object" || Object.keys(m).some((k) => k !== "id" && k !== "email" && k !== "label")) return true;
+		if (typeof m.label !== "string" || !m.label.trim() || m.label.length > 80 || /^@?marver\b/i.test(m.label.trim())) return true;
+		const who = operator ? m.email : m.id;
+		if (operator ? typeof m.email !== "string" || !EMAIL_SHAPE.test(m.email) || m.email.length > 254 || m.id !== void 0 : typeof m.id !== "string" || !OPAQUE_ID.test(m.id) || m.email !== void 0) return true;
+		const key = who.toLowerCase();
+		if (seen.has(key)) return true;
+		seen.add(key);
+	}
+	return false;
+}
+/** Reject anything the log must not absorb. Returns an error string or null.
+*  Events are append-only and synced by id, so acceptance is forever - validate hard. */
+function validateEvents(incoming, log, u, board, opts = {}) {
+	const now = Date.now();
+	const creates = /* @__PURE__ */ new Map();
+	const comments = /* @__PURE__ */ new Set();
+	const authors = /* @__PURE__ */ new Map();
+	for (const ev of log) {
+		if (ev.type === "create" && ev.commentId && !creates.has(ev.commentId)) creates.set(ev.commentId, ev);
+		if ((ev.type === "create" || ev.type === "reply") && ev.commentId) {
+			comments.add(ev.commentId);
+			if (ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+		}
+	}
+	const me = u.email.toLowerCase();
+	for (const ev of incoming) {
+		if (!ev || typeof ev !== "object") return "malformed event";
+		if (typeof ev.id !== "string" || !ID_RE.test(ev.id)) return "event id must be an 8-64 char token";
+		if (!EVENT_TYPES.has(ev.type)) return `unknown event type "${ev.type}"`;
+		if (ev.agent !== void 0 || ev.agentMeta !== void 0) return "agent provenance is daemon-only";
+		if (ev.author && ev.author.id !== void 0) return "author id is server-assigned";
+		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
+		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
+		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
+		if ((ev.type === "create" || ev.type === "reply") && !ev.body?.trim()) return "a comment needs a body";
+		if (badMentions(ev, !!opts.operator)) return "invalid mentions";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor" || ev.type === "profile") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
+			if (ev.type !== "profile") return "event needs a commentId";
+		}
+		switch (ev.type) {
+			case "create":
+				if (creates.has(ev.commentId)) return "a thread with that id already exists";
+				creates.set(ev.commentId, ev);
+				comments.add(ev.commentId);
+				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
+				break;
+			case "reply":
+				if (typeof ev.parentId !== "string" || !creates.has(ev.parentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.parentId)) return "reply parent does not exist";
+				if (comments.has(ev.commentId)) return "a comment with that id already exists";
+				comments.add(ev.commentId);
+				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
+				break;
+			case "edit": {
+				const owner = authors.get(ev.commentId);
+				if (!owner) return "cannot edit a comment that does not exist";
+				if (owner !== me) return "only the author can edit a comment";
+				break;
+			}
+			case "resolve":
+			case "reopen":
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+				break;
+			case "reanchor": {
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot reanchor a thread that does not exist";
+				if (ev.anchor == null) return "reanchor needs a new anchor";
+				const owner = authors.get(ev.commentId);
+				if (owner && owner !== me) return "only the thread author can reanchor";
+				break;
+			}
+		}
+	}
+	return null;
+}
+function collabHandler(dataDir, distDir) {
+	let rights = {};
+	let meta = {};
+	try {
+		meta = JSON.parse(readFileSync(join(distDir, "meta.json"), "utf8"));
+		rights = meta.rights ?? {};
+	} catch {}
+	const commentsDir = join(dataDir, "comments");
+	const idIssuer = (process.env.MARVER_ID_ISSUER ?? "").trim() || null;
+	const publicOrigin = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim() || null;
+	const appOrigin = (process.env.MARVER_APP_ORIGIN ?? "").trim() || "https://app.marver.design";
+	const frontDoorOn = !!idIssuer && !!publicOrigin && meta.frontDoor !== false;
+	const notifyCtx = {
+		dataDir,
+		issuer: idIssuer,
+		origin: publicOrigin,
+		enabled: meta.notify !== false
+	};
+	const threads = /* @__PURE__ */ new Map();
+	for (const b of Object.keys(rights)) threads.set(b, deriveThreads(readLog(commentsDir, b)));
+	const summaryJtis = /* @__PURE__ */ new Map();
+	const boardType = (b) => meta.boards?.[b]?.type ?? "mix";
+	const cors = (res) => {
+		res.setHeader("access-control-allow-origin", appOrigin);
+		res.setHeader("vary", "origin");
+		res.setHeader("access-control-allow-methods", "GET, OPTIONS");
+		res.setHeader("access-control-allow-headers", "authorization");
+		res.setHeader("access-control-max-age", "600");
+	};
+	const bootEpoch = randomBytes(4).toString("hex");
+	let seq = 0;
+	const ring = [];
+	const clients = /* @__PURE__ */ new Map();
+	const broadcast = (board, events) => {
+		for (const ev of events) {
+			const frame = `id: ${bootEpoch}-${++seq}\nevent: comment\ndata: ${JSON.stringify({
+				board,
+				ev
+			})}\n\n`;
+			ring.push({
+				seq,
+				data: frame
+			});
+			if (ring.length > 500) ring.shift();
+			for (const res of clients.keys()) res.write(frame);
+		}
+	};
+	setInterval(() => {
+		for (const res of clients.keys()) res.write(": keepalive\n\n");
+	}, 24e4).unref();
+	const ceilings = ceilingsFromRights(rights);
+	const streamAllowed = (tok) => {
+		const store = shareState(dataDir);
+		if (!store) return true;
+		if (!tok) return store.general.mode !== "private";
+		const u = sessionUser(dataDir, tok);
+		return !!u && entryAllowed(dataDir, u, ceilings);
+	};
+	setInterval(() => {
+		for (const [res, c] of clients) {
+			if (streamAllowed(c.tok)) continue;
+			clients.delete(res);
+			try {
+				res.end();
+			} catch {}
+		}
+	}, 6e4).unref();
+	const attempts = /* @__PURE__ */ new Map();
+	const limited = (...keys) => {
+		const now = Date.now();
+		if (attempts.size > 1e4) {
+			for (const [k, a] of attempts) if (a.reset < now) attempts.delete(k);
+		}
+		if (attempts.size > 2e4) return true;
+		let hit = false;
+		for (const key of keys) {
+			const a = attempts.get(key);
+			if (!a || a.reset < now) attempts.set(key, {
+				n: 1,
+				reset: now + 6e4
+			});
+			else if (++a.n > 10) hit = true;
+		}
+		return hit;
+	};
+	const project = (ev) => {
+		let out = ev;
+		if (ev.author?.email) {
+			const { email, ...rest } = ev.author;
+			out = {
+				...out,
+				author: {
+					...rest,
+					id: opaqueId(dataDir, email)
+				}
+			};
+		}
+		if (ev.mentions !== void 0) {
+			const safe = Array.isArray(ev.mentions) ? ev.mentions.flatMap((m) => {
+				if (!m || typeof m !== "object") return [];
+				const label = typeof m.label === "string" ? m.label : "";
+				if (typeof m.email === "string") return [{
+					id: opaqueId(dataDir, m.email),
+					label
+				}];
+				if (typeof m.id === "string") return [{
+					id: m.id,
+					label
+				}];
+				return [];
+			}) : [];
+			out = {
+				...out,
+				mentions: safe.length ? safe : void 0
+			};
+		}
+		return out;
+	};
+	/** Every opaque id the canvas can resolve back to an address: accounts, plus
+	*  every author and mention across the boards' logs. Broader than any one
+	*  composer can see, and safely so - ids are HMACs under the canvas secret,
+	*  so a valid id for an unseen person cannot be manufactured to probe with. */
+	const mentionTargets = () => {
+		const map = /* @__PURE__ */ new Map();
+		const add = (email) => {
+			if (email) map.set(opaqueId(dataDir, email), normEmail(email));
+		};
+		for (const usr of loadStore(dataDir).users) add(usr.email);
+		for (const st of threads.values()) for (const ev of st.events) {
+			add(ev.author?.email);
+			for (const mn of ev.mentions ?? []) add(mn.email);
+		}
+		return map;
+	};
+	/** May this address still read this board - the activity-mail eligibility
+	*  filter, asked at enqueue time (delivery cannot re-check; 07-v1.1 §A). */
+	const mailAllowed = (board, email) => {
+		const store = shareState(dataDir);
+		if (!store) return true;
+		const owner = loadStore(dataDir).users.find((x) => x.role === "owner");
+		const userRole = owner && normEmail(owner.email) === normEmail(email) ? "owner" : "member";
+		return (resolveAccess({
+			email,
+			userRole,
+			store,
+			ceilings
+		}).boards[board] ?? "none") !== "none";
+	};
+	const rawTransport = (req) => {
+		const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
+		return tok ? sessionIsOperator(dataDir, tok) : false;
+	};
+	const cookie = (req, name) => new RegExp(`(?:^|;\\s*)${name}=([\\w-]+)`).exec(String(req.headers.cookie ?? ""))?.[1];
+	/** browser session cookie, or a bearer token (the dev proxy / agent CLI path -
+	*  same session store, held server-side by the Vite process, never by a page) */
+	const sessionToken = (req) => /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? cookie(req, "mv_s") ?? null;
+	const currentUser = (req) => {
+		const tok = sessionToken(req);
+		return tok ? sessionUser(dataDir, tok) : null;
+	};
+	const json = (res, code, body) => {
+		res.statusCode = code;
+		res.setHeader("content-type", "application/json");
+		res.setHeader("cache-control", "no-store");
+		res.end(JSON.stringify(body));
+	};
+	const readBody = (req) => new Promise((resolve, reject) => {
+		if (!/^application\/json\b/.test(String(req.headers["content-type"] ?? ""))) return reject(/* @__PURE__ */ new Error("content-type must be application/json"));
+		let body = "";
+		let done = false;
+		const settle = (fn) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const timer = setTimeout(() => settle(() => {
+			req.destroy();
+			reject(/* @__PURE__ */ new Error("body timed out"));
+		}), 1e4);
+		if (typeof timer.unref === "function") timer.unref();
+		req.on("data", (c) => {
+			body += c;
+			if (body.length > MAX_BODY) settle(() => {
+				req.destroy();
+				reject(/* @__PURE__ */ new Error("body too large"));
+			});
+		});
+		req.on("end", () => settle(() => {
+			try {
+				resolve(body ? JSON.parse(body) : {});
+			} catch {
+				reject(/* @__PURE__ */ new Error("bad json"));
+			}
+		}));
+		req.on("error", () => settle(() => reject(/* @__PURE__ */ new Error("request failed"))));
+	});
+	const setSession = (req, res, token) => {
+		const secure = secureSuffix(req);
+		res.setHeader("set-cookie", [`mv_s=${token}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`, `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${MONTH}; SameSite=Lax${secure}`]);
+	};
+	const csrfOk = (req) => !!/^Bearer /.test(String(req.headers.authorization ?? "")) || !cookie(req, "mv_s") || !!cookie(req, "mv_c") && req.headers["x-mv-c"] === cookie(req, "mv_c");
+	/** Returns true when the request was handled. Mounted behind the gate by serve. */
+	return async (req, res, url) => {
+		if (!url.pathname.startsWith("/__mv/api/")) return false;
+		const path = url.pathname.slice(10);
+		const ip = process.env.MARVER_TRUSTED_PROXY ? String(req.headers["x-forwarded-for"] ?? req.socket.remoteAddress ?? "?").split(",")[0].trim() : String(req.socket.remoteAddress ?? "?");
+		try {
+			if (frontDoorOn && path === "summary" && req.method === "OPTIONS") {
+				cors(res);
+				res.statusCode = 204;
+				return res.end(), true;
+			}
+			if (frontDoorOn && path === "identity" && req.method === "GET") {
+				cors(res);
+				const id = canvasIdentity(dataDir);
+				return json(res, 200, {
+					kid: id.kid,
+					jwk: id.publicJwk
+				}), true;
+			}
+			if (frontDoorOn && path === "summary" && req.method === "GET") {
+				cors(res);
+				if (String(req.headers.cookie ?? "").trim()) return json(res, 401, { error: "not authorized" }), true;
+				if (limited(`sum:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const tok = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				const { verifyBearerJwt } = await import("./marver-id-CVCoaMGI.mjs");
+				const v = await verifyBearerJwt({
+					token: tok,
+					origin: publicOrigin,
+					issuer: idIssuer,
+					typ: "marver-summary+jwt",
+					azp: appOrigin,
+					maxAgeS: 120
+				});
+				if (!v.ok) return json(res, 401, { error: "not authorized" }), true;
+				const jti = typeof v.claims.jti === "string" ? v.claims.jti : "";
+				if (!jti) return json(res, 401, { error: "not authorized" }), true;
+				{
+					const now = Date.now();
+					for (const [k, e] of summaryJtis) if (e < now) summaryJtis.delete(k);
+					if (summaryJtis.has(jti)) return json(res, 401, { error: "not authorized" }), true;
+					summaryJtis.set(jti, now + 15e4);
+				}
+				const share = shareState(dataDir);
+				const ceilings = ceilingsFromRights(rights);
+				const account = loadStore(dataDir).users.find((u) => normEmail(u.email) === normEmail(v.email));
+				const role = account?.role === "owner" ? "owner" : "member";
+				const resolution = share ? resolveAccess({
+					email: v.email,
+					userRole: account?.role,
+					store: share,
+					ceilings
+				}) : null;
+				if (!(share ? role === "owner" || resolution.entry : !!account)) return json(res, 404, { error: "not found" }), true;
+				const marks = loadSeen(dataDir)[normEmail(v.email)] ?? {};
+				let open = 0, unread = 0;
+				for (const [b, st] of threads) {
+					open += st.open.size;
+					unread += unreadCount(st, marks[b]);
+				}
+				const boardNames = Object.keys(rights);
+				const payload = {
+					v: 1,
+					name: meta.name ?? "Marver",
+					role: resolution?.role ?? (account ? "comment" : "view"),
+					type: boardType(boardNames[0] ?? ""),
+					boards: boardNames.map((b) => ({
+						name: b,
+						role: resolution?.boards[b] ?? (rights[b] === "comment" ? "comment" : "view"),
+						type: boardType(b)
+					})),
+					threads: {
+						open,
+						unread
+					},
+					owner: role === "owner",
+					...role === "owner" ? { people: loadStore(dataDir).users.length } : {},
+					kid: canvasIdentity(dataDir).kid
+				};
+				res.statusCode = 200;
+				res.setHeader("content-type", "application/jose");
+				res.setHeader("cache-control", "no-store");
+				return res.end(signCanvasJws(dataDir, payload)), true;
+			}
+			if (idIssuer && publicOrigin && path === "request-access" && req.method === "POST") {
+				if (limited(`req:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const b = await readBody(req).catch(() => null);
+				const requestedRole = b?.requestedRole === "comment" ? "comment" : "view";
+				const note = typeof b?.note === "string" ? b.note.slice(0, 500) : void 0;
+				const share = shareState(dataDir);
+				const notBlocked = (email) => !share || provisionVerdict(share, email) !== "blocked";
+				const tok0 = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
+				const tok = tok0?.includes(".") ? tok0 : void 0;
+				const sessionCaller = tok || !b ? null : currentUser(req);
+				const tellOwner = (asker, put) => {
+					if (!put.fresh) return;
+					const owner = loadStore(dataDir).users.find((u) => u.role === "owner");
+					if (owner) relayNotify(notifyCtx, "access-requested", owner.email, transitionId("asked", asker, put.at));
+				};
+				if (b && tok) {
+					const v = verifyCanvasJws(dataDir, tok, "marver-reqaccess+jwt", publicOrigin);
+					if (v.ok && typeof v.claims.email === "string" && notBlocked(v.claims.email)) {
+						const put = putRequest(dataDir, {
+							email: v.claims.email,
+							name: typeof v.claims.name === "string" ? v.claims.name : void 0,
+							picture: typeof v.claims.picture === "string" ? v.claims.picture : void 0,
+							requestedRole,
+							target: typeof v.claims.target === "string" && v.claims.target ? v.claims.target.slice(0, 300) : void 0,
+							note
+						});
+						tellOwner(v.claims.email, put);
+					}
+				} else if (sessionCaller && csrfOk(req) && notBlocked(sessionCaller.email)) tellOwner(sessionCaller.email, putRequest(dataDir, {
+					email: sessionCaller.email,
+					name: sessionCaller.name,
+					requestedRole,
+					note
+				}));
+				return json(res, 202, { ok: true }), true;
+			}
+			if (path.startsWith("share/")) {
+				if (req.method === "OPTIONS") {
+					cors(res);
+					res.setHeader("access-control-allow-methods", "GET, PUT, POST, DELETE, OPTIONS");
+					res.setHeader("access-control-allow-headers", "authorization, content-type, x-mv-salt");
+					res.statusCode = 204;
+					return res.end(), true;
+				}
+				if (String(req.headers.cookie ?? "").trim()) {
+					cors(res);
+					return json(res, 403, { error: "owner only" }), true;
+				}
+				let bodyBuf;
+				try {
+					bodyBuf = req.method === "GET" ? Buffer.alloc(0) : await new Promise((resolve, reject) => {
+						const chunks = [];
+						let size = 0;
+						const onData = (c) => {
+							chunks.push(c);
+							size += c.length;
+							if (size > MAX_BODY) {
+								req.removeListener("data", onData);
+								req.pause();
+								reject(/* @__PURE__ */ new Error("body too large"));
+							}
+						};
+						req.on("data", onData);
+						req.on("end", () => resolve(Buffer.concat(chunks)));
+						req.on("error", () => reject(/* @__PURE__ */ new Error("request failed")));
+					});
+				} catch (err) {
+					cors(res);
+					res.setHeader("connection", "close");
+					return json(res, 422, { error: err.message }), true;
+				}
+				const body = bodyBuf.toString("utf8");
+				const tok = /^Bearer (\S+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				const owner = loadStore(dataDir).users.find((u) => u.role === "owner");
+				let allowed = false;
+				const su = tok ? sessionUser(dataDir, tok) : null;
+				if (su && su.role === "owner") allowed = true;
+				if (!allowed && tok && idIssuer && publicOrigin) {
+					const { verifyBearerJwt } = await import("./marver-id-CVCoaMGI.mjs");
+					const v = await verifyBearerJwt({
+						token: tok,
+						origin: publicOrigin,
+						issuer: idIssuer,
+						typ: "marver-owner-api+jwt",
+						azp: appOrigin,
+						maxAgeS: 300
+					});
+					const subjectOk = owner?.idSubject ? owner.idSubject === `${idIssuer}#${v.ok ? v.sub : ""}` : true;
+					if (v.ok && owner && subjectOk && normEmail(v.email) === normEmail(owner.email)) {
+						if (req.method === "GET") allowed = true;
+						else {
+							const etag = rosterEtag(dataDir);
+							const claimedEtag = typeof v.claims.etag === "string" ? v.claims.etag : "";
+							if (claimedEtag && claimedEtag !== etag) {
+								cors(res);
+								return json(res, 409, { error: "roster changed - re-read and retry" }), true;
+							}
+							const salt = String(req.headers["x-mv-salt"] ?? "");
+							const bodyHash = createHash("sha256").update(bodyBuf).digest("hex");
+							const want = createHash("sha256").update(`${req.method}\n${url.pathname}\n${bodyHash}\n${etag}${salt ? `\n${salt}` : ""}`).digest("hex");
+							if (v.claims.digest === want) allowed = true;
+						}
+					}
+				}
+				cors(res);
+				if (!allowed) return json(res, 403, { error: "owner only" }), true;
+				const b = body ? (() => {
+					try {
+						return JSON.parse(body);
+					} catch {
+						return null;
+					}
+				})() : {};
+				if (b === null) return json(res, 422, { error: "bad json" }), true;
+				const ceilings = ceilingsFromRights(rights);
+				const roster = () => {
+					const s = loadShare(dataDir);
+					const history = {};
+					const allAuthors = /* @__PURE__ */ new Set();
+					for (const [b, st] of threads) {
+						const authors = /* @__PURE__ */ new Set();
+						for (const e of st.events) if (e.author?.email) {
+							authors.add(e.author.email.toLowerCase());
+							allAuthors.add(e.author.email.toLowerCase());
+						}
+						if (authors.size) history[b] = authors.size;
+					}
+					return {
+						general: s?.general ?? {
+							mode: "private",
+							role: "view"
+						},
+						blocked: s?.blocked ?? [],
+						grants: s?.grants ?? [],
+						requests: loadRequests(dataDir).map(({ exp, ...r }) => r),
+						etag: rosterEtag(dataDir),
+						ceilings,
+						history,
+						historyAuthors: allAuthors.size,
+						gate: idIssuer ? "identity" : process.env.MARVER_PASSWORD ? "password" : "open"
+					};
+				};
+				const withEtag = (r) => {
+					res.setHeader("etag", `"${r.etag}"`);
+					return r;
+				};
+				try {
+					const sub = path.slice(6);
+					if (sub === "roster" && req.method === "GET") return json(res, 200, withEtag(roster())), true;
+					if (sub === "explain" && req.method === "GET") {
+						const who = String(url.searchParams.get("who") ?? "");
+						if (!who) return json(res, 422, { error: "who is required" }), true;
+						const s = loadShare(dataDir);
+						if (!s) return json(res, 422, { error: "no roster yet" }), true;
+						const asEmail = who.startsWith("@") ? `probe-${randomBytes(8).toString("hex")}${who}` : who;
+						const account = loadStore(dataDir).users.find((u) => normEmail(u.email) === normEmail(asEmail));
+						const r = resolveAccess({
+							email: asEmail,
+							userRole: account?.role,
+							store: s,
+							ceilings
+						});
+						return json(res, 200, {
+							who,
+							entry: r.entry,
+							role: r.role,
+							boards: r.boards,
+							trace: r.trace
+						}), true;
+					}
+					if (sub === "grant" && req.method === "PUT") {
+						const g = upsertGrant(dataDir, ceilings, {
+							principal: String(b.principal ?? ""),
+							scope: b.scope === "canvas" ? "canvas" : String(b.scope ?? ""),
+							assigned: b.assigned === "comment" ? "comment" : "view",
+							expires: typeof b.expires === "string" ? b.expires : null,
+							by: owner?.email ?? "owner"
+						}, { identityMode: !!idIssuer });
+						if (g.changed) relayNotify(notifyCtx, "invited", g.principal, transitionId("invited", g.principal, g.assigned, g.at));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "grant" && req.method === "DELETE") {
+						removeGrant(dataDir, String(b.principal ?? ""), b.scope === "canvas" ? "canvas" : String(b.scope ?? ""));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "reconfirm" && req.method === "POST") {
+						reconfirmGrant(dataDir, ceilings, String(b.principal ?? ""), b.scope === "canvas" ? "canvas" : String(b.scope ?? ""), String(b.board ?? ""));
+						return json(res, 200, withEtag(roster())), true;
+					}
+					if (sub === "general" && req.method === "PUT") {
+						const mode = String(b.mode ?? "");
+						if (mode !== "private" && mode !== "password" && mode !== "public") return json(res, 422, { error: "mode must be private | password | public" }), true;
+						const operative = operativeMode(mode, {
+							password: !!process.env.MARVER_PASSWORD && !idIssuer,
+							issuer: !!idIssuer
+						});
+						setGeneralMode(dataDir, operative);
+						const r = withEtag(roster());
+						return json(res, 200, operative === mode ? r : {
+							...r,
+							clamped: {
+								asked: mode,
+								operative
+							}
+						}), true;
+					}
+					if (sub === "block" && (req.method === "PUT" || req.method === "DELETE")) {
+						const address = String(b.address ?? "");
+						if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(address)) return json(res, 422, { error: "a valid address is required" }), true;
+						setBlocked(dataDir, address, req.method === "PUT");
+						return json(res, 200, withEtag(roster())), true;
+					}
+					const rm = /^request\/(.+)$/.exec(sub);
+					if (rm && req.method === "POST") {
+						const email = decodeURIComponent(rm[1]);
+						const approved = b.approve === true ? {
+							assigned: b.assigned === "comment" ? "comment" : "view",
+							by: owner?.email ?? "owner"
+						} : null;
+						if (!resolveRequest(dataDir, ceilings, email, approved)) return json(res, 422, { error: "no pending request for that address" }), true;
+						if (approved) relayNotify(notifyCtx, "request-approved", email, transitionId("approved", email, approved.assigned, (/* @__PURE__ */ new Date()).toISOString()));
+						return json(res, 200, withEtag(roster())), true;
+					}
+				} catch (err) {
+					return json(res, 422, { error: err.message }), true;
+				}
+				return json(res, 422, { error: "no such share route" }), true;
+			}
+			if (path === "seen" && req.method === "POST") {
+				if (!csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
+				const u = currentUser(req);
+				if (!u) return json(res, 401, { error: "sign in first" }), true;
+				const b = await readBody(req);
+				const board = String(b.board ?? "");
+				const st = threads.get(board);
+				if (!st) return json(res, 422, { error: "unknown board" }), true;
+				const latest = st.events[st.events.length - 1]?.id;
+				if (latest) markSeen(dataDir, normEmail(u.email), board, latest);
+				res.statusCode = 204;
+				return res.end(), true;
+			}
+			if (req.method === "GET") {
+				if (path === "me") {
+					const u = currentUser(req);
+					if (!u) return json(res, 401, { error: "signed out" }), true;
+					const share = shareState(dataDir);
+					const boards = share ? resolveAccess({
+						email: u.email,
+						userRole: u.role,
+						store: share,
+						ceilings: ceilingsFromRights(rights)
+					}).boards : Object.fromEntries(Object.entries(rights).map(([b, r]) => [b, r === "comment" ? "comment" : "view"]));
+					return json(res, 200, {
+						user: publicUser(u),
+						role: u.role,
+						id: opaqueId(dataDir, u.email),
+						boards
+					}), true;
+				}
+				if (path === "boards") {
+					const name = ownerName(dataDir);
+					return json(res, 200, {
+						rights,
+						stored: listBoards(commentsDir),
+						...name ? { owner: { name } } : {}
+					}), true;
+				}
+				const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
+				if (m) {
+					if (!can(currentUser(req), rights, m[1], "read")) return json(res, 404, { error: "no such board" }), true;
+					const events = readLog(commentsDir, m[1]);
+					return json(res, 200, { events: rawTransport(req) ? events : events.map(project) }), true;
+				}
+				if (path === "invite-info") {
+					if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+					const info = inviteInfo(dataDir, String(url.searchParams.get("token") ?? ""));
+					return json(res, info ? 200 : 404, info ?? { error: "this invite link is invalid, expired, or already used" }), true;
+				}
+				if (path === "events") {
+					const tok = sessionToken(req);
+					if (!streamAllowed(tok)) return json(res, 401, { error: "not authorized" }), true;
+					res.statusCode = 200;
+					res.setHeader("content-type", "text/event-stream");
+					res.setHeader("cache-control", "no-store");
+					res.setHeader("x-accel-buffering", "no");
+					res.write(": connected\n\n");
+					const lastRaw = String(req.headers["last-event-id"] ?? "");
+					const lm = /^([0-9a-f]{8})-(\d+)$/.exec(lastRaw);
+					if (lastRaw) {
+						const last = lm && lm[1] === bootEpoch ? Number(lm[2]) : NaN;
+						if (!Number.isFinite(last)) res.write("event: resync\ndata: {}\n\n");
+						else {
+							const missed = ring.filter((r) => r.seq > last);
+							if (missed.length && missed[0].seq !== last + 1) res.write("event: resync\ndata: {}\n\n");
+							else for (const r of missed) res.write(r.data);
+						}
+					}
+					clients.set(res, { tok });
+					req.on("close", () => clients.delete(res));
+					return true;
+				}
+				return false;
+			}
+			if (req.method !== "POST") return false;
+			if (!(path === "auth/claim" || path === "auth/signin") && !csrfOk(req)) return json(res, 403, { error: "missing or stale request token - reload the page" }), true;
+			if (path === "auth/claim") {
+				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const b = await readBody(req);
+				const { user, session } = claimInvite(dataDir, String(b.token ?? ""), {
+					password: String(b.password ?? ""),
+					name: String(b.name ?? ""),
+					avatar: validAvatar(b.avatar) ? b.avatar : void 0
+				}, ceilings);
+				setSession(req, res, session);
+				return json(res, 200, { user: publicUser(user) }), true;
+			}
+			if (path === "auth/signin") {
+				const b = await readBody(req);
+				const email = String(b.email ?? "").trim().toLowerCase();
+				if (limited(`ip:${ip}`, `em:${email}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const hit = signIn(dataDir, email, String(b.password ?? ""), ceilings);
+				if (!hit) return json(res, 401, { error: "wrong email or password" }), true;
+				setSession(req, res, hit.session);
+				return json(res, 200, { user: publicUser(hit.user) }), true;
+			}
+			if (path === "auth/signout") {
+				const tok = cookie(req, "mv_s");
+				if (tok) signOut(dataDir, tok);
+				res.setHeader("set-cookie", ["mv_s=; Path=/; Max-Age=0; HttpOnly", "mv_c=; Path=/; Max-Age=0"]);
+				return json(res, 200, {}), true;
+			}
+			if (path === "profile") {
+				const u = currentUser(req);
+				if (!u) return json(res, 401, { error: "sign in first" }), true;
+				const b = await readBody(req);
+				const next = updateProfile(dataDir, u.email, {
+					name: typeof b.name === "string" ? b.name : void 0,
+					avatar: b.avatar === "" ? "" : validAvatar(b.avatar) ? b.avatar : void 0
+				});
+				return json(res, 200, { user: publicUser(next) }), true;
+			}
+			if (path === "cli-session") {
+				const bearer = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1] ?? "";
+				if (limited(`ip:${ip}`)) return json(res, 429, { error: "too many attempts - wait a minute" }), true;
+				const issued = issueDeviceSession(dataDir, bearer);
+				if (!issued) return json(res, 401, { error: "MARVER_CLI_TOKEN was refused, or nobody owns this canvas yet" }), true;
+				return json(res, 200, {
+					token: issued.token,
+					exp: issued.exp,
+					user: publicUser(issued.user)
+				}), true;
+			}
+			if (path === "invite") {
+				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
+				const b = await readBody(req);
+				const email = String(b.email ?? "");
+				if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return json(res, 400, { error: "a valid email is required" }), true;
+				const idMode = !!process.env.MARVER_ID_ISSUER;
+				return json(res, 200, {
+					...createInvite(dataDir, email),
+					idMode
+				}), true;
+			}
+			if (path === "revoke") {
+				if (!can(currentUser(req), rights, "", "admin")) return json(res, 403, { error: "owner only" }), true;
+				const b = await readBody(req);
+				revokeUser(dataDir, String(b.email ?? ""));
+				return json(res, 200, {}), true;
+			}
+			const m = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
+			if (m) {
+				const u = currentUser(req);
+				if (!can(u, rights, m[1], "comment", dataDir)) return json(res, u ? 403 : 401, { error: u ? `this board is read-only - ask ${ownerName(dataDir) ?? "the canvas owner"} for commenting access` : "sign in to comment" }), true;
+				const b = await readBody(req);
+				const incoming = Array.isArray(b.events) ? b.events : [];
+				if (incoming.length > 100) return json(res, 400, { error: "too many events in one push" }), true;
+				const operator = rawTransport(req);
+				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1], { operator });
+				if (bad) return json(res, 400, { error: bad }), true;
+				if (!operator && incoming.some((ev) => ev.mentions?.length)) {
+					const targets = mentionTargets();
+					for (const ev of incoming) {
+						if (!ev.mentions?.length) continue;
+						const mapped = [];
+						for (const mn of ev.mentions) {
+							const email = targets.get(mn.id);
+							if (!email || email === normEmail(u.email)) return json(res, 400, { error: "invalid mentions" }), true;
+							mapped.push({
+								email,
+								label: mn.label
+							});
+						}
+						ev.mentions = mapped;
+					}
+				}
+				const fresh = appendEvents(commentsDir, m[1], incoming);
+				if (fresh.length) {
+					const st = threads.get(m[1]);
+					threads.set(m[1], deriveThreads([...st?.events ?? [], ...fresh]));
+				}
+				broadcast(m[1], fresh.map(project));
+				if (fresh.length) notifyCommentActivity(notifyCtx, m[1], fresh, threads.get(m[1])?.events ?? [], (email) => mailAllowed(m[1], email));
+				return json(res, 200, { accepted: fresh.length }), true;
+			}
+			return false;
+		} catch (err) {
+			return json(res, 400, { error: err.message }), true;
+		}
+	};
+}
+//#endregion
+export { collabHandler, validAvatar };