@marver-design/marver 0.11.1 → 0.13.0

package/dist/{marver-id-gate-BDzW6ahN.mjs → marver-id-gate-B2uraTHS.mjs}

@@ -1,6 +1,6 @@
-import { i as avatarSourceFor, n as attachAvatar, u as provisionFromMarverId } from "./auth-B5yuwnOq.mjs";
-import { TransactionStore, browserBinding, verifyAssertion } from "./marver-id-B8-3WiHk.mjs";
-import { t as poweredByUrl } from "./utm-CxC3QN5X.mjs";
+import { i as avatarSourceFor, n as attachAvatar, p as provisionFromMarverId } from "./auth-DdUKeVKt.mjs";
+import { TransactionStore, browserBinding, verifyAssertion } from "./marver-id-CVCoaMGI.mjs";
+import { t as poweredByUrl } from "./serve-EjEqsiYa.mjs";
 import { randomBytes } from "node:crypto";
 import { isIP } from "node:net";
 import { lookup } from "node:dns/promises";
@@ -324,7 +324,7 @@ function safeHash(raw) {
 	if (!/^#\/[\w\-./~%!$&'()*+,;=:@?[\]]*$/.test(value)) return null;
 	return value;
 }
-function marverIdHandler(dir, issuer, canvasName, branding = true) {
+function marverIdHandler(dir, issuer, canvasName, branding = true, ceilings = {}) {
 	const transactions = new TransactionStore();
 	const pinned = (process.env.MARVER_PUBLIC_ORIGIN ?? "").trim().replace(/\/$/, "");
 	let publicOrigin;
@@ -411,12 +411,37 @@ function marverIdHandler(dir, issuer, canvasName, branding = true) {
 			const session = provisionFromMarverId(dir, {
 				...result.identity,
 				issuer
-			}, { ownerEmail: process.env.MARVER_OWNER_EMAIL });
+			}, {
+				ownerEmail: process.env.MARVER_OWNER_EMAIL,
+				ceilings
+			});
 			if (!session) {
 				console.warn(`[marver-id] ${result.identity.email} is not on this canvas's list`);
+				let request;
+				try {
+					const { shareState, provisionVerdict } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
+					const share = shareState(dir);
+					if (!(share ? provisionVerdict(share, result.identity.email) === "blocked" : false)) {
+						const { signCanvasJws } = await import("./summary-C7CAypbB.mjs");
+						const now = Math.floor(Date.now() / 1e3);
+						request = signCanvasJws(dir, {
+							aud: origin,
+							sub: result.identity.subject,
+							email: result.identity.email,
+							...result.identity.name ? { name: result.identity.name } : {},
+							...result.identity.picture ? { picture: result.identity.picture } : {},
+							target: landing ?? "",
+							iat: now,
+							exp: now + 900,
+							jti: randomBytes(12).toString("hex")
+						}, "marver-reqaccess+jwt");
+					}
+				} catch {}
 				return json(res, 403, {
 					error: "not invited",
-					email: result.identity.email
+					email: result.identity.email,
+					...request ? { request } : {},
+					...request && landing ? { target: landing } : {}
 				});
 			}
 			const picture = result.identity.picture;
@@ -520,9 +545,12 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
   p.lead { margin: 0; padding: 0 4px; font-size: 12.5px; line-height: 1.5;
            color: rgba(24,24,27,.66) }
   p.lead strong { color: #18181b; font-weight: 600 }
-  a.cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
-          font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
-          display: flex; align-items: center; justify-content: center }
+  /* .cta, not a.cta: the request-access <button> wears the same dark pill as the
+     switch-account <a> - scoping to the tag left the button naked (a flat native
+     strip that read as disabled) */
+  .cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
+         font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
+         display: flex; align-items: center; justify-content: center }
   footer a { display: inline-flex; align-items: center; gap: 7px;
              font: 600 12.5px -apple-system, system-ui, sans-serif;
              color: rgba(24,24,27,.5); text-decoration: none }
@@ -538,6 +566,24 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
      needs, appearing and vanishing, which reads as a stutter rather than as
      progress. The card is for when something has to be SAID; getting in says
      itself by the canvas appearing. */
+  /* the request-access ask (01-sharing §7.6): the gate's own language - chips,
+     rounded field, the same CTA - below a hairline. */
+  .rdiv { border: 0; height: 1px; background: rgba(24,24,27,.09); margin: 2px 2px 6px }
+  .rrow { display: flex; gap: 8px; padding: 0 2px }
+  .rchip { flex: 1; cursor: pointer }
+  .rchip input { position: absolute; opacity: 0; pointer-events: none }
+  .rchip span { display: flex; align-items: center; justify-content: center; height: 34px;
+                border-radius: 999px; border: 1px solid rgba(24,24,27,.14); background: #fff;
+                font: 500 12.5px -apple-system, system-ui, sans-serif; transition: border-color .15s, box-shadow .15s }
+  .rchip input:checked + span { border-color: #0088ff; box-shadow: 0 0 0 3px rgba(0,136,255,.14); color: #0088ff }
+  #req { display: flex; flex-direction: column; gap: 12px }
+  #req[hidden] { display: none }
+  #req textarea { padding: 10px 16px; border-radius: 16px; border: 1px solid rgba(24,24,27,.14);
+                  background: #fff; color: #18181b; font: 500 13px -apple-system, system-ui, sans-serif;
+                  outline: none; resize: none; width: 100% }
+  #req textarea:focus { border-color: #0088ff; box-shadow: 0 0 0 3px rgba(0,136,255,.18) }
+  #req button.cta { border: 0; width: 100%; cursor: pointer }
+  #req button.cta:disabled { background: rgba(24,24,27,.35); cursor: default }
   .wait { width: 34px; height: 34px; border-radius: 50%;
           border: 3px solid rgba(24,24,27,.12); border-top-color: #0088ff;
           animation: spin .7s linear infinite }
@@ -555,6 +601,16 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
     <p class="lead" id="m"></p>
     <p class="lead" id="m2" hidden></p>
     <a class="cta" id="back" href="/" data-switch="${esc(switchUrl)}" hidden>Use a different account</a>
+    <div id="req" hidden>
+      <hr class="rdiv" />
+      <p class="lead">Or ask for access - the owner decides who gets in.</p>
+      <div class="rrow">
+        <label class="rchip"><input type="radio" name="rrole" value="view" checked /><span>View</span></label>
+        <label class="rchip"><input type="radio" name="rrole" value="comment" /><span>View + comment</span></label>
+      </div>
+      <textarea id="rnote" maxlength="500" rows="2" placeholder="Add a note (optional)"></textarea>
+      <button class="cta" id="rgo" type="button">Request access</button>
+    </div>
   </div>
   ${branding ? `<footer id="mark" hidden><a href="${poweredByUrl(canvasName, "published-canvas", "sign-in")}" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> ${ARROW}</a></footer>` : ""}
 <script>
@@ -628,6 +684,40 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
     back.hidden = false
   }
 
+  /** The door a refusal offers: role, note, one send. The response is the same
+   *  whatever the server recognised (no probe oracle) - "sent" is all it says. */
+  function offerRequest(token, target) {
+    var req = document.getElementById('req'), go = document.getElementById('rgo')
+    req.hidden = false
+    // name what the link pointed at - context the owner sees with the ask
+    if (target) {
+      var lead = req.querySelector('p.lead')
+      if (lead) {
+        lead.textContent = 'Or ask for access - the owner decides. Your request will name what this link pointed at ('
+        var b = document.createElement('code')
+        b.textContent = target
+        b.style.font = '500 11.5px ui-monospace, monospace'
+        lead.appendChild(b)
+        lead.appendChild(document.createTextNode(').'))
+      }
+    }
+    go.addEventListener('click', function () {
+      go.disabled = true
+      var role = (document.querySelector('input[name="rrole"]:checked') || {}).value === 'comment' ? 'comment' : 'view'
+      var note = (document.getElementById('rnote') || {}).value || ''
+      fetch('/__mv/api/request-access', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: 'Bearer ' + token },
+        body: JSON.stringify({ requestedRole: role, note: note.slice(0, 500) })
+      }).then(function () { sent() }, function () { sent() })
+      function sent() {
+        go.textContent = 'Request sent'
+        var lead = req.querySelector('p.lead')
+        if (lead) lead.textContent = 'The owner will review it. If they approve, signing in again will let you straight in.'
+      }
+    })
+  }
+
   // Take it, then erase it - before any await, so a slow network cannot leave
   // the assertion sitting in the address bar.
   var assertion = location.hash.replace(/^#/, '')
@@ -658,6 +748,7 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
         who ? refused(who) : stop("You haven't been invited",
           'That account is not on the invite list for this canvas. Ask whoever owns it to add your address.',
           'Use a different account')
+        if (who && body && typeof body.request === 'string') offerRequest(body.request, typeof body.target === 'string' ? body.target : '')
       }, function () {
         stop("You haven't been invited",
           'That account is not on the invite list for this canvas.',

package/dist/{plugin-DjBFxEQ7.mjs → plugin-DNc4Jpae.mjs}

@@ -1,9 +1,10 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { n as localProfile, t as isConnected } from "./profile-DcsJyppw.mjs";
-import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-C2tzkNaC.mjs";
-import { n as installedVersion, t as checkUpdate } from "./update-DuWDj5nR.mjs";
+import { n as localProfile, t as isConnected } from "./profile-BjAPAJSb.mjs";
+import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-CS6krOTe.mjs";
 import { copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
-import { basename, join, resolve, sep } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 //#region src/server/api.ts
 const BOARD_NAME = /^[a-z0-9][a-z0-9-]*$/;
@@ -305,7 +306,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-CWaG3Q4w.mjs");
+				const { validAvatar } = await import("./collab-mAiNZlDj.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -396,7 +397,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-DELGomPk.mjs").then((n) => n.o);
+				const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -425,7 +426,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-DELGomPk.mjs").then((n) => n.o);
+			const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -483,6 +484,77 @@ function routesMiddleware(server, clientDir) {
 	};
 }
 //#endregion
+//#region src/server/update.ts
+/**
+* Update discovery - dev only, and deliberately boring about privacy: one anonymous
+* registry metadata GET per day (the same request `npm view` makes), cached in
+* design/.local/, nothing sent beyond the request itself. Offline, slow, or
+* firewalled registries degrade to silence. MARVER_NO_UPDATE_CHECK=1 disables it.
+* Published bundles never check anything - viewers are not the owner.
+*/
+var update_exports = /* @__PURE__ */ __exportAll({
+	checkUpdate: () => checkUpdate,
+	installedVersion: () => installedVersion
+});
+const TTL = 864e5;
+/** Installed version: walk up from this module to the package's own package.json
+*  (one level from dist/, two from src/server/ - the walk covers both). */
+function installedVersion() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 4; i++) {
+		try {
+			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+			if (pkg.name === "@marver-design/marver") return pkg.version;
+		} catch {}
+		dir = dirname(dir);
+	}
+	return null;
+}
+/** Strictly-newer numeric compare; anything non-numeric (prerelease tags) compares false. */
+const newer = (a, b) => {
+	const pa = a.split(".").map((n) => parseInt(n, 10));
+	const pb = b.split(".").map((n) => parseInt(n, 10));
+	for (let i = 0; i < 3; i++) {
+		const x = pa[i] ?? 0, y = pb[i] ?? 0;
+		if (!Number.isFinite(x) || !Number.isFinite(y)) return false;
+		if (x !== y) return x > y;
+	}
+	return false;
+};
+/** The latest published version when strictly newer than installed, else null. Never throws. */
+async function checkUpdate(root) {
+	if (process.env.MARVER_NO_UPDATE_CHECK) return null;
+	const current = installedVersion();
+	if (!current) return null;
+	const latest = await latestVersion(root);
+	return latest && newer(latest, current) ? latest : null;
+}
+async function latestVersion(root) {
+	const cacheFile = join(root, "design", ".local", "update-check.json");
+	const wellFormed = (v) => typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v);
+	try {
+		const c = JSON.parse(readFileSync(cacheFile, "utf8"));
+		const age = Date.now() - c.checkedAt;
+		if (typeof c.checkedAt === "number" && age >= 0 && age < TTL) return wellFormed(c.latest) ? c.latest : null;
+	} catch {}
+	let latest = null;
+	try {
+		const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`, { signal: AbortSignal.timeout(3e3) });
+		if (res.ok) {
+			const v = (await res.json())?.version;
+			if (wellFormed(v)) latest = v;
+		}
+	} catch {}
+	try {
+		mkdirSync(join(root, "design", ".local"), { recursive: true });
+		writeFileSync(cacheFile, JSON.stringify({
+			checkedAt: Date.now(),
+			latest
+		}) + "\n");
+	} catch {}
+	return latest;
+}
+//#endregion
 //#region src/server/plugin.ts
 const VIRTUAL_THEME = "virtual:sh-theme";
 const VIRTUAL_CONFIG = "virtual:sh-config";
@@ -539,7 +611,8 @@ function marverPlugin(ctx) {
 					zoomSpeed: config.zoomSpeed,
 					noTheme: themeFile() == null,
 					setup: setupPending,
-					projectName: config.share.name || basename(root)
+					projectName: config.share.name || basename(root),
+					branding: config.share.branding
 				})}`;
 			}
 			if (id === "\0virtual:sh-data") return "export default null";
@@ -806,4 +879,4 @@ async function tailwind3Css(root) {
 	return null;
 }
 //#endregion
-export { tailwind3Css as n, tailwind4Plugin as r, marverPlugin as t };
+export { update_exports as i, tailwind3Css as n, tailwind4Plugin as r, marverPlugin as t };

package/dist/{profile-DcsJyppw.mjs → profile-BjAPAJSb.mjs}

@@ -1,4 +1,4 @@
-import { i as loadCollab } from "./sync-DELGomPk.mjs";
+import { i as loadCollab } from "./sync-BZaCWqK-.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/profile.ts

package/dist/{serve-3APqaNSB.mjs → serve-EjEqsiYa.mjs}

@@ -1,10 +1,28 @@
 import { n as NAME } from "./cli.mjs";
 import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
-import { t as poweredByUrl } from "./utm-CxC3QN5X.mjs";
 import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+//#region src/shared/utm.ts
+/** Automatic attribution for the powered-by links: every canvas tags its marver.design
+*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
+*  Conventional UTM semantics (stable groupings first, the variable last):
+*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
+*    utm_medium   = the link unit ('powered-by')
+*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
+*    utm_content  = the placement ('gate' badge | 'shell' wordmark | 'sign-in' finish page)
+*/
+function poweredByUrl(canvasName, source, content) {
+	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return `https://marver.design/?${new URLSearchParams({
+		utm_source: source,
+		utm_medium: "powered-by",
+		...slug ? { utm_campaign: slug } : {},
+		utm_content: content
+	}).toString()}`;
+}
+//#endregion
 //#region src/server/serve.ts
 /**
 * `marver serve` - a zero-dependency static server for design/.dist with an optional
@@ -51,24 +69,41 @@ async function serve(root, portFlag) {
 	let bearerCheck = null;
 	let operatorCheck = null;
 	let sessionCheck = null;
+	/** Whether the anonymous door (canvas password / guest cookie) is open at all:
+	*  general access can be set to Private on a password canvas, and then only
+	*  accounts get in. Null when there is no roster to consult. */
+	let guestDoorOpen = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-CWaG3Q4w.mjs");
+		const { collabHandler } = await import("./collab-mAiNZlDj.mjs");
 		const { appendEvents, readLog } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const dir = dataDir();
-		const seedDir = join(dist, "design", "comments");
-		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {
-			if (!f.endsWith(".jsonl")) continue;
-			const board = f.slice(0, -6);
-			appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
+		for (const seedDir of [join(root, "design", ".dist-seeds"), join(dist, "design", "comments")]) {
+			if (!existsSync(seedDir)) continue;
+			for (const f of readdirSync(seedDir)) {
+				if (!f.endsWith(".jsonl")) continue;
+				const board = f.slice(0, -6);
+				appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
+			}
 		}
 		collab = collabHandler(dir, dist);
-		const { loadStore, createInvite, normEmail, operatorUser, sessionUser } = await import("./auth-B5yuwnOq.mjs").then((n) => n.r);
-		bearerCheck = (token) => sessionUser(dir, token);
+		const { loadStore, createInvite, normEmail, operatorUser, sessionUser } = await import("./auth-DdUKeVKt.mjs").then((n) => n.r);
+		const share = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
+		const ceilings = share.ceilingsFromRights(meta.rights ?? {});
+		const admitted = (u) => !!u && share.entryAllowed(dir, u, ceilings);
+		guestDoorOpen = () => {
+			const s = share.shareState(dir);
+			return !s || s.general.mode !== "private";
+		};
+		bearerCheck = (token) => {
+			const u = sessionUser(dir, token);
+			return admitted(u) ? u : null;
+		};
 		operatorCheck = (token, req, url) => req.method === "POST" && url.pathname === "/__mv/api/cli-session" && !!operatorUser(dir, token);
 		sessionCheck = (req) => {
 			const tok = /(?:^|;\s*)mv_s=([\w-]+)/.exec(String(req.headers.cookie ?? ""))?.[1];
-			return tok ? sessionUser(dir, tok) : null;
+			const u = tok ? sessionUser(dir, tok) : null;
+			return admitted(u) ? u : null;
 		};
 		const owner = process.env.MARVER_ID_ISSUER ? "" : process.env.MARVER_OWNER_EMAIL;
 		if (owner) {
@@ -83,7 +118,7 @@ async function serve(root, portFlag) {
 	}
 	const cliToken = process.env.MARVER_CLI_TOKEN ?? "";
 	if (cliToken) {
-		const { cliTokenProblem } = await import("./auth-B5yuwnOq.mjs").then((n) => n.r);
+		const { cliTokenProblem } = await import("./auth-DdUKeVKt.mjs").then((n) => n.r);
 		if (!process.env.MARVER_DATA_DIR) {
 			console.error(`[${NAME}] MARVER_CLI_TOKEN needs MARVER_DATA_DIR - there are no accounts for it to act as otherwise.`);
 			process.exit(1);
@@ -95,7 +130,7 @@ async function serve(root, portFlag) {
 		}
 	}
 	const rawIssuer = (process.env.MARVER_ID_ISSUER ?? "").trim();
-	const { normalizeIssuer } = await import("./marver-id-B8-3WiHk.mjs");
+	const { normalizeIssuer } = await import("./marver-id-CVCoaMGI.mjs");
 	const idIssuer = normalizeIssuer(rawIssuer);
 	if (rawIssuer && !idIssuer) {
 		console.error(`[${NAME}] MARVER_ID_ISSUER is not a usable issuer: ${rawIssuer}\n  It must be a bare https origin - https://id.marver.design - with no path, query or credentials.\n  http:// is accepted only for localhost, while developing against a local identity service.`);
@@ -111,11 +146,13 @@ async function serve(root, portFlag) {
 			console.error(`[${NAME}] MARVER_ID_ISSUER is set but MARVER_PUBLIC_ORIGIN is not.\n  Every assertion is bound to this canvas's exact origin, and it cannot be\n  inferred from request headers - a proxy can make any request look local.\n  Set it to the origin people actually reach this canvas on:\n    MARVER_PUBLIC_ORIGIN=https://canvas.example.com\n    MARVER_PUBLIC_ORIGIN=http://localhost:${portFlag ?? (Number(process.env.PORT) || 4199)} (development)`);
 			process.exit(1);
 		}
-		const { marverIdHandler } = await import("./marver-id-gate-BDzW6ahN.mjs");
+		const { marverIdHandler } = await import("./marver-id-gate-B2uraTHS.mjs");
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const canvasName = humanName(meta.name);
-		idHandler = marverIdHandler(dataDir(), idIssuer, canvasName, meta.branding);
+		const { ceilingsFromRights } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
+		idHandler = marverIdHandler(dataDir(), idIssuer, canvasName, meta.branding, ceilingsFromRights(meta.rights ?? {}));
 	}
+	if (idIssuer && process.env.MARVER_PASSWORD) console.log(`  note: MARVER_ID_ISSUER and MARVER_PASSWORD are both set - the identity gate wins, the password is IGNORED`);
 	const password = idIssuer ? "" : process.env.MARVER_PASSWORD ?? "";
 	const verifier = password ? scryptSync(password, "marver-gate", 32) : null;
 	const cookieKey = randomBytes(32);
@@ -129,10 +166,22 @@ async function serve(root, portFlag) {
 		return want.length === got.length && timingSafeEqual(want, got);
 	};
 	const gated = Boolean(verifier || idIssuer);
+	if (collab) {
+		const { ensureShare, reclampShare, ceilingsFromRights } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
+		const { loadStore } = await import("./auth-DdUKeVKt.mjs").then((n) => n.r);
+		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
+		const dir = dataDir();
+		const ceilings = ceilingsFromRights(meta.rights ?? {});
+		const mode = idIssuer ? "private" : verifier ? "password" : "public";
+		const { created } = ensureShare(dir, mode, loadStore(dir).users, ceilings);
+		if (created) console.log(`  share: roster migrated → ${join(dir, "share.json")} (general: ${mode}, ${loadStore(dir).users.length} account grant${loadStore(dir).users.length === 1 ? "" : "s"})`);
+		reclampShare(dir, ceilings);
+	}
 	const server = createServer((req, res) => {
 		const url = new URL(req.url ?? "/", "http://x");
 		if (gated) {
 			if (verifier && req.method === "POST" && url.pathname === "/__mv/auth") {
+				if (guestDoorOpen && !guestDoorOpen()) return gate(res, meta, !!collab, "This canvas is members-only - sign in with your account instead", !!idIssuer);
 				let body = "";
 				req.on("data", (c) => {
 					body += c;
@@ -155,13 +204,13 @@ async function serve(root, portFlag) {
 				return;
 			}
 			const cosmetic = isCosmetic(url.pathname);
-			if (!authed(req) && !cosmetic && !sessionCheck?.(req)) {
+			if (!(authed(req) && (guestDoorOpen?.() ?? true)) && !cosmetic && !sessionCheck?.(req)) {
 				const bearerOk = collab && url.pathname.startsWith("/__mv/api/") && (() => {
 					const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
 					if (!tok) return false;
 					return !!bearerCheck?.(tok) || !!operatorCheck?.(tok, req, url);
 				})();
-				const preGate = collab && !idIssuer && (req.method === "POST" && (url.pathname === "/__mv/api/auth/signin" || url.pathname === "/__mv/api/auth/claim") || req.method === "GET" && url.pathname === "/__mv/api/invite-info") || !!idIssuer && (req.method === "GET" && url.pathname === "/__mv/id/start" || req.method === "GET" && url.pathname === "/__mv/id/finish" || req.method === "POST" && url.pathname === "/__mv/id/callback");
+				const preGate = collab && !idIssuer && (req.method === "POST" && (url.pathname === "/__mv/api/auth/signin" || url.pathname === "/__mv/api/auth/claim") || req.method === "GET" && url.pathname === "/__mv/api/invite-info") || !!idIssuer && (req.method === "GET" && url.pathname === "/__mv/id/start" || req.method === "GET" && url.pathname === "/__mv/id/finish" || req.method === "POST" && url.pathname === "/__mv/id/callback" || req.method === "GET" && url.pathname === "/__mv/api/summary" || req.method === "OPTIONS" && url.pathname === "/__mv/api/summary" || req.method === "GET" && url.pathname === "/__mv/api/identity" || req.method === "POST" && url.pathname === "/__mv/api/request-access" || url.pathname.startsWith("/__mv/api/share/"));
 				if (!bearerOk && !preGate) return gate(res, meta, !!collab, void 0, !!idIssuer);
 			}
 		}
@@ -200,6 +249,10 @@ async function serve(root, portFlag) {
 			res.statusCode = 400;
 			return res.end("bad request");
 		}
+		if (path.startsWith("/design/comments/")) {
+			res.statusCode = 404;
+			return res.end("not found");
+		}
 		if (path.endsWith("/")) path += "index.html";
 		let file = resolve(dist, path.slice(1));
 		try {
@@ -605,4 +658,4 @@ ${collabOn ? `
 }
 const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
 //#endregion
-export { serve };
+export { serve, poweredByUrl as t };

package/dist/share-Gqo_Ygqw.mjs

@@ -0,0 +1,158 @@
+import { n as NAME } from "./cli.mjs";
+import { M as resolveAccess } from "./auth-DdUKeVKt.mjs";
+import { i as loadCollab } from "./sync-BZaCWqK-.mjs";
+//#region src/cli/share.ts
+/**
+* `marver share <action>` - the roster from the terminal (01-sharing §9).
+*
+* The sovereign administration path: on a canvas with no identity issuer this
+* IS the whole interface, and on every canvas it calls the same owner routes
+* the app does, over the device credential `comments connect` stored. The
+* resolver ships with an explainer because a permission system nobody can
+* predict is not safe - `explain` asks the canvas's OWN `share/explain` route,
+* so its trace is the resolver the doors enforce with (owner role filled,
+* `@domain` explained through a synthetic member, the winning step marked) and
+* cannot drift from the dialog's Who-sees-what (acceptance 9). `who` runs that
+* same pure function locally over the fetched roster for the granted principals
+* it lists - none of them the owner, so no server-only role handling applies.
+*
+* add <who>        grant view (default) or --role comment; --expires <iso>
+* remove <who>     remove the grant
+* block <email> / unblock <email>
+* general <mode>   private · password · public
+* list             the roster - general access, grants, blocklist
+* requests         pending access requests; --approve <email> [--role r] · --decline <email>
+* explain <who>    the resolver's trace for one principal
+* who              the whole matrix
+*/
+async function api(root, method, path, body) {
+	const collab = loadCollab(root);
+	if (!collab) throw new Error(`no canvas connected - run \`npx ${NAME} comments connect <url>\` first`);
+	const res = await fetch(`${collab.url.replace(/\/+$/, "")}/__mv/api/${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${collab.token}`,
+			...body === void 0 ? {} : { "content-type": "application/json" }
+		},
+		body: body === void 0 ? void 0 : JSON.stringify(body)
+	});
+	if (res.status === 403) throw new Error("the canvas refused - sharing is owner-only, and the connect credential must be the owner's");
+	if (!res.ok) throw new Error((await res.json().catch(() => null))?.error ?? `canvas answered ${res.status}`);
+	return res.json();
+}
+/** The published ceilings, from the boards route - the same rights serve enforces with. */
+async function fetchCeilings(root) {
+	const { rights } = await api(root, "GET", "boards");
+	return Object.fromEntries(Object.entries(rights).map(([b, r]) => [b, r === "comment" ? "comment" : "view"]));
+}
+const asStore = (roster) => ({
+	version: 1,
+	general: roster.general,
+	blocked: roster.blocked,
+	grants: roster.grants
+});
+/** The resolver's trace as the server returned it - the winning step marked with
+*  an arrow, the same verdict the dialog's Who-sees-what draws. */
+function renderExplain(r) {
+	const lines = [];
+	for (const step of r.trace) lines.push(`  ${step.win ? "→" : " "} ${step.where.padEnd(14)} ${step.role.padEnd(9)} ${step.why}`);
+	const boards = Object.entries(r.boards);
+	const readable = boards.filter(([, role]) => role !== "none").length;
+	const writable = boards.filter(([, role]) => role === "comment").length;
+	for (const [b, role] of boards) lines.push(`    board ${b.padEnd(14)} ${role}`);
+	lines.push(`  → ${readable} of ${boards.length} board${boards.length === 1 ? "" : "s"}, may comment on ${writable}`);
+	return lines.join("\n");
+}
+async function shareCommand(root, action, value, opts) {
+	switch (action) {
+		case "add": {
+			if (!value) throw new Error("add needs a principal: an email, or @domain");
+			const role = opts.role === "comment" ? "comment" : "view";
+			const r = await api(root, "PUT", "share/grant", {
+				principal: value,
+				scope: "canvas",
+				assigned: role,
+				expires: opts.expires ?? null
+			});
+			console.log(`  granted ${value} → ${role}${opts.expires ? ` until ${opts.expires}` : ""} (${r.grants.length} grant${r.grants.length === 1 ? "" : "s"} total)`);
+			return;
+		}
+		case "remove":
+			if (!value) throw new Error("remove needs the principal to remove");
+			await api(root, "DELETE", "share/grant", {
+				principal: value,
+				scope: "canvas"
+			});
+			console.log(`  removed ${value}`);
+			return;
+		case "block":
+		case "unblock":
+			if (!value) throw new Error(`${action} needs an email address`);
+			await api(root, action === "block" ? "PUT" : "DELETE", "share/block", { address: value });
+			console.log(action === "block" ? `  blocked ${value} - refused everywhere, ahead of every grant.\n  Blocking only bites while general access is Private.` : `  unblocked ${value}`);
+			return;
+		case "general": {
+			if (value !== "private" && value !== "password" && value !== "public") throw new Error("general needs a mode: private · password · public");
+			const r = await api(root, "PUT", "share/general", { mode: value });
+			if (r.clamped) console.log(`  general access → ${r.clamped.operative} (you asked for ${r.clamped.asked}, but the gate this canvas runs cannot enforce it - the roster never claims a state the server does not hold)`);
+			else console.log(`  general access → ${value}${value === "public" ? " (anyone with the URL reads - Public is called Public)" : ""}`);
+			return;
+		}
+		case "list": {
+			const r = await api(root, "GET", "share/roster");
+			if (opts.json) return console.log(JSON.stringify(r, null, 2));
+			console.log(`\n  general access: ${r.general.mode}`);
+			if (r.blocked.length) console.log(`  blocked: ${r.blocked.join(", ")}`);
+			if (!r.grants.length) console.log("  no grants - only the owner (and general access, if open) gets in");
+			for (const g of r.grants) console.log(`  ${g.principal.padEnd(28)} ${g.assigned.padEnd(8)}${g.expires ? ` until ${g.expires.slice(0, 10)}` : ""}  by ${g.by}`);
+			if (r.requests.length) console.log(`\n  ${r.requests.length} pending request${r.requests.length === 1 ? "" : "s"} - \`${NAME} share requests\``);
+			console.log("");
+			return;
+		}
+		case "requests": {
+			if (opts.approve || opts.decline) {
+				const email = opts.approve ?? opts.decline;
+				await api(root, "POST", `share/request/${encodeURIComponent(email)}`, {
+					approve: !!opts.approve,
+					...opts.approve ? { assigned: opts.role === "comment" ? "comment" : "view" } : {}
+				});
+				console.log(opts.approve ? `  approved ${email} → ${opts.role === "comment" ? "comment" : "view"} - CANVAS-WIDE (v1 approval covers every published board)` : `  declined ${email} (silently - no rejection reaches them)`);
+				return;
+			}
+			const r = await api(root, "GET", "share/roster");
+			if (!r.requests.length) return console.log("  no pending requests");
+			for (const q of r.requests) console.log(`  ${q.email.padEnd(28)} asks ${q.requestedRole.padEnd(8)}${q.target ? ` for ${q.target}` : ""}${q.note ? `  "${q.note}"` : ""}`);
+			console.log(`\n  approve: \`${NAME} share requests --approve <email> [--role comment]\` · decline: \`--decline <email>\``);
+			return;
+		}
+		case "explain": {
+			if (!value) throw new Error("explain needs a principal to explain");
+			const r = await api(root, "GET", `share/explain?who=${encodeURIComponent(value)}`);
+			console.log(`\n${renderExplain(r)}\n`);
+			return;
+		}
+		case "who": {
+			const [roster, ceilings] = await Promise.all([api(root, "GET", "share/roster"), fetchCeilings(root)]);
+			const store = asStore(roster);
+			const boards = Object.keys(ceilings);
+			const principals = [...new Set(store.grants.map((g) => g.principal))];
+			console.log(`\n  ${"".padEnd(28)} ${boards.map((b) => b.padEnd(16)).join("")}`);
+			for (const p of principals) {
+				const r = resolveAccess({
+					email: p.startsWith("@") ? null : p,
+					store,
+					ceilings
+				});
+				const cells = p.startsWith("@") ? boards.map(() => "(per member)") : boards.map((b) => r.boards[b]);
+				console.log(`  ${p.padEnd(28)} ${cells.map((c) => String(c).padEnd(16)).join("")}`);
+			}
+			for (const b of store.blocked) console.log(`  blocked ${String(b).padEnd(20)} ${boards.map(() => "none".padEnd(16)).join("")}`);
+			if (store.general.mode !== "private") console.log(`  ${"anyone (general access)".padEnd(28)} ${boards.map((b) => "view".padEnd(16)).join("")}`);
+			console.log("");
+			return;
+		}
+		default: throw new Error(`unknown action "${action}" - use add · remove · block · unblock · general · list · requests · explain · who`);
+	}
+}
+//#endregion
+export { shareCommand };