@marver-design/marver 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.13.0 - 2026-09-01
+
+### Added
+
+- **@-mentions in comments.** Type `@` in the composer to name someone already
+  visible in the canvas's comments - they get one mail for that comment and a
+  bell notification on the front door. Mentions ride the same identity-minimised
+  projection as authors: browsers only ever see opaque ids, and you can only
+  mention people you can already see. The agent side is real too: `marver
+  comments list --json` now carries each comment's mentions.
+- **Reply mail.** A fresh reply mails the thread's other participants (the 10
+  most recent, at most once per person per thread per 6-hour window; history
+  imports never mail). Activity mail reads like a comment - who wrote it and a
+  snippet of what they said (capped, escaped; the identity service holds those
+  snippets for its delivery window - a disclosed tradeoff, documented in
+  docs/sharing.md) - and carries an unsubscribe link that mutes email without
+  touching the bell. Caveat: delivery needs Marver Sign In - a sovereign canvas
+  has no relay, and `share: { notify: false }` still declines everything.
+- **Mentions light up in the canvas.** A mention of you pulses its comment pin
+  in accent blue until you open the thread, the marker stack opens on the
+  mentioning thread first, and a mention of YOU renders as the loudest chip -
+  including in your own view (they used to render plain exactly for the person
+  they were for). The @-picker got a solid background.
+- **In-app notifications, with sound.** A fresh mention of you - or a reply in
+  a thread you are part of - raises a person-first pill while you are on the
+  canvas: the author's avatar, "name mentioned you", their message, and View,
+  with a soft two-tone ping (best-effort under browser autoplay rules; one
+  ping per batch). Same pill family the Live Jam agent uses, so they stack
+  together. History and first loads never announce.
+- **Mail lands on the thread.** The activity mail's button ("Open the comment"
+  / "Open the thread") deep-links straight to the conversation
+  (`#/b/<board>?c=<thread>`); the relay refuses any other link shape, so mail
+  can only ever point a reader back into the canvas that sent it.
+
+### Fixed
+
+- **Comment `profile` events now bind to the signed-in author.** They were
+  accepted with an arbitrary `author.email`, which let any commenter read the
+  opaque id of any guessed address off the projection.
+- **Blank bodies and duplicate reply ids are refused.** Replay always discarded
+  them silently; the validator now agrees, so nothing downstream (like mail)
+  can fire for an event that was never going to render.
+
+- **`marver share explain` now asks the canvas's own resolver.** It called
+  `resolveAccess` locally over the fetched roster, which drops the three things only the
+  server's `explain` route does - fills the owner role (a fresh owner was explained as an
+  ordinary ungranted person), explains a `@domain` through a synthetic member, and marks
+  the winning step. It now fetches `GET /__mv/api/share/explain?who=`, so the terminal and
+  the browser dialog can never disagree. `who` stays local (it lists only granted
+  non-owner principals, where a local resolve is identical).
+
 ## 0.12.0 - 2026-08-31
 
 ### Added

package/dist/{build-DmfxJc6L.mjs → build-BxGrHFT2.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
 import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-CS6krOTe.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Boy7I_JH.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-DNc4Jpae.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/cli.mjs

@@ -46,7 +46,7 @@ cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "st
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-BXq7yE1p.mjs");
+	const { dev } = await import("./dev-DLwt3Brb.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--embed-seeds", "Copy comment history INTO the web root (identifying - every event carries its author's email)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-DmfxJc6L.mjs");
+	const { buildSite } = await import("./build-BxGrHFT2.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true, opts.embedSeeds === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-BeLLizNg.mjs");
+	const { serve } = await import("./serve-EjEqsiYa.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -75,7 +75,7 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	serve(resolve(opts.root), port);
 });
 cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--token <token>", "connect: the canvas's MARVER_CLI_TOKEN (default $MARVER_CLI_TOKEN) - the identity-mode path").option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-pNxjTrGN.mjs");
+	const { commentsCommand } = await import("./comments-DHB_8BRa.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {
@@ -84,7 +84,7 @@ cli.command("comments <action> [value]", "Comment collaboration: connect <url>
 	}
 });
 cli.command("share <action> [value]", "Sharing roster (owner): add <who> · remove <who> · block/unblock <email> · general <mode> · list · requests · explain <who> · who").option("--root <dir>", "Host repo root", { default: "." }).option("--role <role>", "add / requests --approve: view (default) or comment").option("--expires <iso>", "add: expiry timestamp, e.g. 2026-12-31T00:00:00Z").option("--approve <email>", "requests: approve this pending request (canvas-wide in v1)").option("--decline <email>", "requests: decline this pending request (silent to the asker)").option("--json", "list: machine-readable output").action(async (action, value, opts) => {
-	const { shareCommand } = await import("./share-C64b1tdN.mjs");
+	const { shareCommand } = await import("./share-Gqo_Ygqw.mjs");
 	try {
 		await shareCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {

package/dist/{collab-BmaOjwP1.mjs → collab-mAiNZlDj.mjs}

@@ -1,50 +1,138 @@
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
 import { A as reconfirmGrant, C as commentAllowed, D as operativeMode, E as loadShare, F as setBlocked, I as setGeneralMode, L as shareState, M as resolveAccess, N as resolveRequest, O as provisionVerdict, P as rosterEtag, S as ceilingsFromRights, T as loadRequests, _ as sessionUser, a as claimInvite, b as updateProfile, c as issueDeviceSession, d as opaqueId, f as ownerName, g as sessionIsOperator, h as revokeUser, j as removeGrant, k as putRequest, l as loadStore, m as publicUser, o as createInvite, s as inviteInfo, u as normEmail, v as signIn, w as entryAllowed, y as signOut, z as upsertGrant } from "./auth-DdUKeVKt.mjs";
-import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-Bf9tiGrE.mjs";
+import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-C7CAypbB.mjs";
 import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/server/notify.ts
 /**
-* The canvas's half of the notification relay (04-solution §2.3, §9.5).
+* The canvas's half of the notification relay (04-solution §2.3, §9.5; v1.1
+* additions in 07-v1.1 §A/§B).
 *
-* Three transactional moments, exactly: you were invited (a view/comment grant
-* landed on an address), your request was approved, someone asked for access
-* (to the owner - and that mail carries only "someone"). Delivery is the ID
-* service's relay; the canvas never talks to Resend. The action token is
-* signed by the canvas identity key - owner authorization is implicit in the
-* signature, since only the canvas server holds it.
+* Transactional moments: you were invited, your request was approved, someone
+* asked for access. Activity moments (v1.1): a thread you are in moved
+* (`reply`), somebody named you (`mentioned`). Delivery is the ID service's
+* relay; the canvas never talks to Resend. The action token is signed by the
+* canvas identity key - owner authorization is implicit in the signature,
+* since only the canvas server holds it.
 *
 * Fire-and-forget, always: a notification that failed must never be the reason
-* a grant did not land. Idempotency lives at the relay, keyed on
-* (origin, template, eventId) - the eventId is derived from the STATE
-* TRANSITION, so a re-invite at the same role sends nothing and a role change
-* sends one.
+* a comment or grant did not land - delivery is best-effort at this boundary,
+* durable only once the relay's outbox row exists. Idempotency lives at the
+* relay, keyed on (origin, template, eventId) - the eventId is derived from
+* the STATE TRANSITION, so a re-invite at the same role sends nothing, a
+* mention mails once per person per comment ever, and replies throttle to one
+* mail per recipient per thread per window.
+*
+* All relay requests ride ONE promise chain: however wide a reply fans out,
+* this process holds at most one in-flight relay request (each bounded by its
+* own 5s timeout) - a comment-authorized caller cannot burst sockets.
 */
 const transitionId = (...parts) => createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 32);
-function relayNotify(ctx, template, recipient, eventId) {
+let chain = Promise.resolve();
+const capped = (s, cap) => {
+	const t = s?.replace(/\s+/g, " ").trim();
+	return t ? t.length > cap ? `${t.slice(0, cap - 1)}…` : t : void 0;
+};
+function relayNotify(ctx, template, recipient, eventId, content) {
 	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
 	if (recipient.startsWith("@") || !recipient.includes("@")) return;
-	const now = Math.floor(Date.now() / 1e3);
-	let token;
-	try {
-		token = signCanvasJws(ctx.dataDir, {
-			origin: ctx.origin,
-			template,
-			recipient,
-			eventId,
-			iat: now,
-			exp: now + 600
-		}, "marver-relay+jwt");
-	} catch {
-		return;
+	const { dataDir, origin } = ctx;
+	const actor = capped(content?.actor, 60);
+	const snippet = capped(content?.snippet, 180);
+	const link = content?.link && content.link.length <= 160 ? content.link : void 0;
+	const url = `${ctx.issuer.replace(/\/+$/, "")}/relay/notify`;
+	chain = chain.then(() => {
+		const now = Math.floor(Date.now() / 1e3);
+		let token;
+		try {
+			token = signCanvasJws(dataDir, {
+				origin,
+				template,
+				recipient,
+				eventId,
+				iat: now,
+				exp: now + 600,
+				...actor ? { actor } : {},
+				...snippet ? { snippet } : {},
+				...link ? { link } : {}
+			}, "marver-relay+jwt");
+		} catch {
+			return;
+		}
+		return fetch(url, {
+			method: "POST",
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(5e3)
+		}).then(() => void 0, () => void 0);
+	});
+}
+const FRESH_MS = 9e5;
+const REPLY_WINDOW_MS = 216e5;
+const MAX_REPLY_RECIPIENTS = 10;
+/**
+* Mail the people a fresh comment batch concerns. `accepted` is what
+* appendEvents actually took (never the raw POST body); `log` is the board's
+* full event list including them; `allowed` is the resolver's answer for THIS
+* board (≥ view), injected so this stays pure of store plumbing. Recipients
+* are canonical emails - by the time events land here the write boundary has
+* already inverted the projection.
+*
+* Windows use SERVER time, never ev.ts - a client-datable timestamp must not
+* pick its own throttle bucket. The board is in every key because comment ids
+* are only board-local.
+*/
+function notifyCommentActivity(ctx, board, accepted, log, allowed) {
+	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
+	for (const [eventId, job] of activityJobs(board, accepted, log, allowed, Date.now())) relayNotify(ctx, job.template, job.recipient, eventId, {
+		actor: job.actor,
+		snippet: job.snippet,
+		link: job.link
+	});
+}
+/** The pure half: which (template, recipient, transition) a batch owes. Split
+*  out so the fan-out rules are testable without a relay or a signing key. */
+function activityJobs(board, accepted, log, allowed, now) {
+	const jobs = /* @__PURE__ */ new Map();
+	const threadLink = (threadId) => threadId ? `/#/b/${encodeURIComponent(board)}?c=${encodeURIComponent(threadId)}` : void 0;
+	for (const ev of accepted) {
+		if (ev.type !== "create" && ev.type !== "reply" || Math.abs(now - ev.ts) > FRESH_MS) continue;
+		const author = ev.author?.email?.toLowerCase();
+		const mentioned = /* @__PURE__ */ new Set();
+		for (const m of ev.mentions ?? []) {
+			const email = m.email?.toLowerCase();
+			if (!email || email === author || !allowed(email)) continue;
+			mentioned.add(email);
+			jobs.set(transitionId("mention", email, board, ev.commentId ?? ev.id), {
+				template: "mentioned",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.type === "reply" ? ev.parentId : ev.commentId)
+			});
+		}
+		if (ev.type !== "reply" || !ev.parentId) continue;
+		const recent = [];
+		for (let i = log.length - 1; i >= 0 && recent.length < MAX_REPLY_RECIPIENTS; i--) {
+			const p = log[i];
+			if (p.id === ev.id) continue;
+			const email = (p.type === "reply" ? p.parentId === ev.parentId : p.type === "create" && p.commentId === ev.parentId) ? p.author?.email?.toLowerCase() : void 0;
+			if (email && email !== author && !mentioned.has(email) && !recent.includes(email)) recent.push(email);
+		}
+		const window = String(Math.floor(now / REPLY_WINDOW_MS));
+		for (const email of recent) {
+			if (!allowed(email)) continue;
+			jobs.set(transitionId("reply", email, board, ev.parentId, window), {
+				template: "reply",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.parentId)
+			});
+		}
 	}
-	fetch(`${ctx.issuer.replace(/\/+$/, "")}/relay/notify`, {
-		method: "POST",
-		headers: { authorization: `Bearer ${token}` },
-		signal: AbortSignal.timeout(5e3)
-	}).catch(() => {});
+	return jobs;
 }
 //#endregion
 //#region src/server/collab.ts
@@ -97,15 +185,41 @@ function validAvatar(s) {
 		webp: (b) => b.toString("latin1", 0, 4) === "RIFF" && b.toString("latin1", 8, 12) === "WEBP"
 	}[m[1]]?.(head) ?? false;
 }
+const EMAIL_SHAPE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+const OPAQUE_ID = /^[0-9a-f]{24}$/;
+/** Mention shape rules (07-v1.1 §B). One generic refusal for every violation -
+*  no per-cause oracle. The browser form carries the opaque `id` and NEVER an
+*  email (a browser-supplied email is a membership probe); the operator form
+*  (CLI sync - canonical bytes) carries `email` and never an id. */
+function badMentions(ev, operator) {
+	if (ev.mentions === void 0) return false;
+	if (ev.type !== "create" && ev.type !== "reply") return true;
+	if (!Array.isArray(ev.mentions) || ev.mentions.length > 8) return true;
+	const seen = /* @__PURE__ */ new Set();
+	for (const m of ev.mentions) {
+		if (!m || typeof m !== "object" || Object.keys(m).some((k) => k !== "id" && k !== "email" && k !== "label")) return true;
+		if (typeof m.label !== "string" || !m.label.trim() || m.label.length > 80 || /^@?marver\b/i.test(m.label.trim())) return true;
+		const who = operator ? m.email : m.id;
+		if (operator ? typeof m.email !== "string" || !EMAIL_SHAPE.test(m.email) || m.email.length > 254 || m.id !== void 0 : typeof m.id !== "string" || !OPAQUE_ID.test(m.id) || m.email !== void 0) return true;
+		const key = who.toLowerCase();
+		if (seen.has(key)) return true;
+		seen.add(key);
+	}
+	return false;
+}
 /** Reject anything the log must not absorb. Returns an error string or null.
 *  Events are append-only and synced by id, so acceptance is forever - validate hard. */
-function validateEvents(incoming, log, u, board) {
+function validateEvents(incoming, log, u, board, opts = {}) {
 	const now = Date.now();
 	const creates = /* @__PURE__ */ new Map();
+	const comments = /* @__PURE__ */ new Set();
 	const authors = /* @__PURE__ */ new Map();
 	for (const ev of log) {
 		if (ev.type === "create" && ev.commentId && !creates.has(ev.commentId)) creates.set(ev.commentId, ev);
-		if ((ev.type === "create" || ev.type === "reply") && ev.commentId && ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+		if ((ev.type === "create" || ev.type === "reply") && ev.commentId) {
+			comments.add(ev.commentId);
+			if (ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+		}
 	}
 	const me = u.email.toLowerCase();
 	for (const ev of incoming) {
@@ -117,7 +231,9 @@ function validateEvents(incoming, log, u, board) {
 		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
 		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
 		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
-		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if ((ev.type === "create" || ev.type === "reply") && !ev.body?.trim()) return "a comment needs a body";
+		if (badMentions(ev, !!opts.operator)) return "invalid mentions";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor" || ev.type === "profile") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
 		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
 			if (ev.type !== "profile") return "event needs a commentId";
 		}
@@ -125,10 +241,13 @@ function validateEvents(incoming, log, u, board) {
 			case "create":
 				if (creates.has(ev.commentId)) return "a thread with that id already exists";
 				creates.set(ev.commentId, ev);
+				comments.add(ev.commentId);
 				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
 				break;
 			case "reply":
 				if (typeof ev.parentId !== "string" || !creates.has(ev.parentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.parentId)) return "reply parent does not exist";
+				if (comments.has(ev.commentId)) return "a comment with that id already exists";
+				comments.add(ev.commentId);
 				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
 				break;
 			case "edit": {
@@ -238,15 +357,67 @@ function collabHandler(dataDir, distDir) {
 		return hit;
 	};
 	const project = (ev) => {
-		if (!ev.author?.email) return ev;
-		const { email, ...rest } = ev.author;
-		return {
-			...ev,
-			author: {
-				...rest,
-				id: opaqueId(dataDir, email)
-			}
+		let out = ev;
+		if (ev.author?.email) {
+			const { email, ...rest } = ev.author;
+			out = {
+				...out,
+				author: {
+					...rest,
+					id: opaqueId(dataDir, email)
+				}
+			};
+		}
+		if (ev.mentions !== void 0) {
+			const safe = Array.isArray(ev.mentions) ? ev.mentions.flatMap((m) => {
+				if (!m || typeof m !== "object") return [];
+				const label = typeof m.label === "string" ? m.label : "";
+				if (typeof m.email === "string") return [{
+					id: opaqueId(dataDir, m.email),
+					label
+				}];
+				if (typeof m.id === "string") return [{
+					id: m.id,
+					label
+				}];
+				return [];
+			}) : [];
+			out = {
+				...out,
+				mentions: safe.length ? safe : void 0
+			};
+		}
+		return out;
+	};
+	/** Every opaque id the canvas can resolve back to an address: accounts, plus
+	*  every author and mention across the boards' logs. Broader than any one
+	*  composer can see, and safely so - ids are HMACs under the canvas secret,
+	*  so a valid id for an unseen person cannot be manufactured to probe with. */
+	const mentionTargets = () => {
+		const map = /* @__PURE__ */ new Map();
+		const add = (email) => {
+			if (email) map.set(opaqueId(dataDir, email), normEmail(email));
 		};
+		for (const usr of loadStore(dataDir).users) add(usr.email);
+		for (const st of threads.values()) for (const ev of st.events) {
+			add(ev.author?.email);
+			for (const mn of ev.mentions ?? []) add(mn.email);
+		}
+		return map;
+	};
+	/** May this address still read this board - the activity-mail eligibility
+	*  filter, asked at enqueue time (delivery cannot re-check; 07-v1.1 §A). */
+	const mailAllowed = (board, email) => {
+		const store = shareState(dataDir);
+		if (!store) return true;
+		const owner = loadStore(dataDir).users.find((x) => x.role === "owner");
+		const userRole = owner && normEmail(owner.email) === normEmail(email) ? "owner" : "member";
+		return (resolveAccess({
+			email,
+			userRole,
+			store,
+			ceilings
+		}).boards[board] ?? "none") !== "none";
 	};
 	const rawTransport = (req) => {
 		const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
@@ -761,14 +932,32 @@ function collabHandler(dataDir, distDir) {
 				const b = await readBody(req);
 				const incoming = Array.isArray(b.events) ? b.events : [];
 				if (incoming.length > 100) return json(res, 400, { error: "too many events in one push" }), true;
-				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1]);
+				const operator = rawTransport(req);
+				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1], { operator });
 				if (bad) return json(res, 400, { error: bad }), true;
+				if (!operator && incoming.some((ev) => ev.mentions?.length)) {
+					const targets = mentionTargets();
+					for (const ev of incoming) {
+						if (!ev.mentions?.length) continue;
+						const mapped = [];
+						for (const mn of ev.mentions) {
+							const email = targets.get(mn.id);
+							if (!email || email === normEmail(u.email)) return json(res, 400, { error: "invalid mentions" }), true;
+							mapped.push({
+								email,
+								label: mn.label
+							});
+						}
+						ev.mentions = mapped;
+					}
+				}
 				const fresh = appendEvents(commentsDir, m[1], incoming);
 				if (fresh.length) {
 					const st = threads.get(m[1]);
 					threads.set(m[1], deriveThreads([...st?.events ?? [], ...fresh]));
 				}
 				broadcast(m[1], fresh.map(project));
+				if (fresh.length) notifyCommentActivity(notifyCtx, m[1], fresh, threads.get(m[1])?.events ?? [], (email) => mailAllowed(m[1], email));
 				return json(res, 200, { accepted: fresh.length }), true;
 			}
 			return false;

package/dist/{comments-pNxjTrGN.mjs → comments-DHB_8BRa.mjs}

@@ -1,8 +1,8 @@
 import { n as NAME } from "./cli.mjs";
-import { n as replay } from "./events-C9k-ceOj.mjs";
+import { n as replay } from "./events-B3LBn74P.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, t as connect } from "./sync-WYxDN9IT.mjs";
-import { n as localProfile } from "./profile-ChpTPd-X.mjs";
+import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, t as connect } from "./sync-BZaCWqK-.mjs";
+import { n as localProfile } from "./profile-BjAPAJSb.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";

package/dist/{daemon-WjonKlPz.mjs → daemon-BChkzDqQ.mjs}

@@ -1,6 +1,6 @@
-import { n as replay } from "./events-C9k-ceOj.mjs";
+import { n as replay } from "./events-B3LBn74P.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { n as localProfile } from "./profile-ChpTPd-X.mjs";
+import { n as localProfile } from "./profile-BjAPAJSb.mjs";
 import { i as toFrameId } from "./manifest-CS6krOTe.mjs";
 import { workActivity } from "./work-CLrmY-vQ.mjs";
 import { r as deviceId, t as has } from "./ledger-Bu0BjqIe.mjs";

package/dist/{dev-BXq7yE1p.mjs → dev-DLwt3Brb.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
 import { l as detectHost, s as loadConfig } from "./manifest-CS6krOTe.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Boy7I_JH.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-DNc4Jpae.mjs";
 import { realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -247,7 +247,7 @@ async function dev(root, portFlag) {
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
 	try {
 		const { staleManagedInstructions } = await import("./managed-HwHVNI3h.mjs");
-		const { installedVersion } = await import("./plugin-Boy7I_JH.mjs").then((n) => n.i);
+		const { installedVersion } = await import("./plugin-DNc4Jpae.mjs").then((n) => n.i);
 		const stale = staleManagedInstructions(root);
 		if (stale.length) {
 			const shown = stale.slice(0, 4).join(", ") + (stale.length > 4 ? `, +${stale.length - 4} more` : "");
@@ -255,7 +255,7 @@ async function dev(root, portFlag) {
 			console.log(`  instructions predate ${v ? NAME + " " + v : "the installed version"} (${shown}) - run: npx ${NAME} init\n`);
 		}
 	} catch {}
-	const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+	const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -285,7 +285,7 @@ async function dev(root, portFlag) {
 		});
 	}
 	if (config.jam) {
-		const { startJam } = await import("./daemon-WjonKlPz.mjs");
+		const { startJam } = await import("./daemon-BChkzDqQ.mjs");
 		const jam = startJam(root, config.jam, (m) => console.log(m), (board) => server.ws.send("sh:jam-comment", { board }));
 		if (jam) {
 			const close = server.close.bind(server);

package/dist/{events-C9k-ceOj.mjs → events-B3LBn74P.mjs}

@@ -26,6 +26,7 @@ function replay(events) {
 			resolved: false,
 			agent: ev.agent,
 			agentMeta: ev.agentMeta,
+			mentions: ev.mentions,
 			replies: [],
 			reactions: {}
 		});
@@ -40,7 +41,8 @@ function replay(events) {
 				body: ev.body,
 				ts: ev.ts,
 				agent: ev.agent,
-				agentMeta: ev.agentMeta
+				agentMeta: ev.agentMeta,
+				mentions: ev.mentions
 			});
 			break;
 		}

package/dist/{marver-id-gate-DOjnZakC.mjs → marver-id-gate-B2uraTHS.mjs}

@@ -1,6 +1,6 @@
 import { i as avatarSourceFor, n as attachAvatar, p as provisionFromMarverId } from "./auth-DdUKeVKt.mjs";
 import { TransactionStore, browserBinding, verifyAssertion } from "./marver-id-CVCoaMGI.mjs";
-import { t as poweredByUrl } from "./serve-BeLLizNg.mjs";
+import { t as poweredByUrl } from "./serve-EjEqsiYa.mjs";
 import { randomBytes } from "node:crypto";
 import { isIP } from "node:net";
 import { lookup } from "node:dns/promises";
@@ -422,7 +422,7 @@ function marverIdHandler(dir, issuer, canvasName, branding = true, ceilings = {}
 					const { shareState, provisionVerdict } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
 					const share = shareState(dir);
 					if (!(share ? provisionVerdict(share, result.identity.email) === "blocked" : false)) {
-						const { signCanvasJws } = await import("./summary-Bf9tiGrE.mjs");
+						const { signCanvasJws } = await import("./summary-C7CAypbB.mjs");
 						const now = Math.floor(Date.now() / 1e3);
 						request = signCanvasJws(dir, {
 							aud: origin,
@@ -545,9 +545,12 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
   p.lead { margin: 0; padding: 0 4px; font-size: 12.5px; line-height: 1.5;
            color: rgba(24,24,27,.66) }
   p.lead strong { color: #18181b; font-weight: 600 }
-  a.cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
-          font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
-          display: flex; align-items: center; justify-content: center }
+  /* .cta, not a.cta: the request-access <button> wears the same dark pill as the
+     switch-account <a> - scoping to the tag left the button naked (a flat native
+     strip that read as disabled) */
+  .cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
+         font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
+         display: flex; align-items: center; justify-content: center }
   footer a { display: inline-flex; align-items: center; gap: 7px;
              font: 600 12.5px -apple-system, system-ui, sans-serif;
              color: rgba(24,24,27,.5); text-decoration: none }

package/dist/{plugin-Boy7I_JH.mjs → plugin-DNc4Jpae.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { n as localProfile, t as isConnected } from "./profile-ChpTPd-X.mjs";
+import { n as localProfile, t as isConnected } from "./profile-BjAPAJSb.mjs";
 import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-CS6krOTe.mjs";
 import { copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
@@ -306,7 +306,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-BmaOjwP1.mjs");
+				const { validAvatar } = await import("./collab-mAiNZlDj.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -397,7 +397,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+				const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -426,7 +426,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+			const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}

package/dist/{profile-ChpTPd-X.mjs → profile-BjAPAJSb.mjs}

@@ -1,4 +1,4 @@
-import { i as loadCollab } from "./sync-WYxDN9IT.mjs";
+import { i as loadCollab } from "./sync-BZaCWqK-.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/profile.ts

package/dist/{serve-BeLLizNg.mjs → serve-EjEqsiYa.mjs}

@@ -74,7 +74,7 @@ async function serve(root, portFlag) {
 	*  accounts get in. Null when there is no roster to consult. */
 	let guestDoorOpen = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-BmaOjwP1.mjs");
+		const { collabHandler } = await import("./collab-mAiNZlDj.mjs");
 		const { appendEvents, readLog } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const dir = dataDir();
@@ -146,7 +146,7 @@ async function serve(root, portFlag) {
 			console.error(`[${NAME}] MARVER_ID_ISSUER is set but MARVER_PUBLIC_ORIGIN is not.\n  Every assertion is bound to this canvas's exact origin, and it cannot be\n  inferred from request headers - a proxy can make any request look local.\n  Set it to the origin people actually reach this canvas on:\n    MARVER_PUBLIC_ORIGIN=https://canvas.example.com\n    MARVER_PUBLIC_ORIGIN=http://localhost:${portFlag ?? (Number(process.env.PORT) || 4199)} (development)`);
 			process.exit(1);
 		}
-		const { marverIdHandler } = await import("./marver-id-gate-DOjnZakC.mjs");
+		const { marverIdHandler } = await import("./marver-id-gate-B2uraTHS.mjs");
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const canvasName = humanName(meta.name);
 		const { ceilingsFromRights } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);