@marver-design/marver 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -2,6 +2,130 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.14.0 - 2026-09-02
+
+### Added
+
+- **Slides.** A deck is a scene of `slide: true` frames: 1280×720 on the
+  canvas, the slideshow badge, and a real slides mode - the standard
+  prototype toolbar and walker, arrows / Space / click to advance, and
+  **the board as the sorter** (the deck plays in the board's reading
+  order; drag to reorder). Publish with `"type": "slides", "open":
+  "slides"` plus `transition` (`fade | none`) and `chrome` (`full |
+  minimal | none`); the Slide stage scales and centers itself to ANY
+  viewport with pure CSS (fill window, phones, a resized canvas node -
+  author px and Tailwind scale together); viewers land straight in the
+  deck and the URL survives refresh. The full guide is
+  [docs/slides.md](docs/slides.md).
+- **The `Slide` root, `Chart`, and `Video` content primitives.** One root
+  owns the stage (asymmetric margins - 88px sides, 44px top and bottom - so
+  the middle band breathes; content box 1104×632), the theme tokens
+  (`--marver-slide-ground/-ink/-muted` with dark twins, `-accent`, `-font`,
+  `-tempo` timing both entrances and morphs), fixed type roles
+  (`sl-display` 160, `sl-stat` 88, `sl-assertion` 56, `sl-support` 30,
+  `sl-body` 24, `sl-caption` 18), and a development-only overflow marker
+  that catches content escaping the stage, or a flex/grid child outgrowing
+  its parent; `Chart`
+  is Apache ECharts on a fixed supported surface (series bar, line, pie, scatter, radar, gauge, heatmap, funnel, treemap, sunburst, sankey, boxplot; SVG, lazy
+  chunk, house-themed, animation stripped at rest); `Video` is
+  poster-first with a glass control strip in play mode. The motion
+  contract: a resting slide built from the shipped primitives serializes
+  to the canvas's lean path - no canvas/video elements, no running
+  animation - so a 40-slide deck pans like 40 statics (a slide that embeds
+  its own canvas, video, or shadow DOM stays live, as any frame would).
+- **Motion as the diff.** `view-transition-name` morphs between adjacent
+  slides are the animation system; build steps are sibling frames; three
+  one-shot entrance presets (`data-animate`) run after each transition
+  settles. Reduced motion flattens both. Slides mode offers a 1280×720
+  Slide device preset beside your devices and fill; `marver shot` renders a
+  slide at 1280×720 over any authored viewport; `/content` exports
+  `SLIDE_W` / `SLIDE_H`; `--marver-slide-pad-x/-y` set the stage margins.
+- **The slides doctrine.** `marver init` ships
+  `design/instructions/slides.md` - assertion-first argument, the type
+  scale, 19 layout recipes with budgets and morph anchors, the choreography
+  rules, "the space IS the design" (asymmetric margins, the 85% rule, one
+  px spacing scale), seven silhouettes chosen before any recipe with a
+  storyboard step and pacing rules, and a review gate that squints the
+  contact sheet - with two depth references behind it:
+  `reference/deck-story.md` (intake, answer-first structure, the evidence
+  check, audience calibration, the writing) and `reference/deck-layouts.md`
+  (the full layout atlas grouped by job, the composition grid, content
+  budgets, rebuilding an existing deck, chart craft). Plus your
+  project-owned `design/slides.md` - now opening with a fill-in **deck
+  look** template (tokens, type, mark, colour meaning, numbers, voice) the
+  agent drafts on the first deck - which overrides the doctrine and survives
+  every upgrade.
+
+### Changed
+
+- **The play brand pill is a powered-by link** (marver.design, standard UTM
+  set, `utm_content=play-brand`), sized to the pixel like the toolbar pill.
+  The keyboard-hint pill is gone (two conflicting rules stretched it into a
+  full-stage circle; the walker and toolbar already carry stepping and
+  comment). Name your canvas - `share: { name }` - before containerising it:
+  the shell's fallback is the root directory, which in a container is `app`.
+- **A `slides` board plays only its `slide: true` frames.** 0.13.0 accepted
+  `type: "slides"` / `open: "slides"` and played them as `present`. From
+  0.14.0 the deck is the board's slide frames in reading order; non-slide
+  frames on such a board warn at build, and a board with none fails the
+  build with the fix in the message (a non-slides `type` plus
+  `open: "present"` to keep the old behaviour, or `slide: true` on the
+  frames). In the app an empty deck
+  falls back to the prototype with a toast. `transition` / `chrome` are
+  refused on non-slide boards. `marver init` appends `slides-inspiration/`
+  to an existing `design/.gitignore`. `docs/` now ships in the package.
+
+## 0.13.0 - 2026-09-01
+
+### Added
+
+- **@-mentions in comments.** Type `@` in the composer to name someone already
+  visible in the canvas's comments - they get one mail for that comment and a
+  bell notification on the front door. Mentions ride the same identity-minimised
+  projection as authors: browsers only ever see opaque ids, and you can only
+  mention people you can already see. The agent side is real too: `marver
+  comments list --json` now carries each comment's mentions.
+- **Reply mail.** A fresh reply mails the thread's other participants (the 10
+  most recent, at most once per person per thread per 6-hour window; history
+  imports never mail). Activity mail reads like a comment - who wrote it and a
+  snippet of what they said (capped, escaped; the identity service holds those
+  snippets for its delivery window - a disclosed tradeoff, documented in
+  docs/sharing.md) - and carries an unsubscribe link that mutes email without
+  touching the bell. Caveat: delivery needs Marver Sign In - a sovereign canvas
+  has no relay, and `share: { notify: false }` still declines everything.
+- **Mentions light up in the canvas.** A mention of you pulses its comment pin
+  in accent blue until you open the thread, the marker stack opens on the
+  mentioning thread first, and a mention of YOU renders as the loudest chip -
+  including in your own view (they used to render plain exactly for the person
+  they were for). The @-picker got a solid background.
+- **In-app notifications, with sound.** A fresh mention of you - or a reply in
+  a thread you are part of - raises a person-first pill while you are on the
+  canvas: the author's avatar, "name mentioned you", their message, and View,
+  with a soft two-tone ping (best-effort under browser autoplay rules; one
+  ping per batch). Same pill family the Live Jam agent uses, so they stack
+  together. History and first loads never announce.
+- **Mail lands on the thread.** The activity mail's button ("Open the comment"
+  / "Open the thread") deep-links straight to the conversation
+  (`#/b/<board>?c=<thread>`); the relay refuses any other link shape, so mail
+  can only ever point a reader back into the canvas that sent it.
+
+### Fixed
+
+- **Comment `profile` events now bind to the signed-in author.** They were
+  accepted with an arbitrary `author.email`, which let any commenter read the
+  opaque id of any guessed address off the projection.
+- **Blank bodies and duplicate reply ids are refused.** Replay always discarded
+  them silently; the validator now agrees, so nothing downstream (like mail)
+  can fire for an event that was never going to render.
+
+- **`marver share explain` now asks the canvas's own resolver.** It called
+  `resolveAccess` locally over the fetched roster, which drops the three things only the
+  server's `explain` route does - fills the owner role (a fresh owner was explained as an
+  ordinary ungranted person), explains a `@domain` through a synthetic member, and marks
+  the winning step. It now fetches `GET /__mv/api/share/explain?who=`, so the terminal and
+  the browser dialog can never disagree. `who` stays local (it lists only granted
+  non-owner principals, where a local resolve is identical).
+
 ## 0.12.0 - 2026-08-31
 
 ### Added

package/README.md

@@ -6,7 +6,9 @@
 
 **The agent-native design canvas.** A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
 
-[marver.design](https://marver.design) · [Live Jam](docs/live-jam.md) · [Deploying a canvas](docs/publish.md) · [Sharing](docs/sharing.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
+Screens, prototypes, specs, and now slide decks - all real code, all on one canvas, all shareable with people who sign in as themselves.
+
+[marver.design](https://marver.design) · [Slides](docs/slides.md) · [Live Jam](docs/live-jam.md) · [Deploying a canvas](docs/publish.md) · [Sharing](docs/sharing.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
 
 ## Quickstart
 
@@ -20,42 +22,57 @@ Then, to your agent:
 
 > Read design/AGENTS.md. Build an onboarding scene - welcome, form, done - mobile-first, using our components.
 
+or
+
+> Read design/AGENTS.md. Build me a 12-slide pitch deck from this brief, in our brand.
+
 Frames appear on the canvas the moment the files land. That's the loop.
 
 ## Why marver
 
 - **Frames are real code.** Plain TSX/HTML files rendered from your repo's actual components and theme - zero imports from this package required. An approved design promotes into the app by moving a file, not by re-implementing a picture.
+- **Decks are real code too.** A slide is a frame with `slide: true`. One `Slide` primitive, your own markup inside it, a doctrine that teaches the agent to argue rather than decorate - and a stage that scales itself to any screen without the agent writing a single breakpoint. See [Slides](#slides).
 - **Everything hot-reloads.** The agent writes, you watch it land - live.
 - **True viewports.** Each frame is a real iframe: drag its edge and your actual breakpoints fire.
 - **Your agent answers on the canvas.** Tag `@marver` in a comment and it picks up the job, edits the real source, and replies in the thread - no wiring, on by default. See [Live Jam](#live-jam).
-- **Feedback without a signup wall.** Publish the canvas, invite people by email, and they sign in as themselves - one free Marver account, Google or an emailed code, and it opens every canvas you ever share with them. Or keep it entirely self-hosted behind a shared password. See [Collaboration](#collaboration).
-- **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates the `design/AGENTS.md` contract that teaches it the whole workflow.
+- **Feedback without a signup wall.** Publish the canvas and invite people by email; they sign in as themselves with one free Marver account that opens every canvas anyone ever shares with them. @-mention a reviewer, they get the mail; reply, and the thread's people hear about it. Or keep it entirely self-hosted behind a shared password. See [Collaboration](#collaboration).
+- **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates `design/AGENTS.md` and a `design/instructions/` method - configure, discover, wireframe, brand, build, review, slides, publish - that teaches it the whole workflow.
 
 ## The canvas
 
 - **Frames, scenes, boards.** Frames are screens, scenes group them (`design/scenes/<scene>/<frame>.tsx`), boards arrange them. Agents write `design/boards/<name>.json` (a frame list is enough); switch boards at the top of the sidebar. `all-scenes` is auto-managed. Right-click any board, scene, or frame in the sidebar to copy its path - the exact string to paste to your agent - and rename or drag-reorder boards from there too.
 - **Devices view.** Hotkeys `1`-`5` (or the Devices menu) size every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
 - **Prototype links.** `data-goto="scene/frame"` on any element links frames into a walkable prototype - across boards, too.
-- **Play mode.** Press `p`: the board becomes a full-screen, clickable walkthrough. `data-goto` links navigate, arrow keys step between frames, `[` / `]` cycle variants, `Escape` exits. Publish it and you have a shareable prototype.
-- **Content frames.** Specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through before any pixels exist. Works in a repo with no app at all: idea first, design second.
+- **Five ways to view a board.** The canvas (frames on a plane), the board (the same, tidy), **present** (`p`: a full-screen clickable walkthrough - `data-goto` navigates, arrows step, `[` / `]` cycle variants, laser, comments, theme and device pickers in the toolbar), **focus** (one frame as a document - the reading preset for specs), and **slides** (a deck). A published board names its landing view; a frame deep link opens straight into it.
+- **Content frames.** Specs, Mermaid diagrams, mood boards, and slides live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img`, `Slide`, `Chart`, `Video` from `@marver-design/marver/content` and think a feature through before any pixels exist. Works in a repo with no app at all: idea first, design second.
 
-## Collaboration
+## Slides
 
-- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Viewers on a published canvas comment with real names and avatars - either a Marver account they already have, or an invite-link account on that canvas alone. `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
-- **Laser mode.** Press `l`: every element in every frame gets depth-hued outlines plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent.
-- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships, and whether each board is `read` or `comment`); `npx marver serve` hosts it. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+A deck is a scene of `slide: true` frames. On the canvas they are 1280×720 frames like any other - comment on them, laser them, fork variants, drag them to reorder the deck (the board's reading order is the play order). Press `p` on a slides board and you get slides mode: the 16:9 stage, arrows / Space / click to advance, `d` cycles the theme, devices including fill window, morphs between slides where the agent named the same element twice.
 
-- **Two ways to let people in.** They are alternatives, not layers - pick one per canvas.
+What makes it light on the agent side, and good on every screen:
 
-  **Marver Sign In** (new in 0.11). Set `MARVER_ID_ISSUER=https://id.marver.design` and reviewers sign in as themselves, with Google or a six-digit code emailed to them. One free Marver account opens *every* canvas gated this way, so the second board you share costs them nothing: no new signup, no new password, no link to keep. You invite an email address and they are in.
+- **One primitive, no component library.** `Slide` owns the stage, the margins, six fixed type roles, your theme's tokens, and the motion contract. Everything inside is your project's own markup and components - a slide is built the way a screen is built.
+- **The fit is pure CSS.** The agent authors at exactly 1280×720; the root scales and centers itself to a phone, a laptop, a projector, or a resized canvas node. No `vw`, no media queries, no breakpoints - the composition you approved is the composition everyone sees, and a dev-only overflow marker outlines a slide whose content escapes the stage, or whose flex/grid child outgrows its parent.
+- **Still at rest.** Charts are final-state SVG in a lazy chunk, videos are posters, and every CSS animation under `Slide` is suspended until slides mode plays - so a 40-slide deck of the shipped primitives pans like 40 statics on the canvas. (Your own `<canvas>`, `<video>`, or JS-driven motion stays live, as in any frame.)
+- **A doctrine, not a template.** `init` ships `design/instructions/slides.md`: assertion-first argument, the space (three bands, the 85% rule, one spacing scale), seven silhouettes chosen before any recipe so a deck never reads as one repeated shape, 19 recipes with budgets, choreography rules, and a review gate - plus two depth references and your own project-owned `design/slides.md` with a fill-in **deck look** the agent drafts from your brand.
 
-  That is the whole difference, and it is the difference between "I'll look later" and a comment actually landing on the board. It also means their real name and face ride along, so a thread is from a person rather than from an address.
+Publish a deck with `{ "boards": { "pitch": { "max": "read", "type": "slides", "open": "slides", "lock": true } } }` in `design/publish.json` and the link opens straight into the deck, read-only, with no canvas behind it. The [slides guide](docs/slides.md) has the rest - morphs, build steps, `Chart` and `Video`, the theme tokens.
 
-  **A shared password** (`MARVER_PASSWORD`). Fully self-hosted, no account anywhere but your own volume, nothing about your reviewers leaves your infrastructure - and still fully supported, not a legacy path. The trade is that every canvas is an island: reviewers claim an invite link and pick a name and password *on that canvas*, and do it again for the next one. Fine for one board, a toll on the fifth.
+## Collaboration
 
-  Either way the canvas runs on your infrastructure and stores its own comments and members. With Marver Sign In the identity service only ever tells your canvas that a verified address matched an entry on your invite list - it never sees your frames, your files, or your comments. Rights stay yours: `design/publish.json` decides which boards are readable and which are commentable, and `marver comments invite`/`revoke` decides who is on the list.
+- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Type `@` to mention someone who can already see the canvas; they get a mail with the comment and a link that lands on the thread, and the mention pulses its pin in their canvas with an in-app notification. A reply mails the thread's other participants, throttled per person and thread; anyone can mute a canvas's mail. `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
+- **Laser mode.** Press `l`: every element in every frame gets depth-hued outlines plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent. (On a published canvas, laser needs `"reveal": { "source": true }` in `publish.json` - source paths go opaque by default.)
+- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships, each board's ceiling - `read` or `comment` - and, since 0.12, its **type** and **landing view**: `{ "max", "type": "doc" | "slides" | "design" | "sketch" | "refs" | "mix", "open": "canvas" | "board" | "present" | "focus" | "slides", "lock": true }`); `npx marver serve` hosts it. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+- **Sharing, person by person.** On a canvas with a persistent volume, `marver share add sam@acme.com --role comment` (or the browser's share dialog) grants one person access, `@acme.com` grants a domain, `general private|password|public` sets the floor, and a refused visitor can ask to get in - approve from the terminal. One resolver answers "what can this person do here", and `marver share explain <email>` shows its reasoning. The [sharing guide](docs/sharing.md) has the whole surface.
 
-  *Coming next:* one home for your account - every canvas you have been invited to, every canvas you have shared, and the access each one carries, in a single list. Today the account page at `id.marver.design` shows the canvases you have approved and lets you revoke them.
+- **Two ways to let people in.** They are alternatives, not layers - pick one per canvas.
+
+  **Marver Sign In.** Set `MARVER_ID_ISSUER=https://id.marver.design` and reviewers sign in as themselves, with Google or a six-digit code emailed to them. One free Marver account opens *every* canvas gated this way, so the second board you share costs them nothing: no new signup, no new password, no link to keep. Their real name and face ride along, so a thread is from a person rather than from an address. And **[app.marver.design](https://app.marver.design)** is their front door: every canvas they can reach, in one signed-in list, each row lit by a summary the canvas itself signs - the front door holds no roster and makes no access decision.
+
+  **A shared password** (`MARVER_PASSWORD`). Fully self-hosted, no account anywhere but your own volume, nothing about your reviewers leaves your infrastructure - and still fully supported. The trade is that every canvas is an island: reviewers claim an invite link and pick a name and password *on that canvas*, and do it again for the next one.
+
+  Either way the canvas runs on your infrastructure and stores its own comments and members. With Marver Sign In the identity service only ever tells your canvas that a verified address matched an entry on your list - it never sees your frames, your files, or your comments. Rights stay yours: `design/publish.json` decides which boards are readable and which are commentable, and the roster decides who is on the list.
 
 ## Live Jam
 
@@ -65,7 +82,7 @@ The trust boundary is hard: only comments written on the owner's machine trigger
 
 ## Working state
 
-The same glow, driven from the terminal. When your agent takes a request, it creates the frame files first, pins them on a board, and runs `npx marver work start <scene/frame ...>` - you see the work land on the canvas in seconds, watch it shimmer while subagents build in parallel, and see it settle on `work done`. Marks self-expire, so a crashed agent never leaves a frame glowing.
+The same glow, driven from the terminal. When your agent takes a request, it creates the frame files first, pins them on a board, and runs `npx marver work start <scene/frame ...>` - you see the work land on the canvas in seconds, watch it shimmer while subagents build in parallel, and see it settle on `work done`. Marks self-expire, so a crashed agent never leaves a frame glowing. And `npx marver shot <scene/frame>` renders one frame headless to a PNG, so the agent can look at what it built before it says it is done.
 
 ## Commands
 
@@ -75,8 +92,10 @@ The same glow, driven from the terminal. When your agent takes a request, it cre
 | `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam armed (`--port`, default 5199) |
 | `npx marver build` | Static export → `design/.dist`; what ships comes from `design/publish.json` (default-closed) |
 | `npx marver serve` | Serve the export; `MARVER_ID_ISSUER` or `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
+| `npx marver share …` | The roster (owner): `add <who> [--role]` · `remove` · `block` / `unblock` · `general <mode>` · `list` · `requests` · `explain <who>` · `who` |
 | `npx marver comments …` | The agent's queue: `connect <url>` · `sync` · `list` · `reply` · `resolve` · `invite <email>` · `revoke <email>` |
 | `npx marver work …` | Working glow from the terminal: `start <scene/frame …>` · `done … \| --all` · `list` |
+| `npx marver shot <frame>` | Render one frame headless and print the PNG path (needs `dev` running) |
 
 ## Shortcuts
 
@@ -91,17 +110,20 @@ The same glow, driven from the terminal. When your agent takes a request, it cre
 
 **Selection** - click selects · shift+click (canvas or sidebar) builds a multi-selection · `⌘A` selects every frame on the board · `⇧P` copies the selected frames' paths (board, frame, and file) · double-click enters interact mode (`esc` or click outside leaves) · drag the title bar to move, edges to resize (widths snap to devices).
 
-**Modes** - `c` comment mode · `l` laser mode · `⇧C` hide/show comment pins · `⇧L` laser comment (spotlight a thread's element) · `p` play mode · `h` hide all chrome.
+**Modes** - `c` comment mode · `l` laser mode · `⇧C` hide/show comment pins · `⇧L` laser comment (spotlight a thread's element) · `p` play (present, or slides on a slides board) · `h` hide all chrome.
+
+**In play** - `←` `→` step (Space and click advance a deck) · `[` `]` cycle variants · `d` cycles the theme · digits pick a device, the digit after your last one fills the window · `esc` exits, unless the board is locked to that view.
 
 ## Notes
 
 - **Next.js**: supported with one caveat - frames render in Vite, outside Next. `next/font` CSS variables are undefined inside frames (give font tokens a fallback chain), `next/image`/`next/link` should be plain `img`/`data-goto` in frames, and Server Components cannot run there. `init` writes the specifics into `design/AGENTS.md` when it detects Next.
-- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
+- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables), and warns when your `design/instructions/` predate the installed package. Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
+- **Name your canvas**: `share: { name: "Your App" }` in `design/config.ts` titles the gate, labels the brand pill, and tags every powered-by link. Unset, the gate falls back to your `package.json` name and the canvas shell to the directory name - `app` inside most containers.
 - **Uninstall**: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
 
 ## Status
 
-Marver is a young solo side project - it works, it's dogfooded daily, and it has rough edges. The known weak spot: boards with many heavy frames (animation-rich, component-dense) can strain the canvas, especially while zooming - snapshot-based rendering helps but isn't finished. If you hit a wall, an issue with your board shape and frame count genuinely helps.
+Marver is a young solo side project - it works, it's dogfooded daily, and it has rough edges. The known weak spot: boards with many heavy frames (animation-rich, component-dense) can strain the canvas, especially while zooming - snapshot-based rendering helps but isn't finished. Sharing controls who gets in and who may comment; per-board read privacy (a board some people can see and others cannot) is next. If you hit a wall, an issue with your board shape and frame count genuinely helps.
 
 ## Contributing
 

package/dist/{build-DmfxJc6L.mjs → build-ByYafIhj.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-CS6krOTe.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Boy7I_JH.mjs";
+import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-DvOmglFp.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BsmG5i2X.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -36,9 +36,19 @@ function scanAssetRefs(src, moduleId) {
 		templates.push(t);
 		return "``";
 	}).replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|\s)\/\/.*$/gm, "$1");
-	if (/<Img\b[^>]*\bsrc\s*=\s*\{/.test(stripped)) throw new Error(`${moduleId}: <Img src={...}> is computed - published builds copy only statically referenced assets. Use a string literal.`);
+	for (const tag of ["Img", "Video"]) if (new RegExp(`<${tag}\\b[^>]*\\b(?:src|poster)\\s*=\\s*\\{`).test(stripped)) throw new Error(`${moduleId}: <${tag}> has a computed src/poster - published builds copy only statically referenced assets. Use a string literal.`);
 	const out = [];
 	for (const m of stripped.matchAll(/<Img\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/g)) out.push(m[1]);
+	for (const m of stripped.matchAll(/<Video\b[^>]*>|<Video\b[^>]*\/>/g)) {
+		const tag = m[0];
+		const srcM = /\bsrc\s*=\s*["']([^"']+)["']/.exec(tag);
+		const posterM = /\bposter\s*=\s*["']([^"']+)["']/.exec(tag);
+		if (srcM) {
+			if (!/^https:\/\//.test(srcM[1]) && !posterM) throw new Error(`${moduleId}: <Video src="${srcM[1]}"> is a local file without a poster - the poster is the slide at rest. Add poster="...".`);
+			out.push(srcM[1]);
+		}
+		if (posterM) out.push(posterM[1]);
+	}
 	for (const tpl of templates) for (const m of tpl.matchAll(/!\[[^\]]*\]\(([^)\s"']+)\)/g)) out.push(m[1]);
 	return out;
 }
@@ -59,6 +69,12 @@ const VIEW_MODES = [
 	"focus",
 	"slides"
 ];
+const DECK_TRANSITIONS = ["fade", "none"];
+const DECK_CHROME = [
+	"full",
+	"minimal",
+	"none"
+];
 /** Publishing is default-CLOSED - no policy and no explicit flag = no build.
 *  Boards absent from the result do not ship. */
 function resolvePolicy(root, allBoards, boardsFlag, allBoardsFlag) {
@@ -108,12 +124,17 @@ function resolvePolicy(root, allBoards, boardsFlag, allBoardsFlag) {
 		const type = p.type ?? "mix";
 		if (!ARTIFACT_TYPES.includes(type)) throw new Error(`design/publish.json: board "${n}" has type "${type}" - use ${ARTIFACT_TYPES.join(" | ")}`);
 		if (p.open !== void 0 && !VIEW_MODES.includes(p.open)) throw new Error(`design/publish.json: board "${n}" has open "${p.open}" - use ${VIEW_MODES.join(" | ")}`);
+		if (p.transition !== void 0 && !DECK_TRANSITIONS.includes(p.transition)) throw new Error(`design/publish.json: board "${n}" has transition "${p.transition}" - use ${DECK_TRANSITIONS.join(" | ")}`);
+		if (p.chrome !== void 0 && !DECK_CHROME.includes(p.chrome)) throw new Error(`design/publish.json: board "${n}" has chrome "${p.chrome}" - use ${DECK_CHROME.join(" | ")}`);
+		if ((p.transition !== void 0 || p.chrome !== void 0) && type !== "slides" && p.open !== "slides") throw new Error(`design/publish.json: board "${n}" sets transition/chrome but is not a slides board - set "type": "slides" or "open": "slides", or drop them`);
 		if (p.lock && p.open === void 0) throw new Error(`design/publish.json: board "${n}" sets "lock" without "open" - name the mode the lock freezes`);
 		out[n] = {
 			max: p.max,
 			type,
 			...p.open ? { open: p.open } : {},
-			...p.lock ? { lock: true } : {}
+			...p.lock ? { lock: true } : {},
+			...p.transition ? { transition: p.transition } : {},
+			...p.chrome ? { chrome: p.chrome } : {}
 		};
 	}
 	if (policy.reveal !== void 0) {
@@ -277,12 +298,23 @@ async function buildSite(root, boardsFlag, allBoardsFlag, embedSeeds) {
 			frames: pubFrames.filter((f) => f.scene === name).length
 		}))
 	};
+	for (const n of publishedNames) {
+		const pb = policy.boards[n];
+		if (pb?.type !== "slides" && pb?.open !== "slides") continue;
+		const ids = new Set((boards[n]?.nodes ?? []).map((x) => x.frame));
+		const on = pubManifest.frames.filter((f) => ids.has(f.id));
+		const off = on.filter((f) => !(f.kind === "tsx" && f.slide));
+		if (off.length === on.length) throw new Error(`design/publish.json: board "${n}" plays as slides but none of its ${on.length} frame(s) carry \`slide: true\` - add it to the frames' meta, or set "type"/"open" to "present" (0.13.0 let slides alias present; 0.14.0 plays only slide frames)`);
+		if (off.length) console.warn(`  warning: board "${n}" plays as slides but ${off.length} frame(s) are not slides (${off.slice(0, 4).map((f) => f.id).join(", ")}${off.length > 4 ? ", …" : ""}) - they will not play`);
+	}
 	const boardsMeta = Object.fromEntries(publishedNames.filter((n) => policy.boards[n]).map((n) => {
 		const p = policy.boards[n];
 		return [n, {
 			type: p.type,
 			...p.open ? { open: p.open } : {},
-			...p.lock ? { lock: true } : {}
+			...p.lock ? { lock: true } : {},
+			...p.transition ? { transition: p.transition } : {},
+			...p.chrome ? { chrome: p.chrome } : {}
 		}];
 	}));
 	const lockedShell = publishedNames.length > 0 && publishedNames.every((n) => {

package/dist/cli.mjs

@@ -16,6 +16,20 @@ const CONTENT_WIDTH = {
 	document: 760,
 	wide: 1280
 };
+/** The slide stage (v1.5): a runtime-reserved intrinsic, deliberately NOT a
+*  config viewport - no migration for existing projects, no deck device in
+*  sweeps. Dependency-neutral so server (shot) and shell (store) share it. */
+const SLIDE_INTRINSIC = {
+	width: 1280,
+	height: 720
+};
+/** The one DEFAULT sizing rule for slide frames, shared by canvas and shot:
+*  `slide: true` sets the intrinsic 1280×720 stage, over any authored viewport.
+*  Board nodes stay resizable (the Slide root scales into whatever box it is
+*  given); this governs defaults, shots, and stage coordinates. */
+function slideSize(frame) {
+	return frame.slide ? SLIDE_INTRINSIC : null;
+}
 //#endregion
 //#region src/cli/index.ts
 const [major, minor] = process.versions.node.split(".").map(Number);
@@ -39,14 +53,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-BpitOqRQ.mjs");
+	const { init } = await import("./init-Dvaso7YO.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-BXq7yE1p.mjs");
+	const { dev } = await import("./dev-yZMyQeUj.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +70,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--embed-seeds", "Copy comment history INTO the web root (identifying - every event carries its author's email)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-DmfxJc6L.mjs");
+	const { buildSite } = await import("./build-ByYafIhj.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true, opts.embedSeeds === true);
@@ -66,7 +80,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-BeLLizNg.mjs");
+	const { serve } = await import("./serve-Bcwfpvhl.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -75,7 +89,7 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	serve(resolve(opts.root), port);
 });
 cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--token <token>", "connect: the canvas's MARVER_CLI_TOKEN (default $MARVER_CLI_TOKEN) - the identity-mode path").option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-pNxjTrGN.mjs");
+	const { commentsCommand } = await import("./comments-DHB_8BRa.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {
@@ -84,7 +98,7 @@ cli.command("comments <action> [value]", "Comment collaboration: connect <url>
 	}
 });
 cli.command("share <action> [value]", "Sharing roster (owner): add <who> · remove <who> · block/unblock <email> · general <mode> · list · requests · explain <who> · who").option("--root <dir>", "Host repo root", { default: "." }).option("--role <role>", "add / requests --approve: view (default) or comment").option("--expires <iso>", "add: expiry timestamp, e.g. 2026-12-31T00:00:00Z").option("--approve <email>", "requests: approve this pending request (canvas-wide in v1)").option("--decline <email>", "requests: decline this pending request (silent to the asker)").option("--json", "list: machine-readable output").action(async (action, value, opts) => {
-	const { shareCommand } = await import("./share-C64b1tdN.mjs");
+	const { shareCommand } = await import("./share-Gqo_Ygqw.mjs");
 	try {
 		await shareCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {
@@ -114,4 +128,4 @@ cli.help();
 cli.version(version());
 cli.parse();
 //#endregion
-export { ROUTE as i, NAME as n, PKG as r, CONTENT_WIDTH as t };
+export { slideSize as a, ROUTE as i, NAME as n, PKG as r, CONTENT_WIDTH as t };