@marver-design/marver 0.12.0 → 0.14.0

package/dist/{collab-BmaOjwP1.mjs → collab-mAiNZlDj.mjs}

@@ -1,50 +1,138 @@
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
 import { A as reconfirmGrant, C as commentAllowed, D as operativeMode, E as loadShare, F as setBlocked, I as setGeneralMode, L as shareState, M as resolveAccess, N as resolveRequest, O as provisionVerdict, P as rosterEtag, S as ceilingsFromRights, T as loadRequests, _ as sessionUser, a as claimInvite, b as updateProfile, c as issueDeviceSession, d as opaqueId, f as ownerName, g as sessionIsOperator, h as revokeUser, j as removeGrant, k as putRequest, l as loadStore, m as publicUser, o as createInvite, s as inviteInfo, u as normEmail, v as signIn, w as entryAllowed, y as signOut, z as upsertGrant } from "./auth-DdUKeVKt.mjs";
-import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-Bf9tiGrE.mjs";
+import { canvasIdentity, deriveThreads, loadSeen, markSeen, signCanvasJws, unreadCount, verifyCanvasJws } from "./summary-C7CAypbB.mjs";
 import { t as secureSuffix } from "./secure-cookie-_K1Hsx8H.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/server/notify.ts
 /**
-* The canvas's half of the notification relay (04-solution §2.3, §9.5).
+* The canvas's half of the notification relay (04-solution §2.3, §9.5; v1.1
+* additions in 07-v1.1 §A/§B).
 *
-* Three transactional moments, exactly: you were invited (a view/comment grant
-* landed on an address), your request was approved, someone asked for access
-* (to the owner - and that mail carries only "someone"). Delivery is the ID
-* service's relay; the canvas never talks to Resend. The action token is
-* signed by the canvas identity key - owner authorization is implicit in the
-* signature, since only the canvas server holds it.
+* Transactional moments: you were invited, your request was approved, someone
+* asked for access. Activity moments (v1.1): a thread you are in moved
+* (`reply`), somebody named you (`mentioned`). Delivery is the ID service's
+* relay; the canvas never talks to Resend. The action token is signed by the
+* canvas identity key - owner authorization is implicit in the signature,
+* since only the canvas server holds it.
 *
 * Fire-and-forget, always: a notification that failed must never be the reason
-* a grant did not land. Idempotency lives at the relay, keyed on
-* (origin, template, eventId) - the eventId is derived from the STATE
-* TRANSITION, so a re-invite at the same role sends nothing and a role change
-* sends one.
+* a comment or grant did not land - delivery is best-effort at this boundary,
+* durable only once the relay's outbox row exists. Idempotency lives at the
+* relay, keyed on (origin, template, eventId) - the eventId is derived from
+* the STATE TRANSITION, so a re-invite at the same role sends nothing, a
+* mention mails once per person per comment ever, and replies throttle to one
+* mail per recipient per thread per window.
+*
+* All relay requests ride ONE promise chain: however wide a reply fans out,
+* this process holds at most one in-flight relay request (each bounded by its
+* own 5s timeout) - a comment-authorized caller cannot burst sockets.
 */
 const transitionId = (...parts) => createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 32);
-function relayNotify(ctx, template, recipient, eventId) {
+let chain = Promise.resolve();
+const capped = (s, cap) => {
+	const t = s?.replace(/\s+/g, " ").trim();
+	return t ? t.length > cap ? `${t.slice(0, cap - 1)}…` : t : void 0;
+};
+function relayNotify(ctx, template, recipient, eventId, content) {
 	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
 	if (recipient.startsWith("@") || !recipient.includes("@")) return;
-	const now = Math.floor(Date.now() / 1e3);
-	let token;
-	try {
-		token = signCanvasJws(ctx.dataDir, {
-			origin: ctx.origin,
-			template,
-			recipient,
-			eventId,
-			iat: now,
-			exp: now + 600
-		}, "marver-relay+jwt");
-	} catch {
-		return;
+	const { dataDir, origin } = ctx;
+	const actor = capped(content?.actor, 60);
+	const snippet = capped(content?.snippet, 180);
+	const link = content?.link && content.link.length <= 160 ? content.link : void 0;
+	const url = `${ctx.issuer.replace(/\/+$/, "")}/relay/notify`;
+	chain = chain.then(() => {
+		const now = Math.floor(Date.now() / 1e3);
+		let token;
+		try {
+			token = signCanvasJws(dataDir, {
+				origin,
+				template,
+				recipient,
+				eventId,
+				iat: now,
+				exp: now + 600,
+				...actor ? { actor } : {},
+				...snippet ? { snippet } : {},
+				...link ? { link } : {}
+			}, "marver-relay+jwt");
+		} catch {
+			return;
+		}
+		return fetch(url, {
+			method: "POST",
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(5e3)
+		}).then(() => void 0, () => void 0);
+	});
+}
+const FRESH_MS = 9e5;
+const REPLY_WINDOW_MS = 216e5;
+const MAX_REPLY_RECIPIENTS = 10;
+/**
+* Mail the people a fresh comment batch concerns. `accepted` is what
+* appendEvents actually took (never the raw POST body); `log` is the board's
+* full event list including them; `allowed` is the resolver's answer for THIS
+* board (≥ view), injected so this stays pure of store plumbing. Recipients
+* are canonical emails - by the time events land here the write boundary has
+* already inverted the projection.
+*
+* Windows use SERVER time, never ev.ts - a client-datable timestamp must not
+* pick its own throttle bucket. The board is in every key because comment ids
+* are only board-local.
+*/
+function notifyCommentActivity(ctx, board, accepted, log, allowed) {
+	if (!ctx.enabled || !ctx.issuer || !ctx.origin) return;
+	for (const [eventId, job] of activityJobs(board, accepted, log, allowed, Date.now())) relayNotify(ctx, job.template, job.recipient, eventId, {
+		actor: job.actor,
+		snippet: job.snippet,
+		link: job.link
+	});
+}
+/** The pure half: which (template, recipient, transition) a batch owes. Split
+*  out so the fan-out rules are testable without a relay or a signing key. */
+function activityJobs(board, accepted, log, allowed, now) {
+	const jobs = /* @__PURE__ */ new Map();
+	const threadLink = (threadId) => threadId ? `/#/b/${encodeURIComponent(board)}?c=${encodeURIComponent(threadId)}` : void 0;
+	for (const ev of accepted) {
+		if (ev.type !== "create" && ev.type !== "reply" || Math.abs(now - ev.ts) > FRESH_MS) continue;
+		const author = ev.author?.email?.toLowerCase();
+		const mentioned = /* @__PURE__ */ new Set();
+		for (const m of ev.mentions ?? []) {
+			const email = m.email?.toLowerCase();
+			if (!email || email === author || !allowed(email)) continue;
+			mentioned.add(email);
+			jobs.set(transitionId("mention", email, board, ev.commentId ?? ev.id), {
+				template: "mentioned",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.type === "reply" ? ev.parentId : ev.commentId)
+			});
+		}
+		if (ev.type !== "reply" || !ev.parentId) continue;
+		const recent = [];
+		for (let i = log.length - 1; i >= 0 && recent.length < MAX_REPLY_RECIPIENTS; i--) {
+			const p = log[i];
+			if (p.id === ev.id) continue;
+			const email = (p.type === "reply" ? p.parentId === ev.parentId : p.type === "create" && p.commentId === ev.parentId) ? p.author?.email?.toLowerCase() : void 0;
+			if (email && email !== author && !mentioned.has(email) && !recent.includes(email)) recent.push(email);
+		}
+		const window = String(Math.floor(now / REPLY_WINDOW_MS));
+		for (const email of recent) {
+			if (!allowed(email)) continue;
+			jobs.set(transitionId("reply", email, board, ev.parentId, window), {
+				template: "reply",
+				recipient: email,
+				actor: ev.author?.name,
+				snippet: ev.body,
+				link: threadLink(ev.parentId)
+			});
+		}
 	}
-	fetch(`${ctx.issuer.replace(/\/+$/, "")}/relay/notify`, {
-		method: "POST",
-		headers: { authorization: `Bearer ${token}` },
-		signal: AbortSignal.timeout(5e3)
-	}).catch(() => {});
+	return jobs;
 }
 //#endregion
 //#region src/server/collab.ts
@@ -97,15 +185,41 @@ function validAvatar(s) {
 		webp: (b) => b.toString("latin1", 0, 4) === "RIFF" && b.toString("latin1", 8, 12) === "WEBP"
 	}[m[1]]?.(head) ?? false;
 }
+const EMAIL_SHAPE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+const OPAQUE_ID = /^[0-9a-f]{24}$/;
+/** Mention shape rules (07-v1.1 §B). One generic refusal for every violation -
+*  no per-cause oracle. The browser form carries the opaque `id` and NEVER an
+*  email (a browser-supplied email is a membership probe); the operator form
+*  (CLI sync - canonical bytes) carries `email` and never an id. */
+function badMentions(ev, operator) {
+	if (ev.mentions === void 0) return false;
+	if (ev.type !== "create" && ev.type !== "reply") return true;
+	if (!Array.isArray(ev.mentions) || ev.mentions.length > 8) return true;
+	const seen = /* @__PURE__ */ new Set();
+	for (const m of ev.mentions) {
+		if (!m || typeof m !== "object" || Object.keys(m).some((k) => k !== "id" && k !== "email" && k !== "label")) return true;
+		if (typeof m.label !== "string" || !m.label.trim() || m.label.length > 80 || /^@?marver\b/i.test(m.label.trim())) return true;
+		const who = operator ? m.email : m.id;
+		if (operator ? typeof m.email !== "string" || !EMAIL_SHAPE.test(m.email) || m.email.length > 254 || m.id !== void 0 : typeof m.id !== "string" || !OPAQUE_ID.test(m.id) || m.email !== void 0) return true;
+		const key = who.toLowerCase();
+		if (seen.has(key)) return true;
+		seen.add(key);
+	}
+	return false;
+}
 /** Reject anything the log must not absorb. Returns an error string or null.
 *  Events are append-only and synced by id, so acceptance is forever - validate hard. */
-function validateEvents(incoming, log, u, board) {
+function validateEvents(incoming, log, u, board, opts = {}) {
 	const now = Date.now();
 	const creates = /* @__PURE__ */ new Map();
+	const comments = /* @__PURE__ */ new Set();
 	const authors = /* @__PURE__ */ new Map();
 	for (const ev of log) {
 		if (ev.type === "create" && ev.commentId && !creates.has(ev.commentId)) creates.set(ev.commentId, ev);
-		if ((ev.type === "create" || ev.type === "reply") && ev.commentId && ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+		if ((ev.type === "create" || ev.type === "reply") && ev.commentId) {
+			comments.add(ev.commentId);
+			if (ev.author?.email && !authors.has(ev.commentId)) authors.set(ev.commentId, ev.author.email.toLowerCase());
+		}
 	}
 	const me = u.email.toLowerCase();
 	for (const ev of incoming) {
@@ -117,7 +231,9 @@ function validateEvents(incoming, log, u, board) {
 		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
 		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
 		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
-		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if ((ev.type === "create" || ev.type === "reply") && !ev.body?.trim()) return "a comment needs a body";
+		if (badMentions(ev, !!opts.operator)) return "invalid mentions";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor" || ev.type === "profile") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
 		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
 			if (ev.type !== "profile") return "event needs a commentId";
 		}
@@ -125,10 +241,13 @@ function validateEvents(incoming, log, u, board) {
 			case "create":
 				if (creates.has(ev.commentId)) return "a thread with that id already exists";
 				creates.set(ev.commentId, ev);
+				comments.add(ev.commentId);
 				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
 				break;
 			case "reply":
 				if (typeof ev.parentId !== "string" || !creates.has(ev.parentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.parentId)) return "reply parent does not exist";
+				if (comments.has(ev.commentId)) return "a comment with that id already exists";
+				comments.add(ev.commentId);
 				if (ev.author?.email) authors.set(ev.commentId, ev.author.email.toLowerCase());
 				break;
 			case "edit": {
@@ -238,15 +357,67 @@ function collabHandler(dataDir, distDir) {
 		return hit;
 	};
 	const project = (ev) => {
-		if (!ev.author?.email) return ev;
-		const { email, ...rest } = ev.author;
-		return {
-			...ev,
-			author: {
-				...rest,
-				id: opaqueId(dataDir, email)
-			}
+		let out = ev;
+		if (ev.author?.email) {
+			const { email, ...rest } = ev.author;
+			out = {
+				...out,
+				author: {
+					...rest,
+					id: opaqueId(dataDir, email)
+				}
+			};
+		}
+		if (ev.mentions !== void 0) {
+			const safe = Array.isArray(ev.mentions) ? ev.mentions.flatMap((m) => {
+				if (!m || typeof m !== "object") return [];
+				const label = typeof m.label === "string" ? m.label : "";
+				if (typeof m.email === "string") return [{
+					id: opaqueId(dataDir, m.email),
+					label
+				}];
+				if (typeof m.id === "string") return [{
+					id: m.id,
+					label
+				}];
+				return [];
+			}) : [];
+			out = {
+				...out,
+				mentions: safe.length ? safe : void 0
+			};
+		}
+		return out;
+	};
+	/** Every opaque id the canvas can resolve back to an address: accounts, plus
+	*  every author and mention across the boards' logs. Broader than any one
+	*  composer can see, and safely so - ids are HMACs under the canvas secret,
+	*  so a valid id for an unseen person cannot be manufactured to probe with. */
+	const mentionTargets = () => {
+		const map = /* @__PURE__ */ new Map();
+		const add = (email) => {
+			if (email) map.set(opaqueId(dataDir, email), normEmail(email));
 		};
+		for (const usr of loadStore(dataDir).users) add(usr.email);
+		for (const st of threads.values()) for (const ev of st.events) {
+			add(ev.author?.email);
+			for (const mn of ev.mentions ?? []) add(mn.email);
+		}
+		return map;
+	};
+	/** May this address still read this board - the activity-mail eligibility
+	*  filter, asked at enqueue time (delivery cannot re-check; 07-v1.1 §A). */
+	const mailAllowed = (board, email) => {
+		const store = shareState(dataDir);
+		if (!store) return true;
+		const owner = loadStore(dataDir).users.find((x) => x.role === "owner");
+		const userRole = owner && normEmail(owner.email) === normEmail(email) ? "owner" : "member";
+		return (resolveAccess({
+			email,
+			userRole,
+			store,
+			ceilings
+		}).boards[board] ?? "none") !== "none";
 	};
 	const rawTransport = (req) => {
 		const tok = /^Bearer ([\w-]+)$/.exec(String(req.headers.authorization ?? ""))?.[1];
@@ -761,14 +932,32 @@ function collabHandler(dataDir, distDir) {
 				const b = await readBody(req);
 				const incoming = Array.isArray(b.events) ? b.events : [];
 				if (incoming.length > 100) return json(res, 400, { error: "too many events in one push" }), true;
-				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1]);
+				const operator = rawTransport(req);
+				const bad = validateEvents(incoming, readLog(commentsDir, m[1]), u, m[1], { operator });
 				if (bad) return json(res, 400, { error: bad }), true;
+				if (!operator && incoming.some((ev) => ev.mentions?.length)) {
+					const targets = mentionTargets();
+					for (const ev of incoming) {
+						if (!ev.mentions?.length) continue;
+						const mapped = [];
+						for (const mn of ev.mentions) {
+							const email = targets.get(mn.id);
+							if (!email || email === normEmail(u.email)) return json(res, 400, { error: "invalid mentions" }), true;
+							mapped.push({
+								email,
+								label: mn.label
+							});
+						}
+						ev.mentions = mapped;
+					}
+				}
 				const fresh = appendEvents(commentsDir, m[1], incoming);
 				if (fresh.length) {
 					const st = threads.get(m[1]);
 					threads.set(m[1], deriveThreads([...st?.events ?? [], ...fresh]));
 				}
 				broadcast(m[1], fresh.map(project));
+				if (fresh.length) notifyCommentActivity(notifyCtx, m[1], fresh, threads.get(m[1])?.events ?? [], (email) => mailAllowed(m[1], email));
 				return json(res, 200, { accepted: fresh.length }), true;
 			}
 			return false;

package/dist/{comments-pNxjTrGN.mjs → comments-DHB_8BRa.mjs}

@@ -1,8 +1,8 @@
 import { n as NAME } from "./cli.mjs";
-import { n as replay } from "./events-C9k-ceOj.mjs";
+import { n as replay } from "./events-B3LBn74P.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, t as connect } from "./sync-WYxDN9IT.mjs";
-import { n as localProfile } from "./profile-ChpTPd-X.mjs";
+import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, t as connect } from "./sync-BZaCWqK-.mjs";
+import { n as localProfile } from "./profile-BjAPAJSb.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";

package/dist/{daemon-WjonKlPz.mjs → daemon-Bfucyf1o.mjs}

@@ -1,7 +1,7 @@
-import { n as replay } from "./events-C9k-ceOj.mjs";
+import { n as replay } from "./events-B3LBn74P.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { n as localProfile } from "./profile-ChpTPd-X.mjs";
-import { i as toFrameId } from "./manifest-CS6krOTe.mjs";
+import { n as localProfile } from "./profile-BjAPAJSb.mjs";
+import { i as toFrameId } from "./manifest-DvOmglFp.mjs";
 import { workActivity } from "./work-CLrmY-vQ.mjs";
 import { r as deviceId, t as has } from "./ledger-Bu0BjqIe.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync, writeSync } from "node:fs";

package/dist/{dev-BXq7yE1p.mjs → dev-yZMyQeUj.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
-import { l as detectHost, s as loadConfig } from "./manifest-CS6krOTe.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Boy7I_JH.mjs";
+import { l as detectHost, s as loadConfig } from "./manifest-DvOmglFp.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BsmG5i2X.mjs";
 import { realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -247,7 +247,7 @@ async function dev(root, portFlag) {
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
 	try {
 		const { staleManagedInstructions } = await import("./managed-HwHVNI3h.mjs");
-		const { installedVersion } = await import("./plugin-Boy7I_JH.mjs").then((n) => n.i);
+		const { installedVersion } = await import("./plugin-BsmG5i2X.mjs").then((n) => n.i);
 		const stale = staleManagedInstructions(root);
 		if (stale.length) {
 			const shown = stale.slice(0, 4).join(", ") + (stale.length > 4 ? `, +${stale.length - 4} more` : "");
@@ -255,7 +255,7 @@ async function dev(root, portFlag) {
 			console.log(`  instructions predate ${v ? NAME + " " + v : "the installed version"} (${shown}) - run: npx ${NAME} init\n`);
 		}
 	} catch {}
-	const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+	const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -285,7 +285,7 @@ async function dev(root, portFlag) {
 		});
 	}
 	if (config.jam) {
-		const { startJam } = await import("./daemon-WjonKlPz.mjs");
+		const { startJam } = await import("./daemon-Bfucyf1o.mjs");
 		const jam = startJam(root, config.jam, (m) => console.log(m), (board) => server.ws.send("sh:jam-comment", { board }));
 		if (jam) {
 			const close = server.close.bind(server);

package/dist/{events-C9k-ceOj.mjs → events-B3LBn74P.mjs}

@@ -26,6 +26,7 @@ function replay(events) {
 			resolved: false,
 			agent: ev.agent,
 			agentMeta: ev.agentMeta,
+			mentions: ev.mentions,
 			replies: [],
 			reactions: {}
 		});
@@ -40,7 +41,8 @@ function replay(events) {
 				body: ev.body,
 				ts: ev.ts,
 				agent: ev.agent,
-				agentMeta: ev.agentMeta
+				agentMeta: ev.agentMeta,
+				mentions: ev.mentions
 			});
 			break;
 		}

package/dist/{init-BpitOqRQ.mjs → init-Dvaso7YO.mjs}

@@ -1,5 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as writeManifest, c as detectAgent, l as detectHost, o as DEFAULTS, r as scanFrames, u as readJson } from "./manifest-CS6krOTe.mjs";
+import { a as writeManifest, c as detectAgent, l as detectHost, o as DEFAULTS, r as scanFrames, u as readJson } from "./manifest-DvOmglFp.mjs";
 import { MANAGED_PREFIX, enumerateInstructionTemplates, hashBody, managedFile, pkgDir } from "./managed-HwHVNI3h.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
@@ -143,7 +143,71 @@ function init(root, opts) {
 		refresh("providers.tsx", [providersTemplate(null, null), providersTemplate(null, host.toaster, host.routerPkg)], providersTemplate(host.router, host.toaster, host.routerPkg));
 		refresh("tsconfig.json", [STANDALONE_TSCONFIG], tsconfigNow());
 	}
-	write(".gitignore", ".local/\n.dist/\n.dist-seeds/\n");
+	write(".gitignore", ".local/\n.dist/\n.dist-seeds/\nslides-inspiration/\n");
+	{
+		const gi = join(design, ".gitignore");
+		const cur = readFileSync(gi, "utf8");
+		if (!cur.split("\n").some((l) => l.trim() === "slides-inspiration/" || l.trim() === "slides-inspiration")) {
+			writeFileSync(gi, cur + (cur.endsWith("\n") || cur === "" ? "" : "\n") + "slides-inspiration/\n");
+			created.push("design/.gitignore (+ slides-inspiration/)");
+		}
+	}
+	write("slides.md", [
+		"# This project's slide layouts and house rules",
+		"",
+		"The agent reads BOTH the shipped doctrine (instructions/slides.md) and this",
+		"file - and this file WINS where they disagree. Add your own layouts, house",
+		"rules, and banned moves here; it is yours and marver never touches it.",
+		"",
+		"To grow it from examples: drop decks (PPTX, PDF, screenshots) into",
+		"design/slides-inspiration/ and ask the agent to \"study my inspiration\" -",
+		"it will propose additions here for your review.",
+		"",
+		"## The deck look",
+		"",
+		"How a deck wears this brand. The agent drafts it from DESIGN.md and",
+		"theme.css on the first deck (a reviewed edit, building on provisionally",
+		"with the theme's tokens); anything it cannot settle stays `TBD` for you.",
+		"Each line shows the shape with an example - replace the example, keep the",
+		"shape.",
+		"",
+		"- **Tokens** (`--marver-slide-*` in theme.css, read by the Slide root):",
+		"  ground / ink / muted, each with a `-dark` twin; accent, one value for",
+		"  both themes. e.g. ground = the page background, ink = the heading",
+		"  colour, accent = the primary button.",
+		"- **Type** (`--marver-slide-font`): one family, the theme's; the type",
+		"  roles carry their weights. e.g. Inter.",
+		"- **The mark**: which asset, where, how big. e.g. wordmark SVG, bottom-left",
+		"  of the cover and the closing only, 120px wide - never on content slides.",
+		"- **Colour meaning** (charts, cards, badges): hue = category, fixed across",
+		"  the deck. e.g. accent = us, slate = competitors, muted = the baseline;",
+		"  green / amber / red reserved for status.",
+		"- **Backgrounds allowed**: e.g. the flat ground; a theme gradient on covers",
+		"  and sections only; no photos behind text without a scrim.",
+		"- **Imagery**: e.g. product screenshots on a device-less frame, real people,",
+		"  no stock; illustrations in the product's line style only. Evidentiary",
+		"  images (a report fragment, a log line, a reasoning trace, a real",
+		"  screen) are evidence objects, not decoration - hero material when the",
+		"  message warrants it.",
+		"- **Tempo** (`--marver-slide-tempo`): e.g. 350ms - one value, every deck.",
+		"- **Numbers**: e.g. $ and k / M (lowercase k), fiscal years as FY26,",
+		"  negatives in brackets, one decimal on percentages.",
+		"- **Voice**: three words the deck sounds like, and the words it never",
+		"  uses. e.g. direct, warm, specific; never \"leverage\", \"seamless\", \"journey\".",
+		"- **Terminology**: user-facing word → never-shown internal word.",
+		"  e.g. \"Comments\" → \"Enrichment\".",
+		"- **End card**: yes / no. e.g. yes - the mark on the ground, no text; the",
+		"  ask lives on the slide before it.",
+		"",
+		"## Layouts",
+		"",
+		"(none yet - the shipped recipe list and atlas apply)",
+		"",
+		"## House rules",
+		"",
+		"(none yet)",
+		""
+	].join("\n"));
 	write(".gitattributes", "comments/*.jsonl merge=union\n");
 	write("scenes/_layout.tsx", readFileSync(join(templates, "root-layout.tsx"), "utf8"));
 	if (!existsSync(join(design, "boards"))) {

package/dist/{manifest-CS6krOTe.mjs → manifest-DvOmglFp.mjs}

@@ -382,6 +382,10 @@ function extractMeta(src) {
 		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
 		return r ? r[2] : void 0;
 	};
+	const pickBool = (key) => {
+		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(true|false)\\b`).exec(body);
+		return r ? r[1] === "true" : void 0;
+	};
 	const out = {};
 	const title = pick("title");
 	if (title) out.title = title;
@@ -395,6 +399,8 @@ function extractMeta(src) {
 	if (variant) out.variant = variant;
 	const intent = pick("intent");
 	if (intent) out.intent = intent;
+	const slide = pickBool("slide");
+	if (slide !== void 0) out.slide = slide;
 	return out;
 }
 /** Content-frame detection: LEXICAL by convention - the frame file
@@ -484,6 +490,7 @@ function scanFrames(root) {
 			if (meta.theme) entry.theme = meta.theme;
 			if (meta.of) entry.variantGroup = meta.of;
 			if (meta.variant) entry.variant = meta.variant;
+			if (meta.slide) entry.slide = true;
 			const content = contentScan(src);
 			if (content || meta.intent) {
 				entry.intent = meta.intent ?? content.intent;

package/dist/{marver-id-gate-DOjnZakC.mjs → marver-id-gate-D6By7XHj.mjs}

@@ -1,6 +1,6 @@
 import { i as avatarSourceFor, n as attachAvatar, p as provisionFromMarverId } from "./auth-DdUKeVKt.mjs";
 import { TransactionStore, browserBinding, verifyAssertion } from "./marver-id-CVCoaMGI.mjs";
-import { t as poweredByUrl } from "./serve-BeLLizNg.mjs";
+import { t as poweredByUrl } from "./serve-Bcwfpvhl.mjs";
 import { randomBytes } from "node:crypto";
 import { isIP } from "node:net";
 import { lookup } from "node:dns/promises";
@@ -422,7 +422,7 @@ function marverIdHandler(dir, issuer, canvasName, branding = true, ceilings = {}
 					const { shareState, provisionVerdict } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);
 					const share = shareState(dir);
 					if (!(share ? provisionVerdict(share, result.identity.email) === "blocked" : false)) {
-						const { signCanvasJws } = await import("./summary-Bf9tiGrE.mjs");
+						const { signCanvasJws } = await import("./summary-C7CAypbB.mjs");
 						const now = Math.floor(Date.now() / 1e3);
 						request = signCanvasJws(dir, {
 							aud: origin,
@@ -545,9 +545,12 @@ function finishPage(canvasName, host, switchUrl, branding = true) {
   p.lead { margin: 0; padding: 0 4px; font-size: 12.5px; line-height: 1.5;
            color: rgba(24,24,27,.66) }
   p.lead strong { color: #18181b; font-weight: 600 }
-  a.cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
-          font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
-          display: flex; align-items: center; justify-content: center }
+  /* .cta, not a.cta: the request-access <button> wears the same dark pill as the
+     switch-account <a> - scoping to the tag left the button naked (a flat native
+     strip that read as disabled) */
+  .cta { height: 40px; border-radius: 999px; background: #18181b; color: #fafafa;
+         font: 600 13px -apple-system, system-ui, sans-serif; text-decoration: none;
+         display: flex; align-items: center; justify-content: center }
   footer a { display: inline-flex; align-items: center; gap: 7px;
              font: 600 12.5px -apple-system, system-ui, sans-serif;
              color: rgba(24,24,27,.5); text-decoration: none }

package/dist/{plugin-Boy7I_JH.mjs → plugin-BsmG5i2X.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { n as localProfile, t as isConnected } from "./profile-ChpTPd-X.mjs";
-import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-CS6krOTe.mjs";
+import { n as localProfile, t as isConnected } from "./profile-BjAPAJSb.mjs";
+import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-DvOmglFp.mjs";
 import { copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -125,6 +125,24 @@ function apiMiddleware(root, opts = {}) {
 		const path = url.pathname.slice(`${ROUTE}/api/`.length);
 		if (req.method === "GET" && !cookie(req, "mv_c")) res.setHeader("set-cookie", `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${CSRF_MAX_AGE}; SameSite=Lax`);
 		try {
+			if (path === "policy" && req.method === "GET") try {
+				const raw = JSON.parse(readFileSync(join(root, "design", "publish.json"), "utf8"));
+				const boards = {};
+				for (const [n, level] of Object.entries(raw?.boards ?? {})) {
+					if (typeof level !== "object" || level === null) continue;
+					const p2 = level;
+					boards[n] = {
+						...typeof p2.type === "string" ? { type: p2.type } : {},
+						...typeof p2.open === "string" ? { open: p2.open } : {},
+						...p2.lock === true ? { lock: true } : {},
+						...typeof p2.transition === "string" ? { transition: p2.transition } : {},
+						...typeof p2.chrome === "string" ? { chrome: p2.chrome } : {}
+					};
+				}
+				return json(res, 200, { boards });
+			} catch {
+				return json(res, 200, { boards: {} });
+			}
 			if (path === "boards" && req.method === "GET") {
 				mkdirSync(boardsDir, { recursive: true });
 				return json(res, 200, readdirSync(boardsDir).filter((f) => f.endsWith(".json") && !f.endsWith(".tmp")).map((f) => {
@@ -266,7 +284,7 @@ function apiMiddleware(root, opts = {}) {
 				const frameId = url.searchParams.get("frame") ?? "";
 				const theme = url.searchParams.get("theme") ?? "light";
 				const origin = opts.origin?.() ?? `http://${req.headers.host ?? "localhost"}`;
-				const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
+				const { shootFrame } = await import("./shot-kbR_xzJH.mjs");
 				const r = await shootFrame({
 					root,
 					viewports: opts.viewports ?? {},
@@ -306,7 +324,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-BmaOjwP1.mjs");
+				const { validAvatar } = await import("./collab-mAiNZlDj.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -397,7 +415,7 @@ function apiMiddleware(root, opts = {}) {
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+				const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -426,7 +444,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
+			const { loadCollab, syncOnce } = await import("./sync-BZaCWqK-.mjs").then((n) => n.o);
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -799,7 +817,7 @@ function marverPlugin(ctx) {
 								});
 								return;
 							}
-							const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
+							const { shootFrame } = await import("./shot-kbR_xzJH.mjs");
 							write(await shootFrame({
 								root,
 								viewports: config.viewports,