@marver-design/marver 0.13.0 → 0.15.0

package/dist/{init-BpitOqRQ.mjs → init-QKNi9gvF.mjs}

@@ -1,5 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as writeManifest, c as detectAgent, l as detectHost, o as DEFAULTS, r as scanFrames, u as readJson } from "./manifest-CS6krOTe.mjs";
+import { a as writeManifest, c as detectAgent, l as detectHost, o as DEFAULTS, r as scanFrames, u as readJson } from "./manifest-BzxSMoDB.mjs";
 import { MANAGED_PREFIX, enumerateInstructionTemplates, hashBody, managedFile, pkgDir } from "./managed-HwHVNI3h.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
@@ -143,7 +143,71 @@ function init(root, opts) {
 		refresh("providers.tsx", [providersTemplate(null, null), providersTemplate(null, host.toaster, host.routerPkg)], providersTemplate(host.router, host.toaster, host.routerPkg));
 		refresh("tsconfig.json", [STANDALONE_TSCONFIG], tsconfigNow());
 	}
-	write(".gitignore", ".local/\n.dist/\n.dist-seeds/\n");
+	write(".gitignore", ".local/\n.dist/\n.dist-seeds/\nslides-inspiration/\n");
+	{
+		const gi = join(design, ".gitignore");
+		const cur = readFileSync(gi, "utf8");
+		if (!cur.split("\n").some((l) => l.trim() === "slides-inspiration/" || l.trim() === "slides-inspiration")) {
+			writeFileSync(gi, cur + (cur.endsWith("\n") || cur === "" ? "" : "\n") + "slides-inspiration/\n");
+			created.push("design/.gitignore (+ slides-inspiration/)");
+		}
+	}
+	write("slides.md", [
+		"# This project's slide layouts and house rules",
+		"",
+		"The agent reads BOTH the shipped doctrine (instructions/slides.md) and this",
+		"file - and this file WINS where they disagree. Add your own layouts, house",
+		"rules, and banned moves here; it is yours and marver never touches it.",
+		"",
+		"To grow it from examples: drop decks (PPTX, PDF, screenshots) into",
+		"design/slides-inspiration/ and ask the agent to \"study my inspiration\" -",
+		"it will propose additions here for your review.",
+		"",
+		"## The deck look",
+		"",
+		"How a deck wears this brand. The agent drafts it from DESIGN.md and",
+		"theme.css on the first deck (a reviewed edit, building on provisionally",
+		"with the theme's tokens); anything it cannot settle stays `TBD` for you.",
+		"Each line shows the shape with an example - replace the example, keep the",
+		"shape.",
+		"",
+		"- **Tokens** (`--marver-slide-*` in theme.css, read by the Slide root):",
+		"  ground / ink / muted, each with a `-dark` twin; accent, one value for",
+		"  both themes. e.g. ground = the page background, ink = the heading",
+		"  colour, accent = the primary button.",
+		"- **Type** (`--marver-slide-font`): one family, the theme's; the type",
+		"  roles carry their weights. e.g. Inter.",
+		"- **The mark**: which asset, where, how big. e.g. wordmark SVG, bottom-left",
+		"  of the cover and the closing only, 120px wide - never on content slides.",
+		"- **Colour meaning** (charts, cards, badges): hue = category, fixed across",
+		"  the deck. e.g. accent = us, slate = competitors, muted = the baseline;",
+		"  green / amber / red reserved for status.",
+		"- **Backgrounds allowed**: e.g. the flat ground; a theme gradient on covers",
+		"  and sections only; no photos behind text without a scrim.",
+		"- **Imagery**: e.g. product screenshots on a device-less frame, real people,",
+		"  no stock; illustrations in the product's line style only. Evidentiary",
+		"  images (a report fragment, a log line, a reasoning trace, a real",
+		"  screen) are evidence objects, not decoration - hero material when the",
+		"  message warrants it.",
+		"- **Tempo** (`--marver-slide-tempo`): e.g. 350ms - one value, every deck.",
+		"- **Numbers**: e.g. $ and k / M (lowercase k), fiscal years as FY26,",
+		"  negatives in brackets, one decimal on percentages.",
+		"- **Voice**: three words the deck sounds like, and the words it never",
+		"  uses. e.g. direct, warm, specific; never \"leverage\", \"seamless\", \"journey\".",
+		"- **Terminology**: user-facing word → never-shown internal word.",
+		"  e.g. \"Comments\" → \"Enrichment\".",
+		"- **End card**: yes / no. e.g. yes - the mark on the ground, no text; the",
+		"  ask lives on the slide before it.",
+		"",
+		"## Layouts",
+		"",
+		"(none yet - the shipped recipe list and atlas apply)",
+		"",
+		"## House rules",
+		"",
+		"(none yet)",
+		""
+	].join("\n"));
 	write(".gitattributes", "comments/*.jsonl merge=union\n");
 	write("scenes/_layout.tsx", readFileSync(join(templates, "root-layout.tsx"), "utf8"));
 	if (!existsSync(join(design, "boards"))) {

package/dist/{manifest-CS6krOTe.mjs → manifest-BzxSMoDB.mjs}

@@ -382,6 +382,10 @@ function extractMeta(src) {
 		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
 		return r ? r[2] : void 0;
 	};
+	const pickBool = (key) => {
+		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(true|false)\\b`).exec(body);
+		return r ? r[1] === "true" : void 0;
+	};
 	const out = {};
 	const title = pick("title");
 	if (title) out.title = title;
@@ -395,22 +399,35 @@ function extractMeta(src) {
 	if (variant) out.variant = variant;
 	const intent = pick("intent");
 	if (intent) out.intent = intent;
+	const slide = pickBool("slide");
+	if (slide !== void 0) out.slide = slide;
 	return out;
 }
-/** Content-frame detection: LEXICAL by convention - the frame file
-*  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
-*  string in a UI frame can never misbadge it; barrels/re-exports are not
-*  detected - meta.intent is the taught path and always works). Returns the
-*  inferred intent + natural width, or null for UI frames. */
+/** Content-frame detection: LEXICAL by convention - the frame file itself imports
+*  PKG/content (an import specifier scan, so "<Diagram" inside a string in a UI frame can
+*  never misbadge it; barrels/re-exports are not detected - meta.intent is the taught path
+*  and always works) AND renders a DOCUMENT primitive: Doc, Md, Diagram or Img (reference
+*  imagery - a moodboard is Rows of Img). The import alone is not enough - Chart, Video, Row,
+*  Col and Space are shared blocks a UI screen or a slide uses too, and a dashboard with one
+*  <Chart> is still a screen (device height, no document measuring), never a spec. Returns
+*  the inferred intent + natural width, or null for UI frames. */
 const CONTENT_IMPORT = new RegExp(`from\\s+['"]${PKG}/content['"]`);
 const WIDE_DOC = /<Doc\b[^>]*\blayout\s*=\s*["']wide["']/;
 const contentWidthOf = (src) => WIDE_DOC.test(src) ? CONTENT_WIDTH.wide : CONTENT_WIDTH.document;
+/** The source with comments, template literals and CODE-shaped strings blanked (a JSX
+*  expression string `{'<Diagram>'}`, an attribute value), so a tag name quoted in an example
+*  or a comment never counts as a rendered element. Prose is left alone: JSX text has
+*  apostrophes ("it's"), and a blanket quote match would swallow real tags between two of them. */
+const codeOnly = (src) => src.replace(/`(?:[^`\\]|\\[\s\S])*`/g, "``").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/\{\s*(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')\s*\}/g, "{\"\"}").replace(/([=(,:[{?+|&!]|\breturn)\s*(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')/g, "$1\"\"").replace(/([=(,:[{?+|&!]|\breturn)\s*\/(?:[^/\\\n[]|\\.|\[(?:[^\]\\\n]|\\.)*\])+\/[gimsuy]*/g, "$1/re/");
 function contentScan(src) {
 	if (!CONTENT_IMPORT.test(src)) return null;
-	const count = (re) => (src.match(re) ?? []).length;
+	const code = codeOnly(src);
+	const count = (re) => (code.match(re) ?? []).length;
+	const docs = count(/<Doc[\s>/]/g);
 	const diagrams = count(/<Diagram[\s>/]/g);
 	const imgs = count(/<Img[\s>/]/g);
 	const mds = count(/<Md[\s>/]/g);
+	if (docs + diagrams + mds + imgs === 0) return null;
 	return {
 		intent: diagrams > 0 ? "diagram" : imgs > mds ? "moodboard" : "spec",
 		width: contentWidthOf(src)
@@ -484,6 +501,7 @@ function scanFrames(root) {
 			if (meta.theme) entry.theme = meta.theme;
 			if (meta.of) entry.variantGroup = meta.of;
 			if (meta.variant) entry.variant = meta.variant;
+			if (meta.slide) entry.slide = true;
 			const content = contentScan(src);
 			if (content || meta.intent) {
 				entry.intent = meta.intent ?? content.intent;

package/dist/{marver-id-gate-B2uraTHS.mjs → marver-id-gate-D6By7XHj.mjs}

@@ -1,6 +1,6 @@
 import { i as avatarSourceFor, n as attachAvatar, p as provisionFromMarverId } from "./auth-DdUKeVKt.mjs";
 import { TransactionStore, browserBinding, verifyAssertion } from "./marver-id-CVCoaMGI.mjs";
-import { t as poweredByUrl } from "./serve-EjEqsiYa.mjs";
+import { t as poweredByUrl } from "./serve-Bcwfpvhl.mjs";
 import { randomBytes } from "node:crypto";
 import { isIP } from "node:net";
 import { lookup } from "node:dns/promises";

package/dist/{plugin-DNc4Jpae.mjs → plugin-DJyjmQeh.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
 import { n as localProfile, t as isConnected } from "./profile-BjAPAJSb.mjs";
-import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-CS6krOTe.mjs";
+import { a as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-BzxSMoDB.mjs";
 import { copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -125,6 +125,24 @@ function apiMiddleware(root, opts = {}) {
 		const path = url.pathname.slice(`${ROUTE}/api/`.length);
 		if (req.method === "GET" && !cookie(req, "mv_c")) res.setHeader("set-cookie", `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${CSRF_MAX_AGE}; SameSite=Lax`);
 		try {
+			if (path === "policy" && req.method === "GET") try {
+				const raw = JSON.parse(readFileSync(join(root, "design", "publish.json"), "utf8"));
+				const boards = {};
+				for (const [n, level] of Object.entries(raw?.boards ?? {})) {
+					if (typeof level !== "object" || level === null) continue;
+					const p2 = level;
+					boards[n] = {
+						...typeof p2.type === "string" ? { type: p2.type } : {},
+						...typeof p2.open === "string" ? { open: p2.open } : {},
+						...p2.lock === true ? { lock: true } : {},
+						...typeof p2.transition === "string" ? { transition: p2.transition } : {},
+						...typeof p2.chrome === "string" ? { chrome: p2.chrome } : {}
+					};
+				}
+				return json(res, 200, { boards });
+			} catch {
+				return json(res, 200, { boards: {} });
+			}
 			if (path === "boards" && req.method === "GET") {
 				mkdirSync(boardsDir, { recursive: true });
 				return json(res, 200, readdirSync(boardsDir).filter((f) => f.endsWith(".json") && !f.endsWith(".tmp")).map((f) => {
@@ -265,27 +283,59 @@ function apiMiddleware(root, opts = {}) {
 				if (!ownerGated(req) && !(token && req.headers["x-mv-work"] === token)) return json(res, 403, { error: "forbidden" });
 				const frameId = url.searchParams.get("frame") ?? "";
 				const theme = url.searchParams.get("theme") ?? "light";
+				const scale = url.searchParams.has("scale") ? Number(url.searchParams.get("scale")) : void 0;
+				const dim = (k) => {
+					const v = Math.round(Number(url.searchParams.get(k)));
+					return url.searchParams.has(k) && Number.isFinite(v) ? v : void 0;
+				};
+				const size = {
+					w: dim("w"),
+					h: dim("h")
+				};
+				const asPng = url.searchParams.get("format") === "png";
 				const origin = opts.origin?.() ?? `http://${req.headers.host ?? "localhost"}`;
-				const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
+				const { shootFrame } = await import("./shot-BWhoz6cU.mjs");
 				const r = await shootFrame({
 					root,
 					viewports: opts.viewports ?? {},
 					frameId,
 					theme,
-					origin
+					origin,
+					scale,
+					size
 				});
-				if (!r.ok) return json(res, r.error.startsWith("unknown frame") ? 404 : r.error === "invalid theme" ? 400 : 503, { error: r.error });
-				return json(res, 200, {
+				if (!r.ok) return json(res, r.error.startsWith("unknown frame") ? 404 : r.error.startsWith("invalid ") ? 400 : 503, { error: r.error });
+				const summary = {
 					path: r.path,
 					frame: frameId,
 					theme,
 					width: r.width,
 					height: r.height,
 					scale: r.scale,
-					...r.truncated ? {
-						truncated: true,
-						note: r.note
-					} : {}
+					...r.truncated ? { truncated: true } : {},
+					...r.note ? { note: r.note } : {}
+				};
+				if (!asPng) return json(res, 200, summary);
+				const png = readFileSync(join(root, r.path));
+				res.writeHead(200, {
+					"content-type": "image/png",
+					"content-length": png.length,
+					"cache-control": "no-store",
+					"x-mv-shot": Buffer.from(JSON.stringify(summary)).toString("base64url")
+				});
+				return res.end(png);
+			}
+			if (path === "poster" && req.method === "GET") {
+				if (!ownerGated(req)) return json(res, 403, { error: "forbidden" });
+				const src = url.searchParams.get("src") ?? "";
+				const { ensurePoster, isLocalClip } = await import("./poster-CbpzSzJu.mjs");
+				const { isLocalAssetRef } = await import("./build-DfuTQZlY.mjs");
+				if (!isLocalAssetRef(src) || !isLocalClip(src)) return json(res, 400, { error: "src must be a clip under design/assets/" });
+				const r = await ensurePoster(join(root, "design", "assets"), src);
+				if (!r.ok) return json(res, r.error.includes("does not exist") ? 404 : 503, { error: r.error });
+				return json(res, 200, {
+					path: `design/assets/${src}.poster.png`,
+					generated: r.generated
 				});
 			}
 			if (path === "me" && req.method === "GET") return json(res, 200, {
@@ -799,7 +849,7 @@ function marverPlugin(ctx) {
 								});
 								return;
 							}
-							const { shootFrame } = await import("./shot-Cyv3GN79.mjs");
+							const { shootFrame } = await import("./shot-BWhoz6cU.mjs");
 							write(await shootFrame({
 								root,
 								viewports: config.viewports,

package/dist/poster-CbpzSzJu.mjs

@@ -0,0 +1,143 @@
+import { capture, findChrome } from "./shot-BWhoz6cU.mjs";
+import { constants, copyFileSync, existsSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+//#region src/server/poster.ts
+/**
+* Video posters, generated: a local clip without an authored poster gets one rendered
+* from its own first moments - the same headless Chrome the shot renderer drives, no
+* ffmpeg. The convention is `<clip>.poster.png` beside the clip in design/assets/, and
+* the Video primitive reaches for that name whenever `poster` is omitted, so the dev
+* server (on demand, when the frame first asks) and `marver build` (before assets are
+* copied - a published canvas never ships a poster-less video) produce one file both
+* agree on. An authored poster always wins: this only runs when the file is missing.
+*
+* The frame is taken at min(0.5s, half the duration) - the first frame of most clips is
+* black or a fade. The page is a file:// document holding the clip as a file:// <video>,
+* so nothing has to be served; readiness is the video element appearing in #root once
+* the seek lands, which is the shot renderer's own readiness rule.
+*/
+/** The conventional poster path for a local clip reference (relative to design/assets/). */
+const posterNameFor = (src) => `${src}.poster.png`;
+/** Is this a video reference the generator handles (a local design-asset clip)? The same
+*  grammar the client's assetUrl accepts: relative, forward slashes only, no dot segments. */
+const isLocalClip = (src) => !/^https?:\/\//.test(src) && /\.(mp4|webm|mov|m4v|ogv)$/i.test(src) && !src.includes("\\") && !src.includes(":") && !src.startsWith("/") && !src.split("/").some((seg) => seg === ".." || seg === "." || seg === "");
+/** realpath(p) is base or inside it. */
+const inside = (p, base) => {
+	try {
+		const r = realpathSync(p);
+		return r === base || r.startsWith(base + sep);
+	} catch {
+		return false;
+	}
+};
+const PAGE = (video) => `<!doctype html><html><head><meta charset="utf-8"><style>
+html,body{margin:0;background:#000}#root video{display:block}
+</style></head><body><div id="root"></div><script>
+(function(){
+  var v = document.createElement('video');
+  v.muted = true; v.playsInline = true; v.preload = 'auto'; v.src = ${JSON.stringify(video)};
+  var done = false;
+  function show(){ if (done) return; done = true;
+    var w = Math.min(1920, v.videoWidth || 1280), h = Math.round(w * ((v.videoHeight || 720) / (v.videoWidth || 1280)));
+    v.width = w; v.height = h; v.style.width = w + 'px'; v.style.height = h + 'px';
+    document.getElementById('root').appendChild(v) }
+  v.addEventListener('loadedmetadata', function(){
+    var t = Math.min(0.5, (isFinite(v.duration) ? v.duration : 1) / 2);
+    v.addEventListener('seeked', show, { once: true });
+    v.currentTime = t; });
+  v.addEventListener('error', function(){ window.__mvFrameError = 'the clip could not be decoded by this browser (' + (v.error && v.error.code) + ')' ; document.getElementById('root').appendChild(document.createElement('i')) });
+  setTimeout(function(){ if (!done && v.readyState >= 2) show() }, 4000);
+})();
+<\/script></body></html>`;
+/** Render `<clip>.poster.png` for a clip under design/assets/. Idempotent: an existing
+*  poster (authored or generated) is left alone. */
+async function ensurePoster(assetsDir, src) {
+	if (!isLocalClip(src)) return {
+		ok: false,
+		error: `not a local clip: ${src}`
+	};
+	const clip = join(assetsDir, src);
+	const out = join(assetsDir, posterNameFor(src));
+	if (existsSync(out)) return {
+		ok: true,
+		path: out,
+		width: 0,
+		height: 0,
+		generated: false
+	};
+	if (!existsSync(clip)) return {
+		ok: false,
+		error: `design/assets/${src} does not exist`
+	};
+	let realAssets;
+	try {
+		realAssets = realpathSync(assetsDir);
+	} catch {
+		return {
+			ok: false,
+			error: "design/assets/ does not exist"
+		};
+	}
+	if (!inside(clip, realAssets)) return {
+		ok: false,
+		error: `design/assets/${src} resolves outside design/assets/ - not rendered`
+	};
+	if (!inside(dirname(out), realAssets)) return {
+		ok: false,
+		error: `design/assets/${dirname(src)} resolves outside design/assets/ - not rendered`
+	};
+	if (!findChrome()) return {
+		ok: false,
+		error: `no Chrome/Chromium found to render a poster for ${src} - add poster="..." on the <Video>, or install Chrome`
+	};
+	const dir = mkdtempSync(join(tmpdir(), "mv-poster-"));
+	const page = join(dir, "poster.html");
+	writeFileSync(page, PAGE(pathToFileURL(realpathSync(clip)).href));
+	const tmp = join(dirname(out), `.${basename(out)}.${randomBytes(6).toString("hex")}.tmp`);
+	try {
+		const r = await capture({
+			url: pathToFileURL(page).href,
+			width: 1920,
+			height: 1080,
+			scale: 1,
+			out: tmp,
+			fullHeight: false,
+			clip: "#root video",
+			timeoutMs: 2e4
+		}, "poster");
+		if (!r.ok) return {
+			ok: false,
+			error: `could not render a poster for ${basename(src)} - ${r.error}`
+		};
+		try {
+			copyFileSync(tmp, out, constants.COPYFILE_EXCL);
+		} catch (err) {
+			if (err.code === "EEXIST") return {
+				ok: true,
+				path: out,
+				width: r.width,
+				height: r.height,
+				generated: false
+			};
+			throw err;
+		}
+		return {
+			ok: true,
+			path: out,
+			width: r.width,
+			height: r.height,
+			generated: true
+		};
+	} finally {
+		rmSync(tmp, { force: true });
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+export { ensurePoster, isLocalClip };

package/dist/{serve-EjEqsiYa.mjs → serve-Bcwfpvhl.mjs}

@@ -11,7 +11,8 @@ import { createServer } from "node:http";
 *    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
 *    utm_medium   = the link unit ('powered-by')
 *    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
-*    utm_content  = the placement ('gate' badge | 'shell' wordmark | 'sign-in' finish page)
+*    utm_content  = the placement ('gate' badge | 'shell' wordmark | 'sign-in' finish page |
+*                   'play-brand' the present/slides brand pill)
 */
 function poweredByUrl(canvasName, source, content) {
 	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -146,7 +147,7 @@ async function serve(root, portFlag) {
 			console.error(`[${NAME}] MARVER_ID_ISSUER is set but MARVER_PUBLIC_ORIGIN is not.\n  Every assertion is bound to this canvas's exact origin, and it cannot be\n  inferred from request headers - a proxy can make any request look local.\n  Set it to the origin people actually reach this canvas on:\n    MARVER_PUBLIC_ORIGIN=https://canvas.example.com\n    MARVER_PUBLIC_ORIGIN=http://localhost:${portFlag ?? (Number(process.env.PORT) || 4199)} (development)`);
 			process.exit(1);
 		}
-		const { marverIdHandler } = await import("./marver-id-gate-B2uraTHS.mjs");
+		const { marverIdHandler } = await import("./marver-id-gate-D6By7XHj.mjs");
 		const { dataDir } = await import("./comments-DZyobpxG.mjs").then((n) => n.n);
 		const canvasName = humanName(meta.name);
 		const { ceilingsFromRights } = await import("./auth-DdUKeVKt.mjs").then((n) => n.R);