@marver-design/marver 0.2.0

package/dist/plugin-DB5t2WUl.mjs

@@ -0,0 +1,437 @@
+import { r as ROUTE } from "./cli.mjs";
+import { join, relative, resolve, sep } from "node:path";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/server/manifest.ts
+const FRAME_EXT = /\.(tsx|jsx|html)$/;
+const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
+/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted (spec §6). */
+function extractMeta(src) {
+	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
+	if (!m) return {};
+	const body = m[1];
+	const pick = (key) => {
+		const r = new RegExp(`${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
+		return r ? r[2] : void 0;
+	};
+	const out = {};
+	const title = pick("title");
+	if (title) out.title = title;
+	const viewport = pick("viewport");
+	if (viewport) out.viewport = viewport;
+	const theme = pick("theme");
+	if (theme) out.theme = theme;
+	return out;
+}
+/** id = path relative to design/, extension dropped, `scenes/` prefix dropped. Always `/`-separated. */
+function toFrameId(designRelPath) {
+	const noExt = designRelPath.split(sep).join("/").replace(FRAME_EXT, "");
+	return noExt.startsWith("scenes/") ? noExt.slice(7) : noExt;
+}
+function walk(dir, out = []) {
+	if (!existsSync(dir)) return out;
+	for (const e of readdirSync(dir, { withFileTypes: true })) {
+		if (e.name.startsWith(".")) continue;
+		const p = join(dir, e.name);
+		if (e.isDirectory()) walk(p, out);
+		else out.push(p);
+	}
+	return out;
+}
+function scanFrames(root) {
+	const design = join(root, "design");
+	const frames = [];
+	for (const base of ["scenes", "components"]) for (const abs of walk(join(design, base))) {
+		const name = abs.split(sep).pop();
+		if (name.startsWith("_") || !FRAME_EXT.test(name)) continue;
+		const rel = relative(design, abs).split(sep).join("/");
+		const id = toFrameId(rel);
+		const scene = id.includes("/") ? id.split("/")[0] : "";
+		if (base === "scenes" && RESERVED_SCENES.has(scene)) {
+			console.error(`[marver] scene "${scene}" is a reserved name - "${rel}" skipped. Rename the scene.`);
+			continue;
+		}
+		const kind = name.endsWith(".html") ? "html" : "tsx";
+		const entry = {
+			id,
+			file: `design/${rel}`,
+			kind,
+			scene
+		};
+		if (kind === "tsx") {
+			const meta = extractMeta(readFileSync(abs, "utf8"));
+			if (meta.title) entry.title = meta.title;
+			if (meta.viewport) entry.viewport = meta.viewport;
+			if (meta.theme) entry.theme = meta.theme;
+		}
+		frames.push(entry);
+	}
+	const extRank = (file) => file.endsWith(".tsx") ? 0 : file.endsWith(".jsx") ? 1 : 2;
+	frames.sort((a, b) => a.id.localeCompare(b.id) || extRank(a.file) - extRank(b.file) || a.file.localeCompare(b.file));
+	const seen = /* @__PURE__ */ new Map();
+	const deduped = frames.filter((f) => {
+		const prev = seen.get(f.id);
+		if (prev) {
+			console.error(`[marver] duplicate frame id "${f.id}" (${prev} vs ${f.file}) - keeping ${prev}.`);
+			return false;
+		}
+		seen.set(f.id, f.file);
+		return true;
+	});
+	frames.length = 0;
+	frames.push(...deduped);
+	const sceneCounts = /* @__PURE__ */ new Map();
+	for (const f of frames) sceneCounts.set(f.scene, (sceneCounts.get(f.scene) ?? 0) + 1);
+	return {
+		frames,
+		scenes: [...sceneCounts.entries()].map(([name, n]) => ({
+			name,
+			frames: n
+		})).sort((a, b) => a.name.localeCompare(b.name))
+	};
+}
+/** Write design/manifest.json only when content changed. Returns the manifest either way. */
+function writeManifest(root, manifest) {
+	const file = join(root, "design", "manifest.json");
+	const next = JSON.stringify(manifest, null, 2) + "\n";
+	const prev = existsSync(file) ? readFileSync(file, "utf8") : "";
+	if (hash(prev) === hash(next)) return false;
+	mkdirSync(join(root, "design"), { recursive: true });
+	writeFileSync(file, next);
+	return true;
+}
+const hash = (s) => createHash("sha256").update(s).digest("hex");
+//#endregion
+//#region src/server/api.ts
+const BOARD_NAME = /^[a-z0-9][a-z0-9-]*$/;
+const BODY_LIMIT = 1e6;
+function json(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("content-type", "application/json");
+	res.end(JSON.stringify(body));
+}
+function readBody(req) {
+	return new Promise((done) => {
+		let size = 0;
+		const chunks = [];
+		req.on("data", (c) => {
+			size += c.length;
+			if (size > BODY_LIMIT) {
+				done(null);
+				req.destroy();
+			} else chunks.push(c);
+		});
+		req.on("end", () => done(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", () => done(null));
+	});
+}
+/** Atomic write: random temp name (no predictable symlink target), rename, and a
+*  copy-fallback only for the Windows rename errors - anything else rethrows. */
+function atomicWrite(file, content) {
+	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+	writeFileSync(tmp, content, { flag: "wx" });
+	try {
+		renameSync(tmp, file);
+	} catch (err) {
+		const code = err.code;
+		if (code !== "EEXIST" && code !== "EPERM") {
+			rmSync(tmp, { force: true });
+			throw err;
+		}
+		copyFileSync(tmp, file);
+		rmSync(tmp, { force: true });
+	}
+}
+/** Containment beyond string prefixes: the realpath of the parent dir must stay inside base. */
+function contained(target, base) {
+	try {
+		const realBase = realpathSync(base);
+		const parent = realpathSync(resolve(target, ".."));
+		if (parent !== realBase && !parent.startsWith(realBase + sep)) return false;
+		if (existsSync(target)) {
+			const real = realpathSync(target);
+			return real === realBase || real.startsWith(realBase + sep);
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+function apiMiddleware(root) {
+	const boardsDir = join(root, "design", "boards");
+	const boardPath = (name) => {
+		if (!BOARD_NAME.test(name)) return null;
+		mkdirSync(boardsDir, { recursive: true });
+		const p = resolve(boardsDir, `${name}.json`);
+		return contained(p, boardsDir) ? p : null;
+	};
+	try {
+		for (const f of readdirSync(boardsDir)) if (f.endsWith(".tmp")) rmSync(join(boardsDir, f), { force: true });
+	} catch {}
+	return async (req, res, next) => {
+		const url = new URL(req.url ?? "/", "http://x");
+		if (!url.pathname.startsWith(`/__mv/api/`)) return next();
+		const path = url.pathname.slice(`${ROUTE}/api/`.length);
+		try {
+			if (path === "boards" && req.method === "GET") {
+				mkdirSync(boardsDir, { recursive: true });
+				return json(res, 200, readdirSync(boardsDir).filter((f) => f.endsWith(".json") && !f.endsWith(".tmp")).map((f) => {
+					const content = readFileSync(join(boardsDir, f), "utf8");
+					return {
+						name: f.replace(/\.json$/, ""),
+						sha256: hash(content)
+					};
+				}));
+			}
+			const boardMatch = /^boards\/([^/]+)$/.exec(path);
+			if (boardMatch) {
+				const p = boardPath(boardMatch[1]);
+				if (!p) return json(res, 400, { error: "invalid board name" });
+				if (req.method === "GET") {
+					if (!existsSync(p)) return json(res, 404, { error: "not found" });
+					const content = readFileSync(p, "utf8");
+					try {
+						return json(res, 200, {
+							board: JSON.parse(content),
+							sha256: hash(content)
+						});
+					} catch {
+						return json(res, 422, { error: `board "${boardMatch[1]}" is not valid JSON - fix the file` });
+					}
+				}
+				if (req.method === "PUT") {
+					const raw = await readBody(req);
+					if (raw == null) return json(res, 400, { error: "body too large or unreadable" });
+					let body;
+					try {
+						body = JSON.parse(raw);
+					} catch {
+						return json(res, 400, { error: "malformed JSON" });
+					}
+					const current = existsSync(p) ? readFileSync(p, "utf8") : "";
+					if (current && body.baseHash !== hash(current)) {
+						let disk = null;
+						try {
+							disk = JSON.parse(current);
+						} catch {}
+						return json(res, 409, {
+							error: "board changed on disk",
+							board: disk,
+							sha256: hash(current)
+						});
+					}
+					mkdirSync(boardsDir, { recursive: true });
+					const next2 = JSON.stringify(body.board, null, 2) + "\n";
+					atomicWrite(p, next2);
+					return json(res, 200, { sha256: hash(next2) });
+				}
+			}
+			json(res, 404, { error: "unknown endpoint" });
+		} catch (err) {
+			json(res, 500, { error: err.message });
+		}
+	};
+}
+//#endregion
+//#region src/server/routes.ts
+/**
+* Serves the package's own pages. transformIndexHtml does not map URLs - we do (spec §3).
+* Entry html files carry an {{ENTRY}} placeholder replaced with an /@fs/ absolute path,
+* because a relative ./main.tsx would resolve against the URL, not the package dir.
+*/
+function routesMiddleware(server, clientDir) {
+	const page = (dir) => {
+		const html = readFileSync(join(clientDir, dir, "index.html"), "utf8");
+		const entry = "/@fs/" + join(clientDir, dir, "main.tsx").split("\\").join("/");
+		return html.replaceAll("{{ENTRY}}", entry).replaceAll("{{ROUTE}}", ROUTE);
+	};
+	const ICON_TYPES = {
+		png: "image/png",
+		ico: "image/x-icon",
+		webmanifest: "application/manifest+json"
+	};
+	return async (req, res, next) => {
+		const path = new URL(req.url ?? "/", "http://x").pathname;
+		let dir = null;
+		if (path === "/" || path === "/index.html") dir = "shell";
+		else if (path === `/__mv/frame/` || path === `/__mv/frame/index.html`) dir = "frame-host";
+		else if (path === `/__mv/stage/` || path === `/__mv/stage/index.html`) dir = "stage";
+		else if (path.startsWith(`/__mv/favicon/`)) {
+			const name = path.slice(`${ROUTE}/favicon/`.length);
+			const type = ICON_TYPES[name.split(".").pop() ?? ""];
+			if (!/^[\w@-]+(\.[\w]+)+$/.test(name) || !type) return next();
+			try {
+				res.setHeader("content-type", type);
+				res.setHeader("cache-control", "public, max-age=3600");
+				return res.end(readFileSync(join(clientDir, "shell", "favicon", name)));
+			} catch {
+				return next();
+			}
+		} else if (path === `/__mv/bridge.js`) {
+			res.setHeader("content-type", "text/javascript");
+			return res.end(readFileSync(join(clientDir, "frame-host", "bridge.js"), "utf8"));
+		}
+		if (!dir) return next();
+		try {
+			const html = await server.transformIndexHtml(req.url ?? "/", page(dir));
+			res.setHeader("content-type", "text/html");
+			res.end(html);
+		} catch (err) {
+			res.statusCode = 500;
+			res.end(`marver route error: ${err.message}`);
+		}
+	};
+}
+//#endregion
+//#region src/server/plugin.ts
+const VIRTUAL_THEME = "virtual:sh-theme";
+const VIRTUAL_CONFIG = "virtual:sh-config";
+const VIRTUAL_DATA = "virtual:sh-data";
+function marverPlugin(ctx) {
+	const { root, clientDir, config } = ctx;
+	/** Theme resolution: design/theme.css wrapper > configured > detected > empty (spec §5.4). */
+	const themeFile = () => {
+		const wrapper = join(root, "design", "theme.css");
+		if (existsSync(wrapper)) return wrapper;
+		if (config.theme && existsSync(join(root, config.theme))) return join(root, config.theme);
+		if (ctx.detectedThemeCss && existsSync(join(root, ctx.detectedThemeCss))) return join(root, ctx.detectedThemeCss);
+		return null;
+	};
+	return {
+		name: "marver",
+		resolveId(id) {
+			if (id === VIRTUAL_THEME) return themeFile() ?? "\0virtual:sh-theme.css";
+			if (id === VIRTUAL_CONFIG) return "\0virtual:sh-config";
+			if (id === VIRTUAL_DATA) return "\0virtual:sh-data";
+		},
+		load(id) {
+			if (id === "\0virtual:sh-theme.css") {
+				console.warn("[marver] no theme detected - frames render unstyled. Set `theme` in design/config.ts.");
+				return "/* marver: no theme configured */";
+			}
+			if (id === "\0virtual:sh-config") return `export default ${JSON.stringify({
+				viewports: config.viewports,
+				themes: config.themes,
+				zoomSpeed: config.zoomSpeed,
+				noTheme: themeFile() == null
+			})}`;
+			if (id === "\0virtual:sh-data") return "export default null";
+		},
+		/** HTML frames: inject theme + bridge into any design/**.html Vite serves.
+		*  Inline scripts go through vite's html-proxy import-analysis: bare specifiers resolve
+		*  through plugins (so `virtual:sh-theme` works); `/@id/` URLs are rejected there. */
+		transformIndexHtml: {
+			order: "pre",
+			handler(html, hctx) {
+				if (!(hctx.originalUrl ?? hctx.path ?? "").split("?")[0].startsWith("/design/")) return;
+				const bridge = "/@fs/" + join(clientDir, "frame-host", "bridge.js").split("\\").join("/") + "?html=1";
+				return {
+					html,
+					tags: [{
+						tag: "script",
+						attrs: { type: "module" },
+						children: `import '${VIRTUAL_THEME}'`,
+						injectTo: "head-prepend"
+					}, {
+						tag: "script",
+						attrs: {
+							type: "module",
+							src: bridge
+						},
+						injectTo: "head-prepend"
+					}]
+				};
+			}
+		},
+		/**
+		* Frame add/unlink is OUR event (sh:manifest → shell appends/flags nodes); Vite's default for
+		* an out-of-graph file is a full-reload broadcast to every client, shell included. Suppress it.
+		* Edits to loaded frames keep normal HMR (modules present + file exists → pass through).
+		*/
+		handleHotUpdate(hctx) {
+			if (![join(root, "design", "scenes"), join(root, "design", "components")].some((w) => hctx.file.startsWith(w))) return;
+			if (!existsSync(hctx.file)) return [];
+			if (hctx.modules.length === 0) return [];
+		},
+		configureServer(server) {
+			server.middlewares.use(apiMiddleware(root));
+			server.middlewares.use(routesMiddleware(server, clientDir));
+			const regen = debounce(() => {
+				const manifest = scanFrames(root);
+				if (writeManifest(root, manifest)) server.ws.send("sh:manifest", manifest);
+			}, 150);
+			const watched = [join(root, "design", "scenes"), join(root, "design", "components")];
+			const inScope = (file) => watched.some((w) => file.startsWith(w));
+			server.watcher.on("add", (f) => inScope(f) && regen());
+			server.watcher.on("unlink", (f) => inScope(f) && regen());
+			server.watcher.on("change", (f) => inScope(f) && /\.(tsx|jsx)$/.test(f) && regen());
+			writeManifest(root, scanFrames(root));
+			const boardsDir = join(root, "design", "boards");
+			try {
+				mkdirSync(boardsDir, { recursive: true });
+				const timers = /* @__PURE__ */ new Map();
+				const watcher = watch(boardsDir, (_event, file) => {
+					if (!file || !file.endsWith(".json")) return;
+					clearTimeout(timers.get(file));
+					timers.set(file, setTimeout(() => {
+						timers.delete(file);
+						try {
+							const content = readFileSync(join(boardsDir, file), "utf8");
+							JSON.parse(content);
+							server.ws.send("sh:board", {
+								name: file.replace(/\.json$/, ""),
+								sha256: hash(content)
+							});
+						} catch {}
+					}, 120));
+				});
+				server.httpServer?.once("close", () => watcher.close());
+			} catch {}
+		}
+	};
+}
+function debounce(fn, ms) {
+	let t;
+	return ((...a) => {
+		clearTimeout(t);
+		t = setTimeout(() => fn(...a), ms);
+	});
+}
+/** Extra vite plugin when the host runs Tailwind v4: use their own @tailwindcss/vite. */
+async function tailwind4Plugin(root) {
+	try {
+		const mod = await import(join(root, "node_modules", "@tailwindcss", "vite", "dist", "index.mjs"));
+		const result = (mod.default ?? mod)();
+		return Array.isArray(result) ? result : [result];
+	} catch {
+		return null;
+	}
+}
+/** Tailwind v3: inline PostCSS config extending the host's tailwind config with design/ globs. Host files untouched. */
+async function tailwind3Css(root) {
+	for (const name of [
+		"tailwind.config.ts",
+		"tailwind.config.js",
+		"tailwind.config.mjs",
+		"tailwind.config.cjs"
+	]) {
+		const file = join(root, name);
+		if (!existsSync(file)) continue;
+		try {
+			const { pathToFileURL } = await import("node:url");
+			const twConfig = (await import(pathToFileURL(file).href)).default;
+			const tailwindcss = (await import(join(root, "node_modules", "tailwindcss", "lib", "index.js").replace(/\\/g, "/"))).default;
+			const content = Array.isArray(twConfig.content) ? twConfig.content : twConfig.content?.files ?? [];
+			return { postcss: { plugins: [tailwindcss({
+				...twConfig,
+				content: [...content, "./design/**/*.{ts,tsx,html}"]
+			})] } };
+		} catch (err) {
+			console.warn(`[marver] could not extend Tailwind v3 config (${err.message}). Add './design/**/*.{ts,tsx,html}' to its content globs manually.`);
+			return null;
+		}
+	}
+	return null;
+}
+//#endregion
+export { scanFrames as i, tailwind3Css as n, tailwind4Plugin as r, marverPlugin as t };

package/dist/serve-BPNmWeJx.mjs

@@ -0,0 +1,200 @@
+import { t as NAME } from "./cli.mjs";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+//#region src/server/serve.ts
+/**
+* `marver serve` - a zero-dependency static server for design/.dist with an optional
+* password gate (SPEC-M2 §4b). No MARVER_PASSWORD → plain static serving. With it, the
+* bundle is never sent pre-auth: every unauthenticated request gets the gate page, auth
+* is a POST compare + an HMAC-signed 30-day cookie keyed off the password itself (all
+* instances agree, nothing stored server-side).
+*/
+const MIME = {
+	".html": "text/html; charset=utf-8",
+	".js": "text/javascript",
+	".mjs": "text/javascript",
+	".css": "text/css",
+	".json": "application/json",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".ico": "image/x-icon",
+	".webmanifest": "application/manifest+json",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".map": "application/json",
+	".txt": "text/plain"
+};
+const COOKIE = "mv_a";
+const MONTH = 2592e3;
+function serve(root, portFlag) {
+	const dist = join(root, "design", ".dist");
+	if (!existsSync(join(dist, "index.html"))) {
+		console.error(`[${NAME}] design/.dist not found - run \`npx ${NAME} build\` first.`);
+		process.exit(1);
+	}
+	const realDist = realpathSync(dist);
+	let meta = {
+		name: "Marver",
+		branding: true
+	};
+	try {
+		meta = {
+			...meta,
+			...JSON.parse(readFileSync(join(dist, "meta.json"), "utf8"))
+		};
+	} catch {}
+	const password = process.env.MARVER_PASSWORD ?? "";
+	const verifier = password ? scryptSync(password, "marver-gate", 32) : null;
+	const cookieKey = randomBytes(32);
+	const sign = (exp) => createHmac("sha256", cookieKey).update(`v1.${exp}`).digest("hex");
+	const authed = (req) => {
+		const m = /(?:^|;\s*)mv_a=(\d+)\.([0-9a-f]+)/.exec(String(req.headers.cookie ?? ""));
+		if (!m) return false;
+		const exp = Number(m[1]);
+		if (!Number.isFinite(exp) || exp * 1e3 < Date.now()) return false;
+		const want = Buffer.from(sign(exp)), got = Buffer.from(m[2]);
+		return want.length === got.length && timingSafeEqual(want, got);
+	};
+	const server = createServer((req, res) => {
+		const url = new URL(req.url ?? "/", "http://x");
+		if (verifier) {
+			if (req.method === "POST" && url.pathname === "/__mv/auth") {
+				let body = "";
+				req.on("data", (c) => {
+					body += c;
+					if (body.length > 1e4) req.destroy();
+				});
+				req.on("end", () => {
+					const form = new URLSearchParams(body);
+					const given = form.get("password") ?? "";
+					if (timingSafeEqual(scryptSync(given, "marver-gate", 32), verifier)) {
+						const exp = Math.floor(Date.now() / 1e3) + MONTH;
+						const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
+						res.setHeader("set-cookie", `${COOKIE}=${exp}.${sign(exp)}; Path=/; Max-Age=${MONTH}; HttpOnly; SameSite=Lax${secure}`);
+						const next = form.get("next") ?? "";
+						res.statusCode = 303;
+						res.setHeader("location", /^#\/[\w\/?&=%.,~-]*$/.test(next) ? `/${next}` : "/");
+						return res.end();
+					}
+					return gate(res, meta, "Wrong password - try again");
+				});
+				return;
+			}
+			const cosmetic = url.pathname.startsWith("/__mv/favicon/") || /^\/__mv\/logo\.(svg|png)$/.test(url.pathname);
+			if (!authed(req) && !cosmetic) return gate(res, meta);
+		}
+		let path;
+		try {
+			path = decodeURIComponent(url.pathname);
+		} catch {
+			res.statusCode = 400;
+			return res.end("bad request");
+		}
+		if (path.endsWith("/")) path += "index.html";
+		let file = resolve(dist, path.slice(1));
+		try {
+			const real = realpathSync(file);
+			const rel = relative(realDist, real);
+			if (rel.startsWith("..") || isAbsolute(rel)) throw new Error("outside dist");
+			file = real;
+		} catch {
+			file = join(dist, "index.html");
+		}
+		if (!extname(file)) file = join(dist, "index.html");
+		try {
+			const content = readFileSync(file);
+			res.setHeader("content-type", MIME[extname(file)] ?? "application/octet-stream");
+			const cache = verifier ? "private, no-store" : file.startsWith(join(dist, "assets")) ? "public, max-age=31536000, immutable" : "no-store";
+			res.setHeader("cache-control", cache);
+			res.end(content);
+		} catch {
+			res.statusCode = 404;
+			res.end("not found");
+		}
+	});
+	const port = portFlag ?? (Number(process.env.PORT) || 4199);
+	server.listen(port, () => {
+		console.log(`\n  ${NAME} serving design/.dist → http://localhost:${port}/`);
+		console.log(verifier ? "  gate: ON (MARVER_PASSWORD set)\n" : "  gate: off - set MARVER_PASSWORD to require a password\n");
+	});
+	return server;
+}
+/** The Marver logo mark (ParallelogramDuo, same as the shell's sidebar). */
+const MARK_AT = (size) => `<svg viewBox="0 0 256 256" width="${size}" height="${size}" fill="currentColor" aria-hidden><path d="M239.29,59.28l-64.8,144a8,8,0,0,1-7.3,4.72H24a8,8,0,0,1-7.3-11.28l64.8-144A8,8,0,0,1,88.81,48H232A8,8,0,0,1,239.29,59.28Z" opacity=".1"/><path d="M245.43,47.31A15.94,15.94,0,0,0,232,40H88.81a16,16,0,0,0-14.59,9.43l-64.8,144A16,16,0,0,0,24,216H167.19a16,16,0,0,0,14.59-9.43l64.8-144A16,16,0,0,0,245.43,47.31ZM167.19,200H24L88.81,56H232Z"/></svg>`;
+const MARK = MARK_AT(17);
+const MARK_LG = MARK_AT(24);
+/** The gate: the canvas's own antechamber - light ground, dot grid, glass card in the
+*  shell's exact token language. The visitor is one password away from stepping in. */
+function gate(res, meta, error) {
+	const name = meta.name ? meta.name[0].toUpperCase() + meta.name.slice(1) : "Marver";
+	const appMark = meta.logo ? `<img src="${esc(meta.logo)}" alt="" width="24" height="24" />` : MARK_LG;
+	const title = meta.branding ? `${name} | Marver - Visualize your software` : name;
+	const desc = meta.branding ? `${name}, shared as a live Marver canvas - real screens and prototypes, built from the codebase. Marver is the agent-native design canvas.` : `${name} - a private design canvas.`;
+	res.statusCode = 200;
+	res.setHeader("content-type", "text/html; charset=utf-8");
+	res.setHeader("cache-control", "no-store");
+	res.end(`<!doctype html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(title)}</title>
+<meta name="description" content="${esc(desc)}" />
+<meta name="robots" content="noindex" />
+<meta name="theme-color" content="#e7e9ef" />
+<meta property="og:title" content="${esc(title)}" />
+<meta property="og:description" content="${esc(desc)}" />
+${meta.branding ? "<meta property=\"og:site_name\" content=\"Marver\" />" : ""}
+<meta property="og:type" content="website" />
+<meta name="twitter:card" content="summary" />
+<link rel="icon" href="/__mv/favicon/favicon.ico" sizes="48x48" />
+<link rel="icon" type="image/png" sizes="32x32" href="/__mv/favicon/favicon-32x32.png" />
+<link rel="icon" type="image/png" sizes="16x16" href="/__mv/favicon/favicon-16x16.png" />
+<link rel="apple-touch-icon" href="/__mv/favicon/apple-touch-icon.png" />
+<style>
+  * { box-sizing: border-box; margin: 0 }
+  body { min-height: 100vh; display: flex; align-items: center; justify-content: center;
+    background-color: #e7e9ef;
+    background-image: radial-gradient(#c9cbd5 1px, transparent 1px); background-size: 20px 20px;
+    font: 500 14px -apple-system, system-ui, sans-serif; color: #18181b;
+    -webkit-font-smoothing: antialiased }
+  main { display: flex; flex-direction: column; align-items: center; gap: 22px; padding: 16px }
+  form { width: 340px; padding: 24px; border-radius: 24px; display: flex; flex-direction: column; gap: 14px;
+    background: rgba(255, 255, 255, .64); backdrop-filter: blur(20px); -webkit-backdrop-filter: blur(20px);
+    border: 1px solid rgba(24, 24, 27, .1);
+    box-shadow: inset 0 1px 0 rgba(255, 255, 255, .65), 0 1px 2px rgba(24, 24, 27, .05), 0 4px 12px -6px rgba(24, 24, 27, .12) }
+  header { display: flex; align-items: center; gap: 10px; padding: 4px 2px 4px 4px }
+  header svg, header img { color: #0088ff; flex: none; border-radius: 6px }
+  h1 { font-size: 17px; font-weight: 600; letter-spacing: -.01em }
+  p { font-size: 12.5px; line-height: 1.5; color: rgba(24, 24, 27, .66); padding: 0 4px }
+  input { height: 40px; padding: 0 16px; border-radius: 999px; border: 1px solid rgba(24, 24, 27, .14);
+    background: #fff; color: #18181b; font: inherit; outline: none; transition: border-color .15s, box-shadow .15s }
+  input::placeholder { color: rgba(24, 24, 27, .35) }
+  input:focus { border-color: #0088ff; box-shadow: 0 0 0 3px rgba(0, 136, 255, .18) }
+  button { height: 40px; border: 0; border-radius: 999px; background: #18181b; color: #fafafa;
+    font: 600 13px -apple-system, system-ui, sans-serif; cursor: pointer; transition: background .15s }
+  button:hover { background: #000 }
+  .err { font-size: 12px; color: #b42318; padding: 0 4px }
+  footer a { display: inline-flex; align-items: center; gap: 7px; font: 600 12.5px -apple-system, system-ui, sans-serif;
+    color: rgba(24, 24, 27, .55); text-decoration: none }
+  footer a > svg:first-of-type { width: 20px; height: 20px; color: #0088ff }
+  footer .md, footer .up { transition: color .15s, opacity .15s }
+  footer a:hover .md { color: #0088ff; text-decoration: underline; text-underline-offset: 3px }
+  footer .up { opacity: .45; margin-left: -3px }
+  footer a:hover .up { opacity: 1; color: #0088ff }
+</style></head>
+<body><main>
+  <form method="post" action="/__mv/auth">
+    <header>${appMark}<h1>${esc(name)}</h1></header>
+    <p>You're one step from the canvas. This space is private - enter the password to step inside.</p>
+    ${error ? `<div class="err">${esc(error)}</div>` : ""}
+    <input type="password" name="password" placeholder="Password" autofocus autocomplete="current-password" />
+    <input type="hidden" name="next" />
+    <button type="submit">Open the canvas</button>
+  </form>
+  <script>document.querySelector('[name=next]').value = location.hash<\/script>
+  ${meta.branding ? `<footer><a href="https://marver.design" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
+</main></body></html>`);
+}
+const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+//#endregion
+export { serve };