@marver-design/marver 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,101 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.4.0 - 2026-08-14
+
+The collaboration release (SPEC-M3): the canvas becomes a place where colleagues,
+the designer, and the coding agent close the feedback loop together.
+
+### Added
+
+- **Element-anchored comments.** `C` enters comment mode: click any element inside a
+  frame (laser outlines guide you) and the thread pins to it - fractional position
+  inside the element's box, so pins ride through responsive reflow. Threads are
+  Google-Docs-shaped: root + one level of replies, resolve/reopen. Anchors survive
+  agent edits via a verified ladder (semantics → CSS path → fuzzy quote match);
+  a dead anchor parks the thread visibly at the frame edge, never silently deleted.
+  Inactive frames collapse their open threads into a top-right avatar stack.
+  `Shift+C` hides all pins; `?c=<thread>` deep-links a specific thread through the
+  password gate (copy-link on every card).
+- **Real commenter identity, no email infrastructure.** Viewers on a published canvas
+  claim an account through a single-use invite link (owner mints it; the link travels
+  over Slack/DM) - display name, password, avatar. Accounts are scrypt-verified with
+  per-user salts; sessions survive restarts. The first account owns the canvas;
+  `MARVER_OWNER_EMAIL` prints the owner's one-time claim link in the deploy logs.
+  Avatars fall back to initials on a deterministic color.
+- **Gate v2: one credential per persona.** The gate on a collaboration canvas has
+  three doors: guests pay the canvas password (read-only), members sign in with
+  their OWN password (their session IS gate passage - they never touch the shared
+  secret), and an invite link (`<url>/#/i/<token>`) opens straight into the claim -
+  email shown as an INVITED chip, profile-picture picker (client-side 128px
+  downscale), display name, password. Sign-in/claim endpoints sit in front of the
+  gate (rate-limited, non-enumerating); rotating the canvas password only ever
+  affects guests. Primary buttons stay disabled until their mandatory fields are
+  filled, with a tooltip naming what's missing. The boards payload carries the
+  owner's display name, so a read-only refusal says who to ask. Static canvases
+  keep the single-field gate untouched.
+- **One deploy, comments live everywhere.** `marver serve` grows a collaboration API
+  (REST + SSE) when `MARVER_DATA_DIR` names a durable volume; the published canvas is
+  the comments' home. `marver dev` two-way syncs every 30s (`marver comments connect
+  <url>` once), so client feedback lands in `design/comments/<board>.jsonl` - a
+  git-tracked, append-only event log the agent reads with zero tooling. Republishing
+  never clobbers collected feedback (the store unions the bundle seed on boot).
+- **The agent works the queue.** `marver comments list --open --json` / `reply` /
+  `resolve --addressed-in <frame>` - resolving records which variant answered the
+  feedback, making the fork-don't-overwrite doctrine auditable. `marver comments
+  invite <email>` mints single-use invite links from the CLI (owner only), `revoke
+  <email>` retires an account. `instructions/iterate.md` carries the
+  comments-as-work-queue discipline; `instructions/publish.md` is the agent-facing
+  deploy runbook (boards policy, gate, volume, accounts) and AGENTS.md routes to it.
+- **Laser mode.** `L` (or the toolbar crosshair) outlines every element in every frame
+  with depth-hued borders (60° per nesting level) plus a DevTools-style hover label.
+  Zero layout shift - outlines only. Clicking an element copies its full address for
+  the agent - frame source file + CSS path (+ JSX source location when stamped).
+  Comment mode shows only the hover highlight (no full rainbow) and a chat-teardrop
+  cursor, so picking an element to comment on stays calm.
+- **Default-closed publishing.** `marver build` now requires a publish policy:
+  `design/publish.json` names each published board with `read` or `comment` rights
+  (enforced server-side, not just hidden in UI). `--boards a,b` stays as an explicit
+  override; publishing everything takes a deliberate `--all-boards`.
+
+### Changed
+
+- **`c` is comment mode now** (the Figma/Miro convention). Copy-selected-file-paths
+  moved from `c` to `y`.
+- `marver build` without a publish policy fails with instructions instead of
+  publishing everything - the privacy default flipped closed.
+
+### Security
+
+- Comment mutations are CSRF-protected (double-submit cookie + origin checks) and
+  rate-limited; session and invite tokens are stored hashed; every pushed event is
+  validated hard (author must match the session, thread ids cannot be hijacked,
+  edits are owner-only, timestamps cannot come from the future) - and accepted
+  events are never rewritten, so id-keyed sync converges byte-identically.
+- v1 trust boundary, stated plainly: frame code in your design repo runs same-origin
+  with the shell - review what you merge. Full frame sandboxing is the v1.1 follow-up
+  (SPEC-M3 §0 records the probe results and the plan).
+
+### Durability & concurrency
+
+- Comment appends and auth writes are `fsync`'d before they are acknowledged - a
+  comment or account confirmed to the client survives a crash or volume interruption,
+  not just the page cache.
+- `auth.json`'s read-modify-write is guarded by a cross-process lock (stale-stolen
+  after 10s, never deadlocks) so a deploy overlap or an accidental second instance
+  cannot resurrect a revoked account or drop an invite. The comment log needs no lock:
+  append-only + id-keyed union is conflict-free by construction (and git merges it
+  with `merge=union`). Two honest v1 limits, documented not hidden: thread ordering
+  uses client timestamps (a badly-skewed clock can mis-order a resolve/reopen race -
+  re-resolve to fix), and comment logs have no hard size ceiling (fine at the design-
+  review scale marver targets; a per-board cap is a later concern).
+
+## 0.3.1 - 2026-08-13
+
+### Fixed
+
+- Play-mode variant chrome: the current variant's name was invisible (theme ink on the always-dark glass pill - now the pill's own light ink), and switching variants jiggled the controls. Redesigned: the letter chips now use the sidebar's exact badge language (20px, 7px-radius, one shape in every state) so the two surfaces read as one concept, they LEAD the cluster as the stable anchor, and the name trails at natural width (capped with ellipsis + a tooltip carrying the full title) - a name change grows the pill rightward without moving anything underfoot.
+
 ## 0.3.0 - 2026-08-13
 
 The co-thinking release: the canvas now holds the thinking, not just the screens.

package/README.md

@@ -19,6 +19,8 @@ Then, to your agent:
 - **Devices view**: the Devices menu (or hotkeys `1`-`5`) sizes every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
 - `data-goto="scene/frame"` on any element links frames into a walkable prototype.
 - **Content frames**: specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through *before* any pixels exist. Diagrams ship pre-themed (both modes), content frames auto-size to their content, and everything - devices, play mode, publish - works on them identically. Works in a repo with no app at all: idea first, design second.
+- **Comments**: Google-Docs-style feedback, pinned to actual elements. Press `C`, click a div inside a frame, write - the thread lives on that element, survives edits via a layered anchor (source semantics → structure → fuzzy text), and collapses to an avatar stack when the frame isn't active. Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure); `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services (set `MARVER_DATA_DIR` on a volume + `MARVER_OWNER_EMAIL` for the first account).
+- **Laser mode**: `L` outlines every element in every frame with depth-hued borders plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent. Comment mode is the calm cousin - one at a time with laser - showing only the hovered element so picking a comment target never overwhelms.
 - **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
 - Uninstall: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
 

package/dist/auth-B36fMCM3.mjs

@@ -0,0 +1,245 @@
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/server/auth.ts
+/**
+* Accounts, invites, sessions (SPEC-M3 §3) - the minimal credible implementation,
+* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
+* opaque session tokens stored hashed, single-use invite links as the identity
+* bootstrap (no email infrastructure anywhere).
+*
+* Password = read, account = comment: everything here concerns accounts only; the
+* shared gate password (serve.ts) remains the outer READ boundary.
+*
+* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
+* users change rarely; the event-log treatment is reserved for comments.
+*/
+const SCRYPT = {
+	N: 2 ** 15,
+	r: 8,
+	p: 1,
+	keylen: 32,
+	maxmem: 67108864
+};
+const INVITE_TTL = 6048e5;
+const SESSION_TTL = 2592e6;
+const normEmail = (e) => e.trim().toLowerCase();
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+const token = () => randomBytes(32).toString("base64url");
+const storeFile = (dir) => join(dir, "auth.json");
+/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
+*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
+*  a later save overwrite every account. */
+function loadStore(dir) {
+	let raw;
+	try {
+		raw = readFileSync(storeFile(dir), "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			users: [],
+			invites: [],
+			sessions: []
+		};
+		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
+	}
+	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
+	return parsed;
+}
+/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
+*  0600 throughout: the store holds emails and password verifiers. */
+function saveStore(dir, store) {
+	const file = storeFile(dir);
+	mkdirSync(dirname(file), { recursive: true });
+	const now = Date.now();
+	store.invites = store.invites.filter((i) => i.exp > now);
+	store.sessions = store.sessions.filter((s) => s.exp > now);
+	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+	const fd = openSync(tmp, "wx", 384);
+	try {
+		writeSync(fd, JSON.stringify(store, null, 2));
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	renameSync(tmp, file);
+}
+/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
+*  the store mutations are already synchronous and atomic; this covers deploy overlap
+*  and any accidental multi-instance run (the supported setup is single-instance) -
+*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
+*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
+*  fails loudly rather than hanging. */
+function withLock(dir, fn) {
+	mkdirSync(dir, { recursive: true });
+	const lock = join(dir, ".auth.lock");
+	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	const deadline = Date.now() + 5e3;
+	for (;;) try {
+		closeSync(openSync(lock, "wx"));
+		break;
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		try {
+			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
+				unlinkSync(lock);
+				continue;
+			}
+		} catch {
+			continue;
+		}
+		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
+		nap(25);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			unlinkSync(lock);
+		} catch {}
+	}
+}
+const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
+/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
+*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
+*  token is returned exactly once; only its hash is stored. */
+/** The owner's display name - public-safe (never the email). Null before claim. */
+function ownerName(dir) {
+	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
+}
+/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
+*  token is the proof - holding it means the owner sent it to you. */
+function inviteInfo(dir, rawToken) {
+	const hash = sha256(rawToken);
+	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+	return invite ? { email: invite.emailNorm } : null;
+}
+function createInvite(dir, email) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
+		const raw = token();
+		const exp = Date.now() + INVITE_TTL;
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		store.invites.push({
+			emailNorm: normEmail(email),
+			tokenHash: sha256(raw),
+			exp
+		});
+		saveStore(dir, store);
+		return {
+			token: raw,
+			exp
+		};
+	});
+}
+/** Claim an invite: burns it, creates the account, opens the first session. */
+function claimInvite(dir, rawToken, profile) {
+	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
+	if (!profile.name.trim()) throw new Error("a display name is required");
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
+		store.invites = store.invites.filter((i) => i !== invite);
+		const salt = randomBytes(16).toString("hex");
+		const user = {
+			email: invite.emailNorm,
+			name: profile.name.trim(),
+			avatar: profile.avatar,
+			role: store.users.length ? "member" : "owner",
+			salt,
+			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
+			params: SCRYPT,
+			createdAt: Date.now()
+		};
+		store.users.push(user);
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+/** Password sign-in. One generic failure - never reveal whether the email exists. */
+function signIn(dir, email, password) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = findUser(store, email);
+		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
+		const params = user?.params ?? SCRYPT;
+		const got = scryptSync(password, salt, params.keylen, params);
+		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
+		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+function pushSession(store, user) {
+	const raw = token();
+	store.sessions.push({
+		tokenHash: sha256(raw),
+		emailNorm: normEmail(user.email),
+		exp: Date.now() + SESSION_TTL
+	});
+	return raw;
+}
+/** Resolve a session token to its user; null when unknown or expired. */
+function sessionUser(dir, rawToken) {
+	const store = loadStore(dir);
+	const hash = sha256(rawToken);
+	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
+	return s ? store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null : null;
+}
+function signOut(dir, rawToken) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
+		saveStore(dir, store);
+	});
+}
+/** Update name/avatar on an existing account. */
+function updateProfile(dir, email, patch) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = findUser(store, email);
+		if (!user) throw new Error("no such account");
+		if (patch.name?.trim()) user.name = patch.name.trim();
+		if (patch.avatar !== void 0) user.avatar = patch.avatar || void 0;
+		saveStore(dir, store);
+		return user;
+	});
+}
+/** Remove an account and all its sessions (owner action). The LAST owner cannot be
+*  removed - a store with members but no owner has no one left to administer it,
+*  and bootstrap will not re-run while any user exists. */
+function revokeUser(dir, email) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
+		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
+		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		saveStore(dir, store);
+	});
+}
+/** The public shape of a user - what other viewers (and events) may see. */
+const publicUser = (u) => ({
+	email: u.email,
+	name: u.name,
+	avatar: u.avatar
+});
+//#endregion
+export { claimInvite, createInvite, inviteInfo, loadStore, normEmail, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile };

package/dist/{build-Ckmyci3O.mjs → build-p3xmXU3b.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
 import { a as loadConfig, n as scanFrames, o as detectHost } from "./manifest-DW-T52MM.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Crp4CAma.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-CtQqO5ZZ.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -43,6 +43,37 @@ function scanAssetRefs(src, moduleId) {
 }
 /** Same shape the client's assetUrl accepts: relative, inside design/assets/, no tricks. */
 const isLocalAssetRef = (p) => !!p && !p.includes(":") && !p.startsWith("/") && !p.startsWith("\\") && !p.split("/").some((s) => s === ".." || s === "");
+/** The publish policy (SPEC-M3 §4): design/publish.json names what ships and with what
+*  rights. Publishing is default-CLOSED - no policy and no explicit flag = no build.
+*  Returns name -> 'read' | 'comment'. Boards absent from the result do not ship. */
+function resolvePublish(root, allBoards, boardsFlag, allBoardsFlag) {
+	const known = (n) => n === "all-scenes" || !!allBoards[n];
+	if (boardsFlag !== void 0) {
+		const names = boardsFlag.split(",").map((s) => s.trim()).filter(Boolean);
+		if (!names.length) throw new Error("--boards was given but named no boards");
+		const missing = names.filter((n) => !known(n));
+		if (missing.length) throw new Error(`--boards names not found in design/boards/: ${missing.join(", ")}`);
+		return Object.fromEntries(names.map((n) => [n, "comment"]));
+	}
+	if (allBoardsFlag) return Object.fromEntries(["all-scenes", ...Object.keys(allBoards).filter((n) => n !== "all-scenes")].map((n) => [n, "comment"]));
+	const policyFile = join(root, "design", "publish.json");
+	if (!existsSync(policyFile)) throw new Error("publishing is default-closed and no publish policy exists.\n  Either declare one in design/publish.json:  { \"boards\": { \"<board>\": \"read\" | \"comment\" } }\n  or be explicit:  --boards a,b  (publish just those)  ·  --all-boards  (publish everything)");
+	let policy;
+	try {
+		policy = JSON.parse(readFileSync(policyFile, "utf8"));
+	} catch {
+		throw new Error("design/publish.json is not valid JSON");
+	}
+	const entries = Object.entries(policy?.boards ?? {});
+	if (!entries.length) throw new Error("design/publish.json has no \"boards\" entries - publishing is default-closed, name what ships");
+	const out = {};
+	for (const [n, level] of entries) {
+		if (!known(n)) throw new Error(`design/publish.json names an unknown board: ${n}`);
+		if (level !== "read" && level !== "comment") throw new Error(`design/publish.json: board "${n}" has level "${level}" - use "read" or "comment"`);
+		out[n] = level;
+	}
+	return out;
+}
 /** Read every board file; returns name -> parsed json. Bad JSON fails the build loudly. */
 function readBoards(root) {
 	const dir = join(root, "design", "boards");
@@ -104,7 +135,7 @@ export function layoutChain(fileKey) {
 }
 `;
 }
-async function buildSite(root, boardsFlag) {
+async function buildSite(root, boardsFlag, allBoardsFlag) {
 	const config = await loadConfig(root);
 	const host = detectHost(root);
 	const pkgDir = packageDir();
@@ -112,13 +143,8 @@ async function buildSite(root, boardsFlag) {
 	const outDir = join(root, "design", ".dist");
 	const manifest = scanFrames(root);
 	const allBoards = readBoards(root);
-	let publishedNames;
-	if (boardsFlag !== void 0) {
-		publishedNames = boardsFlag.split(",").map((s) => s.trim()).filter(Boolean);
-		if (!publishedNames.length) throw new Error("--boards was given but named no boards");
-		const missing = publishedNames.filter((n) => n !== "all-scenes" && !allBoards[n]);
-		if (missing.length) throw new Error(`--boards names not found in design/boards/: ${missing.join(", ")}`);
-	} else publishedNames = ["all-scenes", ...Object.keys(allBoards).filter((n) => n !== "all-scenes")];
+	const rights = resolvePublish(root, allBoards, boardsFlag, allBoardsFlag);
+	const publishedNames = Object.keys(rights);
 	const includeAll = publishedNames.includes("all-scenes");
 	const boards = {};
 	for (const n of publishedNames) if (allBoards[n]) boards[n] = allBoards[n];
@@ -138,7 +164,8 @@ async function buildSite(root, boardsFlag) {
 		},
 		boards,
 		names: publishedNames,
-		default: publishedNames[0]
+		default: publishedNames[0],
+		rights
 	};
 	const registryFile = posix(join(clientDir, "frame-host", "registry.ts"));
 	const plugins = [{
@@ -258,6 +285,18 @@ async function buildSite(root, boardsFlag) {
 		cpSync(srcFile, dest);
 		copiedAssets++;
 	}
+	const commentsDir = join(root, "design", "comments");
+	if (existsSync(commentsDir)) {
+		let seeded = 0;
+		for (const n of publishedNames) {
+			const f = join(commentsDir, `${n}.jsonl`);
+			if (!existsSync(f)) continue;
+			mkdirSync(join(outDir, "design", "comments"), { recursive: true });
+			cpSync(f, join(outDir, "design", "comments", `${n}.jsonl`));
+			seeded++;
+		}
+		if (seeded) console.log(`  comments: ${seeded} board log${seeded === 1 ? "" : "s"} seeded`);
+	}
 	let name = basename(root);
 	try {
 		name = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).name ?? name;
@@ -282,10 +321,11 @@ async function buildSite(root, boardsFlag) {
 	writeFileSync(join(outDir, "meta.json"), JSON.stringify({
 		name,
 		branding: config.share.branding,
-		logo
+		logo,
+		rights
 	}));
 	console.log(`\n  ${NAME} build → design/.dist`);
-	console.log(`  boards: ${publishedNames.join(", ")}`);
+	console.log(`  boards: ${publishedNames.map((n) => `${n} (${rights[n]})`).join(", ")}`);
 	console.log(`  frames: ${frames.length}${includeAll ? "" : ` of ${manifest.frames.length} (build-time filter)`}`);
 	if (copiedAssets) console.log(`  assets: ${copiedAssets} referenced file${copiedAssets === 1 ? "" : "s"} from design/assets/ (unreferenced assets never ship)`);
 	if (!includeAll && existsSync(join(root, "public"))) console.log(`  note: the host public/ directory ships in full - the --boards filter covers frames, not public assets`);

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DolP_Ld4.mjs");
+	const { init } = await import("./init-Ck8z-HiD.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-C2oTKuXe.mjs");
+	const { dev } = await import("./dev-DZi1yRhn.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -55,18 +55,18 @@ cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root",
 	}
 	await dev(resolve(opts.root), port);
 });
-cli.command("build", "Static export → design/.dist").option("--boards <names>", "Publish only these boards (comma-separated); the frame filter is applied at build time").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-Ckmyci3O.mjs");
+cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
+	const { buildSite } = await import("./build-p3xmXU3b.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
-		await buildSite(resolve(opts.root), boards);
+		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
 	} catch (err) {
 		console.error(`[${NAME}] build failed: ${err.message}`);
 		process.exit(1);
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-OtA9Nlow.mjs");
+	const { serve } = await import("./serve-D_KBK7Oy.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -74,6 +74,15 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	}
 	serve(resolve(opts.root), port);
 });
+cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
+	const { commentsCommand } = await import("./comments-odHzYdO3.mjs");
+	try {
+		await commentsCommand(resolve(opts.root), action, value, opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();