@marver-design/marver 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,157 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.5.0 - 2026-08-15
+
+The performance & fidelity release (SPEC-M5): the canvas stops jiggling. Moving around a board no
+longer swaps between two documents on every pan/zoom - each passive frame renders as a lean DOM
+snapshot that IS what you see, and the real live app takes over the moment you interact with it.
+
+### Added
+
+- **Lean-primary rendering.** Every passive frame shows a **DOM snapshot** - a self-contained static
+  copy of the frame (real DOM + real CSS, zero JavaScript) served in a `sandbox="allow-same-origin"`
+  iframe. It reflows on resize with the browser's own layout engine and carries the app's exact colors
+  (no rasterisation), so panning, zooming, and device-sweeping a board is smooth and pixel-honest. The
+  full live app sits underneath and swaps in instantly when you focus a frame (double-click), or in
+  laser/comment mode. This replaces the earlier screenshot facade, which invented colors and jittered.
+- **Publish parity.** The lean tier now works in published builds (`marver build` → `marver serve`),
+  not just dev - captured client-side from the bundled same-origin frames, no build-time renderer.
+- **Faster first paint.** Leans capture bounded-parallel and viewport-first, so the frames you're
+  looking at appear first and a big board settles in seconds instead of tens of seconds.
+- **Content-frame color families.** Tag a diagram node with a built-in family - `HQ:::blue`,
+  `Carriers:::orange`, `Drivers:::purple` (also `green red gray`) - and it gets a filled, on-brand
+  color with a legible border in both themes, no `classDef` boilerplate. The same six names work in
+  `Md` prose as `:blue[the shipper's world]`, so a sentence and the diagram beside it read as one
+  color language.
+- **`Head :: gloss` diagram labels.** A node label written `Head :: gloss` renders the head bold on
+  top with the gloss lighter and smaller below - a box scans as label-then-detail, no run-on.
+- **Authoring doctrine that ships with the tool.** The scaffolded instructions
+  (`instructions/shape.md`, `instructions/reference/color.md`) now teach an agent these conventions -
+  the `::` label hierarchy, the `:::family` / `:blue[…]` palette, and "pick one family per concept and
+  hold it" - so diagrams and highlighted prose come out consistent by default instead of hand-rolled
+  hex and one-off `classDef`s.
+
+### Changed
+
+- **Sidebar header** shows the humanized repo name (`marver-pilot` → "Marver Pilot", ellipsed if
+  long); the logo links to marver.design.
+- **Sidebar board/scene labels** are humanized - kebab filenames render Title Case (`tms-specs` →
+  "Tms Specs"), dropping the dashes, while an explicit `meta.title` is honored verbatim.
+- **App cursor** is the marver arrowhead - tilted, rounded, small, soft-shadowed, and theme-adaptive
+  (black-on-light / white-on-dark); reverts to a normal pointer in interact/prototype and keeps the
+  pin/crosshair in comment/laser mode.
+- **Copy-file-path shortcut** moved to `Shift+P` (was a mislabeled `C`).
+
+### Fixed
+
+- The canvas "jiggle" - text shifting ~1-2px when you click or zoom a frame - is gone; there is no
+  longer a per-gesture document swap to shift it.
+- Mermaid diagrams no longer pop in/out or flash the wrong theme during zoom (async render is awaited;
+  a diagram's baked colors re-capture on theme change; the cover's color-scheme is pinned to the
+  frame theme, not the viewer's OS).
+- A frame you've scrolled, typed into, or themed re-captures faithfully; agent edits (HMR) drop the
+  stale snapshot and rebuild; slow data that lands shortly after load triggers one bounded re-capture
+  (data that changes much later shows live the moment you focus the frame, and the lean rebuilds when
+  you leave it).
+
+### Known limitations
+
+- Memory targets typical authoring boards (~15-20 frames); dozens of heavy production apps need the
+  bounded-residency milestone. A frame the serializer can't render faithfully (canvas/video/open- or
+  script-created-closed shadow-DOM/nested-iframe/cross-origin-CSS/blocked-CSP/oversized) degrades to
+  live automatically. (One narrow edge: a declarative closed shadow root can't be detected and may
+  render stale - rare in practice.)
+
+## 0.4.0 - 2026-08-14
+
+The collaboration release (SPEC-M3): the canvas becomes a place where colleagues,
+the designer, and the coding agent close the feedback loop together.
+
+### Added
+
+- **Element-anchored comments.** `C` enters comment mode: click any element inside a
+  frame (laser outlines guide you) and the thread pins to it - fractional position
+  inside the element's box, so pins ride through responsive reflow. Threads are
+  Google-Docs-shaped: root + one level of replies, resolve/reopen. Anchors survive
+  agent edits via a verified ladder (semantics → CSS path → fuzzy quote match);
+  a dead anchor parks the thread visibly at the frame edge, never silently deleted.
+  Inactive frames collapse their open threads into a top-right avatar stack.
+  `Shift+C` hides all pins; `?c=<thread>` deep-links a specific thread through the
+  password gate (copy-link on every card).
+- **Real commenter identity, no email infrastructure.** Viewers on a published canvas
+  claim an account through a single-use invite link (owner mints it; the link travels
+  over Slack/DM) - display name, password, avatar. Accounts are scrypt-verified with
+  per-user salts; sessions survive restarts. The first account owns the canvas;
+  `MARVER_OWNER_EMAIL` prints the owner's one-time claim link in the deploy logs.
+  Avatars fall back to initials on a deterministic color.
+- **Gate v2: one credential per persona.** The gate on a collaboration canvas has
+  three doors: guests pay the canvas password (read-only), members sign in with
+  their OWN password (their session IS gate passage - they never touch the shared
+  secret), and an invite link (`<url>/#/i/<token>`) opens straight into the claim -
+  email shown as an INVITED chip, profile-picture picker (client-side 128px
+  downscale), display name, password. Sign-in/claim endpoints sit in front of the
+  gate (rate-limited, non-enumerating); rotating the canvas password only ever
+  affects guests. Primary buttons stay disabled until their mandatory fields are
+  filled, with a tooltip naming what's missing. The boards payload carries the
+  owner's display name, so a read-only refusal says who to ask. Static canvases
+  keep the single-field gate untouched.
+- **One deploy, comments live everywhere.** `marver serve` grows a collaboration API
+  (REST + SSE) when `MARVER_DATA_DIR` names a durable volume; the published canvas is
+  the comments' home. `marver dev` two-way syncs every 30s (`marver comments connect
+  <url>` once), so client feedback lands in `design/comments/<board>.jsonl` - a
+  git-tracked, append-only event log the agent reads with zero tooling. Republishing
+  never clobbers collected feedback (the store unions the bundle seed on boot).
+- **The agent works the queue.** `marver comments list --open --json` / `reply` /
+  `resolve --addressed-in <frame>` - resolving records which variant answered the
+  feedback, making the fork-don't-overwrite doctrine auditable. `marver comments
+  invite <email>` mints single-use invite links from the CLI (owner only), `revoke
+  <email>` retires an account. `instructions/iterate.md` carries the
+  comments-as-work-queue discipline; `instructions/publish.md` is the agent-facing
+  deploy runbook (boards policy, gate, volume, accounts) and AGENTS.md routes to it.
+- **Laser mode.** `L` (or the toolbar crosshair) outlines every element in every frame
+  with depth-hued borders (60° per nesting level) plus a DevTools-style hover label.
+  Zero layout shift - outlines only. Clicking an element copies its full address for
+  the agent - frame source file + CSS path (+ JSX source location when stamped).
+  Comment mode shows only the hover highlight (no full rainbow) and a chat-teardrop
+  cursor, so picking an element to comment on stays calm.
+- **Default-closed publishing.** `marver build` now requires a publish policy:
+  `design/publish.json` names each published board with `read` or `comment` rights
+  (enforced server-side, not just hidden in UI). `--boards a,b` stays as an explicit
+  override; publishing everything takes a deliberate `--all-boards`.
+
+### Changed
+
+- **`c` is comment mode now** (the Figma/Miro convention). Copy-selected-file-paths
+  moved from `c` to `y`.
+- `marver build` without a publish policy fails with instructions instead of
+  publishing everything - the privacy default flipped closed.
+
+### Security
+
+- Comment mutations are CSRF-protected (double-submit cookie + origin checks) and
+  rate-limited; session and invite tokens are stored hashed; every pushed event is
+  validated hard (author must match the session, thread ids cannot be hijacked,
+  edits are owner-only, timestamps cannot come from the future) - and accepted
+  events are never rewritten, so id-keyed sync converges byte-identically.
+- v1 trust boundary, stated plainly: frame code in your design repo runs same-origin
+  with the shell - review what you merge. Full frame sandboxing is the v1.1 follow-up
+  (SPEC-M3 §0 records the probe results and the plan).
+
+### Durability & concurrency
+
+- Comment appends and auth writes are `fsync`'d before they are acknowledged - a
+  comment or account confirmed to the client survives a crash or volume interruption,
+  not just the page cache.
+- `auth.json`'s read-modify-write is guarded by a cross-process lock (stale-stolen
+  after 10s, never deadlocks) so a deploy overlap or an accidental second instance
+  cannot resurrect a revoked account or drop an invite. The comment log needs no lock:
+  append-only + id-keyed union is conflict-free by construction (and git merges it
+  with `merge=union`). Two honest v1 limits, documented not hidden: thread ordering
+  uses client timestamps (a badly-skewed clock can mis-order a resolve/reopen race -
+  re-resolve to fix), and comment logs have no hard size ceiling (fine at the design-
+  review scale marver targets; a per-board cap is a later concern).
+
 ## 0.3.1 - 2026-08-13
 
 ### Fixed

package/README.md

@@ -19,6 +19,8 @@ Then, to your agent:
 - **Devices view**: the Devices menu (or hotkeys `1`-`5`) sizes every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
 - `data-goto="scene/frame"` on any element links frames into a walkable prototype.
 - **Content frames**: specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through *before* any pixels exist. Diagrams ship pre-themed (both modes), content frames auto-size to their content, and everything - devices, play mode, publish - works on them identically. Works in a repo with no app at all: idea first, design second.
+- **Comments**: Google-Docs-style feedback, pinned to actual elements. Press `C`, click a div inside a frame, write - the thread lives on that element, survives edits via a layered anchor (source semantics → structure → fuzzy text), and collapses to an avatar stack when the frame isn't active. Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure); `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services (set `MARVER_DATA_DIR` on a volume + `MARVER_OWNER_EMAIL` for the first account).
+- **Laser mode**: `L` outlines every element in every frame with depth-hued borders plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent. Comment mode is the calm cousin - one at a time with laser - showing only the hovered element so picking a comment target never overwhelms.
 - **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
 - Uninstall: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
 

package/dist/auth-B36fMCM3.mjs

@@ -0,0 +1,245 @@
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/server/auth.ts
+/**
+* Accounts, invites, sessions (SPEC-M3 §3) - the minimal credible implementation,
+* extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
+* opaque session tokens stored hashed, single-use invite links as the identity
+* bootstrap (no email infrastructure anywhere).
+*
+* Password = read, account = comment: everything here concerns accounts only; the
+* shared gate password (serve.ts) remains the outer READ boundary.
+*
+* State lives in MARVER_DATA_DIR as two small JSON files rewritten atomically -
+* users change rarely; the event-log treatment is reserved for comments.
+*/
+const SCRYPT = {
+	N: 2 ** 15,
+	r: 8,
+	p: 1,
+	keylen: 32,
+	maxmem: 67108864
+};
+const INVITE_TTL = 6048e5;
+const SESSION_TTL = 2592e6;
+const normEmail = (e) => e.trim().toLowerCase();
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+const token = () => randomBytes(32).toString("base64url");
+const storeFile = (dir) => join(dir, "auth.json");
+/** Only a MISSING file is an empty store. A present-but-unreadable/corrupt auth.json
+*  must fail CLOSED - treating it as empty would let the owner bootstrap re-run and
+*  a later save overwrite every account. */
+function loadStore(dir) {
+	let raw;
+	try {
+		raw = readFileSync(storeFile(dir), "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			users: [],
+			invites: [],
+			sessions: []
+		};
+		throw new Error(`auth store unreadable (${err.message}) - refusing to treat it as empty`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error("auth store is corrupt JSON - refusing to treat it as empty. Restore it or delete it deliberately.");
+	}
+	if (!Array.isArray(parsed?.users) || !Array.isArray(parsed?.invites) || !Array.isArray(parsed?.sessions)) throw new Error("auth store has an unexpected shape - refusing to load it");
+	return parsed;
+}
+/** Atomic rewrite (tmp + rename) - a crash mid-write must never lose every account.
+*  0600 throughout: the store holds emails and password verifiers. */
+function saveStore(dir, store) {
+	const file = storeFile(dir);
+	mkdirSync(dirname(file), { recursive: true });
+	const now = Date.now();
+	store.invites = store.invites.filter((i) => i.exp > now);
+	store.sessions = store.sessions.filter((s) => s.exp > now);
+	const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+	const fd = openSync(tmp, "wx", 384);
+	try {
+		writeSync(fd, JSON.stringify(store, null, 2));
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	renameSync(tmp, file);
+}
+/** Cross-process mutex over auth.json's read-modify-write. Within one Node process
+*  the store mutations are already synchronous and atomic; this covers deploy overlap
+*  and any accidental multi-instance run (the supported setup is single-instance) -
+*  without it, a sign-in that loaded a pre-revoke snapshot could rename it back over a
+*  successful revoke. A crashed holder's lock is stolen after 10s; waiting past 5s
+*  fails loudly rather than hanging. */
+function withLock(dir, fn) {
+	mkdirSync(dir, { recursive: true });
+	const lock = join(dir, ".auth.lock");
+	const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	const deadline = Date.now() + 5e3;
+	for (;;) try {
+		closeSync(openSync(lock, "wx"));
+		break;
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		try {
+			if (Date.now() - statSync(lock).mtimeMs > 1e4) {
+				unlinkSync(lock);
+				continue;
+			}
+		} catch {
+			continue;
+		}
+		if (Date.now() > deadline) throw new Error("auth store is busy - please retry");
+		nap(25);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			unlinkSync(lock);
+		} catch {}
+	}
+}
+const findUser = (store, email) => store.users.find((u) => normEmail(u.email) === normEmail(email));
+/** Mint a single-use invite for an email (this IS the allowlist entry - inviting an
+*  address authorizes it). Re-inviting an email replaces its pending invite. The raw
+*  token is returned exactly once; only its hash is stored. */
+/** The owner's display name - public-safe (never the email). Null before claim. */
+function ownerName(dir) {
+	return loadStore(dir).users.find((u) => u.role === "owner")?.name?.trim() || null;
+}
+/** Peek at a live invite: the claim screens show WHO the invite is for. The raw
+*  token is the proof - holding it means the owner sent it to you. */
+function inviteInfo(dir, rawToken) {
+	const hash = sha256(rawToken);
+	const invite = loadStore(dir).invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+	return invite ? { email: invite.emailNorm } : null;
+}
+function createInvite(dir, email) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		if (findUser(store, email)) throw new Error(`${normEmail(email)} already has an account`);
+		const raw = token();
+		const exp = Date.now() + INVITE_TTL;
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		store.invites.push({
+			emailNorm: normEmail(email),
+			tokenHash: sha256(raw),
+			exp
+		});
+		saveStore(dir, store);
+		return {
+			token: raw,
+			exp
+		};
+	});
+}
+/** Claim an invite: burns it, creates the account, opens the first session. */
+function claimInvite(dir, rawToken, profile) {
+	if (profile.password.length < 8) throw new Error("password must be at least 8 characters");
+	if (!profile.name.trim()) throw new Error("a display name is required");
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		const invite = store.invites.find((i) => i.tokenHash === hash && i.exp > Date.now());
+		if (!invite) throw new Error("this invite link is invalid, expired, or already used");
+		store.invites = store.invites.filter((i) => i !== invite);
+		const salt = randomBytes(16).toString("hex");
+		const user = {
+			email: invite.emailNorm,
+			name: profile.name.trim(),
+			avatar: profile.avatar,
+			role: store.users.length ? "member" : "owner",
+			salt,
+			hash: scryptSync(profile.password, Buffer.from(salt, "hex"), SCRYPT.keylen, SCRYPT).toString("hex"),
+			params: SCRYPT,
+			createdAt: Date.now()
+		};
+		store.users.push(user);
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+/** Password sign-in. One generic failure - never reveal whether the email exists. */
+function signIn(dir, email, password) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = findUser(store, email);
+		const salt = user ? Buffer.from(user.salt, "hex") : randomBytes(16);
+		const params = user?.params ?? SCRYPT;
+		const got = scryptSync(password, salt, params.keylen, params);
+		const want = user ? Buffer.from(user.hash, "hex") : randomBytes(SCRYPT.keylen);
+		if (!user || got.length !== want.length || !timingSafeEqual(got, want)) return null;
+		const session = pushSession(store, user);
+		saveStore(dir, store);
+		return {
+			user,
+			session
+		};
+	});
+}
+function pushSession(store, user) {
+	const raw = token();
+	store.sessions.push({
+		tokenHash: sha256(raw),
+		emailNorm: normEmail(user.email),
+		exp: Date.now() + SESSION_TTL
+	});
+	return raw;
+}
+/** Resolve a session token to its user; null when unknown or expired. */
+function sessionUser(dir, rawToken) {
+	const store = loadStore(dir);
+	const hash = sha256(rawToken);
+	const s = store.sessions.find((s) => s.tokenHash === hash && s.exp > Date.now());
+	return s ? store.users.find((u) => normEmail(u.email) === s.emailNorm) ?? null : null;
+}
+function signOut(dir, rawToken) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		const hash = sha256(rawToken);
+		store.sessions = store.sessions.filter((s) => s.tokenHash !== hash);
+		saveStore(dir, store);
+	});
+}
+/** Update name/avatar on an existing account. */
+function updateProfile(dir, email, patch) {
+	return withLock(dir, () => {
+		const store = loadStore(dir);
+		const user = findUser(store, email);
+		if (!user) throw new Error("no such account");
+		if (patch.name?.trim()) user.name = patch.name.trim();
+		if (patch.avatar !== void 0) user.avatar = patch.avatar || void 0;
+		saveStore(dir, store);
+		return user;
+	});
+}
+/** Remove an account and all its sessions (owner action). The LAST owner cannot be
+*  removed - a store with members but no owner has no one left to administer it,
+*  and bootstrap will not re-run while any user exists. */
+function revokeUser(dir, email) {
+	withLock(dir, () => {
+		const store = loadStore(dir);
+		if (store.users.find((u) => normEmail(u.email) === normEmail(email))?.role === "owner" && !store.users.some((u) => u.role === "owner" && normEmail(u.email) !== normEmail(email))) throw new Error("cannot remove the last owner - the canvas would have no administrator left");
+		store.users = store.users.filter((u) => normEmail(u.email) !== normEmail(email));
+		store.sessions = store.sessions.filter((s) => s.emailNorm !== normEmail(email));
+		store.invites = store.invites.filter((i) => i.emailNorm !== normEmail(email));
+		saveStore(dir, store);
+	});
+}
+/** The public shape of a user - what other viewers (and events) may see. */
+const publicUser = (u) => ({
+	email: u.email,
+	name: u.name,
+	avatar: u.avatar
+});
+//#endregion
+export { claimInvite, createInvite, inviteInfo, loadStore, normEmail, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile };

package/dist/{build-Ckmyci3O.mjs → build-BrCl9hJS.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { a as loadConfig, n as scanFrames, o as detectHost } from "./manifest-DW-T52MM.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Crp4CAma.mjs";
+import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-C8FODq2S.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BtSGAm2h.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -43,6 +43,37 @@ function scanAssetRefs(src, moduleId) {
 }
 /** Same shape the client's assetUrl accepts: relative, inside design/assets/, no tricks. */
 const isLocalAssetRef = (p) => !!p && !p.includes(":") && !p.startsWith("/") && !p.startsWith("\\") && !p.split("/").some((s) => s === ".." || s === "");
+/** The publish policy (SPEC-M3 §4): design/publish.json names what ships and with what
+*  rights. Publishing is default-CLOSED - no policy and no explicit flag = no build.
+*  Returns name -> 'read' | 'comment'. Boards absent from the result do not ship. */
+function resolvePublish(root, allBoards, boardsFlag, allBoardsFlag) {
+	const known = (n) => n === "all-scenes" || !!allBoards[n];
+	if (boardsFlag !== void 0) {
+		const names = boardsFlag.split(",").map((s) => s.trim()).filter(Boolean);
+		if (!names.length) throw new Error("--boards was given but named no boards");
+		const missing = names.filter((n) => !known(n));
+		if (missing.length) throw new Error(`--boards names not found in design/boards/: ${missing.join(", ")}`);
+		return Object.fromEntries(names.map((n) => [n, "comment"]));
+	}
+	if (allBoardsFlag) return Object.fromEntries(["all-scenes", ...Object.keys(allBoards).filter((n) => n !== "all-scenes")].map((n) => [n, "comment"]));
+	const policyFile = join(root, "design", "publish.json");
+	if (!existsSync(policyFile)) throw new Error("publishing is default-closed and no publish policy exists.\n  Either declare one in design/publish.json:  { \"boards\": { \"<board>\": \"read\" | \"comment\" } }\n  or be explicit:  --boards a,b  (publish just those)  ·  --all-boards  (publish everything)");
+	let policy;
+	try {
+		policy = JSON.parse(readFileSync(policyFile, "utf8"));
+	} catch {
+		throw new Error("design/publish.json is not valid JSON");
+	}
+	const entries = Object.entries(policy?.boards ?? {});
+	if (!entries.length) throw new Error("design/publish.json has no \"boards\" entries - publishing is default-closed, name what ships");
+	const out = {};
+	for (const [n, level] of entries) {
+		if (!known(n)) throw new Error(`design/publish.json names an unknown board: ${n}`);
+		if (level !== "read" && level !== "comment") throw new Error(`design/publish.json: board "${n}" has level "${level}" - use "read" or "comment"`);
+		out[n] = level;
+	}
+	return out;
+}
 /** Read every board file; returns name -> parsed json. Bad JSON fails the build loudly. */
 function readBoards(root) {
 	const dir = join(root, "design", "boards");
@@ -104,7 +135,7 @@ export function layoutChain(fileKey) {
 }
 `;
 }
-async function buildSite(root, boardsFlag) {
+async function buildSite(root, boardsFlag, allBoardsFlag) {
 	const config = await loadConfig(root);
 	const host = detectHost(root);
 	const pkgDir = packageDir();
@@ -112,13 +143,8 @@ async function buildSite(root, boardsFlag) {
 	const outDir = join(root, "design", ".dist");
 	const manifest = scanFrames(root);
 	const allBoards = readBoards(root);
-	let publishedNames;
-	if (boardsFlag !== void 0) {
-		publishedNames = boardsFlag.split(",").map((s) => s.trim()).filter(Boolean);
-		if (!publishedNames.length) throw new Error("--boards was given but named no boards");
-		const missing = publishedNames.filter((n) => n !== "all-scenes" && !allBoards[n]);
-		if (missing.length) throw new Error(`--boards names not found in design/boards/: ${missing.join(", ")}`);
-	} else publishedNames = ["all-scenes", ...Object.keys(allBoards).filter((n) => n !== "all-scenes")];
+	const rights = resolvePublish(root, allBoards, boardsFlag, allBoardsFlag);
+	const publishedNames = Object.keys(rights);
 	const includeAll = publishedNames.includes("all-scenes");
 	const boards = {};
 	for (const n of publishedNames) if (allBoards[n]) boards[n] = allBoards[n];
@@ -138,7 +164,8 @@ async function buildSite(root, boardsFlag) {
 		},
 		boards,
 		names: publishedNames,
-		default: publishedNames[0]
+		default: publishedNames[0],
+		rights
 	};
 	const registryFile = posix(join(clientDir, "frame-host", "registry.ts"));
 	const plugins = [{
@@ -223,7 +250,9 @@ async function buildSite(root, boardsFlag) {
 	for (const f of frames.filter((x) => x.kind === "html")) {
 		const src = readFileSync(join(root, f.file), "utf8");
 		const inject = `${frameCss}\n<script type="module" src="/assets/bridge.js?html=1"><\/script>\n`;
-		const html = src.includes("</head>") ? src.replace("</head>", `${inject}</head>`) : inject + src;
+		let html = src.includes("</head>") ? src.replace("</head>", `${inject}</head>`) : inject + src;
+		const shim = `<script>(function(){var a=Element.prototype.attachShadow;if(a)Element.prototype.attachShadow=function(i){if(i&&i.mode==='closed')window.__mvClosedShadow=1;return a.call(this,i)};})();<\/script>`;
+		html = /<head[^>]*>/i.test(html) ? html.replace(/<head[^>]*>/i, (m) => m + shim) : shim + html;
 		mkdirSync(dirname(join(outDir, f.file)), { recursive: true });
 		writeFileSync(join(outDir, f.file), html);
 	}
@@ -258,6 +287,18 @@ async function buildSite(root, boardsFlag) {
 		cpSync(srcFile, dest);
 		copiedAssets++;
 	}
+	const commentsDir = join(root, "design", "comments");
+	if (existsSync(commentsDir)) {
+		let seeded = 0;
+		for (const n of publishedNames) {
+			const f = join(commentsDir, `${n}.jsonl`);
+			if (!existsSync(f)) continue;
+			mkdirSync(join(outDir, "design", "comments"), { recursive: true });
+			cpSync(f, join(outDir, "design", "comments", `${n}.jsonl`));
+			seeded++;
+		}
+		if (seeded) console.log(`  comments: ${seeded} board log${seeded === 1 ? "" : "s"} seeded`);
+	}
 	let name = basename(root);
 	try {
 		name = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).name ?? name;
@@ -282,10 +323,11 @@ async function buildSite(root, boardsFlag) {
 	writeFileSync(join(outDir, "meta.json"), JSON.stringify({
 		name,
 		branding: config.share.branding,
-		logo
+		logo,
+		rights
 	}));
 	console.log(`\n  ${NAME} build → design/.dist`);
-	console.log(`  boards: ${publishedNames.join(", ")}`);
+	console.log(`  boards: ${publishedNames.map((n) => `${n} (${rights[n]})`).join(", ")}`);
 	console.log(`  frames: ${frames.length}${includeAll ? "" : ` of ${manifest.frames.length} (build-time filter)`}`);
 	if (copiedAssets) console.log(`  assets: ${copiedAssets} referenced file${copiedAssets === 1 ? "" : "s"} from design/assets/ (unreferenced assets never ship)`);
 	if (!includeAll && existsSync(join(root, "public"))) console.log(`  note: the host public/ directory ships in full - the --boards filter covers frames, not public assets`);

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DolP_Ld4.mjs");
+	const { init } = await import("./init-DsCUmlCW.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-C2oTKuXe.mjs");
+	const { dev } = await import("./dev-DdeU-Jst.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -55,18 +55,18 @@ cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root",
 	}
 	await dev(resolve(opts.root), port);
 });
-cli.command("build", "Static export → design/.dist").option("--boards <names>", "Publish only these boards (comma-separated); the frame filter is applied at build time").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-Ckmyci3O.mjs");
+cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
+	const { buildSite } = await import("./build-BrCl9hJS.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
-		await buildSite(resolve(opts.root), boards);
+		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
 	} catch (err) {
 		console.error(`[${NAME}] build failed: ${err.message}`);
 		process.exit(1);
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-OtA9Nlow.mjs");
+	const { serve } = await import("./serve-D_KBK7Oy.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -74,6 +74,15 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	}
 	serve(resolve(opts.root), port);
 });
+cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
+	const { commentsCommand } = await import("./comments-odHzYdO3.mjs");
+	try {
+		await commentsCommand(resolve(opts.root), action, value, opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();