@marver-design/marver 0.7.0 → 0.8.0

package/dist/{dev-DaPQ9xA5.mjs → dev-BYm9ebfN.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
-import { o as loadConfig, s as detectHost } from "./manifest-C8FODq2S.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-wMY9lNf3.mjs";
+import { o as loadConfig, s as detectHost } from "./manifest-D3eaARf4.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BVFuRfEo.mjs";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createLogger, createServer, searchForWorkspaceRoot } from "vite";
@@ -141,7 +141,7 @@ async function dev(root, portFlag) {
 	const port = typeof addr === "object" && addr ? addr.port : picked.port;
 	if (picked.fellBack) console.log(`\n  port ${desiredPort} is in use - serving "${projectName}" on ${port} instead`);
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
-	const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+	const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas (design/.local/collab.json)\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -156,6 +156,17 @@ async function dev(root, portFlag) {
 	};
 	tick();
 	setInterval(tick, 3e4).unref();
+	if (config.jam?.agent) {
+		const { startJam } = await import("./daemon-C-huGHAM.mjs");
+		const jam = startJam(root, config.jam, (m) => console.log(m), (frames) => server.ws.send("sh:jam-activity", { frames }), (board) => server.ws.send("sh:jam-comment", { board }));
+		if (jam) {
+			const close = server.close.bind(server);
+			server.close = (async () => {
+				jam.stop();
+				return close();
+			});
+		}
+	}
 	return server;
 }
 //#endregion

package/dist/events-BMtBvvgU.mjs

@@ -0,0 +1,101 @@
+//#region src/shared/events.ts
+/** Events the other side lacks, by id - the sync payload in either direction. */
+function diffEvents(mine, theirIds) {
+	const have = new Set(theirIds);
+	return mine.filter((e) => !have.has(e.id));
+}
+/** Replay a board's events into current thread state. Deterministic: replay order is
+*  (ts, id) so two stores holding the same event SET always derive the same state.
+*  TWO passes - creates first, then everything else - so a reply whose author's clock
+*  ran ahead of the creator's still lands instead of being dropped forever. */
+function replay(events) {
+	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
+	const threads = /* @__PURE__ */ new Map();
+	for (const ev of ordered) {
+		if (ev.type !== "create") continue;
+		if (!ev.commentId || threads.has(ev.commentId)) continue;
+		threads.set(ev.commentId, {
+			id: ev.commentId,
+			board: ev.board,
+			nodeKey: ev.nodeKey,
+			frame: ev.frame,
+			anchor: ev.anchor,
+			author: ev.author,
+			body: ev.body,
+			ts: ev.ts,
+			resolved: false,
+			agent: ev.agent,
+			agentMeta: ev.agentMeta,
+			replies: [],
+			reactions: {}
+		});
+	}
+	for (const ev of ordered) switch (ev.type) {
+		case "reply": {
+			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
+			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
+			t.replies.push({
+				id: ev.commentId,
+				author: ev.author,
+				body: ev.body,
+				ts: ev.ts,
+				agent: ev.agent,
+				agentMeta: ev.agentMeta
+			});
+			break;
+		}
+		case "edit": {
+			if (!ev.commentId || ev.body === void 0) break;
+			const t = threads.get(ev.commentId);
+			if (t) {
+				t.body = ev.body;
+				break;
+			}
+			for (const th of threads.values()) {
+				const r = th.replies.find((r) => r.id === ev.commentId);
+				if (r) {
+					r.body = ev.body;
+					break;
+				}
+			}
+			break;
+		}
+		case "resolve": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = true;
+				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
+			}
+			break;
+		}
+		case "reopen": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = false;
+				t.addressedIn = void 0;
+			}
+			break;
+		}
+		case "reanchor": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t && ev.anchor != null) t.anchor = ev.anchor;
+			break;
+		}
+		case "react": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			const who = ev.author?.email;
+			if (!t || !who || !ev.emoji) break;
+			const users = t.reactions[ev.emoji] ??= [];
+			const at = users.indexOf(who);
+			if (at === -1) users.push(who);
+			else {
+				users.splice(at, 1);
+				if (!users.length) delete t.reactions[ev.emoji];
+			}
+			break;
+		}
+	}
+	return [...threads.values()];
+}
+//#endregion
+export { replay as n, diffEvents as t };

package/dist/{init-DsCUmlCW.mjs → init-DrLomSWq.mjs}

@@ -1,5 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-C8FODq2S.mjs";
+import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-D3eaARf4.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -93,6 +93,18 @@ function init(root, opts) {
 	writeManaged("AGENTS.md", readFileSync(join(templates, `AGENTS-${opts.mode}.md`), "utf8").replaceAll("{{UI_GUIDANCE}}", uiGuidance(host, noApp(host))).replace(/\{\{NEXT_NOTES\}\}\n?/, host.router === "next" ? NEXT_NOTES : ""));
 	const agentsNow = readFileSync(join(design, "AGENTS.md"), "utf8");
 	if (!agentsNow.startsWith(MANAGED_PREFIX) && !agentsNow.startsWith(LEGACY_PREFIX) && agentsNow.includes("# Design canvas - agent contract") && !agentsNow.includes("## The method (binding)")) console.warn(`  note: design/AGENTS.md predates managed regeneration - if you never edited it, delete it and re-run init to get the current contract (incl. the design/instructions routing).`);
+	const claudeMd = join(root, "CLAUDE.md");
+	const importLine = "@design/AGENTS.md";
+	if (!existsSync(claudeMd)) {
+		writeFileSync(claudeMd, `# ${NAME}\n\nThis repo designs with ${NAME}. The agent contract for the canvas lives in design/AGENTS.md:\n\n${importLine}\n`);
+		created.push("CLAUDE.md");
+	} else {
+		const cur = readFileSync(claudeMd, "utf8");
+		if (!cur.includes(importLine)) {
+			writeFileSync(claudeMd, cur.replace(/\n*$/, "") + `\n\n${importLine}\n`);
+			created.push("CLAUDE.md (updated)");
+		}
+	}
 	const instrRoot = join(templates, "instructions");
 	for (const e of readdirSync(instrRoot, { withFileTypes: true })) if (e.isDirectory()) {
 		for (const f of readdirSync(join(instrRoot, e.name))) if (f.endsWith(".md")) writeManaged(`instructions/${e.name}/${f}`, readFileSync(join(instrRoot, e.name, f), "utf8"));

package/dist/ledger-wFvEIEGi.mjs

@@ -0,0 +1,64 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/server/jam/ledger.ts
+/**
+* The device-bound authorization ledger (SPEC-live-jam §1) - the whole trust boundary.
+*
+* When the dev POST accepts an owner-gated write, it records that event's id here. The
+* daemon's owner-trigger check is `has(root, id)`, never a synced field: sync copies
+* `origin` byte-for-byte, so a remote comment can spoof `origin:'local'` (proven RCE),
+* but it can never appear in a file that is written only on THIS machine by the gated
+* POST and never synced. Synced-in events are never in the ledger, so they never trigger.
+*
+* One `<board>\t<id>` per line, append-only, gitignored, never synced (design/.local/ is
+* watch-ignored and sync-excluded). Agent-written events are never recorded (they are
+* daemon-authored, not owner input, so they cannot self-authorize a next job).
+*
+* The key is (board, id), NOT id alone: event ids are client UUIDs that sync copies verbatim,
+* so a remote collaborator could reuse an owner's ledgered id in a NEW malicious event. Binding
+* to the board it was gate-written on defeats that - the forged copy lands on some board the
+* ledger never authorized for that id, so it never triggers.
+*/
+var ledger_exports = /* @__PURE__ */ __exportAll({
+	has: () => has,
+	record: () => record
+});
+const ledgerFile = (root) => join(root, "design", ".local", "jam-ledger");
+const line = (board, id) => `${board}\t${id}`;
+/** Was this (board, id) authorized on this device by the gated dev POST? */
+function has(root, board, id) {
+	if (!board || !id) return false;
+	const file = ledgerFile(root);
+	if (!existsSync(file)) return false;
+	const want = line(board, id);
+	for (const l of readFileSync(file, "utf8").split("\n")) if (l === want) return true;
+	return false;
+}
+/** Authorize a (board, id). fsync'd (a 200-acked, ledgered write must survive a crash) and
+*  0600 (owner-only). Idempotent enough: a duplicate line is harmless, `has` matches either. */
+function record(root, board, id) {
+	if (!board || !id) return;
+	const file = ledgerFile(root);
+	mkdirSync(dirname(file), { recursive: true });
+	const fd = openSync(file, "a", 384);
+	try {
+		writeSync(fd, line(board, id) + "\n");
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+//#endregion
+export { ledger_exports as n, has as t };

package/dist/{manifest-C8FODq2S.mjs → manifest-D3eaARf4.mjs}

@@ -169,7 +169,8 @@ async function loadConfig(root) {
 				branding: user.share?.branding !== false,
 				name: typeof user.share?.name === "string" ? user.share.name : void 0,
 				logo: typeof user.share?.logo === "string" ? user.share.logo : void 0
-			}
+			},
+			jam: validJam(user.jam)
 		};
 	} catch (err) {
 		console.error(`[marver] design/config.ts failed to load, using defaults:\n  ${err.message}`);
@@ -183,6 +184,20 @@ function validPort(n) {
 function validZoom(n) {
 	return typeof n === "number" && Number.isFinite(n) && n >= .1 && n <= 10 ? n : null;
 }
+/** Normalize the jam block. An unknown/missing `agent` means Live Jam stays OFF (returns undefined),
+*  so a stray `jam: {}` never silently arms the daemon. Other fields fall back to lean defaults. */
+function validJam(v) {
+	if (!v || typeof v !== "object") return void 0;
+	const j = v;
+	if (j.agent !== "claude" && j.agent !== "codex") return void 0;
+	const concurrency = typeof j.concurrency === "number" && Number.isInteger(j.concurrency) && j.concurrency >= 1 && j.concurrency <= 16 ? j.concurrency : 3;
+	return {
+		agent: j.agent,
+		concurrency,
+		subagents: j.subagents !== false,
+		proactive: j.proactive === true
+	};
+}
 function validViewports(v) {
 	if (!v || typeof v !== "object") return null;
 	const out = {};

package/dist/{plugin-wMY9lNf3.mjs → plugin-BVFuRfEo.mjs}

@@ -1,5 +1,6 @@
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-C8FODq2S.mjs";
+import { n as localProfile, t as isConnected } from "./profile-BkiWglVE.mjs";
+import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-D3eaARf4.mjs";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -7,6 +8,28 @@ import { randomBytes } from "node:crypto";
 //#region src/server/api.ts
 const BOARD_NAME = /^[a-z0-9][a-z0-9-]*$/;
 const BODY_LIMIT = 1e6;
+const CSRF_MAX_AGE = 2592e3;
+/** Read one cookie value off the request. */
+function cookie(req, name) {
+	const m = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(String(req.headers.cookie ?? ""));
+	return m ? m[1] : "";
+}
+/** The owner gate (SPEC-live-jam §1). The dev server is 127.0.0.1-only, so the live threat is a
+*  cross-origin drive-by page firing a POST at localhost. Two defenses, mirroring the published
+*  side (collab.ts:206): a double-submit cookie (mv_c is JS-readable same-origin, so a cross-origin
+*  page cannot read it to echo x-mv-c), plus an Origin allowlist. Only a POST that passes this is
+*  eligible to be ledgered, so a forged @marver can never authorize the local agent. */
+function ownerGated(req) {
+	const c = cookie(req, "mv_c");
+	if (!c || req.headers["x-mv-c"] !== c) return false;
+	const origin = req.headers.origin;
+	if (origin) try {
+		if (new URL(String(origin)).host !== String(req.headers.host ?? "")) return false;
+	} catch {
+		return false;
+	}
+	return true;
+}
 function json(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("content-type", "application/json");
@@ -74,6 +97,7 @@ function apiMiddleware(root) {
 		const url = new URL(req.url ?? "/", "http://x");
 		if (!url.pathname.startsWith(`/__mv/api/`)) return next();
 		const path = url.pathname.slice(`${ROUTE}/api/`.length);
+		if (req.method === "GET" && !cookie(req, "mv_c")) res.setHeader("set-cookie", `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${CSRF_MAX_AGE}; SameSite=Lax`);
 		try {
 			if (path === "boards" && req.method === "GET") {
 				mkdirSync(boardsDir, { recursive: true });
@@ -146,9 +170,11 @@ function apiMiddleware(root) {
 			if (path === "me" && req.method === "GET") return json(res, 200, {
 				user: localProfile(root),
 				role: "owner",
-				local: true
+				local: true,
+				connected: isConnected(root)
 			});
 			if (path === "profile" && req.method === "POST") {
+				if (!ownerGated(req)) return json(res, 403, { error: "forbidden" });
 				const raw = await readBody(req);
 				if (raw == null) return json(res, 400, { error: "body too large" });
 				let b;
@@ -159,17 +185,22 @@ function apiMiddleware(root) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
+				const { validAvatar } = await import("./collab-pLGzSvm5.mjs");
+				let cur = {};
+				try {
+					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
+				} catch {}
 				const prof = {
-					...localProfile(root),
+					...cur,
 					...typeof b.name === "string" && b.name.trim() ? { name: b.name.trim() } : {},
 					...typeof b.email === "string" ? { email: b.email.trim() } : {},
-					...typeof b.avatar === "string" ? { avatar: b.avatar || void 0 } : {}
+					...b.avatar === "" ? { avatar: void 0 } : validAvatar(b.avatar) ? { avatar: b.avatar } : {}
 				};
 				atomicWrite(join(dir, "profile.json"), JSON.stringify(prof, null, 2) + "\n");
-				return json(res, 200, { user: prof });
+				return json(res, 200, { user: localProfile(root) });
 			}
 			if (path === "boards.rights" && req.method === "GET") {
-				const { listBoards } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+				const { listBoards } = await import("./comments-DSwMhdbZ.mjs");
 				return json(res, 200, {
 					local: true,
 					stored: listBoards(join(root, "design", "comments"))
@@ -177,10 +208,11 @@ function apiMiddleware(root) {
 			}
 			const cm = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
 			if (cm) {
-				const { appendEvents, readLog } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+				const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
 				const dir = join(root, "design", "comments");
 				if (req.method === "GET") return json(res, 200, { events: readLog(dir, cm[1]) });
 				if (req.method === "POST") {
+					if (!ownerGated(req)) return json(res, 403, { error: "forbidden" });
 					const raw = await readBody(req);
 					if (raw == null) return json(res, 400, { error: "body too large" });
 					let b;
@@ -191,23 +223,28 @@ function apiMiddleware(root) {
 					}
 					const incoming = Array.isArray(b.events) ? b.events : [];
 					const me = localProfile(root);
-					const stamped = incoming.map((ev) => ({
-						...ev,
-						board: ev.board ?? cm[1],
-						author: ev.author ?? ([
-							"create",
-							"reply",
-							"react",
-							"edit"
-						].includes(ev.type) ? me : void 0)
-					}));
+					const stamped = incoming.map((ev) => {
+						const { agent: _a, agentMeta: _am, origin: _o, ...clean } = ev;
+						return {
+							...clean,
+							board: clean.board ?? cm[1],
+							author: clean.author ?? ([
+								"create",
+								"reply",
+								"react",
+								"edit"
+							].includes(clean.type) ? me : void 0)
+						};
+					});
 					const fresh = appendEvents(dir, cm[1], stamped);
+					const { record } = await import("./ledger-wFvEIEGi.mjs").then((n) => n.n);
+					for (const ev of fresh) if (ev.type === "create" || ev.type === "reply") record(root, cm[1], ev.id);
 					backgroundPush(root);
 					return json(res, 200, { accepted: fresh.length });
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+				const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -228,27 +265,6 @@ function apiMiddleware(root) {
 		}
 	};
 }
-function localProfile(root) {
-	try {
-		const c = JSON.parse(readFileSync(join(root, "design", ".local", "collab.json"), "utf8"));
-		if (typeof c?.email === "string" && c.email) return {
-			email: c.email,
-			name: c.name ?? "Designer"
-		};
-	} catch {}
-	try {
-		const p = JSON.parse(readFileSync(join(root, "design", ".local", "profile.json"), "utf8"));
-		if (typeof p?.name === "string") return {
-			email: p.email ?? "",
-			name: p.name,
-			avatar: p.avatar
-		};
-	} catch {}
-	return {
-		email: "",
-		name: "Designer"
-	};
-}
 let pushTimer = null;
 /** Debounced fire-and-forget push after a local write; failures are silent - the
 *  30s sync loop is the reliability layer, this is just latency. */
@@ -257,7 +273,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+			const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}

package/dist/profile-BkiWglVE.mjs

@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/server/profile.ts
+/**
+* The dev identity - ONE resolver for every server-side consumer (api, jam daemon, CLI).
+*
+* Two sources merge in design/.local/:
+*  - profile.json  {name, email?, avatar?} - set from the composer's avatar popover
+*  - collab.json   {email, name}           - the connect account, written by `comments connect`
+*
+* The connect account wins name + email (published serves validate author == session, so
+* events born here must carry an identity the remote will accept). The avatar always comes
+* from profile.json - connect doesn't carry one, and the local photo is still YOUR photo.
+*/
+const readJson = (path) => {
+	try {
+		const v = JSON.parse(readFileSync(path, "utf8"));
+		return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+	} catch {
+		return {};
+	}
+};
+const str = (v) => typeof v === "string" ? v.trim() : "";
+/** True when a connect account provides the identity - name/email are then read-only in dev. */
+function isConnected(root) {
+	return !!str(readJson(join(root, "design", ".local", "collab.json")).email);
+}
+function localProfile(root) {
+	const dir = join(root, "design", ".local");
+	const prof = readJson(join(dir, "profile.json"));
+	const collab = readJson(join(dir, "collab.json"));
+	return {
+		name: str(collab.name) || str(prof.name) || "You",
+		email: str(collab.email) || str(prof.email),
+		avatar: str(prof.avatar) || void 0
+	};
+}
+//#endregion
+export { localProfile as n, isConnected as t };

package/dist/{serve-D_KBK7Oy.mjs → serve-CwAfayJk.mjs}

@@ -49,9 +49,9 @@ async function serve(root, portFlag) {
 	let bearerCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-CXy8gqoz.mjs");
-		const { appendEvents, readLog } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
-		const { dataDir } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+		const { collabHandler } = await import("./collab-pLGzSvm5.mjs");
+		const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
+		const { dataDir } = await import("./comments-DSwMhdbZ.mjs");
 		const dir = dataDir();
 		const seedDir = join(dist, "design", "comments");
 		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {

package/dist/{sync-CkBk-tUk.mjs → sync-Ch4Bymb1.mjs}

@@ -1,98 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
+import { t as diffEvents } from "./events-BMtBvvgU.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-//#region src/shared/events.ts
-/** Events the other side lacks, by id - the sync payload in either direction. */
-function diffEvents(mine, theirIds) {
-	const have = new Set(theirIds);
-	return mine.filter((e) => !have.has(e.id));
-}
-/** Replay a board's events into current thread state. Deterministic: replay order is
-*  (ts, id) so two stores holding the same event SET always derive the same state.
-*  TWO passes - creates first, then everything else - so a reply whose author's clock
-*  ran ahead of the creator's still lands instead of being dropped forever. */
-function replay(events) {
-	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
-	const threads = /* @__PURE__ */ new Map();
-	for (const ev of ordered) {
-		if (ev.type !== "create") continue;
-		if (!ev.commentId || threads.has(ev.commentId)) continue;
-		threads.set(ev.commentId, {
-			id: ev.commentId,
-			board: ev.board,
-			nodeKey: ev.nodeKey,
-			frame: ev.frame,
-			anchor: ev.anchor,
-			author: ev.author,
-			body: ev.body,
-			ts: ev.ts,
-			resolved: false,
-			replies: [],
-			reactions: {}
-		});
-	}
-	for (const ev of ordered) switch (ev.type) {
-		case "reply": {
-			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
-			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
-			t.replies.push({
-				id: ev.commentId,
-				author: ev.author,
-				body: ev.body,
-				ts: ev.ts
-			});
-			break;
-		}
-		case "edit": {
-			if (!ev.commentId || ev.body === void 0) break;
-			const t = threads.get(ev.commentId);
-			if (t) {
-				t.body = ev.body;
-				break;
-			}
-			for (const th of threads.values()) {
-				const r = th.replies.find((r) => r.id === ev.commentId);
-				if (r) {
-					r.body = ev.body;
-					break;
-				}
-			}
-			break;
-		}
-		case "resolve": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = true;
-				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
-			}
-			break;
-		}
-		case "reopen": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = false;
-				t.addressedIn = void 0;
-			}
-			break;
-		}
-		case "react": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			const who = ev.author?.email;
-			if (!t || !who || !ev.emoji) break;
-			const users = t.reactions[ev.emoji] ??= [];
-			const at = users.indexOf(who);
-			if (at === -1) users.push(who);
-			else {
-				users.splice(at, 1);
-				if (!users.length) delete t.reactions[ev.emoji];
-			}
-			break;
-		}
-	}
-	return [...threads.values()];
-}
-//#endregion
 //#region src/server/sync.ts
 /**
 * Dev ↔ published comment sync (SPEC-M3 §2) - one merge rule, run from the dev side.
@@ -105,13 +14,6 @@ function replay(events) {
 * Credentials: design/.local/collab.json {url, token} written by `comments connect`.
 * The token is a server session held by the DEV PROCESS only - pages never see it.
 */
-var sync_exports = /* @__PURE__ */ __exportAll({
-	connect: () => connect,
-	connectClaim: () => connectClaim,
-	loadCollab: () => loadCollab,
-	saveCollab: () => saveCollab,
-	syncOnce: () => syncOnce
-});
 const collabFile = (root) => join(root, "design", ".local", "collab.json");
 function loadCollab(root) {
 	try {
@@ -148,7 +50,7 @@ async function syncOnce(root, collab) {
 		const pulled = appendEvents(dir, board, remote).length;
 		let pushed = 0;
 		if (rights[board] === "comment") {
-			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id));
+			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id)).filter((e) => !e.agent);
 			for (let i = 0; i < missing.length; i += 100) {
 				const r = await fetch(`${base}/__mv/api/comments/${board}`, {
 					method: "POST",
@@ -245,4 +147,4 @@ async function connectClaim(root, url, invite, profile, canvasPassword) {
 	});
 }
 //#endregion
-export { sync_exports as a, syncOnce as i, connectClaim as n, replay as o, loadCollab as r, connect as t };
+export { connect, connectClaim, loadCollab, syncOnce };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marver-design/marver",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components. The tool ships no AI - your coding agent is the designer.",
   "type": "module",
   "private": false,