@marver-design/marver 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -2,6 +2,144 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.8.1 - 2026-08-19
+
+### Added
+
+- **`marver work` - the chat agent's hand on the canvas.** The live working shimmer was
+  exclusive to Live Jam; now any coding agent can drive it: create the frame files first,
+  pin them on the board, `npx marver work start <scene/frame ...>` - the human sees the
+  request land on the canvas in seconds, before the first component exists - build
+  (independent frames in parallel, one subagent each), then `work done`. Marks are leased
+  (default 10 min, max 30) so a crashed agent can never leave a frame glowing. The dev
+  server writes `design/.local/dev.json` (port + per-boot token) as the CLI's discovery
+  and credential; presence itself never touches disk. The generated AGENTS.md teaches
+  the choreography.
+- **`marver canvas` - a second name for `marver dev`.** Both start the same full local
+  canvas (hot reload, comments, Live Jam, working state); `dev` reads naturally to
+  developers, `canvas` to everyone else. There is no reduced mode behind either name.
+- **Agents report marver bugs upstream.** The generated AGENTS.md now teaches the
+  coding agent to file issues on the marver repo when the TOOL itself misbehaves
+  (search first, `bug`/`enhancement` labels, version + expected-vs-actual + an
+  abstract reproduction) - with privacy as hard law: issues are public, so nothing
+  from the owner's repo (code, names, comment text, screenshots) may appear; failures
+  are described in neutral terms or handed to the owner instead. The owner is always
+  told what was filed. Every canvas becomes a field reporter, no user effort.
+
+### Changed
+
+- **The powered-by links carry automatic attribution.** Every canvas's marver.design link
+  now ships UTM-tagged with zero setup: `utm_source` says which surface class sent the
+  visitor (`published-canvas` / `dev-canvas`), `utm_medium=powered-by`, `utm_campaign` is
+  the canvas's own name slugged (`marver-tour`), and `utm_content` names the placement
+  (`gate` badge / `shell` wordmark).
+- **`init` wires every agent in, and showing the work comes first.** The repo-root
+  CLAUDE.md @-import has a sibling: init now also creates (or appends one pointer line
+  to) a root AGENTS.md, so Codex-style agents inherit the canvas contract too. And the
+  contract's Show-the-work section is stricter - making the request visible is the
+  agent's FIRST act: skeleton frame created, pinned, and shimmering before research,
+  reading the codebase, or planning begins.
+- **Comments are frame-scoped now, and notifications reach you anywhere.** The client holds
+  every board's comment log, not just the open board's: a thread pins to its frame wherever
+  that frame appears - the all-scenes board finally shows every conversation - and a Marver
+  reply landing on ANY board raises the notification pill no matter where you are, with View
+  navigating to the right board and opening the thread. Replies and resolves route to the
+  thread's origin log, so reading a thread from another board never forks it.
+
+### Fixed
+
+- **The jam shell ban is enforced, not just requested.** The Claude Code adapter now passes
+  `--disallowedTools Bash` alongside its tool allowlist: `--allowedTools` only pre-approves
+  tools, so a permissive inherited `settings.json` could have re-authorized shell. The
+  documented boundary (no shell for untrusted comment text) is now explicit in the spawn.
+- **The jam ack never narrates.** The agent's streamed first line posts to the thread
+  verbatim - and sometimes that line was plan narration ("I'll start by acknowledging,
+  then look at the board...") instead of a message to the owner. The packet now spells
+  out that the first text ships verbatim and must address the owner, and the daemon
+  backstops it: an unmistakable plan-narration first line is skipped and the next
+  streamed text becomes the ack - a later tight ack, never a leaked plan.
+- **`data-goto` follows a frame to its board.** Clicking a link whose target frame lives on
+  another board used to SPAWN that frame onto the current board (mutating it - and in dev,
+  saving the mutation). Navigation now follows the frame home: the canvas switches to the
+  first curated board that pins the target, focuses it, and carries interact mode across the
+  switch - links are navigation, never edits. A frame no board pins still spawns in place
+  (the original single-board prototype behavior), and play mode is unchanged.
+- **Comments no longer vanish across board switches and reloads.** Board nodes the file did not
+  key yet were minted RANDOM keys on every load - and comments anchor to node keys, so any
+  comment created on a never-saved board orphaned invisibly on the next mount (and on published
+  canvases, which can never save keys back, on every visit). Keys are now deterministic
+  (board + frame + occurrence), and a single thread-host resolver adopts threads whose stored
+  key no longer holds onto the first node still showing their frame - a comment degrades to its
+  frame, never to invisible, and never to two pins.
+- **Old comment logs keep their origin.** Events written by 0.8.0 clients carry no `board`;
+  they now get it stamped from the log they came from, so replying to an old thread can never
+  route the reply into whatever board happens to be open.
+- **Create-first frames land at their declared size.** A board node appended before the
+  manifest registered its frame file was sized by the 390x844 guess - and the guess persisted.
+  The size now corrects itself the moment the frame arrives, guessed sizes never reach the
+  file, and authored sizes on temporarily-missing frames are never touched.
+- **`marver init` no longer resurrects the demo scene.** Re-running init on a workspace with
+  real scenes used to scaffold demo/ back next to real work; the demo now only lands on a
+  first canvas.
+- **Static canvases stop knocking.** A published canvas without collaboration used to poll
+  the comments API forever (and retry an EventSource against it); the client now detects the
+  static serve once and goes quiet.
+- **No phantom comments on static canvases.** A published serve without `MARVER_DATA_DIR` used to
+  let `/__mv/api/*` requests fall through to the static handler, which answered them with
+  `index.html` HTTP 200 - the client read that as success, so a guest's comment echoed locally
+  and silently evaporated on reload. The serve now refuses the API with a 404 JSON error the
+  client surfaces as a toast.
+- **The published shell wordmark honors `share.name`.** Deploy hosts build from anonymous paths
+  (`/app`), so the sidebar read "App"; a declared `share.name` now names the shell like it
+  already named the gate.
+
+## 0.8.0 - 2026-08-19
+
+Live Jam: tag `@marver` in a canvas comment and a local coding agent picks it up, edits the real
+frame source, and replies in the thread - live. Plus a dev identity system and a full polish pass
+on the comment thread experience.
+
+### Added
+
+- **Live Jam - the agent in the thread.** A daemon inside `marver dev` watches the comment logs:
+  an owner-authored `@marver` spawns a headless agent (`jam: { agent: "claude" }` or `"codex"`)
+  that reads the whole thread, edits the real frame source, and replies live - a streamed
+  first-line ack within seconds (model provenance included), a look-around-before-asking clarify
+  ladder, replies matched to your message's energy and length, follow-ups in an engaged thread
+  triggering WITHOUT re-tagging, parallel jobs across frames, and crash-safe recovery: a batch
+  killed mid-run (even by a server restart) resumes on the next boot from a durable journal.
+  Every reply carries a provenance tooltip - dev user, harness, model.
+- **A hard trust boundary.** Only the owner's device triggers: a device-bound ledger (keyed per
+  board + comment id, never synced), a same-origin + cookie gate on every dev write (comments AND
+  profile), and a recursion guard so agent replies never re-trigger. The agent runs locked down
+  (Claude Code: no shell, Read/Edit/Write/Glob/Grep + WebSearch/WebFetch only; Codex: confined
+  to its workspace-write sandbox) - and its reply is extracted structurally
+  (the `marver-reply` block), so narration can never leak into a thread. Comment text is framed
+  as untrusted data end to end.
+- **The felt surface.** A frame being worked on wears the selection geometry in marver blue with
+  a rotating shimmer, a top-to-bottom content wave, and a parallelogram shimmer matrix on its
+  flank - phased per frame so parallel jams don't pulse in sync, held alive by a heartbeat for
+  the whole job. Replies land as minimal notification pills (frame title + preview) that stack
+  into a card deck at 3+, expand, clear, and jump you to the thread - delivered instantly over
+  the dev websocket. Marver renders as its own participant with the blue mark avatar everywhere.
+- **Dev identity + review controls.** Comments in dev render as "You" (green Y) until you set a
+  profile - hover your avatar (pen on gray), "Set up your profile": name + photo, saved to
+  `design/.local/` on your machine only; a connect account takes over name + email automatically,
+  and account-less history re-renders as the live you. New shortcuts: ⇧L toggles "laser comment"
+  (the element lighting comments paint in the artwork - anchoring stays precise with it off),
+  ⇧C hides pins, both in stateful two-row tooltips; Prototype view moved beside Hide UI.
+
+### Changed
+
+- **The thread card grew up.** World-parked beside its frame with pin-style screen-constant
+  scaling, height rules that respect the frame, content-mask scroll fades, a custom glass
+  scrollbar riding the card's far edge (action buttons never collide), and a stage-docked
+  position in Play that re-docks on device switches. The composer centers its text exactly,
+  renders `@marver` bold WITHOUT caret drift (metrics-safe text-stroke), and the send button is
+  reliably clickable.
+- Laser/comment hover lighting leaves a frame together with the pointer - no fossilized outlines
+  on frames the cursor crossed; the expanded notification list no longer clips pill shadows.
+
 ## 0.7.0 - 2026-08-17
 
 Prototype mode becomes a first-class review surface. The prototype (Play) now carries the same toolbar
@@ -131,8 +269,8 @@ snapshot that IS what you see, and the real live app takes over the moment you i
 
 - **Sidebar header** shows the humanized repo name (`marver-pilot` → "Marver Pilot", ellipsed if
   long); the logo links to marver.design.
-- **Sidebar board/scene labels** are humanized - kebab filenames render Title Case (`tms-specs` →
-  "Tms Specs"), dropping the dashes, while an explicit `meta.title` is honored verbatim.
+- **Sidebar board/scene labels** are humanized - kebab filenames render Title Case (`crm-specs` →
+  "Crm Specs"), dropping the dashes, while an explicit `meta.title` is honored verbatim.
 - **App cursor** is the marver arrowhead - tilted, rounded, small, soft-shadowed, and theme-adaptive
   (black-on-light / white-on-dark); reverts to a normal pointer in interact/prototype and keeps the
   pin/crosshair in comment/laser mode.
@@ -282,7 +420,7 @@ The co-thinking release: the canvas now holds the thinking, not just the screens
 
 ## 0.2.3 - 2026-08-12
 
-- Hardening release: codex P1s (live-JOIN adjacency, same-directory group invariant, tsx-only inference) and a P2 sweep (extractor boundaries, sceneRows dedupe, play-mode chrome fixes, extreme-zoom badge fade).
+- Hardening release: live-JOIN adjacency, same-directory group invariant, tsx-only inference, extractor boundaries, sceneRows dedupe, play-mode chrome fixes, extreme-zoom badge fade.
 
 ## 0.2.2 - 2026-08-12
 

package/README.md

@@ -1,32 +1,68 @@
 # Marver
 
-The agent-native design canvas. A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
+[![npm](https://img.shields.io/npm/v/%40marver-design%2Fmarver?color=2f6fed&label=npm)](https://www.npmjs.com/package/@marver-design/marver)
+[![license](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)
+[![node](https://img.shields.io/badge/node-%3E%3D22.18-brightgreen)](package.json)
+
+**The agent-native design canvas.** A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
+
+[marver.design](https://marver.design) · [Deploying a canvas](docs/publish.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
+
+## Quickstart
 
 ```bash
 npm i -D @marver-design/marver
 npx marver init   # scaffolds design/ (detects shadcn, Tailwind, your router)
-npx marver dev    # canvas at localhost:5199
+npx marver dev    # canvas at localhost:5199 (npx marver canvas works too - same thing)
 ```
 
 Then, to your agent:
 
 > Read design/AGENTS.md. Build an onboarding scene - welcome, form, done - mobile-first, using our components.
 
-- **Frames** are plain TSX/HTML files - zero imports from this package required.
-- **Everything hot-reloads**; frames appear on the canvas the moment the file lands.
-- Drag a frame's edge and the real breakpoints fire - each frame is a true iframe viewport.
-- **Boards**: one canvas on screen at a time. Agents write `design/boards/<name>.json` (a frame list is enough); switch boards at the top of the sidebar. `all-scenes` is auto-managed.
-- **Devices view**: the Devices menu (or hotkeys `1`-`5`) sizes every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
-- `data-goto="scene/frame"` on any element links frames into a walkable prototype.
-- **Content frames**: specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through *before* any pixels exist. Diagrams ship pre-themed (both modes), content frames auto-size to their content, and everything - devices, play mode, publish - works on them identically. Works in a repo with no app at all: idea first, design second.
-- **Comments**: Google-Docs-style feedback, pinned to actual elements. Press `C`, click a div inside a frame, write - the thread lives on that element, survives edits via a layered anchor (source semantics → structure → fuzzy text), and collapses to an avatar stack when the frame isn't active. Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure); `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services (set `MARVER_DATA_DIR` on a volume + `MARVER_OWNER_EMAIL` for the first account).
-- **Laser mode**: `L` outlines every element in every frame with depth-hued borders plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent. Comment mode is the calm cousin - one at a time with laser - showing only the hovered element so picking a comment target never overwhelms.
-- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
-- Uninstall: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
+Frames appear on the canvas the moment the files land. That's the loop.
+
+## Why marver
+
+- **Frames are real code.** Plain TSX/HTML files rendered from your repo's actual components and theme - zero imports from this package required. An approved design promotes into the app by moving a file, not by re-implementing a picture.
+- **Everything hot-reloads.** The agent writes, you watch it land - live.
+- **True viewports.** Each frame is a real iframe: drag its edge and your actual breakpoints fire.
+- **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates the `design/AGENTS.md` contract that teaches it the whole workflow.
+
+## The canvas
+
+- **Frames, scenes, boards.** Frames are screens, scenes group them (`design/scenes/<scene>/<frame>.tsx`), boards arrange them. Agents write `design/boards/<name>.json` (a frame list is enough); switch boards at the top of the sidebar. `all-scenes` is auto-managed.
+- **Devices view.** Hotkeys `1`-`5` (or the Devices menu) size every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
+- **Prototype links.** `data-goto="scene/frame"` on any element links frames into a walkable prototype - across boards, too.
+- **Play mode.** Press `p`: the board becomes a full-screen, clickable walkthrough. `data-goto` links navigate, arrow keys step between frames, `[` / `]` cycle variants, `Escape` exits. Publish it and you have a shareable prototype.
+- **Content frames.** Specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through before any pixels exist. Works in a repo with no app at all: idea first, design second.
+
+## Collaboration
+
+- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure). `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
+- **Laser mode.** Press `l`: every element in every frame gets depth-hued outlines plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent.
+- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships); `npx marver serve` hosts it with an optional password gate. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+
+## Live Jam
+
+Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Opt in with `jam: { agent: "claude" }` (or `"codex"`) in `design/config.ts`.
+
+The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (Claude Code with shell disabled entirely; Codex confined to its workspace-write sandbox), and every reply carries provenance: agent, model, dev user. Marver ships no AI; the agent that acts is the one you already run.
 
-**Next.js**: supported with one caveat - frames render in Vite, outside Next. `next/font` CSS variables are undefined inside frames (give font tokens a fallback chain), `next/image`/`next/link` should be plain `img`/`data-goto` in frames, and Server Components cannot run there. `init` writes the specifics into `design/AGENTS.md` when it detects Next.
+## Working state
 
-Implementation contracts (SPEC.md, DECISIONS.md) live in the [GitHub repo](https://github.com/TNEP4/marver).
+The same glow, driven from the terminal. When your agent takes a request, it creates the frame files first, pins them on a board, and runs `npx marver work start <scene/frame ...>` - you see the work land on the canvas in seconds, watch it shimmer while subagents build in parallel, and see it settle on `work done`. Marks self-expire, so a crashed agent never leaves a frame glowing.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `npx marver init` | Scaffold `design/` in this repo (safe to re-run; refreshes managed files) |
+| `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam (`--port`, default 5199) |
+| `npx marver build` | Static export → `design/.dist`; what ships comes from `design/publish.json` (default-closed) |
+| `npx marver serve` | Serve the export; `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
+| `npx marver comments …` | The agent's queue: `connect <url>` · `sync` · `list` · `reply` · `resolve` · `invite <email>` · `revoke <email>` |
+| `npx marver work …` | Working glow from the terminal: `start <scene/frame …>` · `done … \| --all` · `list` |
 
 ## Shortcuts
 
@@ -39,4 +75,24 @@ Implementation contracts (SPEC.md, DECISIONS.md) live in the [GitHub repo](https
 
 **Board & chrome** - `t` tidy · `d` toggle light/dark for the board · `⌘\` (ctrl+\) collapse/open sidebar.
 
-**Selection** - click selects · shift+click (canvas or sidebar) builds a multi-selection · `⌘A` selects every frame on the board · `c` copies the selected frames' file paths · double-click enters interact mode (`esc` or click outside leaves) · drag the title bar to move, edges to resize (widths snap to devices).
+**Selection** - click selects · shift+click (canvas or sidebar) builds a multi-selection · `⌘A` selects every frame on the board · `⇧P` copies the selected frames' file paths · double-click enters interact mode (`esc` or click outside leaves) · drag the title bar to move, edges to resize (widths snap to devices).
+
+**Modes** - `c` comment mode · `l` laser mode · `⇧C` hide/show comment pins · `⇧L` laser comment (spotlight a thread's element) · `p` play mode · `h` hide all chrome.
+
+## Notes
+
+- **Next.js**: supported with one caveat - frames render in Vite, outside Next. `next/font` CSS variables are undefined inside frames (give font tokens a fallback chain), `next/image`/`next/link` should be plain `img`/`data-goto` in frames, and Server Components cannot run there. `init` writes the specifics into `design/AGENTS.md` when it detects Next.
+- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
+- **Uninstall**: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
+
+## Status
+
+Marver is a young solo side project - it works, it's dogfooded daily, and it has rough edges. The known weak spot: boards with many heavy frames (animation-rich, component-dense) can strain the canvas, especially while zooming - snapshot-based rendering helps but isn't finished. If you hit a wall, an issue with your board shape and frame count genuinely helps.
+
+## Contributing
+
+Bug reports, ideas, and PRs are welcome - start with [CONTRIBUTING.md](CONTRIBUTING.md). Security reports go through [private vulnerability reporting](SECURITY.md), not public issues. Agents running marver are taught to file what they hit as issues here, too - expect some robot reporters.
+
+## License
+
+[Apache-2.0](LICENSE) · built by [Nic Touron](https://github.com/TNEP4)

package/dist/{auth-B36fMCM3.mjs → auth-KQ9Aj-nB.mjs}

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 //#region src/server/auth.ts
 /**
-* Accounts, invites, sessions (SPEC-M3 §3) - the minimal credible implementation,
+* Accounts, invites, sessions - the minimal credible implementation,
 * extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
 * opaque session tokens stored hashed, single-use invite links as the identity
 * bootstrap (no email infrastructure anywhere).

package/dist/{build-BZaPa2DS.mjs → build-BBVQRetk.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-C8FODq2S.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-wMY9lNf3.mjs";
+import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-B4zcDGBf.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BdQEeTLg.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -8,7 +8,7 @@ import { build } from "vite";
 import react from "@vitejs/plugin-react";
 //#region src/server/build.ts
 /**
-* `marver build` - the static adapter (SPEC.md §12 + SPEC-M2 §4a).
+* `marver build` - the static adapter.
 *
 * Same Vite pipeline as dev (theme wrapper, tailwind, virtuals) with three JS entries
 * (shell / frame-host / stage); the html pages are generated from the build output, so
@@ -24,7 +24,7 @@ const posix = (p) => p.split(sep).join("/");
 function packageDir() {
 	return join(dirname(fileURLToPath(import.meta.url)), "..");
 }
-/** Static asset references in one module's source (SPEC-026): <Img src="..."> string
+/** Static asset references in one module's source: <Img src="..."> string
 *  literals plus markdown image literals INSIDE TEMPLATE STRINGS (where Md content
 *  lives - prose in comments never counts). Comments are stripped first so a commented
 *  example cannot fail the build. A computed <Img src={...}> fails CLOSED - the build
@@ -43,7 +43,7 @@ function scanAssetRefs(src, moduleId) {
 }
 /** Same shape the client's assetUrl accepts: relative, inside design/assets/, no tricks. */
 const isLocalAssetRef = (p) => !!p && !p.includes(":") && !p.startsWith("/") && !p.startsWith("\\") && !p.split("/").some((s) => s === ".." || s === "");
-/** The publish policy (SPEC-M3 §4): design/publish.json names what ships and with what
+/** The publish policy: design/publish.json names what ships and with what
 *  rights. Publishing is default-CLOSED - no policy and no explicit flag = no build.
 *  Returns name -> 'read' | 'comment'. Boards absent from the result do not ship. */
 function resolvePublish(root, allBoards, boardsFlag, allBoardsFlag) {

package/dist/cli.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from "node:url";
 const NAME = "marver";
 const PKG = "@marver-design/marver";
 const ROUTE = "/__mv";
-/** Content-frame natural widths (SPEC-026): Doc layout -> own-size width.
+/** Content-frame natural widths: Doc layout -> own-size width.
 *  Shared by the Doc primitive (measurement messages) and the server-side
 *  manifest scan (defaultSize for content frames) - one source, no drift. */
 const CONTENT_WIDTH = {
@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DsCUmlCW.mjs");
+	const { init } = await import("./init-DWdhjJD5.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
-cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-DaPQ9xA5.mjs");
+for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
+	const { dev } = await import("./dev-BTAhTie-.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root",
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-BZaPa2DS.mjs");
+	const { buildSite } = await import("./build-BBVQRetk.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-D_KBK7Oy.mjs");
+	const { serve } = await import("./serve-CZqPnj19.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -75,7 +75,7 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	serve(resolve(opts.root), port);
 });
 cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-odHzYdO3.mjs");
+	const { commentsCommand } = await import("./comments-J06jqCVV.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {
@@ -83,6 +83,15 @@ cli.command("comments <action> [value]", "Comment collaboration: connect <url>
 		process.exit(1);
 	}
 });
+cli.command("work <action> [...frames]", "Working state on the canvas: start <scene/frame ...> · done <scene/frame ...> | --all · list").option("--root <dir>", "Host repo root", { default: "." }).option("--ttl <minutes>", "start: minutes before the glow self-expires (default 10, max 30)").option("--all", "done: clear every working frame").action(async (action, frames, opts) => {
+	const { workCommand } = await import("./work-lzC-lPY0.mjs");
+	try {
+		await workCommand(resolve(opts.root), action, frames ?? [], opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();

package/dist/{collab-CXy8gqoz.mjs → collab-s3k5byM1.mjs}

@@ -1,12 +1,12 @@
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
-import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-B36fMCM3.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
+import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-KQ9Aj-nB.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 //#region src/server/collab.ts
 const MONTH = 2592e3;
 const MAX_BODY = 262144;
-/** The permission seam (SPEC-M3 §3): v1 derives from publish policy + membership;
+/** The permission seam: v1 derives from publish policy + membership;
 *  a per-user ACL can replace the internals without touching a single route. */
 function can(user, rights, board, action) {
 	if (action === "read") return board in rights;
@@ -20,7 +20,8 @@ const EVENT_TYPES = /* @__PURE__ */ new Set([
 	"resolve",
 	"reopen",
 	"react",
-	"profile"
+	"profile",
+	"reanchor"
 ]);
 const ID_RE = /^[\w-]{8,64}$/;
 const MAX_BODY_TEXT = 1e4;
@@ -60,10 +61,11 @@ function validateEvents(incoming, log, u, board) {
 		if (!ev || typeof ev !== "object") return "malformed event";
 		if (typeof ev.id !== "string" || !ID_RE.test(ev.id)) return "event id must be an 8-64 char token";
 		if (!EVENT_TYPES.has(ev.type)) return `unknown event type "${ev.type}"`;
+		if (ev.agent !== void 0 || ev.agentMeta !== void 0) return "agent provenance is daemon-only";
 		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
 		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
 		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
-		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
 		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
 			if (ev.type !== "profile") return "event needs a commentId";
 		}
@@ -84,7 +86,16 @@ function validateEvents(incoming, log, u, board) {
 				break;
 			}
 			case "resolve":
-			case "reopen": if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+			case "reopen":
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+				break;
+			case "reanchor": {
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot reanchor a thread that does not exist";
+				if (ev.anchor == null) return "reanchor needs a new anchor";
+				const owner = authors.get(ev.commentId);
+				if (owner && owner !== me) return "only the thread author can reanchor";
+				break;
+			}
 		}
 	}
 	return null;
@@ -294,4 +305,4 @@ function collabHandler(dataDir, distDir) {
 	};
 }
 //#endregion
-export { collabHandler };
+export { collabHandler, validAvatar };

package/dist/{comments-Ba8mU600.mjs → comments-BZBKhKRO.mjs}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import "./events-BMtBvvgU.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, writeSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/comments.ts
 /**
-* The comment event store (SPEC-M3 §1) - an append-only JSONL log, one file per board.
+* The comment event store - an append-only JSONL log, one file per board.
 *
 * Events are immutable and identified by client-generated UUIDs; two logs merge by SET
 * UNION on id. That single rule is the entire sync protocol: idempotent, order-
@@ -11,12 +11,6 @@ import { join } from "node:path";
 * state is derived by replaying events (ordered by ts then id, last writer wins per
 * field). Files, not a database - tens to low hundreds of events per board.
 */
-var comments_exports = /* @__PURE__ */ __exportAll({
-	appendEvents: () => appendEvents,
-	dataDir: () => dataDir,
-	listBoards: () => listBoards,
-	readLog: () => readLog
-});
 const BOARD_RE = /^[a-z0-9][a-z0-9-]*$/;
 const boardFile = (dir, board) => {
 	if (!BOARD_RE.test(board)) throw new Error(`bad board name: ${board}`);
@@ -79,7 +73,7 @@ function listBoards(dir) {
 }
 /** Where serve keeps its live store: MARVER_DATA_DIR is REQUIRED when collaboration is
 *  on - failing loudly beats silently writing into an ephemeral working directory that a
-*  redeploy wipes (SPEC-M3 §2). */
+*  redeploy wipes. */
 function dataDir() {
 	const dir = process.env.MARVER_DATA_DIR;
 	if (!dir) throw new Error("collaboration needs a durable home: set MARVER_DATA_DIR to a directory on a persistent volume (comments written anywhere else would vanish on redeploy)");
@@ -87,4 +81,4 @@ function dataDir() {
 	return dir;
 }
 //#endregion
-export { readLog as i, comments_exports as n, listBoards as r, appendEvents as t };
+export { appendEvents, dataDir, listBoards, readLog };

package/dist/{comments-odHzYdO3.mjs → comments-J06jqCVV.mjs}

@@ -1,13 +1,14 @@
 import { n as NAME } from "./cli.mjs";
-import { i as syncOnce, n as connectClaim, o as replay, r as loadCollab, t as connect } from "./sync-CkBk-tUk.mjs";
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
-import { readFileSync } from "node:fs";
+import { n as replay } from "./events-BMtBvvgU.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
+import { connect, connectClaim, loadCollab, syncOnce } from "./sync-BJKKmy1n.mjs";
+import { n as localProfile } from "./profile-BkiWglVE.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
 //#region src/cli/comments.ts
 /**
-* `marver comments <action>` (SPEC-M3 §2, §9) - the collaboration CLI.
+* `marver comments <action>` - the collaboration CLI.
 *
 * connect <url>   sign in (or --invite <token> to claim) against a published canvas;
 *                 stores the device credential in design/.local/collab.json
@@ -162,18 +163,11 @@ const pushIfConnected = async (root) => {
 *  authors against the session - an authorless push would be rejected), else the
 *  local dev profile. */
 const localAuthor = (root) => {
-	const collab = loadCollab(root);
-	if (collab?.email) return {
-		email: collab.email,
-		name: collab.name
-	};
-	try {
-		const p = JSON.parse(readFileSync(join(root, "design", ".local", "profile.json"), "utf8"));
-		if (p?.email) return {
-			email: p.email,
-			name: p.name
-		};
-	} catch {}
+	const p = localProfile(root);
+	return p.email ? {
+		email: p.email,
+		name: p.name
+	} : void 0;
 };
 //#endregion
 export { commentsCommand };