@marver-design/marver 0.7.0 → 0.8.1

package/dist/{dev-DaPQ9xA5.mjs → dev-BTAhTie-.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
-import { o as loadConfig, s as detectHost } from "./manifest-C8FODq2S.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-wMY9lNf3.mjs";
+import { o as loadConfig, s as detectHost } from "./manifest-B4zcDGBf.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BdQEeTLg.mjs";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createLogger, createServer, searchForWorkspaceRoot } from "vite";
@@ -141,7 +141,7 @@ async function dev(root, portFlag) {
 	const port = typeof addr === "object" && addr ? addr.port : picked.port;
 	if (picked.fellBack) console.log(`\n  port ${desiredPort} is in use - serving "${projectName}" on ${port} instead`);
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
-	const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+	const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas (design/.local/collab.json)\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -156,6 +156,31 @@ async function dev(root, portFlag) {
 	};
 	tick();
 	setInterval(tick, 3e4).unref();
+	const { workActivity, writeDevInfo, removeDevInfo } = await import("./work-CLrmY-vQ.mjs");
+	const unsubscribe = workActivity.onChange((frames) => server.ws.send("sh:jam-activity", { frames }));
+	const sweep = setInterval(() => workActivity.sweep(), 15e3);
+	sweep.unref?.();
+	writeDevInfo(root, port);
+	{
+		const close = server.close.bind(server);
+		server.close = (async () => {
+			unsubscribe();
+			clearInterval(sweep);
+			removeDevInfo(root);
+			return close();
+		});
+	}
+	if (config.jam?.agent) {
+		const { startJam } = await import("./daemon-DkyNOwIt.mjs");
+		const jam = startJam(root, config.jam, (m) => console.log(m), (board) => server.ws.send("sh:jam-comment", { board }));
+		if (jam) {
+			const close = server.close.bind(server);
+			server.close = (async () => {
+				jam.stop();
+				return close();
+			});
+		}
+	}
 	return server;
 }
 //#endregion

package/dist/events-BMtBvvgU.mjs

@@ -0,0 +1,101 @@
+//#region src/shared/events.ts
+/** Events the other side lacks, by id - the sync payload in either direction. */
+function diffEvents(mine, theirIds) {
+	const have = new Set(theirIds);
+	return mine.filter((e) => !have.has(e.id));
+}
+/** Replay a board's events into current thread state. Deterministic: replay order is
+*  (ts, id) so two stores holding the same event SET always derive the same state.
+*  TWO passes - creates first, then everything else - so a reply whose author's clock
+*  ran ahead of the creator's still lands instead of being dropped forever. */
+function replay(events) {
+	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
+	const threads = /* @__PURE__ */ new Map();
+	for (const ev of ordered) {
+		if (ev.type !== "create") continue;
+		if (!ev.commentId || threads.has(ev.commentId)) continue;
+		threads.set(ev.commentId, {
+			id: ev.commentId,
+			board: ev.board,
+			nodeKey: ev.nodeKey,
+			frame: ev.frame,
+			anchor: ev.anchor,
+			author: ev.author,
+			body: ev.body,
+			ts: ev.ts,
+			resolved: false,
+			agent: ev.agent,
+			agentMeta: ev.agentMeta,
+			replies: [],
+			reactions: {}
+		});
+	}
+	for (const ev of ordered) switch (ev.type) {
+		case "reply": {
+			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
+			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
+			t.replies.push({
+				id: ev.commentId,
+				author: ev.author,
+				body: ev.body,
+				ts: ev.ts,
+				agent: ev.agent,
+				agentMeta: ev.agentMeta
+			});
+			break;
+		}
+		case "edit": {
+			if (!ev.commentId || ev.body === void 0) break;
+			const t = threads.get(ev.commentId);
+			if (t) {
+				t.body = ev.body;
+				break;
+			}
+			for (const th of threads.values()) {
+				const r = th.replies.find((r) => r.id === ev.commentId);
+				if (r) {
+					r.body = ev.body;
+					break;
+				}
+			}
+			break;
+		}
+		case "resolve": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = true;
+				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
+			}
+			break;
+		}
+		case "reopen": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = false;
+				t.addressedIn = void 0;
+			}
+			break;
+		}
+		case "reanchor": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t && ev.anchor != null) t.anchor = ev.anchor;
+			break;
+		}
+		case "react": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			const who = ev.author?.email;
+			if (!t || !who || !ev.emoji) break;
+			const users = t.reactions[ev.emoji] ??= [];
+			const at = users.indexOf(who);
+			if (at === -1) users.push(who);
+			else {
+				users.splice(at, 1);
+				if (!users.length) delete t.reactions[ev.emoji];
+			}
+			break;
+		}
+	}
+	return [...threads.values()];
+}
+//#endregion
+export { replay as n, diffEvents as t };

package/dist/{init-DsCUmlCW.mjs → init-DWdhjJD5.mjs}

@@ -1,5 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-C8FODq2S.mjs";
+import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-B4zcDGBf.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -93,6 +93,30 @@ function init(root, opts) {
 	writeManaged("AGENTS.md", readFileSync(join(templates, `AGENTS-${opts.mode}.md`), "utf8").replaceAll("{{UI_GUIDANCE}}", uiGuidance(host, noApp(host))).replace(/\{\{NEXT_NOTES\}\}\n?/, host.router === "next" ? NEXT_NOTES : ""));
 	const agentsNow = readFileSync(join(design, "AGENTS.md"), "utf8");
 	if (!agentsNow.startsWith(MANAGED_PREFIX) && !agentsNow.startsWith(LEGACY_PREFIX) && agentsNow.includes("# Design canvas - agent contract") && !agentsNow.includes("## The method (binding)")) console.warn(`  note: design/AGENTS.md predates managed regeneration - if you never edited it, delete it and re-run init to get the current contract (incl. the design/instructions routing).`);
+	const claudeMd = join(root, "CLAUDE.md");
+	const importLine = "@design/AGENTS.md";
+	if (!existsSync(claudeMd)) {
+		writeFileSync(claudeMd, `# ${NAME}\n\nThis repo designs with ${NAME}. The agent contract for the canvas lives in design/AGENTS.md:\n\n${importLine}\n`);
+		created.push("CLAUDE.md");
+	} else {
+		const cur = readFileSync(claudeMd, "utf8");
+		if (!cur.includes(importLine)) {
+			writeFileSync(claudeMd, cur.replace(/\n*$/, "") + `\n\n${importLine}\n`);
+			created.push("CLAUDE.md (updated)");
+		}
+	}
+	const rootAgentsMd = join(root, "AGENTS.md");
+	const pointerLine = `Before any design or canvas work, read design/AGENTS.md and follow it - it is binding.`;
+	if (!existsSync(rootAgentsMd)) {
+		writeFileSync(rootAgentsMd, `# ${NAME}\n\nThis repo designs with ${NAME}. ${pointerLine}\n`);
+		created.push("AGENTS.md");
+	} else {
+		const cur = readFileSync(rootAgentsMd, "utf8");
+		if (!cur.includes("design/AGENTS.md")) {
+			writeFileSync(rootAgentsMd, cur.replace(/\n*$/, "") + `\n\n${pointerLine}\n`);
+			created.push("AGENTS.md (updated)");
+		}
+	}
 	const instrRoot = join(templates, "instructions");
 	for (const e of readdirSync(instrRoot, { withFileTypes: true })) if (e.isDirectory()) {
 		for (const f of readdirSync(join(instrRoot, e.name))) if (f.endsWith(".md")) writeManaged(`instructions/${e.name}/${f}`, readFileSync(join(instrRoot, e.name, f), "utf8"));
@@ -140,7 +164,8 @@ function init(root, opts) {
 		writeFileSync(join(design, "boards", ".gitkeep"), "");
 		created.push("design/boards/");
 	}
-	if (opts.demo && !existsSync(join(design, "scenes", "demo"))) {
+	const sceneDirs = existsSync(join(design, "scenes")) ? readdirSync(join(design, "scenes"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("_")).length : 0;
+	if (opts.demo && sceneDirs === 0 && !existsSync(join(design, "scenes", "demo"))) {
 		cpSync(join(templates, "demo"), join(design, "scenes", "demo"), { recursive: true });
 		created.push("design/scenes/demo/ (3 frames)");
 	}
@@ -162,7 +187,7 @@ function init(root, opts) {
 	console.log(`\n  commit design/ - only .local/ is ignored`);
 	console.log(`  uninstall = delete design/, remove the ${NAME} dependency${host.tsconfigSweepsDesign ? ", revert the \"design\" line in tsconfig exclude" : ""}`);
 	if (!noApp(host) && !existsSync(join(design, "DESIGN.md"))) console.log(`\n  note: design/DESIGN.md (the brand doc) does not exist yet - have your agent create it from the app's tokens (instructions/brand.md, Path A) to reach the idle state.`);
-	console.log(`\n  next: npx ${NAME} dev   (canvas on http://localhost:${DEFAULTS.port} by default)\n`);
+	console.log(`\n  next: npx ${NAME} dev   (or: npx ${NAME} canvas - same thing; canvas on http://localhost:${DEFAULTS.port} by default)\n`);
 	if (!noApp(host)) console.log(`  then, to your agent: "Read design/AGENTS.md. This is our first session - follow design/instructions/welcome.md."\n`);
 }
 const MANAGED_PREFIX = "<!-- marver:managed ";

package/dist/ledger-CbzTJrV2.mjs

@@ -0,0 +1,64 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/server/jam/ledger.ts
+/**
+* The device-bound authorization ledger - the whole trust boundary.
+*
+* When the dev POST accepts an owner-gated write, it records that event's id here. The
+* daemon's owner-trigger check is `has(root, id)`, never a synced field: sync copies
+* `origin` byte-for-byte, so a remote comment can spoof `origin:'local'` (proven RCE),
+* but it can never appear in a file that is written only on THIS machine by the gated
+* POST and never synced. Synced-in events are never in the ledger, so they never trigger.
+*
+* One `<board>\t<id>` per line, append-only, gitignored, never synced (design/.local/ is
+* watch-ignored and sync-excluded). Agent-written events are never recorded (they are
+* daemon-authored, not owner input, so they cannot self-authorize a next job).
+*
+* The key is (board, id), NOT id alone: event ids are client UUIDs that sync copies verbatim,
+* so a remote collaborator could reuse an owner's ledgered id in a NEW malicious event. Binding
+* to the board it was gate-written on defeats that - the forged copy lands on some board the
+* ledger never authorized for that id, so it never triggers.
+*/
+var ledger_exports = /* @__PURE__ */ __exportAll({
+	has: () => has,
+	record: () => record
+});
+const ledgerFile = (root) => join(root, "design", ".local", "jam-ledger");
+const line = (board, id) => `${board}\t${id}`;
+/** Was this (board, id) authorized on this device by the gated dev POST? */
+function has(root, board, id) {
+	if (!board || !id) return false;
+	const file = ledgerFile(root);
+	if (!existsSync(file)) return false;
+	const want = line(board, id);
+	for (const l of readFileSync(file, "utf8").split("\n")) if (l === want) return true;
+	return false;
+}
+/** Authorize a (board, id). fsync'd (a 200-acked, ledgered write must survive a crash) and
+*  0600 (owner-only). Idempotent enough: a duplicate line is harmless, `has` matches either. */
+function record(root, board, id) {
+	if (!board || !id) return;
+	const file = ledgerFile(root);
+	mkdirSync(dirname(file), { recursive: true });
+	const fd = openSync(file, "a", 384);
+	try {
+		writeSync(fd, line(board, id) + "\n");
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+//#endregion
+export { ledger_exports as n, has as t };

package/dist/{manifest-C8FODq2S.mjs → manifest-B4zcDGBf.mjs}

@@ -169,7 +169,8 @@ async function loadConfig(root) {
 				branding: user.share?.branding !== false,
 				name: typeof user.share?.name === "string" ? user.share.name : void 0,
 				logo: typeof user.share?.logo === "string" ? user.share.logo : void 0
-			}
+			},
+			jam: validJam(user.jam)
 		};
 	} catch (err) {
 		console.error(`[marver] design/config.ts failed to load, using defaults:\n  ${err.message}`);
@@ -183,6 +184,20 @@ function validPort(n) {
 function validZoom(n) {
 	return typeof n === "number" && Number.isFinite(n) && n >= .1 && n <= 10 ? n : null;
 }
+/** Normalize the jam block. An unknown/missing `agent` means Live Jam stays OFF (returns undefined),
+*  so a stray `jam: {}` never silently arms the daemon. Other fields fall back to lean defaults. */
+function validJam(v) {
+	if (!v || typeof v !== "object") return void 0;
+	const j = v;
+	if (j.agent !== "claude" && j.agent !== "codex") return void 0;
+	const concurrency = typeof j.concurrency === "number" && Number.isInteger(j.concurrency) && j.concurrency >= 1 && j.concurrency <= 16 ? j.concurrency : 3;
+	return {
+		agent: j.agent,
+		concurrency,
+		subagents: j.subagents !== false,
+		proactive: j.proactive === true
+	};
+}
 function validViewports(v) {
 	if (!v || typeof v !== "object") return null;
 	const out = {};
@@ -199,7 +214,7 @@ function validViewports(v) {
 //#region src/server/manifest.ts
 const FRAME_EXT = /\.(tsx|jsx|html)$/;
 const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
-/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted (spec §6). */
+/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
 function extractMeta(src) {
 	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
 	if (!m) return {};
@@ -223,7 +238,7 @@ function extractMeta(src) {
 	if (intent) out.intent = intent;
 	return out;
 }
-/** Content-frame detection (SPEC-026): LEXICAL by convention - the frame file
+/** Content-frame detection: LEXICAL by convention - the frame file
 *  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
 *  string in a UI frame can never misbadge it; barrels/re-exports are not
 *  detected - meta.intent is the taught path and always works). Returns the
@@ -343,7 +358,7 @@ function scanFrames(root) {
 		})).sort((a, b) => a.name.localeCompare(b.name))
 	};
 }
-/** Variant groups (SPEC-023 §1). A group = 2+ frames in one DIRECTORY whose basenames
+/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
 *  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
 *  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
 *  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).

package/dist/{plugin-wMY9lNf3.mjs → plugin-BdQEeTLg.mjs}

@@ -1,5 +1,6 @@
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
-import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-C8FODq2S.mjs";
+import { n as localProfile, t as isConnected } from "./profile-BkiWglVE.mjs";
+import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-B4zcDGBf.mjs";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -7,6 +8,28 @@ import { randomBytes } from "node:crypto";
 //#region src/server/api.ts
 const BOARD_NAME = /^[a-z0-9][a-z0-9-]*$/;
 const BODY_LIMIT = 1e6;
+const CSRF_MAX_AGE = 2592e3;
+/** Read one cookie value off the request. */
+function cookie(req, name) {
+	const m = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(String(req.headers.cookie ?? ""));
+	return m ? m[1] : "";
+}
+/** The owner gate. The dev server is 127.0.0.1-only, so the live threat is a
+*  cross-origin drive-by page firing a POST at localhost. Two defenses, mirroring the published
+*  side (collab.ts:206): a double-submit cookie (mv_c is JS-readable same-origin, so a cross-origin
+*  page cannot read it to echo x-mv-c), plus an Origin allowlist. Only a POST that passes this is
+*  eligible to be ledgered, so a forged @marver can never authorize the local agent. */
+function ownerGated(req) {
+	const c = cookie(req, "mv_c");
+	if (!c || req.headers["x-mv-c"] !== c) return false;
+	const origin = req.headers.origin;
+	if (origin) try {
+		if (new URL(String(origin)).host !== String(req.headers.host ?? "")) return false;
+	} catch {
+		return false;
+	}
+	return true;
+}
 function json(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("content-type", "application/json");
@@ -74,6 +97,7 @@ function apiMiddleware(root) {
 		const url = new URL(req.url ?? "/", "http://x");
 		if (!url.pathname.startsWith(`/__mv/api/`)) return next();
 		const path = url.pathname.slice(`${ROUTE}/api/`.length);
+		if (req.method === "GET" && !cookie(req, "mv_c")) res.setHeader("set-cookie", `mv_c=${randomBytes(16).toString("base64url")}; Path=/; Max-Age=${CSRF_MAX_AGE}; SameSite=Lax`);
 		try {
 			if (path === "boards" && req.method === "GET") {
 				mkdirSync(boardsDir, { recursive: true });
@@ -146,9 +170,11 @@ function apiMiddleware(root) {
 			if (path === "me" && req.method === "GET") return json(res, 200, {
 				user: localProfile(root),
 				role: "owner",
-				local: true
+				local: true,
+				connected: isConnected(root)
 			});
 			if (path === "profile" && req.method === "POST") {
+				if (!ownerGated(req)) return json(res, 403, { error: "forbidden" });
 				const raw = await readBody(req);
 				if (raw == null) return json(res, 400, { error: "body too large" });
 				let b;
@@ -159,17 +185,54 @@ function apiMiddleware(root) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
+				const { validAvatar } = await import("./collab-s3k5byM1.mjs");
+				let cur = {};
+				try {
+					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
+				} catch {}
 				const prof = {
-					...localProfile(root),
+					...cur,
 					...typeof b.name === "string" && b.name.trim() ? { name: b.name.trim() } : {},
 					...typeof b.email === "string" ? { email: b.email.trim() } : {},
-					...typeof b.avatar === "string" ? { avatar: b.avatar || void 0 } : {}
+					...b.avatar === "" ? { avatar: void 0 } : validAvatar(b.avatar) ? { avatar: b.avatar } : {}
 				};
 				atomicWrite(join(dir, "profile.json"), JSON.stringify(prof, null, 2) + "\n");
-				return json(res, 200, { user: prof });
+				return json(res, 200, { user: localProfile(root) });
+			}
+			if (path === "work") {
+				const { workActivity, readDevInfo, WORK_TTL_DEFAULT, WORK_TTL_MAX } = await import("./work-CLrmY-vQ.mjs");
+				const tokenOk = () => {
+					const t = readDevInfo(root)?.token;
+					return !!t && req.headers["x-mv-work"] === t;
+				};
+				if (req.method === "GET") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					return json(res, 200, { frames: workActivity.active() });
+				}
+				if (req.method === "POST") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					const raw = await readBody(req);
+					if (raw == null) return json(res, 400, { error: "body too large" });
+					let b;
+					try {
+						b = JSON.parse(raw);
+					} catch {
+						return json(res, 400, { error: "malformed JSON" });
+					}
+					const frames = Array.isArray(b.frames) ? b.frames.filter((f) => typeof f === "string" && f) : [];
+					const on = b.on !== false;
+					if (!on && b.all === true) {
+						workActivity.clearAll("cli");
+						return json(res, 200, { frames: workActivity.active() });
+					}
+					if (!frames.length) return json(res, 400, { error: "frames required" });
+					const ttl = Math.min(Math.max(Number(b.ttlMs) || WORK_TTL_DEFAULT, 1e4), WORK_TTL_MAX);
+					for (const f of frames) on ? workActivity.mark(f, ttl, "cli") : workActivity.clear(f, "cli");
+					return json(res, 200, { frames: workActivity.active() });
+				}
 			}
 			if (path === "boards.rights" && req.method === "GET") {
-				const { listBoards } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+				const { listBoards } = await import("./comments-BZBKhKRO.mjs");
 				return json(res, 200, {
 					local: true,
 					stored: listBoards(join(root, "design", "comments"))
@@ -177,10 +240,11 @@ function apiMiddleware(root) {
 			}
 			const cm = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
 			if (cm) {
-				const { appendEvents, readLog } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+				const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
 				const dir = join(root, "design", "comments");
 				if (req.method === "GET") return json(res, 200, { events: readLog(dir, cm[1]) });
 				if (req.method === "POST") {
+					if (!ownerGated(req)) return json(res, 403, { error: "forbidden" });
 					const raw = await readBody(req);
 					if (raw == null) return json(res, 400, { error: "body too large" });
 					let b;
@@ -191,23 +255,28 @@ function apiMiddleware(root) {
 					}
 					const incoming = Array.isArray(b.events) ? b.events : [];
 					const me = localProfile(root);
-					const stamped = incoming.map((ev) => ({
-						...ev,
-						board: ev.board ?? cm[1],
-						author: ev.author ?? ([
-							"create",
-							"reply",
-							"react",
-							"edit"
-						].includes(ev.type) ? me : void 0)
-					}));
+					const stamped = incoming.map((ev) => {
+						const { agent: _a, agentMeta: _am, origin: _o, ...clean } = ev;
+						return {
+							...clean,
+							board: clean.board ?? cm[1],
+							author: clean.author ?? ([
+								"create",
+								"reply",
+								"react",
+								"edit"
+							].includes(clean.type) ? me : void 0)
+						};
+					});
 					const fresh = appendEvents(dir, cm[1], stamped);
+					const { record } = await import("./ledger-CbzTJrV2.mjs").then((n) => n.n);
+					for (const ev of fresh) if (ev.type === "create" || ev.type === "reply") record(root, cm[1], ev.id);
 					backgroundPush(root);
 					return json(res, 200, { accepted: fresh.length });
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+				const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -228,27 +297,6 @@ function apiMiddleware(root) {
 		}
 	};
 }
-function localProfile(root) {
-	try {
-		const c = JSON.parse(readFileSync(join(root, "design", ".local", "collab.json"), "utf8"));
-		if (typeof c?.email === "string" && c.email) return {
-			email: c.email,
-			name: c.name ?? "Designer"
-		};
-	} catch {}
-	try {
-		const p = JSON.parse(readFileSync(join(root, "design", ".local", "profile.json"), "utf8"));
-		if (typeof p?.name === "string") return {
-			email: p.email ?? "",
-			name: p.name,
-			avatar: p.avatar
-		};
-	} catch {}
-	return {
-		email: "",
-		name: "Designer"
-	};
-}
 let pushTimer = null;
 /** Debounced fire-and-forget push after a local write; failures are silent - the
 *  30s sync loop is the reliability layer, this is just latency. */
@@ -257,7 +305,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-CkBk-tUk.mjs").then((n) => n.a);
+			const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -438,7 +486,7 @@ function marverPlugin(ctx) {
 					zoomSpeed: config.zoomSpeed,
 					noTheme: themeFile() == null,
 					setup: setupPending,
-					projectName: basename(root)
+					projectName: config.share.name || basename(root)
 				})}`;
 			}
 			if (id === "\0virtual:sh-data") return "export default null";

package/dist/profile-BkiWglVE.mjs

@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/server/profile.ts
+/**
+* The dev identity - ONE resolver for every server-side consumer (api, jam daemon, CLI).
+*
+* Two sources merge in design/.local/:
+*  - profile.json  {name, email?, avatar?} - set from the composer's avatar popover
+*  - collab.json   {email, name}           - the connect account, written by `comments connect`
+*
+* The connect account wins name + email (published serves validate author == session, so
+* events born here must carry an identity the remote will accept). The avatar always comes
+* from profile.json - connect doesn't carry one, and the local photo is still YOUR photo.
+*/
+const readJson = (path) => {
+	try {
+		const v = JSON.parse(readFileSync(path, "utf8"));
+		return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+	} catch {
+		return {};
+	}
+};
+const str = (v) => typeof v === "string" ? v.trim() : "";
+/** True when a connect account provides the identity - name/email are then read-only in dev. */
+function isConnected(root) {
+	return !!str(readJson(join(root, "design", ".local", "collab.json")).email);
+}
+function localProfile(root) {
+	const dir = join(root, "design", ".local");
+	const prof = readJson(join(dir, "profile.json"));
+	const collab = readJson(join(dir, "collab.json"));
+	return {
+		name: str(collab.name) || str(prof.name) || "You",
+		email: str(collab.email) || str(prof.email),
+		avatar: str(prof.avatar) || void 0
+	};
+}
+//#endregion
+export { localProfile as n, isConnected as t };

package/dist/{serve-D_KBK7Oy.mjs → serve-CZqPnj19.mjs}

@@ -3,10 +3,29 @@ import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+//#region src/shared/utm.ts
+/** Automatic attribution for the powered-by links: every canvas tags its marver.design
+*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
+*  Conventional UTM semantics (stable groupings first, the variable last):
+*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
+*    utm_medium   = the link unit ('powered-by')
+*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
+*    utm_content  = the placement ('gate' badge | 'shell' wordmark)
+*/
+function poweredByUrl(canvasName, source, content) {
+	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return `https://marver.design/?${new URLSearchParams({
+		utm_source: source,
+		utm_medium: "powered-by",
+		...slug ? { utm_campaign: slug } : {},
+		utm_content: content
+	}).toString()}`;
+}
+//#endregion
 //#region src/server/serve.ts
 /**
 * `marver serve` - a zero-dependency static server for design/.dist with an optional
-* password gate (SPEC-M2 §4b). No MARVER_PASSWORD → plain static serving. With it, the
+* password gate. No MARVER_PASSWORD → plain static serving. With it, the
 * bundle is never sent pre-auth: every unauthenticated request gets the gate page, auth
 * is a POST compare + an HMAC-signed 30-day cookie keyed off the password itself (all
 * instances agree, nothing stored server-side).
@@ -49,9 +68,9 @@ async function serve(root, portFlag) {
 	let bearerCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-CXy8gqoz.mjs");
-		const { appendEvents, readLog } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
-		const { dataDir } = await import("./comments-Ba8mU600.mjs").then((n) => n.n);
+		const { collabHandler } = await import("./collab-s3k5byM1.mjs");
+		const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
+		const { dataDir } = await import("./comments-BZBKhKRO.mjs");
 		const dir = dataDir();
 		const seedDir = join(dist, "design", "comments");
 		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {
@@ -60,7 +79,7 @@ async function serve(root, portFlag) {
 			appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
 		}
 		collab = collabHandler(dir, dist);
-		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-B36fMCM3.mjs");
+		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-KQ9Aj-nB.mjs");
 		bearerCheck = (token) => sessionUser(dir, token);
 		sessionCheck = (req) => {
 			const tok = /(?:^|;\s*)mv_s=([\w-]+)/.exec(String(req.headers.cookie ?? ""))?.[1];
@@ -128,7 +147,12 @@ async function serve(root, portFlag) {
 				if (!bearerOk && !preGate) return gate(res, meta, !!collab);
 			}
 		}
-		if (collab && url.pathname.startsWith("/__mv/api/")) {
+		if (url.pathname.startsWith("/__mv/api/")) {
+			if (!collab) {
+				res.statusCode = 404;
+				res.setHeader("content-type", "application/json");
+				return res.end("{\"error\":\"collaboration is not enabled on this canvas\"}");
+			}
 			collab(req, res, url).then((handled) => {
 				if (!handled) {
 					res.statusCode = 404;
@@ -188,7 +212,7 @@ const MARK_AT = (size) => `<svg viewBox="0 0 256 256" width="${size}" height="${
 const MARK = MARK_AT(17);
 const MARK_LG = MARK_AT(24);
 /** The gate: the canvas's own antechamber - light ground, dot grid, glass card in the
-*  shell's exact token language. Three doors, one credential each (SPEC-M3 gate v2):
+*  shell's exact token language. Three doors, one credential each:
 *  guests pay the canvas password, members sign in with their OWN password, and an
 *  invite link (#/i/<token>) opens straight into the claim. The member and claim
 *  states exist only on collaboration canvases - a static canvas keeps one field. */
@@ -423,7 +447,7 @@ ${collabOn ? `
     ` : ""}
   })()
   <\/script>
-  ${meta.branding ? `<footer><a href="https://marver.design" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
+  ${meta.branding ? `<footer><a href="${poweredByUrl(meta.name, "published-canvas", "gate")}" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
 </main></body></html>`);
 }
 const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);