@marver-design/marver 0.7.0 → 0.8.1

package/dist/{sync-CkBk-tUk.mjs → sync-BJKKmy1n.mjs}

@@ -1,101 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
+import { t as diffEvents } from "./events-BMtBvvgU.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-//#region src/shared/events.ts
-/** Events the other side lacks, by id - the sync payload in either direction. */
-function diffEvents(mine, theirIds) {
-	const have = new Set(theirIds);
-	return mine.filter((e) => !have.has(e.id));
-}
-/** Replay a board's events into current thread state. Deterministic: replay order is
-*  (ts, id) so two stores holding the same event SET always derive the same state.
-*  TWO passes - creates first, then everything else - so a reply whose author's clock
-*  ran ahead of the creator's still lands instead of being dropped forever. */
-function replay(events) {
-	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
-	const threads = /* @__PURE__ */ new Map();
-	for (const ev of ordered) {
-		if (ev.type !== "create") continue;
-		if (!ev.commentId || threads.has(ev.commentId)) continue;
-		threads.set(ev.commentId, {
-			id: ev.commentId,
-			board: ev.board,
-			nodeKey: ev.nodeKey,
-			frame: ev.frame,
-			anchor: ev.anchor,
-			author: ev.author,
-			body: ev.body,
-			ts: ev.ts,
-			resolved: false,
-			replies: [],
-			reactions: {}
-		});
-	}
-	for (const ev of ordered) switch (ev.type) {
-		case "reply": {
-			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
-			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
-			t.replies.push({
-				id: ev.commentId,
-				author: ev.author,
-				body: ev.body,
-				ts: ev.ts
-			});
-			break;
-		}
-		case "edit": {
-			if (!ev.commentId || ev.body === void 0) break;
-			const t = threads.get(ev.commentId);
-			if (t) {
-				t.body = ev.body;
-				break;
-			}
-			for (const th of threads.values()) {
-				const r = th.replies.find((r) => r.id === ev.commentId);
-				if (r) {
-					r.body = ev.body;
-					break;
-				}
-			}
-			break;
-		}
-		case "resolve": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = true;
-				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
-			}
-			break;
-		}
-		case "reopen": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			if (t) {
-				t.resolved = false;
-				t.addressedIn = void 0;
-			}
-			break;
-		}
-		case "react": {
-			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
-			const who = ev.author?.email;
-			if (!t || !who || !ev.emoji) break;
-			const users = t.reactions[ev.emoji] ??= [];
-			const at = users.indexOf(who);
-			if (at === -1) users.push(who);
-			else {
-				users.splice(at, 1);
-				if (!users.length) delete t.reactions[ev.emoji];
-			}
-			break;
-		}
-	}
-	return [...threads.values()];
-}
-//#endregion
 //#region src/server/sync.ts
 /**
-* Dev ↔ published comment sync (SPEC-M3 §2) - one merge rule, run from the dev side.
+* Dev ↔ published comment sync - one merge rule, run from the dev side.
 *
 * The published serve is the canonical home; the repo's design/comments/ is the
 * mirror the agent reads. Each exchange is: pull remote events → union into local
@@ -105,13 +14,6 @@ function replay(events) {
 * Credentials: design/.local/collab.json {url, token} written by `comments connect`.
 * The token is a server session held by the DEV PROCESS only - pages never see it.
 */
-var sync_exports = /* @__PURE__ */ __exportAll({
-	connect: () => connect,
-	connectClaim: () => connectClaim,
-	loadCollab: () => loadCollab,
-	saveCollab: () => saveCollab,
-	syncOnce: () => syncOnce
-});
 const collabFile = (root) => join(root, "design", ".local", "collab.json");
 function loadCollab(root) {
 	try {
@@ -148,7 +50,7 @@ async function syncOnce(root, collab) {
 		const pulled = appendEvents(dir, board, remote).length;
 		let pushed = 0;
 		if (rights[board] === "comment") {
-			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id));
+			const missing = diffEvents(readLog(dir, board), remote.map((e) => e.id)).filter((e) => !e.agent);
 			for (let i = 0; i < missing.length; i += 100) {
 				const r = await fetch(`${base}/__mv/api/comments/${board}`, {
 					method: "POST",
@@ -245,4 +147,4 @@ async function connectClaim(root, url, invite, profile, canvasPassword) {
 	});
 }
 //#endregion
-export { sync_exports as a, syncOnce as i, connectClaim as n, replay as o, loadCollab as r, connect as t };
+export { connect, connectClaim, loadCollab, syncOnce };

package/dist/work-CLrmY-vQ.mjs

@@ -0,0 +1,97 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+//#region src/server/jam/activity.ts
+function createActivity(ttlMs = 9e4) {
+	const m = /* @__PURE__ */ new Map();
+	const cbs = [];
+	const frames = () => [...new Set([...m.keys()].map((k) => k.slice(k.indexOf("|") + 1)))];
+	const emit = () => {
+		const f = frames();
+		for (const cb of cbs) cb(f);
+	};
+	return {
+		mark(frame, ttl, src = "cli") {
+			if (!frame) return;
+			m.set(`${src}|${frame}`, Date.now() + (ttl ?? ttlMs));
+			emit();
+		},
+		clear(frame, src = "cli") {
+			if (m.delete(`${src}|${frame}`)) emit();
+		},
+		clearAll(src = "cli") {
+			let changed = false;
+			for (const k of [...m.keys()]) if (k.startsWith(`${src}|`)) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		active: frames,
+		sweep() {
+			const now = Date.now();
+			let changed = false;
+			for (const [k, until] of m) if (until <= now) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		onChange(fn) {
+			cbs.push(fn);
+			return () => {
+				const i = cbs.indexOf(fn);
+				if (i !== -1) cbs.splice(i, 1);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/server/work.ts
+/**
+* The working-state rail for CHAT-driven agents (the jam daemon has its own in-process
+* path into the same set). A coding agent that just accepted a request creates the frame
+* files first, then `npx marver work start <frame...>` - the canvas shows the live
+* working shimmer before a single component exists. `marver work done` clears it.
+*
+* Transport: the dev server writes design/.local/dev.json ({port, token}) at boot; the
+* CLI reads it to find the server and authenticate. The token makes the endpoint
+* unreachable from a drive-by browser page (which cannot read local files), while any
+* process that can read the repo - the owner's own tools - is trusted by definition.
+* Presence itself NEVER touches disk (activity.ts).
+*/
+/** One per process - the dev server, the jam daemon, and the API all share it. */
+const workActivity = createActivity();
+/** The longest a CLI mark may glow unrefreshed - a forgotten `done` self-heals. */
+const WORK_TTL_MAX = 18e5;
+const WORK_TTL_DEFAULT = 6e5;
+const infoPath = (root) => join(root, "design", ".local", "dev.json");
+/** Written once per boot (dev.ts), removed on close - the CLI's discovery + credential. */
+function writeDevInfo(root, port) {
+	const token = randomBytes(24).toString("base64url");
+	mkdirSync(join(root, "design", ".local"), { recursive: true });
+	writeFileSync(infoPath(root), JSON.stringify({
+		port,
+		token,
+		ts: Date.now()
+	}, null, 2) + "\n");
+	return token;
+}
+function removeDevInfo(root) {
+	try {
+		rmSync(infoPath(root), { force: true });
+	} catch {}
+}
+function readDevInfo(root) {
+	try {
+		const v = JSON.parse(readFileSync(infoPath(root), "utf8"));
+		return typeof v?.port === "number" && typeof v?.token === "string" ? {
+			port: v.port,
+			token: v.token
+		} : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo, removeDevInfo, workActivity, writeDevInfo };

package/dist/work-lzC-lPY0.mjs

@@ -0,0 +1,76 @@
+import { n as NAME } from "./cli.mjs";
+import { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo } from "./work-CLrmY-vQ.mjs";
+//#region src/cli/work.ts
+/**
+* `marver work` - the coding agent's hand on the canvas working state.
+*
+*   work start <scene/frame ...> [--ttl <minutes>]   mark frames actively working
+*   work done  <scene/frame ...> | --all             clear the glow
+*   work list                                        what is glowing right now
+*
+* The intended choreography (taught in design/AGENTS.md): on accepting a request,
+* create the frame FILES first (name, meta, a minimal skeleton), pin them on the
+* right board, `work start` them - the human sees the request land on the canvas
+* within seconds - build (independent frames in parallel, one subagent each), then
+* `work done`. Marks self-expire (default 10 min, max 30) so a crashed agent can
+* never leave a frame glowing forever.
+*/
+async function workCommand(root, action, frames, opts) {
+	const info = readDevInfo(root);
+	if (!info) throw new Error(`\`${NAME} dev\` is not running in this repo (design/.local/dev.json not found) - start it first.`);
+	const call = async (method, body) => {
+		let res;
+		try {
+			res = await fetch(`http://localhost:${info.port}/__mv/api/work`, {
+				method,
+				headers: {
+					"content-type": "application/json",
+					"x-mv-work": info.token
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch {
+			throw new Error(`could not reach \`${NAME} dev\` on port ${info.port} - is it still running?`);
+		}
+		const data = await res.json().catch(() => ({}));
+		if (res.status === 403) throw new Error(`the dev server refused the token - it likely restarted; try again (design/.local/dev.json is re-read each run)`);
+		if (!res.ok) throw new Error(String(data?.error ?? `work ${action} failed (${res.status})`));
+		if (!Array.isArray(data?.frames)) throw new Error(`port ${info.port} did not answer like \`${NAME} dev\` - is it still running?`);
+		return data;
+	};
+	switch (action) {
+		case "start": {
+			if (!frames.length) throw new Error("name the frames: work start <scene/frame ...>");
+			const min = Number(opts.ttl);
+			const ttlMs = Number.isFinite(min) && min > 0 ? Math.min(Math.max(min * 6e4, 1e4), WORK_TTL_MAX) : WORK_TTL_DEFAULT;
+			const { frames: active } = await call("POST", {
+				frames,
+				on: true,
+				ttlMs
+			});
+			const pretty = ttlMs >= 6e4 ? `${Math.round(ttlMs / 6e4)} min` : `${Math.round(ttlMs / 1e3)} s`;
+			console.log(`working: ${active.join(", ")}   (auto-expires in ${pretty} - re-run to extend, \`work done\` to clear)`);
+			return;
+		}
+		case "done": {
+			if (!frames.length && !opts.all) throw new Error("name the frames (or --all): work done <scene/frame ...>");
+			const { frames: active } = await call("POST", opts.all ? {
+				on: false,
+				all: true
+			} : {
+				frames,
+				on: false
+			});
+			console.log(active.length ? `still working: ${active.join(", ")}` : "nothing working - all clear");
+			return;
+		}
+		case "list": {
+			const { frames: active } = await call("GET");
+			console.log(active.length ? active.join("\n") : "nothing working");
+			return;
+		}
+		default: throw new Error(`unknown action "${action}" - use start · done · list`);
+	}
+}
+//#endregion
+export { workCommand };

package/package.json

@@ -1,10 +1,24 @@
 {
   "name": "@marver-design/marver",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components. The tool ships no AI - your coding agent is the designer.",
   "type": "module",
   "private": false,
   "license": "Apache-2.0",
+  "author": "Nic Touron (https://github.com/TNEP4)",
+  "keywords": [
+    "design",
+    "canvas",
+    "agent",
+    "prototyping",
+    "design-tool",
+    "react",
+    "vite",
+    "tailwind"
+  ],
+  "bugs": {
+    "url": "https://github.com/TNEP4/marver/issues"
+  },
   "bin": {
     "marver": "dist/cli.mjs"
   },
@@ -55,6 +69,7 @@
   "engines": {
     "node": ">=22.18.0"
   },
+  "packageManager": "pnpm@11.0.8",
   "homepage": "https://marver.design",
   "repository": {
     "type": "git",

package/src/client/const.ts

@@ -4,7 +4,7 @@ export const NAME = 'marver'
 export const PKG = '@marver-design/marver'   // registry identity; bin stays `marver`
 export const ROUTE = '/__mv'
 
-/** Content-frame natural widths (SPEC-026): Doc layout -> own-size width.
+/** Content-frame natural widths: Doc layout -> own-size width.
  *  Shared by the Doc primitive (measurement messages) and the server-side
  *  manifest scan (defaultSize for content frames) - one source, no drift. */
 export const CONTENT_WIDTH: Record<string, number> = { document: 760, wide: 1280 }

package/src/client/content/diagram.tsx

@@ -1,5 +1,5 @@
 /**
- * The Diagram block - first-class Mermaid (SPEC-026).
+ * The Diagram block - first-class Mermaid.
  * Mermaid is marver's dependency behind a dynamic import: a workspace with no
  * Diagram loads no mermaid bytes. Source-level theme overrides (%%{init}%%,
  * yaml frontmatter) are stripped so the marver palette always holds; the

package/src/client/content/index.tsx

@@ -1,8 +1,8 @@
 /**
- * Content-frame block primitives (SPEC-026): Doc, Row, Col, Space, Md, Diagram, Img.
+ * Content-frame block primitives: Doc, Row, Col, Space, Md, Diagram, Img.
  * One vocabulary at two scales: boards arrange frames in rows/columns with space
  * units; these primitives do the same for blocks INSIDE a frame - as CSS flex,
- * deliberately NOT the SPEC-024 lane grammar (shared vocabulary, not semantics).
+ * deliberately NOT the board lane-flow grammar (shared vocabulary, not semantics).
  *
  * Doc owns the measurement protocol: it reports its content height so the shell
  * can give the frame a natural size (the shell alone owns node dimensions).

package/src/client/content/md.ts

@@ -1,5 +1,5 @@
 /**
- * Markdown rendering for the Md block (SPEC-026 security section).
+ * Markdown rendering for the Md block.
  * Raw HTML is inert (escaped, never parsed). Links and images have SEPARATE
  * policies: links may be goto:/http(s)/mailto (external ones open a new tab,
  * never navigate the iframe); images are local-only - design/assets/ paths.

package/src/client/content/palette.ts

@@ -1,5 +1,5 @@
 /**
- * The marver diagram identity (SPEC-026): the full Apple system palette (HIG),
+ * The marver diagram identity: the full Apple system palette (HIG),
  * every value the HIG's own light/dark pair - never inverted. Structure comes
  * from the systemGray ramp, emphasis from blue+purple, series diversity from
  * the 12-color set.
@@ -43,7 +43,7 @@ export function themeVars(dark: boolean): Record<string, string> {
   const purple = dark ? ACCENT.purple.dark : ACCENT.purple.light
   // Nodes are ACCENTED by default - a plain flowchart only ever touches
   // primaryColor, so a gray primary meant every default diagram rendered
-  // gray-on-gray (Nic's dogfood catch, 2026-08-13). Structure (lines, clusters,
+  // gray-on-gray. Structure (lines, clusters,
   // labels) stays grayscale; the shapes carry the marver blue.
   const blueWash = dark ? '#123A5C' : '#E4F0FF'
   const purpleWash = dark ? '#3A1440' : '#F8E4FC'

package/src/client/frame-host/bridge.js

@@ -12,7 +12,7 @@ const isHtmlFrame = new URL(import.meta.url).searchParams.get('html') === '1'
 const post = (msg) => { if (window.parent !== window) window.parent.postMessage(msg, location.origin) }
 const id = new URLSearchParams(location.search).get('id') ?? location.pathname
 
-// SPEC-M5: the shell serialises this frame's DOM (same origin) for the lean facade. Open shadow roots
+// The shell serialises this frame's DOM (same origin) for the lean facade. Open shadow roots
 // are walkable, but a CLOSED root is invisible after the fact - flag it at creation so the serialiser
 // degrades the frame (keeps it live) instead of shipping a lean copy missing its shadow content.
 const _attachShadow = Element.prototype.attachShadow

package/src/client/frame-host/inspect.js

@@ -1,4 +1,4 @@
-// Shared frame-inspect controller (SPEC-M3 §5/§7 + prototype-review #4/#5).
+// Shared frame-inspect controller.
 //
 // Laser outlines, comment-pick, anchor capture/resolve, and a persistent element
 // lock ("highlight") - the review machinery shared by the canvas frame bridge
@@ -52,6 +52,9 @@ const DEPTH_HUE = (() => {
 
 export function createInspect({ post, getId, onModeChange }) {
   let laserOn = false, pickOn = false
+  // quiet pick (⇧L laser comment off): clicks still anchor comments, but NO hover outline,
+  // label, or lock lighting inside the artwork - the shell decides, the frame obeys
+  let pickQuiet = false
   let hoverEl = null, labelEl = null
   let lockedEl = null, highlightAnchor = null   // the persistent outline (#4 lock / #5 open)
   let copiedTimer = null, copySeq = 0, copyEl = null
@@ -172,11 +175,19 @@ body [data-mv-hover] { outline: 2px solid hsl(var(--mv-hue) 95% 45%); outline-of
     label.style.top = y + 'px'
   }
 
+  // the pointer LEAVING this frame takes its hover lighting with it: each frame is its own
+  // document, so once the cursor is gone no mousemove ever fires here again - without this,
+  // the last hovered outline + label fossilize on every frame the cursor crossed.
+  // (relatedTarget null = left the window/iframe, not just moved between elements)
+  on(document, 'mouseout', (e) => { if (!e.relatedTarget) clearHover() })
+  on(window, 'blur', clearHover)
+
   // hover-follow: the label chases the cursor while a mode is on - BUT a locked
   // element (#4 composing / #5 thread open) freezes it: the lit element is the one
   // being discussed, not whatever the pointer grazes.
   on(document, 'mousemove', (e) => {
     if (!modeActive() || lockedEl) return
+    if (pickOn && pickQuiet) return   // quiet pick: no hover visuals, clicks still land
     const el = e.target instanceof Element && e.target.closest('body *:not(#mv-laser-label)')
     if (!el || el === hoverEl) { if (labelEl && hoverEl) place(labelEl, e); return }
     clearHover()
@@ -245,7 +256,8 @@ body [data-mv-hover] { outline: 2px solid hsl(var(--mv-hue) 95% 45%); outline-of
     if (pickOn) {
       // #4: lock the chosen element the instant it is picked - no round-trip flicker.
       // The shell re-confirms via sh:highlight-anchor once the draft is staged.
-      applyLock(el, hueOf(el))
+      // Quiet pick (⇧L off) anchors WITHOUT lighting the element.
+      if (!pickQuiet) applyLock(el, hueOf(el))
       clearHover()
       post({ type: 'sh:picked', id: getId(), anchor: anchorBundle(el, e) })
     } else {
@@ -299,7 +311,8 @@ body [data-mv-hover] { outline: 2px solid hsl(var(--mv-hue) 95% 45%); outline-of
     if (!m || typeof m !== 'object') return
     if (m.type === 'sh:laser') { laserOn = !!m.on; applyModes(); onModeChange?.(laserOn, pickOn) }
     else if (m.type === 'sh:pick') {
-      pickOn = !!m.on; applyModes()
+      pickOn = !!m.on; pickQuiet = !!m.quiet; applyModes()
+      if (pickQuiet) clearHover()   // a hover lit before the toggle landed must not linger
       // leaving comment mode drops a provisional self-lock the shell never confirmed;
       // a shell-owned highlight (highlightAnchor set, e.g. #5) survives
       if (!pickOn && !highlightAnchor) clearLock()

package/src/client/frame-host/serialize.ts

@@ -1,4 +1,4 @@
-// SPEC-M5 slice 1: the DOM-snapshot serializer. Turns a live, same-origin frame Document into a
+// The DOM-snapshot serializer. Turns a live, same-origin frame Document into a
 // self-contained STATIC html string: post-render DOM + full inlined CSS (styleSheets +
 // adoptedStyleSheets), JS stripped. Rendered in a `sandbox="allow-same-origin"` (NO allow-scripts)
 // iframe srcdoc, it reflows / theme-flips / device-sweeps with the browser's own layout engine and
@@ -19,7 +19,7 @@ export interface SerializeResult {
 
 const STRIP_TAGS = new Set(['SCRIPT', 'NOSCRIPT'])
 
-/** Absolutize relative url() in a sheet's cssText against that sheet's href (codex P1: consolidating
+/** Absolutize relative url() in a sheet's cssText against that sheet's href (consolidating
  *  rules into one <style> moves the url() base from each sheet to the srcdoc base). */
 function absolutizeUrls(css: string, sheetHref: string | null): string {
   if (!sheetHref) return css