@marver-design/marver 0.8.0 → 0.8.1

package/dist/{dev-BYm9ebfN.mjs → dev-BTAhTie-.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
-import { o as loadConfig, s as detectHost } from "./manifest-D3eaARf4.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BVFuRfEo.mjs";
+import { o as loadConfig, s as detectHost } from "./manifest-B4zcDGBf.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BdQEeTLg.mjs";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createLogger, createServer, searchForWorkspaceRoot } from "vite";
@@ -141,7 +141,7 @@ async function dev(root, portFlag) {
 	const port = typeof addr === "object" && addr ? addr.port : picked.port;
 	if (picked.fellBack) console.log(`\n  port ${desiredPort} is in use - serving "${projectName}" on ${port} instead`);
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
-	const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
+	const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas (design/.local/collab.json)\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -156,9 +156,23 @@ async function dev(root, portFlag) {
 	};
 	tick();
 	setInterval(tick, 3e4).unref();
+	const { workActivity, writeDevInfo, removeDevInfo } = await import("./work-CLrmY-vQ.mjs");
+	const unsubscribe = workActivity.onChange((frames) => server.ws.send("sh:jam-activity", { frames }));
+	const sweep = setInterval(() => workActivity.sweep(), 15e3);
+	sweep.unref?.();
+	writeDevInfo(root, port);
+	{
+		const close = server.close.bind(server);
+		server.close = (async () => {
+			unsubscribe();
+			clearInterval(sweep);
+			removeDevInfo(root);
+			return close();
+		});
+	}
 	if (config.jam?.agent) {
-		const { startJam } = await import("./daemon-C-huGHAM.mjs");
-		const jam = startJam(root, config.jam, (m) => console.log(m), (frames) => server.ws.send("sh:jam-activity", { frames }), (board) => server.ws.send("sh:jam-comment", { board }));
+		const { startJam } = await import("./daemon-DkyNOwIt.mjs");
+		const jam = startJam(root, config.jam, (m) => console.log(m), (board) => server.ws.send("sh:jam-comment", { board }));
 		if (jam) {
 			const close = server.close.bind(server);
 			server.close = (async () => {

package/dist/{init-DrLomSWq.mjs → init-DWdhjJD5.mjs}

@@ -1,5 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-D3eaARf4.mjs";
+import { a as DEFAULTS, c as readJson, i as writeManifest, r as scanFrames, s as detectHost } from "./manifest-B4zcDGBf.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -105,6 +105,18 @@ function init(root, opts) {
 			created.push("CLAUDE.md (updated)");
 		}
 	}
+	const rootAgentsMd = join(root, "AGENTS.md");
+	const pointerLine = `Before any design or canvas work, read design/AGENTS.md and follow it - it is binding.`;
+	if (!existsSync(rootAgentsMd)) {
+		writeFileSync(rootAgentsMd, `# ${NAME}\n\nThis repo designs with ${NAME}. ${pointerLine}\n`);
+		created.push("AGENTS.md");
+	} else {
+		const cur = readFileSync(rootAgentsMd, "utf8");
+		if (!cur.includes("design/AGENTS.md")) {
+			writeFileSync(rootAgentsMd, cur.replace(/\n*$/, "") + `\n\n${pointerLine}\n`);
+			created.push("AGENTS.md (updated)");
+		}
+	}
 	const instrRoot = join(templates, "instructions");
 	for (const e of readdirSync(instrRoot, { withFileTypes: true })) if (e.isDirectory()) {
 		for (const f of readdirSync(join(instrRoot, e.name))) if (f.endsWith(".md")) writeManaged(`instructions/${e.name}/${f}`, readFileSync(join(instrRoot, e.name, f), "utf8"));
@@ -152,7 +164,8 @@ function init(root, opts) {
 		writeFileSync(join(design, "boards", ".gitkeep"), "");
 		created.push("design/boards/");
 	}
-	if (opts.demo && !existsSync(join(design, "scenes", "demo"))) {
+	const sceneDirs = existsSync(join(design, "scenes")) ? readdirSync(join(design, "scenes"), { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("_")).length : 0;
+	if (opts.demo && sceneDirs === 0 && !existsSync(join(design, "scenes", "demo"))) {
 		cpSync(join(templates, "demo"), join(design, "scenes", "demo"), { recursive: true });
 		created.push("design/scenes/demo/ (3 frames)");
 	}
@@ -174,7 +187,7 @@ function init(root, opts) {
 	console.log(`\n  commit design/ - only .local/ is ignored`);
 	console.log(`  uninstall = delete design/, remove the ${NAME} dependency${host.tsconfigSweepsDesign ? ", revert the \"design\" line in tsconfig exclude" : ""}`);
 	if (!noApp(host) && !existsSync(join(design, "DESIGN.md"))) console.log(`\n  note: design/DESIGN.md (the brand doc) does not exist yet - have your agent create it from the app's tokens (instructions/brand.md, Path A) to reach the idle state.`);
-	console.log(`\n  next: npx ${NAME} dev   (canvas on http://localhost:${DEFAULTS.port} by default)\n`);
+	console.log(`\n  next: npx ${NAME} dev   (or: npx ${NAME} canvas - same thing; canvas on http://localhost:${DEFAULTS.port} by default)\n`);
 	if (!noApp(host)) console.log(`  then, to your agent: "Read design/AGENTS.md. This is our first session - follow design/instructions/welcome.md."\n`);
 }
 const MANAGED_PREFIX = "<!-- marver:managed ";

package/dist/{ledger-wFvEIEGi.mjs → ledger-CbzTJrV2.mjs}

@@ -14,7 +14,7 @@ var __exportAll = (all, no_symbols) => {
 //#endregion
 //#region src/server/jam/ledger.ts
 /**
-* The device-bound authorization ledger (SPEC-live-jam §1) - the whole trust boundary.
+* The device-bound authorization ledger - the whole trust boundary.
 *
 * When the dev POST accepts an owner-gated write, it records that event's id here. The
 * daemon's owner-trigger check is `has(root, id)`, never a synced field: sync copies

package/dist/{manifest-D3eaARf4.mjs → manifest-B4zcDGBf.mjs}

@@ -214,7 +214,7 @@ function validViewports(v) {
 //#region src/server/manifest.ts
 const FRAME_EXT = /\.(tsx|jsx|html)$/;
 const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
-/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted (spec §6). */
+/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
 function extractMeta(src) {
 	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
 	if (!m) return {};
@@ -238,7 +238,7 @@ function extractMeta(src) {
 	if (intent) out.intent = intent;
 	return out;
 }
-/** Content-frame detection (SPEC-026): LEXICAL by convention - the frame file
+/** Content-frame detection: LEXICAL by convention - the frame file
 *  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
 *  string in a UI frame can never misbadge it; barrels/re-exports are not
 *  detected - meta.intent is the taught path and always works). Returns the
@@ -358,7 +358,7 @@ function scanFrames(root) {
 		})).sort((a, b) => a.name.localeCompare(b.name))
 	};
 }
-/** Variant groups (SPEC-023 §1). A group = 2+ frames in one DIRECTORY whose basenames
+/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
 *  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
 *  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
 *  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).

package/dist/{plugin-BVFuRfEo.mjs → plugin-BdQEeTLg.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
 import { n as localProfile, t as isConnected } from "./profile-BkiWglVE.mjs";
-import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-D3eaARf4.mjs";
+import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-B4zcDGBf.mjs";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14,7 +14,7 @@ function cookie(req, name) {
 	const m = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(String(req.headers.cookie ?? ""));
 	return m ? m[1] : "";
 }
-/** The owner gate (SPEC-live-jam §1). The dev server is 127.0.0.1-only, so the live threat is a
+/** The owner gate. The dev server is 127.0.0.1-only, so the live threat is a
 *  cross-origin drive-by page firing a POST at localhost. Two defenses, mirroring the published
 *  side (collab.ts:206): a double-submit cookie (mv_c is JS-readable same-origin, so a cross-origin
 *  page cannot read it to echo x-mv-c), plus an Origin allowlist. Only a POST that passes this is
@@ -185,7 +185,7 @@ function apiMiddleware(root) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-pLGzSvm5.mjs");
+				const { validAvatar } = await import("./collab-s3k5byM1.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -199,8 +199,40 @@ function apiMiddleware(root) {
 				atomicWrite(join(dir, "profile.json"), JSON.stringify(prof, null, 2) + "\n");
 				return json(res, 200, { user: localProfile(root) });
 			}
+			if (path === "work") {
+				const { workActivity, readDevInfo, WORK_TTL_DEFAULT, WORK_TTL_MAX } = await import("./work-CLrmY-vQ.mjs");
+				const tokenOk = () => {
+					const t = readDevInfo(root)?.token;
+					return !!t && req.headers["x-mv-work"] === t;
+				};
+				if (req.method === "GET") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					return json(res, 200, { frames: workActivity.active() });
+				}
+				if (req.method === "POST") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					const raw = await readBody(req);
+					if (raw == null) return json(res, 400, { error: "body too large" });
+					let b;
+					try {
+						b = JSON.parse(raw);
+					} catch {
+						return json(res, 400, { error: "malformed JSON" });
+					}
+					const frames = Array.isArray(b.frames) ? b.frames.filter((f) => typeof f === "string" && f) : [];
+					const on = b.on !== false;
+					if (!on && b.all === true) {
+						workActivity.clearAll("cli");
+						return json(res, 200, { frames: workActivity.active() });
+					}
+					if (!frames.length) return json(res, 400, { error: "frames required" });
+					const ttl = Math.min(Math.max(Number(b.ttlMs) || WORK_TTL_DEFAULT, 1e4), WORK_TTL_MAX);
+					for (const f of frames) on ? workActivity.mark(f, ttl, "cli") : workActivity.clear(f, "cli");
+					return json(res, 200, { frames: workActivity.active() });
+				}
+			}
 			if (path === "boards.rights" && req.method === "GET") {
-				const { listBoards } = await import("./comments-DSwMhdbZ.mjs");
+				const { listBoards } = await import("./comments-BZBKhKRO.mjs");
 				return json(res, 200, {
 					local: true,
 					stored: listBoards(join(root, "design", "comments"))
@@ -208,7 +240,7 @@ function apiMiddleware(root) {
 			}
 			const cm = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
 			if (cm) {
-				const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
+				const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
 				const dir = join(root, "design", "comments");
 				if (req.method === "GET") return json(res, 200, { events: readLog(dir, cm[1]) });
 				if (req.method === "POST") {
@@ -237,14 +269,14 @@ function apiMiddleware(root) {
 						};
 					});
 					const fresh = appendEvents(dir, cm[1], stamped);
-					const { record } = await import("./ledger-wFvEIEGi.mjs").then((n) => n.n);
+					const { record } = await import("./ledger-CbzTJrV2.mjs").then((n) => n.n);
 					for (const ev of fresh) if (ev.type === "create" || ev.type === "reply") record(root, cm[1], ev.id);
 					backgroundPush(root);
 					return json(res, 200, { accepted: fresh.length });
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
+				const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -273,7 +305,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
+			const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -454,7 +486,7 @@ function marverPlugin(ctx) {
 					zoomSpeed: config.zoomSpeed,
 					noTheme: themeFile() == null,
 					setup: setupPending,
-					projectName: basename(root)
+					projectName: config.share.name || basename(root)
 				})}`;
 			}
 			if (id === "\0virtual:sh-data") return "export default null";

package/dist/{serve-CwAfayJk.mjs → serve-CZqPnj19.mjs}

@@ -3,10 +3,29 @@ import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+//#region src/shared/utm.ts
+/** Automatic attribution for the powered-by links: every canvas tags its marver.design
+*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
+*  Conventional UTM semantics (stable groupings first, the variable last):
+*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
+*    utm_medium   = the link unit ('powered-by')
+*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
+*    utm_content  = the placement ('gate' badge | 'shell' wordmark)
+*/
+function poweredByUrl(canvasName, source, content) {
+	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return `https://marver.design/?${new URLSearchParams({
+		utm_source: source,
+		utm_medium: "powered-by",
+		...slug ? { utm_campaign: slug } : {},
+		utm_content: content
+	}).toString()}`;
+}
+//#endregion
 //#region src/server/serve.ts
 /**
 * `marver serve` - a zero-dependency static server for design/.dist with an optional
-* password gate (SPEC-M2 §4b). No MARVER_PASSWORD → plain static serving. With it, the
+* password gate. No MARVER_PASSWORD → plain static serving. With it, the
 * bundle is never sent pre-auth: every unauthenticated request gets the gate page, auth
 * is a POST compare + an HMAC-signed 30-day cookie keyed off the password itself (all
 * instances agree, nothing stored server-side).
@@ -49,9 +68,9 @@ async function serve(root, portFlag) {
 	let bearerCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-pLGzSvm5.mjs");
-		const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
-		const { dataDir } = await import("./comments-DSwMhdbZ.mjs");
+		const { collabHandler } = await import("./collab-s3k5byM1.mjs");
+		const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
+		const { dataDir } = await import("./comments-BZBKhKRO.mjs");
 		const dir = dataDir();
 		const seedDir = join(dist, "design", "comments");
 		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {
@@ -60,7 +79,7 @@ async function serve(root, portFlag) {
 			appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
 		}
 		collab = collabHandler(dir, dist);
-		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-B36fMCM3.mjs");
+		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-KQ9Aj-nB.mjs");
 		bearerCheck = (token) => sessionUser(dir, token);
 		sessionCheck = (req) => {
 			const tok = /(?:^|;\s*)mv_s=([\w-]+)/.exec(String(req.headers.cookie ?? ""))?.[1];
@@ -128,7 +147,12 @@ async function serve(root, portFlag) {
 				if (!bearerOk && !preGate) return gate(res, meta, !!collab);
 			}
 		}
-		if (collab && url.pathname.startsWith("/__mv/api/")) {
+		if (url.pathname.startsWith("/__mv/api/")) {
+			if (!collab) {
+				res.statusCode = 404;
+				res.setHeader("content-type", "application/json");
+				return res.end("{\"error\":\"collaboration is not enabled on this canvas\"}");
+			}
 			collab(req, res, url).then((handled) => {
 				if (!handled) {
 					res.statusCode = 404;
@@ -188,7 +212,7 @@ const MARK_AT = (size) => `<svg viewBox="0 0 256 256" width="${size}" height="${
 const MARK = MARK_AT(17);
 const MARK_LG = MARK_AT(24);
 /** The gate: the canvas's own antechamber - light ground, dot grid, glass card in the
-*  shell's exact token language. Three doors, one credential each (SPEC-M3 gate v2):
+*  shell's exact token language. Three doors, one credential each:
 *  guests pay the canvas password, members sign in with their OWN password, and an
 *  invite link (#/i/<token>) opens straight into the claim. The member and claim
 *  states exist only on collaboration canvases - a static canvas keeps one field. */
@@ -423,7 +447,7 @@ ${collabOn ? `
     ` : ""}
   })()
   <\/script>
-  ${meta.branding ? `<footer><a href="https://marver.design" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
+  ${meta.branding ? `<footer><a href="${poweredByUrl(meta.name, "published-canvas", "gate")}" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
 </main></body></html>`);
 }
 const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);

package/dist/{sync-Ch4Bymb1.mjs → sync-BJKKmy1n.mjs}

@@ -1,10 +1,10 @@
 import { t as diffEvents } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/sync.ts
 /**
-* Dev ↔ published comment sync (SPEC-M3 §2) - one merge rule, run from the dev side.
+* Dev ↔ published comment sync - one merge rule, run from the dev side.
 *
 * The published serve is the canonical home; the repo's design/comments/ is the
 * mirror the agent reads. Each exchange is: pull remote events → union into local

package/dist/work-CLrmY-vQ.mjs

@@ -0,0 +1,97 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+//#region src/server/jam/activity.ts
+function createActivity(ttlMs = 9e4) {
+	const m = /* @__PURE__ */ new Map();
+	const cbs = [];
+	const frames = () => [...new Set([...m.keys()].map((k) => k.slice(k.indexOf("|") + 1)))];
+	const emit = () => {
+		const f = frames();
+		for (const cb of cbs) cb(f);
+	};
+	return {
+		mark(frame, ttl, src = "cli") {
+			if (!frame) return;
+			m.set(`${src}|${frame}`, Date.now() + (ttl ?? ttlMs));
+			emit();
+		},
+		clear(frame, src = "cli") {
+			if (m.delete(`${src}|${frame}`)) emit();
+		},
+		clearAll(src = "cli") {
+			let changed = false;
+			for (const k of [...m.keys()]) if (k.startsWith(`${src}|`)) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		active: frames,
+		sweep() {
+			const now = Date.now();
+			let changed = false;
+			for (const [k, until] of m) if (until <= now) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		onChange(fn) {
+			cbs.push(fn);
+			return () => {
+				const i = cbs.indexOf(fn);
+				if (i !== -1) cbs.splice(i, 1);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/server/work.ts
+/**
+* The working-state rail for CHAT-driven agents (the jam daemon has its own in-process
+* path into the same set). A coding agent that just accepted a request creates the frame
+* files first, then `npx marver work start <frame...>` - the canvas shows the live
+* working shimmer before a single component exists. `marver work done` clears it.
+*
+* Transport: the dev server writes design/.local/dev.json ({port, token}) at boot; the
+* CLI reads it to find the server and authenticate. The token makes the endpoint
+* unreachable from a drive-by browser page (which cannot read local files), while any
+* process that can read the repo - the owner's own tools - is trusted by definition.
+* Presence itself NEVER touches disk (activity.ts).
+*/
+/** One per process - the dev server, the jam daemon, and the API all share it. */
+const workActivity = createActivity();
+/** The longest a CLI mark may glow unrefreshed - a forgotten `done` self-heals. */
+const WORK_TTL_MAX = 18e5;
+const WORK_TTL_DEFAULT = 6e5;
+const infoPath = (root) => join(root, "design", ".local", "dev.json");
+/** Written once per boot (dev.ts), removed on close - the CLI's discovery + credential. */
+function writeDevInfo(root, port) {
+	const token = randomBytes(24).toString("base64url");
+	mkdirSync(join(root, "design", ".local"), { recursive: true });
+	writeFileSync(infoPath(root), JSON.stringify({
+		port,
+		token,
+		ts: Date.now()
+	}, null, 2) + "\n");
+	return token;
+}
+function removeDevInfo(root) {
+	try {
+		rmSync(infoPath(root), { force: true });
+	} catch {}
+}
+function readDevInfo(root) {
+	try {
+		const v = JSON.parse(readFileSync(infoPath(root), "utf8"));
+		return typeof v?.port === "number" && typeof v?.token === "string" ? {
+			port: v.port,
+			token: v.token
+		} : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo, removeDevInfo, workActivity, writeDevInfo };

package/dist/work-lzC-lPY0.mjs

@@ -0,0 +1,76 @@
+import { n as NAME } from "./cli.mjs";
+import { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo } from "./work-CLrmY-vQ.mjs";
+//#region src/cli/work.ts
+/**
+* `marver work` - the coding agent's hand on the canvas working state.
+*
+*   work start <scene/frame ...> [--ttl <minutes>]   mark frames actively working
+*   work done  <scene/frame ...> | --all             clear the glow
+*   work list                                        what is glowing right now
+*
+* The intended choreography (taught in design/AGENTS.md): on accepting a request,
+* create the frame FILES first (name, meta, a minimal skeleton), pin them on the
+* right board, `work start` them - the human sees the request land on the canvas
+* within seconds - build (independent frames in parallel, one subagent each), then
+* `work done`. Marks self-expire (default 10 min, max 30) so a crashed agent can
+* never leave a frame glowing forever.
+*/
+async function workCommand(root, action, frames, opts) {
+	const info = readDevInfo(root);
+	if (!info) throw new Error(`\`${NAME} dev\` is not running in this repo (design/.local/dev.json not found) - start it first.`);
+	const call = async (method, body) => {
+		let res;
+		try {
+			res = await fetch(`http://localhost:${info.port}/__mv/api/work`, {
+				method,
+				headers: {
+					"content-type": "application/json",
+					"x-mv-work": info.token
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch {
+			throw new Error(`could not reach \`${NAME} dev\` on port ${info.port} - is it still running?`);
+		}
+		const data = await res.json().catch(() => ({}));
+		if (res.status === 403) throw new Error(`the dev server refused the token - it likely restarted; try again (design/.local/dev.json is re-read each run)`);
+		if (!res.ok) throw new Error(String(data?.error ?? `work ${action} failed (${res.status})`));
+		if (!Array.isArray(data?.frames)) throw new Error(`port ${info.port} did not answer like \`${NAME} dev\` - is it still running?`);
+		return data;
+	};
+	switch (action) {
+		case "start": {
+			if (!frames.length) throw new Error("name the frames: work start <scene/frame ...>");
+			const min = Number(opts.ttl);
+			const ttlMs = Number.isFinite(min) && min > 0 ? Math.min(Math.max(min * 6e4, 1e4), WORK_TTL_MAX) : WORK_TTL_DEFAULT;
+			const { frames: active } = await call("POST", {
+				frames,
+				on: true,
+				ttlMs
+			});
+			const pretty = ttlMs >= 6e4 ? `${Math.round(ttlMs / 6e4)} min` : `${Math.round(ttlMs / 1e3)} s`;
+			console.log(`working: ${active.join(", ")}   (auto-expires in ${pretty} - re-run to extend, \`work done\` to clear)`);
+			return;
+		}
+		case "done": {
+			if (!frames.length && !opts.all) throw new Error("name the frames (or --all): work done <scene/frame ...>");
+			const { frames: active } = await call("POST", opts.all ? {
+				on: false,
+				all: true
+			} : {
+				frames,
+				on: false
+			});
+			console.log(active.length ? `still working: ${active.join(", ")}` : "nothing working - all clear");
+			return;
+		}
+		case "list": {
+			const { frames: active } = await call("GET");
+			console.log(active.length ? active.join("\n") : "nothing working");
+			return;
+		}
+		default: throw new Error(`unknown action "${action}" - use start · done · list`);
+	}
+}
+//#endregion
+export { workCommand };

package/package.json

@@ -1,10 +1,24 @@
 {
   "name": "@marver-design/marver",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components. The tool ships no AI - your coding agent is the designer.",
   "type": "module",
   "private": false,
   "license": "Apache-2.0",
+  "author": "Nic Touron (https://github.com/TNEP4)",
+  "keywords": [
+    "design",
+    "canvas",
+    "agent",
+    "prototyping",
+    "design-tool",
+    "react",
+    "vite",
+    "tailwind"
+  ],
+  "bugs": {
+    "url": "https://github.com/TNEP4/marver/issues"
+  },
   "bin": {
     "marver": "dist/cli.mjs"
   },
@@ -55,6 +69,7 @@
   "engines": {
     "node": ">=22.18.0"
   },
+  "packageManager": "pnpm@11.0.8",
   "homepage": "https://marver.design",
   "repository": {
     "type": "git",

package/src/client/const.ts

@@ -4,7 +4,7 @@ export const NAME = 'marver'
 export const PKG = '@marver-design/marver'   // registry identity; bin stays `marver`
 export const ROUTE = '/__mv'
 
-/** Content-frame natural widths (SPEC-026): Doc layout -> own-size width.
+/** Content-frame natural widths: Doc layout -> own-size width.
  *  Shared by the Doc primitive (measurement messages) and the server-side
  *  manifest scan (defaultSize for content frames) - one source, no drift. */
 export const CONTENT_WIDTH: Record<string, number> = { document: 760, wide: 1280 }

package/src/client/content/diagram.tsx

@@ -1,5 +1,5 @@
 /**
- * The Diagram block - first-class Mermaid (SPEC-026).
+ * The Diagram block - first-class Mermaid.
  * Mermaid is marver's dependency behind a dynamic import: a workspace with no
  * Diagram loads no mermaid bytes. Source-level theme overrides (%%{init}%%,
  * yaml frontmatter) are stripped so the marver palette always holds; the

package/src/client/content/index.tsx

@@ -1,8 +1,8 @@
 /**
- * Content-frame block primitives (SPEC-026): Doc, Row, Col, Space, Md, Diagram, Img.
+ * Content-frame block primitives: Doc, Row, Col, Space, Md, Diagram, Img.
  * One vocabulary at two scales: boards arrange frames in rows/columns with space
  * units; these primitives do the same for blocks INSIDE a frame - as CSS flex,
- * deliberately NOT the SPEC-024 lane grammar (shared vocabulary, not semantics).
+ * deliberately NOT the board lane-flow grammar (shared vocabulary, not semantics).
  *
  * Doc owns the measurement protocol: it reports its content height so the shell
  * can give the frame a natural size (the shell alone owns node dimensions).

package/src/client/content/md.ts

@@ -1,5 +1,5 @@
 /**
- * Markdown rendering for the Md block (SPEC-026 security section).
+ * Markdown rendering for the Md block.
  * Raw HTML is inert (escaped, never parsed). Links and images have SEPARATE
  * policies: links may be goto:/http(s)/mailto (external ones open a new tab,
  * never navigate the iframe); images are local-only - design/assets/ paths.

package/src/client/content/palette.ts

@@ -1,5 +1,5 @@
 /**
- * The marver diagram identity (SPEC-026): the full Apple system palette (HIG),
+ * The marver diagram identity: the full Apple system palette (HIG),
  * every value the HIG's own light/dark pair - never inverted. Structure comes
  * from the systemGray ramp, emphasis from blue+purple, series diversity from
  * the 12-color set.
@@ -43,7 +43,7 @@ export function themeVars(dark: boolean): Record<string, string> {
   const purple = dark ? ACCENT.purple.dark : ACCENT.purple.light
   // Nodes are ACCENTED by default - a plain flowchart only ever touches
   // primaryColor, so a gray primary meant every default diagram rendered
-  // gray-on-gray (Nic's dogfood catch, 2026-08-13). Structure (lines, clusters,
+  // gray-on-gray. Structure (lines, clusters,
   // labels) stays grayscale; the shapes carry the marver blue.
   const blueWash = dark ? '#123A5C' : '#E4F0FF'
   const purpleWash = dark ? '#3A1440' : '#F8E4FC'

package/src/client/frame-host/bridge.js

@@ -12,7 +12,7 @@ const isHtmlFrame = new URL(import.meta.url).searchParams.get('html') === '1'
 const post = (msg) => { if (window.parent !== window) window.parent.postMessage(msg, location.origin) }
 const id = new URLSearchParams(location.search).get('id') ?? location.pathname
 
-// SPEC-M5: the shell serialises this frame's DOM (same origin) for the lean facade. Open shadow roots
+// The shell serialises this frame's DOM (same origin) for the lean facade. Open shadow roots
 // are walkable, but a CLOSED root is invisible after the fact - flag it at creation so the serialiser
 // degrades the frame (keeps it live) instead of shipping a lean copy missing its shadow content.
 const _attachShadow = Element.prototype.attachShadow

package/src/client/frame-host/inspect.js

@@ -1,4 +1,4 @@
-// Shared frame-inspect controller (SPEC-M3 §5/§7 + prototype-review #4/#5).
+// Shared frame-inspect controller.
 //
 // Laser outlines, comment-pick, anchor capture/resolve, and a persistent element
 // lock ("highlight") - the review machinery shared by the canvas frame bridge

package/src/client/frame-host/serialize.ts

@@ -1,4 +1,4 @@
-// SPEC-M5 slice 1: the DOM-snapshot serializer. Turns a live, same-origin frame Document into a
+// The DOM-snapshot serializer. Turns a live, same-origin frame Document into a
 // self-contained STATIC html string: post-render DOM + full inlined CSS (styleSheets +
 // adoptedStyleSheets), JS stripped. Rendered in a `sandbox="allow-same-origin"` (NO allow-scripts)
 // iframe srcdoc, it reflows / theme-flips / device-sweeps with the browser's own layout engine and
@@ -19,7 +19,7 @@ export interface SerializeResult {
 
 const STRIP_TAGS = new Set(['SCRIPT', 'NOSCRIPT'])
 
-/** Absolutize relative url() in a sheet's cssText against that sheet's href (codex P1: consolidating
+/** Absolutize relative url() in a sheet's cssText against that sheet's href (consolidating
  *  rules into one <style> moves the url() base from each sheet to the srcdoc base). */
 function absolutizeUrls(css: string, sheetHref: string | null): string {
   if (!sheetHref) return css