@marver-design/marver 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -2,6 +2,168 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.9.0 - 2026-08-21
+
+### Added
+
+- **A Live Jam guide** (`docs/live-jam.md`), now that the feature arrives armed rather than
+  opted into: how the agent is chosen and how to correct it, every key in the config block,
+  what each of the two CLIs is allowed to do, where the trust boundary sits, and what to
+  check when a mention does nothing.
+
+### Changed
+
+- **Live Jam is on by default, at concurrency 6.** Tagging `@marver` in a comment was the
+  headline workflow and a config edit stood in front of it. Now it arms itself: the tool
+  RUNNING the process wins (its env markers are evidence, and `init` is usually run by the
+  agent), then whatever is on PATH, claude first. That last tie-break is a guess, which is
+  why the answer is made visible rather than clever - `init` prints the agent it chose and
+  writes it into `design/config.ts` in plain sight as
+  `jam: { agent: "claude", concurrency: 6 }`, and the generated instructions have the agent
+  confirm that line names the tool it actually is. One word to correct, once per repo.
+  Workspaces that predate the block need no re-init; they resolve the same way at every
+  dev boot. `jam: false` is the off switch, and `jam: "codex"` is shorthand for naming the
+  agent. Six frames at once replaces three - at three, half of a multi-frame ask sat
+  waiting on the other half while the human watched. With no agent CLI installed, jam stays
+  off and both `init` and `marver dev` say so instead of going quiet.
+- **A named agent is never quietly swapped, nor armed when it cannot run.** `jam.agent`
+  naming something marver cannot spawn turns Live Jam off with a printed reason rather than
+  detecting some other tool and answering the human's comments with it; the same applies
+  when the named CLI is not on PATH, which used to claim every mention and then fail it. A
+  `design/config.ts` that fails to parse also leaves jam off - it may have said `jam: false`,
+  and arming a process spawn against intent we cannot read is the one wrong-way error worth
+  avoiding.
+- **`jam.subagents` does something now, and Codex fans out too.** The setting existed but never
+  reached the spawned agent, which reads no config - so the parallel-frame policy is stated in
+  the job prompt, and turning it off keeps a job on a single agent. The Codex adapter had also
+  been marked as having no subagents; `codex exec` carries `collaboration.spawn_agent`, so a
+  multi-frame Codex job now fans out the way a Claude Code one does. The prompt only ever says
+  "you MAY", so an older CLI without those tools just works serially instead of failing.
+- **Worth knowing, now that it is on by default:** the two agents are locked down differently,
+  because their CLIs differ. Claude Code is spawned with shell access removed entirely
+  (`--disallowedTools Bash`); Codex runs in its own `workspace-write` sandbox, which bounds
+  what commands can *touch* but still lets the model run them. Both are confined to the
+  workspace, and every change is a diff you review.
+
+### Fixed
+
+- **A one-message agent no longer posts the raw reply fence into the thread.** Live Jam posts
+  the agent's first streamed message as an immediate ack. Codex emits a single message at the
+  very end, carrying the completion block, and a fast Claude Code run can do the same - so the
+  ack was the finished reply, fence and all, followed by a second message with the same words.
+  The early path now normalizes exactly like the final one, which also makes the existing
+  duplicate check catch it: one clean reply.
+
+- **The jam ledger and journal are bound to the machine that wrote them.** Both live in
+  `design/.local/`, which is gitignored and never synced - but gitignore is a convention,
+  not provenance: a repo can force-add its own `.local/` and hand a clone a pre-authorized
+  ledger plus a pre-baselined journal. Each line and file now carries a device stamp, so
+  jam state that arrived with a clone is read as absent. The stamp is derived from the
+  machine, not stored (marver writes nothing outside `design/`), so it stops one repo
+  published to everyone rather than someone who already knows your machine - and the larger
+  caution is unchanged either way: `marver dev` imports and executes `design/config.ts`, so
+  running a dev server in a repo you do not trust is already running its code.
+  One-time upgrade cost: an existing journal predates the stamp, so the first boot after
+  upgrading rebaselines - any `@marver` mention left unprocessed while the server was down
+  is marked seen instead of run. Re-comment to pick it up.
+
+- **Comments wear the brand blue.** Pins, thread cards, the comment-mode pick cursor and
+  the anchored-thread chrome move off systemGreen. Interact keeps purple, and green is now
+  reserved for the done state alone - in dark mode the comment and done greens had drifted
+  to the same value, so a frame carrying threads and a frame that had just landed a change
+  looked alike. A pin, a thread card and a selected frame are told apart by shape.
+
+## 0.8.1 - 2026-08-19
+
+### Added
+
+- **`marver work` - the chat agent's hand on the canvas.** The live working shimmer was
+  exclusive to Live Jam; now any coding agent can drive it: create the frame files first,
+  pin them on the board, `npx marver work start <scene/frame ...>` - the human sees the
+  request land on the canvas in seconds, before the first component exists - build
+  (independent frames in parallel, one subagent each), then `work done`. Marks are leased
+  (default 10 min, max 30) so a crashed agent can never leave a frame glowing. The dev
+  server writes `design/.local/dev.json` (port + per-boot token) as the CLI's discovery
+  and credential; presence itself never touches disk. The generated AGENTS.md teaches
+  the choreography.
+- **`marver canvas` - a second name for `marver dev`.** Both start the same full local
+  canvas (hot reload, comments, Live Jam, working state); `dev` reads naturally to
+  developers, `canvas` to everyone else. There is no reduced mode behind either name.
+- **Agents report marver bugs upstream.** The generated AGENTS.md now teaches the
+  coding agent to file issues on the marver repo when the TOOL itself misbehaves
+  (search first, `bug`/`enhancement` labels, version + expected-vs-actual + an
+  abstract reproduction) - with privacy as hard law: issues are public, so nothing
+  from the owner's repo (code, names, comment text, screenshots) may appear; failures
+  are described in neutral terms or handed to the owner instead. The owner is always
+  told what was filed. Every canvas becomes a field reporter, no user effort.
+
+### Changed
+
+- **The powered-by links carry automatic attribution.** Every canvas's marver.design link
+  now ships UTM-tagged with zero setup: `utm_source` says which surface class sent the
+  visitor (`published-canvas` / `dev-canvas`), `utm_medium=powered-by`, `utm_campaign` is
+  the canvas's own name slugged (`marver-tour`), and `utm_content` names the placement
+  (`gate` badge / `shell` wordmark).
+- **`init` wires every agent in, and showing the work comes first.** The repo-root
+  CLAUDE.md @-import has a sibling: init now also creates (or appends one pointer line
+  to) a root AGENTS.md, so Codex-style agents inherit the canvas contract too. And the
+  contract's Show-the-work section is stricter - making the request visible is the
+  agent's FIRST act: skeleton frame created, pinned, and shimmering before research,
+  reading the codebase, or planning begins.
+- **Comments are frame-scoped now, and notifications reach you anywhere.** The client holds
+  every board's comment log, not just the open board's: a thread pins to its frame wherever
+  that frame appears - the all-scenes board finally shows every conversation - and a Marver
+  reply landing on ANY board raises the notification pill no matter where you are, with View
+  navigating to the right board and opening the thread. Replies and resolves route to the
+  thread's origin log, so reading a thread from another board never forks it.
+
+### Fixed
+
+- **The jam shell ban is enforced, not just requested.** The Claude Code adapter now passes
+  `--disallowedTools Bash` alongside its tool allowlist: `--allowedTools` only pre-approves
+  tools, so a permissive inherited `settings.json` could have re-authorized shell. The
+  documented boundary (no shell for untrusted comment text) is now explicit in the spawn.
+- **The jam ack never narrates.** The agent's streamed first line posts to the thread
+  verbatim - and sometimes that line was plan narration ("I'll start by acknowledging,
+  then look at the board...") instead of a message to the owner. The packet now spells
+  out that the first text ships verbatim and must address the owner, and the daemon
+  backstops it: an unmistakable plan-narration first line is skipped and the next
+  streamed text becomes the ack - a later tight ack, never a leaked plan.
+- **`data-goto` follows a frame to its board.** Clicking a link whose target frame lives on
+  another board used to SPAWN that frame onto the current board (mutating it - and in dev,
+  saving the mutation). Navigation now follows the frame home: the canvas switches to the
+  first curated board that pins the target, focuses it, and carries interact mode across the
+  switch - links are navigation, never edits. A frame no board pins still spawns in place
+  (the original single-board prototype behavior), and play mode is unchanged.
+- **Comments no longer vanish across board switches and reloads.** Board nodes the file did not
+  key yet were minted RANDOM keys on every load - and comments anchor to node keys, so any
+  comment created on a never-saved board orphaned invisibly on the next mount (and on published
+  canvases, which can never save keys back, on every visit). Keys are now deterministic
+  (board + frame + occurrence), and a single thread-host resolver adopts threads whose stored
+  key no longer holds onto the first node still showing their frame - a comment degrades to its
+  frame, never to invisible, and never to two pins.
+- **Old comment logs keep their origin.** Events written by 0.8.0 clients carry no `board`;
+  they now get it stamped from the log they came from, so replying to an old thread can never
+  route the reply into whatever board happens to be open.
+- **Create-first frames land at their declared size.** A board node appended before the
+  manifest registered its frame file was sized by the 390x844 guess - and the guess persisted.
+  The size now corrects itself the moment the frame arrives, guessed sizes never reach the
+  file, and authored sizes on temporarily-missing frames are never touched.
+- **`marver init` no longer resurrects the demo scene.** Re-running init on a workspace with
+  real scenes used to scaffold demo/ back next to real work; the demo now only lands on a
+  first canvas.
+- **Static canvases stop knocking.** A published canvas without collaboration used to poll
+  the comments API forever (and retry an EventSource against it); the client now detects the
+  static serve once and goes quiet.
+- **No phantom comments on static canvases.** A published serve without `MARVER_DATA_DIR` used to
+  let `/__mv/api/*` requests fall through to the static handler, which answered them with
+  `index.html` HTTP 200 - the client read that as success, so a guest's comment echoed locally
+  and silently evaporated on reload. The serve now refuses the API with a 404 JSON error the
+  client surfaces as a toast.
+- **The published shell wordmark honors `share.name`.** Deploy hosts build from anonymous paths
+  (`/app`), so the sidebar read "App"; a declared `share.name` now names the shell like it
+  already named the gate.
+
 ## 0.8.0 - 2026-08-19
 
 Live Jam: tag `@marver` in a canvas comment and a local coding agent picks it up, edits the real
@@ -20,8 +182,9 @@ on the comment thread experience.
   Every reply carries a provenance tooltip - dev user, harness, model.
 - **A hard trust boundary.** Only the owner's device triggers: a device-bound ledger (keyed per
   board + comment id, never synced), a same-origin + cookie gate on every dev write (comments AND
-  profile), and a recursion guard so agent replies never re-trigger. The agent gets no shell -
-  Read/Edit/Write/Glob/Grep + WebSearch/WebFetch only - and its reply is extracted structurally
+  profile), and a recursion guard so agent replies never re-trigger. The agent runs locked down
+  (Claude Code: no shell, Read/Edit/Write/Glob/Grep + WebSearch/WebFetch only; Codex: confined
+  to its workspace-write sandbox) - and its reply is extracted structurally
   (the `marver-reply` block), so narration can never leak into a thread. Comment text is framed
   as untrusted data end to end.
 - **The felt surface.** A frame being worked on wears the selection geometry in marver blue with
@@ -177,8 +340,8 @@ snapshot that IS what you see, and the real live app takes over the moment you i
 
 - **Sidebar header** shows the humanized repo name (`marver-pilot` → "Marver Pilot", ellipsed if
   long); the logo links to marver.design.
-- **Sidebar board/scene labels** are humanized - kebab filenames render Title Case (`tms-specs` →
-  "Tms Specs"), dropping the dashes, while an explicit `meta.title` is honored verbatim.
+- **Sidebar board/scene labels** are humanized - kebab filenames render Title Case (`crm-specs` →
+  "Crm Specs"), dropping the dashes, while an explicit `meta.title` is honored verbatim.
 - **App cursor** is the marver arrowhead - tilted, rounded, small, soft-shadowed, and theme-adaptive
   (black-on-light / white-on-dark); reverts to a normal pointer in interact/prototype and keeps the
   pin/crosshair in comment/laser mode.
@@ -328,7 +491,7 @@ The co-thinking release: the canvas now holds the thinking, not just the screens
 
 ## 0.2.3 - 2026-08-12
 
-- Hardening release: codex P1s (live-JOIN adjacency, same-directory group invariant, tsx-only inference) and a P2 sweep (extractor boundaries, sceneRows dedupe, play-mode chrome fixes, extreme-zoom badge fade).
+- Hardening release: live-JOIN adjacency, same-directory group invariant, tsx-only inference, extractor boundaries, sceneRows dedupe, play-mode chrome fixes, extreme-zoom badge fade.
 
 ## 0.2.2 - 2026-08-12
 

package/README.md

@@ -1,32 +1,69 @@
 # Marver
 
-The agent-native design canvas. A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
+[![npm](https://img.shields.io/npm/v/%40marver-design%2Fmarver?color=2f6fed&label=npm)](https://www.npmjs.com/package/@marver-design/marver)
+[![license](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)
+[![node](https://img.shields.io/badge/node-%3E%3D22.18-brightgreen)](package.json)
+
+**The agent-native design canvas.** A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
+
+[marver.design](https://marver.design) · [Live Jam](docs/live-jam.md) · [Deploying a canvas](docs/publish.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
+
+## Quickstart
 
 ```bash
 npm i -D @marver-design/marver
 npx marver init   # scaffolds design/ (detects shadcn, Tailwind, your router)
-npx marver dev    # canvas at localhost:5199
+npx marver dev    # canvas at localhost:5199 (npx marver canvas works too - same thing)
 ```
 
 Then, to your agent:
 
 > Read design/AGENTS.md. Build an onboarding scene - welcome, form, done - mobile-first, using our components.
 
-- **Frames** are plain TSX/HTML files - zero imports from this package required.
-- **Everything hot-reloads**; frames appear on the canvas the moment the file lands.
-- Drag a frame's edge and the real breakpoints fire - each frame is a true iframe viewport.
-- **Boards**: one canvas on screen at a time. Agents write `design/boards/<name>.json` (a frame list is enough); switch boards at the top of the sidebar. `all-scenes` is auto-managed.
-- **Devices view**: the Devices menu (or hotkeys `1`-`5`) sizes every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
-- `data-goto="scene/frame"` on any element links frames into a walkable prototype.
-- **Content frames**: specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through *before* any pixels exist. Diagrams ship pre-themed (both modes), content frames auto-size to their content, and everything - devices, play mode, publish - works on them identically. Works in a repo with no app at all: idea first, design second.
-- **Comments**: Google-Docs-style feedback, pinned to actual elements. Press `C`, click a div inside a frame, write - the thread lives on that element, survives edits via a layered anchor (source semantics → structure → fuzzy text), and collapses to an avatar stack when the frame isn't active. Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure); `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services (set `MARVER_DATA_DIR` on a volume + `MARVER_OWNER_EMAIL` for the first account).
-- **Laser mode**: `L` outlines every element in every frame with depth-hued borders plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent. Comment mode is the calm cousin - one at a time with laser - showing only the hovered element so picking a comment target never overwhelms.
-- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
-- Uninstall: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
+Frames appear on the canvas the moment the files land. That's the loop.
+
+## Why marver
+
+- **Frames are real code.** Plain TSX/HTML files rendered from your repo's actual components and theme - zero imports from this package required. An approved design promotes into the app by moving a file, not by re-implementing a picture.
+- **Everything hot-reloads.** The agent writes, you watch it land - live.
+- **True viewports.** Each frame is a real iframe: drag its edge and your actual breakpoints fire.
+- **Your agent answers on the canvas.** Tag `@marver` in a comment and it picks up the job, edits the real source, and replies in the thread - no wiring, on by default. See [Live Jam](#live-jam).
+- **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates the `design/AGENTS.md` contract that teaches it the whole workflow.
+
+## The canvas
+
+- **Frames, scenes, boards.** Frames are screens, scenes group them (`design/scenes/<scene>/<frame>.tsx`), boards arrange them. Agents write `design/boards/<name>.json` (a frame list is enough); switch boards at the top of the sidebar. `all-scenes` is auto-managed.
+- **Devices view.** Hotkeys `1`-`5` (or the Devices menu) size every frame to mobile / tablet / laptop / monitor / tv to sweep your breakpoints; `0` restores your own layout exactly. Widths live in `design/config.ts`.
+- **Prototype links.** `data-goto="scene/frame"` on any element links frames into a walkable prototype - across boards, too.
+- **Play mode.** Press `p`: the board becomes a full-screen, clickable walkthrough. `data-goto` links navigate, arrow keys step between frames, `[` / `]` cycle variants, `Escape` exits. Publish it and you have a shareable prototype.
+- **Content frames.** Specs, Mermaid diagrams, and mood boards live on the same canvas as the screens - import `Doc`, `Md`, `Diagram`, `Img` from `@marver-design/marver/content` and think a feature through before any pixels exist. Works in a repo with no app at all: idea first, design second.
+
+## Collaboration
+
+- **Comments.** Google-Docs-style feedback pinned to actual elements. Press `c`, click a div inside a frame, write - the thread lives on that element and survives edits via a layered anchor (source semantics → structure → fuzzy text). Viewers on a published canvas comment with real names and avatars (invite-link accounts, no email infrastructure). `marver dev` syncs the same threads into `design/comments/*.jsonl`, where your agent works the queue: `npx marver comments list --open --json` → fork a variant → `resolve --addressed-in`. Live via SSE; one deploy, no extra services.
+- **Laser mode.** Press `l`: every element in every frame gets depth-hued outlines plus a hover label - the fastest way to see structure. Click any element to copy its full address (frame file + CSS path) for the agent.
+- **Publishing.** `npx marver build` exports a static canvas (default-closed: `design/publish.json` names what ships); `npx marver serve` hosts it with an optional password gate. One deploy on Railway, Docker, or any static host - the [publishing guide](docs/publish.md) has the one-pagers.
+
+## Live Jam
+
+Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Nothing to start and nothing to wire: it rides along with `marver dev`, on by default, armed with whichever agent CLI you have. The tool running the process wins, then whatever is on PATH, and `init` writes what it found into `design/config.ts` as `jam: { agent: "claude", concurrency: 6 }` - visible, one word to correct, `jam: false` to switch off.
+
+The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (Claude Code with shell disabled entirely; Codex confined to its workspace-write sandbox), and every reply carries provenance: which agent ran it, as which dev user, on which model when the agent names one. Marver ships no AI; the agent that acts is the one you already run. The [Live Jam guide](docs/live-jam.md) has the config block, the two sandboxes, and what to check when a mention does nothing.
 
-**Next.js**: supported with one caveat - frames render in Vite, outside Next. `next/font` CSS variables are undefined inside frames (give font tokens a fallback chain), `next/image`/`next/link` should be plain `img`/`data-goto` in frames, and Server Components cannot run there. `init` writes the specifics into `design/AGENTS.md` when it detects Next.
+## Working state
 
-Implementation contracts (SPEC.md, DECISIONS.md) live in the [GitHub repo](https://github.com/TNEP4/marver).
+The same glow, driven from the terminal. When your agent takes a request, it creates the frame files first, pins them on a board, and runs `npx marver work start <scene/frame ...>` - you see the work land on the canvas in seconds, watch it shimmer while subagents build in parallel, and see it settle on `work done`. Marks self-expire, so a crashed agent never leaves a frame glowing.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `npx marver init` | Scaffold `design/` in this repo (safe to re-run; refreshes managed files) |
+| `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam armed (`--port`, default 5199) |
+| `npx marver build` | Static export → `design/.dist`; what ships comes from `design/publish.json` (default-closed) |
+| `npx marver serve` | Serve the export; `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
+| `npx marver comments …` | The agent's queue: `connect <url>` · `sync` · `list` · `reply` · `resolve` · `invite <email>` · `revoke <email>` |
+| `npx marver work …` | Working glow from the terminal: `start <scene/frame …>` · `done … \| --all` · `list` |
 
 ## Shortcuts
 
@@ -39,4 +76,24 @@ Implementation contracts (SPEC.md, DECISIONS.md) live in the [GitHub repo](https
 
 **Board & chrome** - `t` tidy · `d` toggle light/dark for the board · `⌘\` (ctrl+\) collapse/open sidebar.
 
-**Selection** - click selects · shift+click (canvas or sidebar) builds a multi-selection · `⌘A` selects every frame on the board · `c` copies the selected frames' file paths · double-click enters interact mode (`esc` or click outside leaves) · drag the title bar to move, edges to resize (widths snap to devices).
+**Selection** - click selects · shift+click (canvas or sidebar) builds a multi-selection · `⌘A` selects every frame on the board · `⇧P` copies the selected frames' file paths · double-click enters interact mode (`esc` or click outside leaves) · drag the title bar to move, edges to resize (widths snap to devices).
+
+**Modes** - `c` comment mode · `l` laser mode · `⇧C` hide/show comment pins · `⇧L` laser comment (spotlight a thread's element) · `p` play mode · `h` hide all chrome.
+
+## Notes
+
+- **Next.js**: supported with one caveat - frames render in Vite, outside Next. `next/font` CSS variables are undefined inside frames (give font tokens a fallback chain), `next/image`/`next/link` should be plain `img`/`data-goto` in frames, and Server Components cannot run there. `init` writes the specifics into `design/AGENTS.md` when it detects Next.
+- **Upgrade**: `npm i -D @marver-design/marver@latest && npx marver init`. The canvas tells you when a new version is out (one anonymous registry check per day, cached in `design/.local/`; `MARVER_NO_UPDATE_CHECK=1` disables). Re-running init refreshes the managed files (AGENTS.md, `design/instructions/`) - your edits to them are detected and preserved; when both you and a release changed a file, the fresh version is staged at `design/.local/latest/` for you (or your agent) to merge. Everything else in `design/` is yours and never touched.
+- **Uninstall**: delete `design/`, remove the dependency. (If `init` patched your tsconfig `exclude`, revert that one line.)
+
+## Status
+
+Marver is a young solo side project - it works, it's dogfooded daily, and it has rough edges. The known weak spot: boards with many heavy frames (animation-rich, component-dense) can strain the canvas, especially while zooming - snapshot-based rendering helps but isn't finished. If you hit a wall, an issue with your board shape and frame count genuinely helps.
+
+## Contributing
+
+Bug reports, ideas, and PRs are welcome - start with [CONTRIBUTING.md](CONTRIBUTING.md). Security reports go through [private vulnerability reporting](SECURITY.md), not public issues. Agents running marver are taught to file what they hit as issues here, too - expect some robot reporters.
+
+## License
+
+[Apache-2.0](LICENSE) · built by [Nic Touron](https://github.com/TNEP4)

package/dist/{auth-B36fMCM3.mjs → auth-KQ9Aj-nB.mjs}

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 //#region src/server/auth.ts
 /**
-* Accounts, invites, sessions (SPEC-M3 §3) - the minimal credible implementation,
+* Accounts, invites, sessions - the minimal credible implementation,
 * extending the gate's own idiom. No framework: per-user salted scrypt verifiers,
 * opaque session tokens stored hashed, single-use invite links as the identity
 * bootstrap (no email infrastructure anywhere).

package/dist/{build-B8z902TW.mjs → build-D9gimz6K.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-D3eaARf4.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BVFuRfEo.mjs";
+import { c as detectHost, o as loadConfig, r as scanFrames } from "./manifest-DJHU7qfu.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BrBWk2Qn.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -8,7 +8,7 @@ import { build } from "vite";
 import react from "@vitejs/plugin-react";
 //#region src/server/build.ts
 /**
-* `marver build` - the static adapter (SPEC.md §12 + SPEC-M2 §4a).
+* `marver build` - the static adapter.
 *
 * Same Vite pipeline as dev (theme wrapper, tailwind, virtuals) with three JS entries
 * (shell / frame-host / stage); the html pages are generated from the build output, so
@@ -24,7 +24,7 @@ const posix = (p) => p.split(sep).join("/");
 function packageDir() {
 	return join(dirname(fileURLToPath(import.meta.url)), "..");
 }
-/** Static asset references in one module's source (SPEC-026): <Img src="..."> string
+/** Static asset references in one module's source: <Img src="..."> string
 *  literals plus markdown image literals INSIDE TEMPLATE STRINGS (where Md content
 *  lives - prose in comments never counts). Comments are stripped first so a commented
 *  example cannot fail the build. A computed <Img src={...}> fails CLOSED - the build
@@ -43,7 +43,7 @@ function scanAssetRefs(src, moduleId) {
 }
 /** Same shape the client's assetUrl accepts: relative, inside design/assets/, no tricks. */
 const isLocalAssetRef = (p) => !!p && !p.includes(":") && !p.startsWith("/") && !p.startsWith("\\") && !p.split("/").some((s) => s === ".." || s === "");
-/** The publish policy (SPEC-M3 §4): design/publish.json names what ships and with what
+/** The publish policy: design/publish.json names what ships and with what
 *  rights. Publishing is default-CLOSED - no policy and no explicit flag = no build.
 *  Returns name -> 'read' | 'comment'. Boards absent from the result do not ship. */
 function resolvePublish(root, allBoards, boardsFlag, allBoardsFlag) {

package/dist/cli.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from "node:url";
 const NAME = "marver";
 const PKG = "@marver-design/marver";
 const ROUTE = "/__mv";
-/** Content-frame natural widths (SPEC-026): Doc layout -> own-size width.
+/** Content-frame natural widths: Doc layout -> own-size width.
 *  Shared by the Doc primitive (measurement messages) and the server-side
 *  manifest scan (defaultSize for content frames) - one source, no drift. */
 const CONTENT_WIDTH = {
@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DrLomSWq.mjs");
+	const { init } = await import("./init-8Giknvy1.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
-cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-BYm9ebfN.mjs");
+for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
+	const { dev } = await import("./dev-CTtkqVo_.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root",
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-B8z902TW.mjs");
+	const { buildSite } = await import("./build-D9gimz6K.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-CwAfayJk.mjs");
+	const { serve } = await import("./serve-CZqPnj19.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -75,7 +75,7 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	serve(resolve(opts.root), port);
 });
 cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-BrpC86Kf.mjs");
+	const { commentsCommand } = await import("./comments-J06jqCVV.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {
@@ -83,6 +83,15 @@ cli.command("comments <action> [value]", "Comment collaboration: connect <url>
 		process.exit(1);
 	}
 });
+cli.command("work <action> [...frames]", "Working state on the canvas: start <scene/frame ...> · done <scene/frame ...> | --all · list").option("--root <dir>", "Host repo root", { default: "." }).option("--ttl <minutes>", "start: minutes before the glow self-expires (default 10, max 30)").option("--all", "done: clear every working frame").action(async (action, frames, opts) => {
+	const { workCommand } = await import("./work-lzC-lPY0.mjs");
+	try {
+		await workCommand(resolve(opts.root), action, frames ?? [], opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();

package/dist/{collab-pLGzSvm5.mjs → collab-s3k5byM1.mjs}

@@ -1,12 +1,12 @@
-import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
-import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-B36fMCM3.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
+import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-KQ9Aj-nB.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 //#region src/server/collab.ts
 const MONTH = 2592e3;
 const MAX_BODY = 262144;
-/** The permission seam (SPEC-M3 §3): v1 derives from publish policy + membership;
+/** The permission seam: v1 derives from publish policy + membership;
 *  a per-user ACL can replace the internals without touching a single route. */
 function can(user, rights, board, action) {
 	if (action === "read") return board in rights;

package/dist/{comments-DSwMhdbZ.mjs → comments-BZBKhKRO.mjs}

@@ -3,7 +3,7 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, re
 import { join } from "node:path";
 //#region src/server/comments.ts
 /**
-* The comment event store (SPEC-M3 §1) - an append-only JSONL log, one file per board.
+* The comment event store - an append-only JSONL log, one file per board.
 *
 * Events are immutable and identified by client-generated UUIDs; two logs merge by SET
 * UNION on id. That single rule is the entire sync protocol: idempotent, order-
@@ -73,7 +73,7 @@ function listBoards(dir) {
 }
 /** Where serve keeps its live store: MARVER_DATA_DIR is REQUIRED when collaboration is
 *  on - failing loudly beats silently writing into an ephemeral working directory that a
-*  redeploy wipes (SPEC-M3 §2). */
+*  redeploy wipes. */
 function dataDir() {
 	const dir = process.env.MARVER_DATA_DIR;
 	if (!dir) throw new Error("collaboration needs a durable home: set MARVER_DATA_DIR to a directory on a persistent volume (comments written anywhere else would vanish on redeploy)");

package/dist/{comments-BrpC86Kf.mjs → comments-J06jqCVV.mjs}

@@ -1,14 +1,14 @@
 import { n as NAME } from "./cli.mjs";
 import { n as replay } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
-import { connect, connectClaim, loadCollab, syncOnce } from "./sync-Ch4Bymb1.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
+import { connect, connectClaim, loadCollab, syncOnce } from "./sync-BJKKmy1n.mjs";
 import { n as localProfile } from "./profile-BkiWglVE.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
 //#region src/cli/comments.ts
 /**
-* `marver comments <action>` (SPEC-M3 §2, §9) - the collaboration CLI.
+* `marver comments <action>` - the collaboration CLI.
 *
 * connect <url>   sign in (or --invite <token> to claim) against a published canvas;
 *                 stores the device credential in design/.local/collab.json