relic-mcp 0.11.0 → 0.12.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "relic",
       "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
-      "version": "0.11.0",
+      "version": "0.12.1",
       "source": "./",
       "author": {
         "name": "The Bushido Collective",
@@ -21,6 +21,6 @@
     }
   ],
   "metadata": {
-    "version": "0.11.0"
+    "version": "0.12.1"
   }
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "relic",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
   "mcpServers": "./mcp-servers.json",
   "author": {

package/README.md

@@ -42,7 +42,8 @@ For any client that takes a JSON config:
    this machine later. See [Republishing](#republishing). The service never
    receives the key or the token plaintext; it keeps only a SHA-256 of the
    token.
-
+7. Returns a shareable URL whose fragment holds the decryption key. Fragments
+   are never sent to a server by a browser.
 Call the `relic_describe_client` tool and it will tell you all of this itself,
 without reading a file or making a request.
 
@@ -179,9 +180,10 @@ relic plaintext leaves the machine during rendering.
 | `relic_lookup_source` | `path` | Reads local state to find whether this machine already published that file, and returns the exact `relic_republish` call. Calls no server. |
 | `relic_list` | optional `limit`, `include_expired`, `verify`, `refresh` | Every relic this machine published, newest first. The only tool that enumerates: lookup answers only from the file a relic came from. A name this machine never recorded is recovered by decrypting the relic's own envelope in one 64 KB range request, or comes back `null` with the reason. A relic the service will not serve is listed with which of removed, expired, exhausted, or unreachable it is. Each row carries the share URL, fragment included, so each row is a credential. Reaching the service spends one of a relic's finite opens; recovered names are cached, so a repeat listing spends none. |
 | `relic_show` | `relic_id`, optional `include_content` | One relic in detail, including how many versions the service holds against how many this machine recorded, and with `include_content` the current decrypted content. Read it before republishing anything you did not just write: republish replaces what the link serves, so without the read-back the edit is blind. Content that is not valid UTF-8 is reported as size and type rather than mangled text. |
-| `relic_republish` | `relic_id`, `path`, optional `filename`, `title`, `cover`, `ttl_days` | Publishes a new version under the same key, so the share URL is unchanged. Replaces the plaintext title (defaults to the new filename; pass `""` to remove it). Replaces the cover image with a newly rendered cover, or clears it if `cover: false` is passed. Works only on the machine holding that relic's key and publish token; a taken-down relic can never be revived. |
+| `relic_republish` | `relic_id`, `path`, optional `filename`, `title`, `cover`, `ttl_days`, `addresses`, `notify` | Publishes a new version under the same key, so the share URL is unchanged. Replaces the plaintext title (defaults to the new filename; pass `""` to remove it). Replaces the cover image with a newly rendered cover, or clears it if `cover: false` is passed. Sends a change notice email to everyone following the relic unless `notify: false` is passed. At most one email per person per relic per 10 minutes is sent, and one stop link stops every email about that relic. Works only on the machine holding that relic's key and publish token; a taken-down relic can never be revived. |
+| `relic_share` | `relic_id`, `emails` | Send a relic this machine published to named people. Registers up to 20 email addresses with the service for change and comment notices, and returns a composed share email and mailto link to draft in the sharer's own mailbox. Addresses are stored in the clear by the service, linked to the relic id. A new comment emails everyone on the list except the author, naming the commenter's address (or 'The publisher'). At most one email per person per relic per 10 minutes, and one stop link stops every email about that relic. Relic never sends the share email. Readers holding the link can also share from the viewer once this client version has published or republished the relic. |
 | `relic_read_comments` | `relic_id` | Returns the relic's comments oldest first, decrypted locally, with the author and a count of any that would not decrypt. Works only on the machine that published. |
-| `relic_comment` | `relic_id`, `body`, optional `display_name` | Leaves a comment, encrypted on this machine, authorized by the publish token and attributed as `publisher`. Body caps at 4096 bytes of UTF-8. |
+| `relic_comment` | `relic_id`, `body`, optional `display_name` | Leaves a comment, encrypted on this machine, authorized by the publish token and attributed as `publisher`. Warning: posting emails everyone following the relic, naming 'The publisher'. At most one email per person per relic per 10 minutes, and one stop link stops every email about that relic. Body caps at 4096 bytes of UTF-8. |
 | `relic_describe_client` | none | Explains the encryption path. Reads nothing, sends nothing. |
 
 ## Environment

package/dist/cover/frame.html

@@ -10996,6 +10996,8 @@ function foldAliases(lowered) {
   }
   return out;
 }
+// ../relic-format/src/share.ts
+var SHARE_PROOF_INFO = new TextEncoder().encode("relic/share-proof/v1");
 // ../relic-viewer/src/sandbox.ts
 var React3 = __toESM(require_react(), 1);
 var import_client = __toESM(require_client(), 1);

package/dist/cover/styles.css

@@ -254,6 +254,10 @@ body {
   position: absolute;
   z-index: 8;
   background: var(--surface);
+  /* Its own ink rather than whatever it inherits. Inside a fullscreen stage
+     the surface is dark and the page around it is not, and an inherited ink
+     put the comment's own words dark on dark. */
+  color: var(--ink);
   border: 1px solid var(--rule-strong);
   box-shadow: 0 6px 18px rgb(0 0 0 / 14%);
   font-family: var(--sans);
@@ -332,6 +336,14 @@ body {
   list-style: none;
 }
 
+/* The card lights the row it opened for, and the light runs edge to edge of
+   the row. The sidebar has margins around its rows; a card has none, so the
+   row brings its own and the author and the date stop touching the light. */
+.popover-thread .comment {
+  padding-right: 0.6rem;
+  padding-left: 0.6rem;
+}
+
 .popover-target {
   margin: 0 0 0.4rem;
   color: var(--ink-soft);
@@ -367,6 +379,68 @@ body {
   font-size: 0.72rem;
 }
 
+/* The comments that share one cluster on the timeline. Each row opens that
+   comment's own card, so a row is a button that reads as the sidebar's
+   comment head shrunk to one line plus the start of what was said. */
+.popover-members {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.popover-members li + li {
+  border-top: 1px solid var(--rule);
+}
+
+.popover-member {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  column-gap: 0.6rem;
+  row-gap: 0.15rem;
+  width: 100%;
+  padding: 0.45rem 0.3rem;
+  background: none;
+  border: 0;
+  color: var(--ink);
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+
+.popover-member:hover {
+  background: color-mix(in srgb, var(--patina) 12%, transparent);
+}
+
+.popover-member:focus-visible {
+  outline: 2px solid var(--patina);
+  outline-offset: -2px;
+}
+
+.popover-member-time {
+  font-family: var(--mono);
+  font-size: 0.72rem;
+  color: var(--patina);
+}
+
+.popover-member-author {
+  overflow: hidden;
+  font-family: var(--mono);
+  font-size: 0.72rem;
+  color: var(--ink-soft);
+  white-space: nowrap;
+  text-overflow: ellipsis;
+}
+
+.popover-member-body {
+  grid-column: 1 / -1;
+  display: -webkit-box;
+  overflow: hidden;
+  font-family: var(--serif);
+  font-size: 0.86rem;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 2;
+}
+
 /* ---------- the accession band ---------- */
 
 .bar {
@@ -702,6 +776,16 @@ body {
   margin: 0 auto;
 }
 
+/* A markdown relic is a document, so it gets the width of a document: a
+   letter page, the 8.5in sheet Google Docs lays out and a printer feeds. The
+   46rem column above is narrower than that page, and it read as a strip down
+   the middle of the window. The notice is widened with it so the explanation
+   above the document lines up with the document it explains. */
+.stage-markdown .doc,
+.stage-markdown .notice {
+  max-width: 8.5in;
+}
+
 .toggle-row {
   display: flex;
   justify-content: flex-end;
@@ -1148,6 +1232,14 @@ body {
   white-space: nowrap;
 }
 
+/* A panel open over the scrubber already names the time it is about, and it
+   sits exactly where this readout does: the readout's lower edge would show
+   under the panel as a stray notch. The rule and the comment button stay, so
+   a reader can still aim somewhere else. */
+.stage-wrap:has(.popover) .hover-timecode {
+  visibility: hidden;
+}
+
 .timeline-hover-comment-btn {
   position: absolute;
   top: calc(100% + 4px);
@@ -1285,6 +1377,10 @@ body {
 .media-stage:fullscreen {
   color-scheme: dark;
   --surface: #171b1c;
+  /* Below the band rather than above it: a comment field in a panel on the
+     stage sits on the ground, and the page's light ground under the stage's
+     light ink made what was typed there unreadable. */
+  --ground: #0e1112;
   --ink: #e6e9e7;
   --ink-soft: #969e9d;
   --rule: #3b4345;
@@ -3068,6 +3164,266 @@ canvas.relic-page {
   }
 }
 
+/* ---------- the share panel ---------- */
+
+/* A sheet that drops from the band, under the action that opened it. It is a
+   modal dialog rather than a third sidebar: sharing is a short errand with an
+   end, the reading row already has a conversation beside it, and a dialog
+   gives the keyboard its trap and Escape for nothing. Square, hairline, the
+   patina rule on top like the composer, and the version list's shadow, so it
+   reads as the same family of chrome as everything else that drops from the
+   band. */
+.share-panel {
+  position: fixed;
+  inset: var(--share-top, var(--bar-height)) 0 auto auto;
+  width: min(28rem, 100vw);
+  max-width: 100vw;
+  max-height: calc(100dvh - var(--share-top, var(--bar-height)));
+  margin: 0;
+  padding: 0;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  color: var(--ink);
+  font-family: var(--sans);
+  background: var(--surface);
+  border: 1px solid var(--rule-strong);
+  border-top: 2px solid var(--patina);
+  border-right: 0;
+  box-shadow: 0 6px 18px rgb(0 0 0 / 18%);
+}
+
+.share-panel::backdrop {
+  background: rgb(16 19 20 / 28%);
+}
+
+.share-head {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  min-height: 2.75rem;
+  padding: 0 0.4rem 0 1.25rem;
+  background: var(--surface);
+  border-bottom: 1px solid var(--rule);
+}
+
+.share-title {
+  margin: 0;
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.share-title:focus {
+  outline: none;
+}
+
+.share-close {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.25rem;
+  height: 2.25rem;
+  padding: 0;
+  color: var(--ink-soft);
+  background: transparent;
+  border: 0;
+  cursor: pointer;
+}
+
+.share-close:hover {
+  color: var(--patina-ink);
+  background: var(--ground);
+}
+
+.share-close:focus-visible {
+  outline: 2px solid var(--patina);
+  outline-offset: -2px;
+}
+
+.share-body {
+  display: grid;
+  gap: 0.75rem;
+  padding: 1.1rem 1.25rem 1.4rem;
+}
+
+.share-body > * {
+  min-width: 0;
+}
+
+.share-form {
+  display: grid;
+  gap: 0.75rem;
+  margin: 0;
+}
+
+.share-form > .action.primary,
+.share-body > .action {
+  justify-self: start;
+}
+
+.share-body .thread-note,
+.share-body .thread-policy {
+  margin: 0;
+}
+
+.share-body .compose-warning {
+  margin: 0;
+}
+
+/* The two facts a sharer is owed before typing anybody's address, set as the
+   composer sets its disclosure: at reading size, on the oxide rule. */
+.share-facts {
+  display: grid;
+  gap: 0.4rem;
+}
+
+.share-facts p {
+  margin: 0;
+}
+
+.share-addresses {
+  min-height: 4.6rem;
+  font-family: var(--mono);
+  font-size: 0.8rem;
+  line-height: 1.6;
+  resize: vertical;
+}
+
+.share-addresses[aria-invalid="true"] {
+  border-color: var(--oxide);
+}
+
+/* Inside the sheet every action is a bordered button: the band's divider
+   rules mean nothing away from the band. */
+.share-panel .action {
+  justify-content: center;
+  padding: 0.5rem 0.85rem;
+  border: 1px solid var(--rule-strong);
+}
+
+.share-panel .action.primary {
+  border: 1px solid var(--patina);
+}
+
+.share-panel .action:disabled {
+  color: var(--ink-soft);
+  background: var(--ground);
+  border-color: var(--rule);
+  cursor: default;
+}
+
+.share-panel .action span {
+  display: inline;
+}
+
+.share-panel .compose-foot .action.primary {
+  margin-left: auto;
+}
+
+.share-done {
+  margin: 0;
+  padding: 0.6rem 0.75rem;
+  font-size: 0.84rem;
+  line-height: 1.5;
+  background: var(--diff-added);
+  border-left: 2px solid var(--patina);
+}
+
+/* The email as the recipient will get it, so what is about to leave the
+   sharer's own mailbox is read before it leaves. The body is set in the
+   reading face because it is a letter, not chrome. */
+.share-email {
+  margin: 0;
+  background: var(--ground);
+  border: 1px solid var(--rule);
+}
+
+.share-email-head {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 0.3rem 0.75rem;
+  margin: 0;
+  padding: 0.65rem 0.8rem;
+  font-size: 0.82rem;
+  border-bottom: 1px solid var(--rule);
+}
+
+.share-email-head dt {
+  padding-top: 0.15rem;
+  color: var(--ink-soft);
+  font-family: var(--mono);
+  font-size: 0.66rem;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+
+.share-email-head dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.share-email-body {
+  margin: 0;
+  padding: 0.75rem 0.8rem 0.85rem;
+  font-family: var(--serif);
+  font-size: 0.9rem;
+  line-height: 1.55;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+.share-send {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+}
+
+.share-again {
+  justify-self: start;
+  padding: 0;
+  color: var(--patina-ink);
+  font: inherit;
+  font-size: 0.8rem;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  background: none;
+  border: 0;
+  cursor: pointer;
+}
+
+.share-again:focus-visible {
+  outline: 2px solid var(--patina);
+  outline-offset: 2px;
+}
+
+.share-body .thread-refusal {
+  margin: 0;
+}
+
+/* A phone gets the whole width under the band, and the buttons stack so the
+   one that opens the mail app is never a sliver. */
+@media (max-width: 34rem) {
+  .share-panel {
+    width: 100vw;
+    border-left: 0;
+  }
+
+  .share-head {
+    padding-left: 1rem;
+  }
+
+  .share-body {
+    padding: 1rem 1rem 1.25rem;
+  }
+
+  .share-send .action {
+    flex: 1 1 100%;
+  }
+}
+
 /* ---------- toast ---------- */
 
 .toast {
@@ -3165,6 +3521,11 @@ canvas.relic-page {
   pointer-events: none;
 }
 
+/* Markers are drawn in ink inside a ring of the surface. The played bar is
+   patina and the unplayed rail a light tint of the ink, so a patina marker
+   vanished over everything already played. Ink stands off the tinted rail,
+   the surface ring stands off the patina, and the pair holds in the dark
+   fullscreen stage, where both tokens are redefined. */
 .time-marker {
   position: absolute;
   top: 50%;
@@ -3173,20 +3534,21 @@ canvas.relic-page {
   padding: 0;
   border: none;
   border-radius: 0;
-  background: var(--patina);
+  background: var(--ink);
   transform: translate(-50%, -50%);
   pointer-events: auto;
   cursor: pointer;
   z-index: 2;
-  box-shadow: none;
+  box-shadow: 0 0 0 1px var(--surface);
 }
 
 .time-marker:hover,
 .time-marker.is-active,
 .time-marker:focus-visible {
   width: 5px;
-  background: var(--patina-ink);
+  background: var(--ink);
   outline: 1px solid var(--patina);
+  outline-offset: 1px;
   z-index: 4;
 }
 
@@ -3195,16 +3557,18 @@ canvas.relic-page {
   border-style: dashed;
 }
 
+/* A span stands above and below the 4px rail, so its ring shows against the
+   controls band as well as against the rail, played or not. */
 .time-marker-span {
-  height: 100%;
-  top: 0;
+  height: 8px;
+  top: 50%;
   border-radius: 0;
-  border-left: 2px solid var(--patina);
-  border-right: 2px solid var(--patina);
+  border-left: 2px solid var(--ink);
+  border-right: 2px solid var(--ink);
   border-top: none;
   border-bottom: none;
-  background: color-mix(in srgb, var(--patina) 40%, transparent);
-  transform: none;
+  background: var(--ink);
+  transform: translateY(-50%);
   min-width: 4px;
   z-index: 2;
 }
@@ -3212,9 +3576,10 @@ canvas.relic-page {
 .time-marker-span:hover,
 .time-marker-span.is-active,
 .time-marker-span:focus-visible {
-  transform: none;
-  background: color-mix(in srgb, var(--patina) 75%, transparent);
+  transform: translateY(-50%);
+  background: var(--ink);
   outline: 1px solid var(--patina);
+  outline-offset: 1px;
   z-index: 4;
 }
 
@@ -3230,8 +3595,8 @@ canvas.relic-page {
   padding: 0 3px;
   border: 1px solid var(--surface);
   border-radius: 0;
-  background: var(--patina);
-  color: #fff;
+  background: var(--ink);
+  color: var(--surface);
   font-family: var(--mono);
   transform: translateY(-50%);
   pointer-events: auto;
@@ -3250,63 +3615,12 @@ canvas.relic-page {
 .time-marker-cluster.is-active,
 .time-marker-cluster:has(.is-active),
 .time-marker-cluster:focus-visible {
-  background: var(--patina-ink);
+  background: var(--ink);
   outline: 1px solid var(--patina);
+  outline-offset: 1px;
   z-index: 5;
 }
 
-.timeline-marker-tooltip {
-  position: absolute;
-  bottom: 100%;
-  margin-bottom: 8px;
-  transform: translateX(-50%);
-  background: var(--surface);
-  border: 1px solid var(--rule);
-  padding: 0.35rem 0.5rem;
-  font-family: var(--sans);
-  font-size: 0.74rem;
-  color: var(--ink);
-  white-space: nowrap;
-  pointer-events: none;
-  z-index: 20;
-  display: flex;
-  flex-direction: column;
-  gap: 0.2rem;
-}
-
-.marker-tooltip-header {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.marker-tooltip-author {
-  font-family: var(--mono);
-  font-size: 0.72rem;
-  font-weight: 600;
-  color: var(--patina);
-}
-
-.marker-tooltip-time {
-  font-family: var(--mono);
-  font-size: 0.7rem;
-  color: var(--ink-soft);
-}
-
-.marker-tooltip-snippet {
-  font-family: var(--sans);
-  font-size: 0.72rem;
-  color: var(--ink);
-  max-width: 18rem;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.marker-tooltip-item {
-  font-family: var(--sans);
-  font-size: 0.7rem;
-  color: var(--ink);
-}
 .time-frame-box {
   position: absolute;
   border: 2px solid var(--patina);