feat(demo): demo.pcbjam.com deploy — versioned WASM CDN + static gallery + tag CI

Cross-origin WASM CDN (cdn.pcbjam.com, R2): per-tool content-addressed,
immutable folders + a per-release runtime manifest (snapshot from registry).
boot.ts loads pthread workers cross-origin via a same-origin blob shim.
Static no-backend project source (demo gallery; Save downloads to local),
api.uploadFileBytes kept and config-gated. demo.pcbjam.com on Cloudflare Pages.
deploy-demo.yml (tag v*) snapshots WASM + content + builds + deploys;
publish-wasm.yml builds on Ubicloud. Design/spec docs live in pcbjam-private.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-demo.yml

@@ -0,0 +1,88 @@
+name: deploy-demo
+
+# Tag a release (vX.Y.Z) → reuse the already-published WASM (snapshot it into a
+# per-release manifest), publish the example gallery, build the standalone pinned
+# to the CDN, and deploy it to demo.pcbjam.com (Cloudflare Pages).
+#
+# The heavy WASM build+upload is DECOUPLED (workflow: publish-wasm.yml / a local
+# seed) because the WASM changes rarely; this pipeline never rebuilds it. See
+# docs/features/demo-deploy/.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to deploy, e.g. v1.2.3"
+        required: true
+
+# Serialize demo deploys so two tags don't race the live site (don't cancel a
+# half-finished deploy — let it complete).
+concurrency:
+  group: deploy-demo
+  cancel-in-progress: false
+
+env:
+  CDN: https://cdn.pcbjam.com
+  BUCKET: pcbjam-cdn
+  PAGES_PROJECT: pcbjam-demo
+  # MUST be the Pages project's PRODUCTION branch — any other value makes
+  # `wrangler pages deploy` a PREVIEW deploy and demo.pcbjam.com won't update.
+  # Direct-Upload projects default to "production".
+  PAGES_PROD_BRANCH: production
+  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  # The publish scripts shell wrangler; no repo dep — fetch it on demand.
+  WRANGLER_CMD: npx --yes wrangler@4
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      # The standalone needs the MIT pcbjam-shared submodule, but NOT the huge
+      # kicad/wxwidgets ones (WASM is prebuilt on the CDN, not built here).
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+      - name: Init pcbjam-shared submodule
+        run: git submodule update --init --depth 1 web/pcbjam-shared
+
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install standalone workspace
+        run: pnpm --dir web install --frozen-lockfile
+
+      - name: Resolve tag
+        id: tag
+        run: echo "tag=${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}" >> "$GITHUB_OUTPUT"
+
+      # 1) Reuse prebuilt WASM: snapshot the current registry into manifest-<tag>
+      #    (no build, no upload). Fails if the WASM was never published — run
+      #    publish-wasm.yml (or a local seed) first.
+      - name: Snapshot WASM manifest
+        run: >
+          node scripts/deploy/publish-wasm.mjs --tag "${{ steps.tag.outputs.tag }}"
+          --driver r2 --bucket "$BUCKET" --remote --from-registry
+
+      # 2) Publish the read-only example gallery (tiny; content/<tag>/).
+      - name: Publish content gallery
+        run: >
+          node scripts/deploy/publish-content.mjs --tag "${{ steps.tag.outputs.tag }}"
+          --gallery deploy/demo/gallery.json --driver r2 --bucket "$BUCKET" --remote
+
+      # 3) Build the standalone pinned to the CDN + this tag's manifests.
+      - name: Build demo
+        run: node scripts/deploy/build-demo.mjs --tag "${{ steps.tag.outputs.tag }}" --cdn "$CDN"
+
+      # 4) Deploy to Cloudflare Pages (demo.pcbjam.com is the project's custom domain).
+      - name: Deploy to Cloudflare Pages
+        run: >
+          npx --yes wrangler@4 pages deploy web/standalone/dist
+          --project-name "$PAGES_PROJECT"
+          --branch "$PAGES_PROD_BRANCH"
+          --commit-dirty=true

.github/workflows/publish-wasm.yml

@@ -0,0 +1,89 @@
+name: publish-wasm
+
+# Heavy, on-demand: build the KiCad WASM on the Ubicloud runner (same recipe as
+# ci-ubicloud.yml, sharing its deps/wx caches) and upload it to the CDN
+# (cdn.pcbjam.com, R2 pcbjam-cdn) as per-tool content-addressed folders +
+# registry.json. Run this ONLY when the WASM actually changes (KiCad/wxwidgets/
+# build flags); the per-release deploy (deploy-demo.yml) reuses whatever this
+# publishes. See docs/features/demo-deploy/0001-wasm-cdn-versioning.md.
+#
+# `wasm_tag` names the folder for any tool whose bytes changed (unchanged tools
+# are skipped via the content-hash registry).
+on:
+  workflow_dispatch:
+    inputs:
+      wasm_tag:
+        description: "Version label for changed tools (e.g. kicad-9.0.1)"
+        required: true
+      compress:
+        description: "Compression for .wasm/.js (gzip | br | none)"
+        default: gzip
+
+concurrency:
+  group: publish-wasm
+  cancel-in-progress: false
+
+env:
+  BUCKET: pcbjam-cdn
+  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  WRANGLER_CMD: npx --yes wrangler@4
+  # Match ci-ubicloud.yml so the deps cache volume name + key line up (warm cache).
+  COMPOSE_PROJECT_NAME: kicad-wasm-ci
+  BINARYEN_VERSION: "130"
+  BINARYEN_OPT_LEVEL: "-O1"
+
+jobs:
+  publish:
+    runs-on: ubicloud-standard-30
+    timeout-minutes: 300
+    steps:
+      - name: Install build toolchain (Binaryen from-source)
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update
+          sudo apt-get install -y cmake ninja-build g++ libjemalloc2 autoconf automake make
+
+      - uses: actions/checkout@v4
+        with: { submodules: recursive }
+      - uses: actions/setup-node@v4
+        with: { node-version: 20 }
+
+      # Reuse ci-ubicloud's deps cache (same key + volume) so --build-deps
+      # short-circuits when warm.
+      - name: Restore deps cache
+        id: deps-cache
+        uses: actions/cache@v4
+        with:
+          path: deps-cache
+          key: deps-${{ runner.os }}-${{ hashFiles('scripts/deps/**','scripts/common/versions.sh','scripts/common/functions.sh','scripts/common/env.sh','docker/Dockerfile','docker/docker-compose.yml') }}
+      - name: Seed deps volume from cache
+        if: steps.deps-cache.outputs.cache-hit == 'true'
+        run: |
+          docker volume create kicad-wasm-ci_kicad-build-cache
+          docker run --rm -v kicad-wasm-ci_kicad-build-cache:/bw -v "$PWD/deps-cache":/cache \
+            alpine sh -c 'tar xzf /cache/deps.tar.gz -C /bw'
+
+      # Full WASM build of every tool the standalone serves → output/*.{wasm,js}
+      # + wx.js, wx-dom.js, images.tar.gz. NOTE: the published tool set
+      # (publish-wasm.mjs default) must match what `build.sh all` produces; pass
+      # `--tools …` if they differ.
+      - name: Build all KiCad tools WASM
+        run: |
+          export KICAD_DOCKER_CPUS="$(( $(nproc) - 1 ))" KICAD_DOCKER_MEM=110G
+          export KICAD_PIPELINE=1 BINARYEN_CORES=16 BINARYEN_BUILD_FROM_SOURCE=1
+          ./docker/build.sh all --build-deps -j "$(nproc)"
+          ls -lh output/*.wasm
+      - name: Package deps for cache
+        if: steps.deps-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p deps-cache
+          docker run --rm -v kicad-wasm-ci_kicad-build-cache:/bw -v "$PWD/deps-cache":/cache \
+            alpine sh -c 'cd /bw && tar czf /cache/deps.tar.gz sysroot stamps'
+
+      # Content-addressed upload + registry update (idempotent: unchanged tools skip).
+      - name: Publish WASM to CDN
+        run: >
+          node scripts/deploy/publish-wasm.mjs --tag "${{ github.event.inputs.wasm_tag }}"
+          --src output --driver r2 --bucket "$BUCKET" --remote
+          --compress "${{ github.event.inputs.compress }}"