feat(deploy): publish-libs CI + full clone (C1.3)

publish-libs.ts: --clone <dir> shallow-clones kicad-symbols + kicad-footprints at --lib-tag (full, all libs) and uses them as sources, so CI publishes the whole set with one command.

publish-libs.yml: decoupled workflow_dispatch (mirrors publish-wasm.yml) — lib_tag input (default 10.0.3) + force; clones + publishes to R2, skip-if-exists keyed by the tag. Dependency-free import chain ⇒ no workspace install (just node + npx tsx + git + wrangler).

deploy-demo.yml: LIB_TAG=10.0.3 → build-demo --lib-tag, so the demo serves the full library set from libs/kicad/<LIB_TAG>. Validated locally over .cache: publish then skip-if-exists; both workflows valid YAML.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-demo.yml

@@ -25,6 +25,9 @@ concurrency:
 env:
   CDN: https://cdn.pcbjam.com
   BUCKET: pcbjam-cdn
+  # KiCad library snapshot the demo points at (published once by publish-libs.yml
+  # to libs/kicad/<LIB_TAG>/). Bump when moving to a newer KiCad library release.
+  LIB_TAG: "10.0.3"
   PAGES_PROJECT: pcbjam-demo
   # MUST be the Pages project's PRODUCTION branch — any other value makes
   # `wrangler pages deploy` a PREVIEW deploy and demo.pcbjam.com won't update.
@@ -82,9 +85,13 @@ jobs:
           node scripts/deploy/publish-content.mjs --tag "${{ steps.tag.outputs.tag }}"
           --gallery deploy/demo/gallery.json --driver r2 --bucket "$BUCKET" --remote
 
-      # 3) Build the standalone pinned to the CDN + this tag's manifests.
+      # 3) Build the standalone pinned to the CDN + this tag's manifests. The
+      #    full KiCad library set is served read-only from libs/kicad/$LIB_TAG
+      #    (published once by publish-libs.yml — run it first for a new lib tag).
       - name: Build demo
-        run: node scripts/deploy/build-demo.mjs --tag "${{ steps.tag.outputs.tag }}" --cdn "$CDN"
+        run: >
+          node scripts/deploy/build-demo.mjs --tag "${{ steps.tag.outputs.tag }}"
+          --cdn "$CDN" --lib-tag "$LIB_TAG"
 
       # 4) Ensure the Pages project exists (first deploy creates it; no-op after).
       #    Its production branch must equal PAGES_PROD_BRANCH or deploys land as

.github/workflows/publish-libs.yml

@@ -0,0 +1,61 @@
+name: publish-libs
+
+# On-demand, decoupled: clone the full upstream KiCad symbol + footprint
+# libraries at a tag and publish them to the CDN (cdn.pcbjam.com, R2 pcbjam-cdn)
+# as version-pinned r2-idb-sync STATIC ORIGINS — one immutable manifest+bundle
+# per lib under libs/kicad/<lib_tag>/. The demo's cdnLibsSource opens these
+# read-only + IDB-cached. See docs/features/r2-idb-sync + the demo-adjustments
+# feature; wasm/libs/cdn-source.ts (client) + scripts/deploy/publish-libs.ts.
+#
+# Keyed by the KiCad library tag and idempotent: if the snapshot already exists
+# the script SKIPS the whole run, so re-running for the same tag is a near no-op.
+# Run this ONLY when the library tag changes; deploy-demo.yml just pins the demo
+# build at the chosen tag (build-demo --lib-tag).
+on:
+  workflow_dispatch:
+    inputs:
+      lib_tag:
+        description: "KiCad library tag to publish (kicad-symbols/footprints), e.g. 10.0.3"
+        required: true
+        default: "10.0.3"
+      force:
+        description: "Re-publish even if the snapshot already exists (true/false)"
+        default: "false"
+
+concurrency:
+  group: publish-libs
+  cancel-in-progress: false
+
+env:
+  BUCKET: pcbjam-cdn
+  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  # publish-libs.ts shells wrangler (R2) via cdn-store; fetch it on demand.
+  WRANGLER_CMD: npx --yes wrangler@4
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      # Only the MIT pcbjam-shared submodule is needed (publish-libs imports the
+      # self-contained sync-wire codecs from it); kicad/wxwidgets are not.
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+      - name: Init pcbjam-shared submodule
+        run: git submodule update --init --depth 1 web/pcbjam-shared
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      # Clone the full libs at <lib_tag>, extract every lib, build the static
+      # origins, upload to R2. The import chain (extract-libs parsers +
+      # sync-wire) is dependency-free, so no workspace install is needed.
+      - name: Publish libs to CDN
+        run: >
+          npx --yes tsx scripts/deploy/publish-libs.ts
+          --lib-tag "${{ github.event.inputs.lib_tag }}"
+          --clone "$RUNNER_TEMP/kicad-libs"
+          --driver r2 --bucket "$BUCKET" --remote
+          ${{ github.event.inputs.force == 'true' && '--force' || '' }}