The @pcbjam/backend-example server had a 1 GiB body limit, no per-owner/per-lib
quotas, bound to 0.0.0.0, and reflected any origin with credentials when
CORS_ORIGIN is *. Bound the write surface (5 MiB body cap, per-owner lib and
per-lib item quotas), bind 127.0.0.1 by default (opt in via HOST), and force
credentials off for a wildcard CORS origin. Refactor main() into an exported
buildApp() and add web/backend/test/security.test.ts (inject-based).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- provider.ts: expose awareness on YjsProvider (partykit/hocuspocus surface
their own; BroadcastChannel gets a sibling-channel relay via awareness-bc.ts)
- presence.ts: createPresence — publish local PresenceState, subscribable
deduped peers() roster, setCursor/setSelection for P2, pagehide fast removal
- PresenceRoster.tsx + WasmTool wiring: facepile chip next to SourceChip;
eeschema rebinds per active sheet (sheet-manager ActiveSheet now carries the
room's provider); config presenceUser() = slug + colorForUser
- new dep y-protocols; unit tests (presence.test.ts) + e2e
tests/web/presence-roster.spec.ts (two tabs, verified vs real partykit)
- bump pcbjam-shared: presence-wire schema (MIT)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CvqUd4QsJSGHN28aunJRTq
- standalone wasm/collab/types.ts: the CollabItem/CollabDelta data shapes now
come from MIT @pcbjam/shared (collab-wire zod schemas) via re-export; the
RUNTIME adapter interface (CollabBridge) stays here. emptyDelta/isEmptyDelta
alias the shared helpers — reconciler untouched.
- tests/collab/browser-entry.ts: fix the import path stale since the repo
restructure (web/apps/frontend → web/standalone) — the collab bundle had been
silently unbuildable; its opts type now tracks startCollab's real signature.
- tests/kicad/*-collab.spec.ts: update KicadCollab.start calls from the
pre-ysync-0004 { channel, settleMs } API to { provider: { kind:
"broadcastchannel", settleMs }, room } — the drift the broken bundle hid.
Verified: pl_editor 2/2, eeschema 2 passed, pcbnew 7 passed (skips pre-existing);
shared 47 unit tests; both typechecks clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pointer bump for the MIT sexpr/kicad-doc converter + schema + round-trip suite;
record the vitest devDep in the web workspace lockfile.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the shared, uuid-keyed structural s-expr comparator (README §B) used by both
the live drift check (0003) and the round-trip tests (0004), plus a vitest setup.
- wasm/collab/sexpr-diff.ts: zero-dependency module (importable from standalone
app code and the Playwright specs). Tokenizes s-expr text into nested lists,
indexes item nodes by their direct (uuid "X") child, compares item sets order-
insensitively as multisets of normalized children, emitting
{ equal, added, removed, changed } with per-property a/b. ignoreTokens drops
volatile tokens. False-positive-free only for same-serializer inputs.
- wasm/collab/sexpr-diff.test.ts: 15 cases (parse, equality, changes, ignoreTokens).
- vitest config + test scripts (node env, isolated from the app build).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Generalize the collab transport into a provider registry (none |
broadcastchannel | partykit | hocuspocus), one active per env. startCollab
takes { provider, room } and awaits provider.whenSynced() before seed/adopt.
Network libs lazily imported; room id from @pcbjam/shared collabRoomId.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reduce web/ to a single generic editor app plus a minimal example backend,
moving all project-specific/app code out to the closed root repo:
- apps/frontend -> standalone (@pcbjam/standalone): the GPL editor. Strips the
project-management UI (ProjectsPage/ProjectDetailPage/UploadDropzone and the
write half of lib/api.ts). WasmTool now takes fetchBytes + assetBaseUrl as
injected props (decoupled from the API client) so it can be driven by either
a backend or a local folder. New HomePage (local-folder loader + backend
project list) and read-only ProjectView. BroadcastChannel collab unchanged.
- backend (@pcbjam/backend-example): thin Fastify+ts-rest reference impl of the
@pcbjam/shared contract — serves a single project off the local filesystem
(PROJECT_DIR), no DB/auth/uploads.
- packages/contract -> web/pcbjam-shared (git submodule, MIT @pcbjam/shared).
- Remove apps/server, packages/storage, packages/contract, docker-compose
(server + storage move to the closed root repo; preserved via subtree
branches). Rewrite pnpm-workspace/turbo/.env for the frontend-only layout.
- Add tests/fixtures/demo so the editor + example backend run out of the box.
Standalone typechecks + builds; backend serves the contract end-to-end.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
