Root route now sends no-cache headers to bust stale 301s from the
rcal standaloneDomain mishap. Standalone domain redirects changed from
301 (permanent/browser-cached) to 302 (temporary) so misconfiguration
can never stick in user browsers again.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add ?minimal=1 query param that renders a full-screen Jitsi meeting
page without the rSpace header, tab bar, or module chrome. Used by
scheduled meeting links so guests get a clean, direct video call
experience. Includes prejoin screen, all standard Jitsi controls,
and auto-closes the tab when the meeting ends.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Ranking: replace broken :hover drop-target with getBoundingClientRect hit testing
- Spider: add #isSliding guard to prevent slider destruction during drag
- Video gen: bump timeout to 10min, show real fal.ai queue position/status
- Fix NotificationCategory type to include 'payment' in db.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Repositions the rApp switcher as a floating action button in the bottom-right
corner that expands upward into a rounded panel. Removes all sidebar push-offset
CSS since the panel now overlays content without layout shift.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Change grid-template-columns from repeat(7, 1fr) to repeat(7, minmax(0, 1fr)) to prevent
content from stretching day cells unevenly
- Add computeEventColumns() helper using greedy interval-coloring algorithm with per-cluster
column counts for tiling overlapping events side-by-side
- Apply sub-column layout to day view, week view, and horizontal day view so concurrent events
no longer render on top of each other
- Guard duplicate day detail rendering when expanded day is at end-of-row or last day of month
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace thin 4px progress bar on task nodes with a prominent 12px fuel
gauge showing committed (green) + proposed (amber) hours vs total needed.
When an orb is dropped on open canvas, auto-find nearest unfulfilled task
and show a pulsing preview wire with confirm/dismiss buttons — human
approval required before creating the connection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
pointerdown on document was hiding the dropdown before click could fire
on My Account / My Spaces / My Wallets buttons. Switching to click lets
stopPropagation in item handlers prevent premature close.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Setting standaloneDomain to "rspace.online" caused the domain→module redirect
system to treat ALL rspace.online traffic as rcal, redirecting / to /rcal.
The correct value is "rcal.online" which redirects old rcal.online → rspace.online/rcal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- rCal landing: strip inline style overrides, use standard rl-* CSS classes
- rCal mod: update standaloneDomain from rcal.online to rspace.online
- Info popup: change from per-rApp auto-show to global one-time auto-show
- Update banner: track dismissal in sessionStorage so it stops re-showing
on every page load within the same session (likely the "persistent banner")
- rpubs landing: fix stale rcart.online URLs → demo.rspace.online/rcart
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace missing folk-exchange-app.js with server-rendered HTML order book.
Seed 8 demo intents, 2 trades, and 5 reputation records on startup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Community members post buy/sell intents for CRDT tokens (cUSDC, $MYCO, fUSDC)
against 8 fiat currencies. Bipartite solver matches intents every 60s. Escrow
via token-service burn/mint trio. Reputation scoring with badges. 14 API routes,
canvas shape with physics orbs, and landing page.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Module onInit functions (rvote, rtasks, rcal, etc.) call seedDemoIfEmpty
which checks the sync server for existing docs. Previously onInit ran
as an IIFE before loadAllDocs completed, so it always found empty docs
and re-seeded demo data — overwriting user deletions/changes. Now
onInit runs inside the loadAllDocs .then() chain, ensuring persisted
data is loaded before any seed checks run.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Binary signoff nodes now have a clickable checkbox that toggles
satisfied state. Checks EncryptID JWT for authority (assignee match),
falls back to allowing anyone in demo mode. Toggling a signoff
auto-recalculates connected project aggregator gate counts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Collapsible palette sidebar (hamburger toggle, hidden by default on mobile)
- Pinch-to-zoom and two-finger pan for touch/pen
- Larger touch targets for ports and zoom controls
- Responsive text sizing and compact toolbar on small screens
- Detail panel goes full-width on very small screens
- touch-action: none on SVG to prevent browser gesture conflicts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The rgov module page was showing a static description with a link to
/rspace. Now it renders the actual canvas (same as rspace module) with
moduleId="rgov" so GovMod shapes display inline at /rgov.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add internal endpoints for payment infrastructure integration:
- GET /api/internal/user-by-wallet — resolve wallet to email/username
- POST /api/internal/notify — trigger in-app notifications by wallet/DID
- Add 'payment' notification category and payment_sent/received event types
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add ExternalTimeLog schema and REST endpoints for ingesting time entries
from backlog-md CLI. Auto-creates commitments, links to existing tasks,
and supports solo settlement with reputation/skill curve updates.
New Fulfillment dashboard tab shows time logs, skill totals with progress
bars, and inline settle buttons. Export-to-backlog endpoint enables
importing rTime tasks into local backlog.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Added hideExchangeScreen, isAutoFillUserData, and paymentMethod params
to both Transak endpoints. This skips the initial exchange screen (we
already provide all required fields) and auto-fills email for Lite KYC,
reducing friction for small transactions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SMTP auth on port 587 was broken across all modules due to stale
credentials. Since rspace is on the mailcow Docker network, all 6
SMTP transports now use unauthenticated relay on port 25 when the
host is the internal postfix container. Fixes emails for: payment
receipts, space invitations, inbox approvals, agent notifications,
scheduled emails, and publication sharing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SMTP auth credentials were stale, causing all payment confirmation
emails to silently fail. Since rspace is on the mailcow Docker network,
use unauthenticated relay on port 25 instead of port 587 with auth.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When a payment request is in a terminal state (paid, confirmed, expired,
cancelled, filled), the /pay/:id route now renders a static HTML page
with a clear message instead of loading the full JS component. Prevents
"corrupted content error" and shows a friendly "already paid" message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Text inputs were rendering in light mode making text invisible against
the dark background. Added colorMode: 'DARK' to both Transak widget
endpoints.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When fiatAmount wasn't explicitly set on a payment request, Transak
defaulted to 300 USD. Now for USDC/USDT/DAI/cUSDC, the fiat amount
is inferred from the crypto amount (1:1 peg) so the widget opens with
the correct payment amount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Orb radius now uses 8-15% of basket radius with sqrt(hours) scaling
instead of fixed pixel sizes (18+hours*9). Prevents orbs from being
oversized on small baskets or undersized on large ones. Hover expansion
also scales proportionally (15% instead of fixed 5px).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add touch-action:none on canvas and preventDefault on pointerdown to
prevent the browser from claiming touch events for scroll/pan gestures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The ascii-art service returns raw HTML, not JSON. Wrap response in
{html, text} JSON envelope and strip tags for plain text version.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add folk-ascii-gen canvas shape with pattern/palette selectors
- Add POST /api/ascii-gen proxy to ascii-art service
- Register create_ascii_art in canvas tools + triage panel
- Fix WAN 2.1 t2v endpoint URL (fal-ai/wan/v2.1 → fal-ai/wan-t2v)
- Convert video gen to async job queue (avoids Cloudflare timeouts)
- Fix Docker API Content-Type bug in sidecar-manager
- Convert scribus-novnc and open-notebook to on-demand sidecars
- Add ensureSidecar("scribus-novnc") to rDesign bridge proxy
- Fix Hono ContextVariableMap and handleTransakMessage type errors
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When dragging a commitment to a task, hours are now split (min of
available, needed), the pool orb shrinks or disappears, and
connections track proposed/committed status with approve/decline UI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Audit and fix ~60 violations across 47 files where URLs were constructed
as /{space}/moduleId instead of /moduleId (subdomain provides the space).
- Add getModuleApiBase() helper to shared/url-helpers.ts
- Fix client components: use getModuleApiBase() for fetch URLs,
rspaceNavUrl() for navigation
- Fix server routes: use c.get("isSubdomain") for redirects and
JSON response URLs
- Fix OAuth callbacks (notion, google, clickup): subdomain-aware redirects
- Fix email notification URLs (rvote): use {space}.rspace.online format
- Fix webhook registration (rtasks/clickup): subdomain-aware endpoint URL
- Replace broken #getSpaceSlug() methods in folk-feed, folk-splat
- Replace NODE_ENV checks with proper isSubdomain checks (rdata, rnetwork)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Empty compose env vars were blocking Infisical secret injection at startup.
Only TRANSAK_ENV needs to be in compose; API keys and secrets come from Infisical.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Spaces are subdomains, not path segments. /rspace is correct since
the space context comes from the subdomain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Seeds demo spaces with a "Build a Climbing Wall" circuit (labor threshold +
capital threshold + proprietor signoff → project) and a "Community Potluck"
circuit (budget knob + RSVPs threshold + venue signoff → project), each
pre-wired with arrows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rich landing page with do-ocratic framing, SVG circuit diagram,
"GovMods" branding, modular governance vs monolithic comparison,
and onboarding action. Module now has landingPage function for
bare-domain rendering.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace 3-tab layout (Pool/Weave/Collaborate) with 2-tab Canvas + Collaborate.
Canvas tab has collapsible left pool panel with orbs alongside infinite SVG
canvas with pan/zoom (ctrl+wheel zoom, wheel pan, space+drag, touch pinch).
- Long-press orb in pool → drag onto canvas to create commitment node
- Drop on matching task port auto-creates wire connection
- Gold glow highlights unfulfilled task ports matching dragged skill
- "Frame as Tasks" button on solver results creates task nodes with
dashed intent frame on canvas
- Add intentFrameId to Task schema for solver-to-task linkage
- Zoom controls overlay (+/−/reset)
- Light/dark theme support for all new elements
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add MoonPay as the primary card payment provider for rCart. MoonPay
uses HMAC-SHA256 signed URLs (no session API needed, no IP whitelisting).
Falls back to Transak if MoonPay keys aren't configured.
- shared/moonpay.ts: URL builder with HMAC signing, currency mapping
- New /api/payments/:id/card-session endpoint picks provider automatically
- Frontend uses unified startCardPayment() with multi-provider message handling
- Set MOONPAY_API_KEY + MOONPAY_SECRET_KEY to activate
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Hardcoded PRODUCTION overrode the Infisical value. Use env var with
STAGING default until Transak production gateway auth issue is resolved.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Production gateway rejects tokens from api.transak.com. Try getting
the access token from the gateway endpoint first (which staging
confirms works), then fall back to the legacy API endpoint.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Transak now requires widget URLs to be generated server-side via their
gateway session API. Direct query-parameter URLs are deprecated.
- Add getAccessToken() with 7-day caching for partner access tokens
- Add createSecureWidgetUrl() that calls the gateway session endpoint
- Falls back to legacy direct URL if gateway returns an error (e.g.
production IP not yet whitelisted)
- Update rCart and rFlows to use the secure API
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Transak rejects `cryptoAmount` when combined with fiatCurrency params.
Use `defaultCryptoAmount` which pre-fills the amount without conflicting.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The payment request form button was cut off on mobile because the shell
uses height:100vh with overflow:hidden on #app. Add padding-bottom to
the .page container so the button scrolls into view within the flex
overflow:auto content area.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
SyncServer.setDoc() was not calling onDocChange, so documents created
via setDoc (including payment requests) were only stored in memory and
lost on container restart. This caused "Payment request not found"
errors after deploys. Now setDoc triggers the same persistence callback
as changeDoc.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Payment request URLs (e.g. /rcart/pay/:id) should be accessible without
authentication, even in private spaces. The API endpoints were already
exempted from auth, but the client-side shell gate was redirecting
unauthenticated visitors to the module landing page. Set
spaceVisibility="public" on the payment page render to bypass this.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Transak production also sends X-Frame-Options: SAMEORIGIN, blocking
iframe embeds. Switch to popup window for all environments, not just
staging. Show "payment opened in new window" status with re-open button.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
TRANSAK_ENV was set to PRODUCTION but TRANSAK_API_KEY_PRODUCTION was
missing, causing the Transak session endpoint to return 503. Add the
env var reference so rCart card payments work in production.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use `user-${email}` instead of raw `email` as the Openfort player label,
matching the flow-service convention. Openfort rejects colons in labels,
and both codepaths must use the same format so users get the same wallet
regardless of whether they on-ramp via rfunds.online or rspace.online.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When a logged-in user visits a private space they don't have access to,
the gate now shows a "Request Access" button (calls POST /api/spaces/:slug/access-requests)
and a "Go to {username}'s Space" secondary link. Handles already-pending (409) gracefully.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Landing, module-landing, and sub-page-info pages showed a stale "Spaces"
dropdown. Now checks encryptid_session and sets the switcher to
{username}'s Space (logged in) or demo (logged out).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Jeff Emmett
Jeff Emmett