Declarative onboardingActions on RSpaceModule lets each rApp define its
own onboarding cards (import, upload, link, create). renderOnboarding()
renders them as a responsive card grid with upload handling. Adds ICS
import endpoint to rCal (POST /api/import-ics). 15 modules wired up.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add BroadcastChannel for instant same-browser tab sync — opening/closing
tabs in one window propagates immediately to sibling tabs. Extract
reconcileRemoteLayers() helper shared by BroadcastChannel and Automerge,
which cleans up cached DOM panes on remote removal and handles
active-tab-closed scenarios.
Also adds configurable rApp shortcuts (Ctrl/Alt+1-9), header swipe
gestures for rApp cycling, and body data-module-id attr for swipe context.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Show colored dots on notebook cards and note list items indicating which
peers are currently viewing/editing. Uses existing presence message relay
with zero server changes — heartbeat every 10s, stale peer GC at 20s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Convert inline forwarding banner to a click-triggered modal overlay.
Fix API field name bug (data.target → data.forwardsTo). Add email
input for no-email state with sovereignty messaging. Remove dismiss
logic in favor of modal open/close.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The thread gallery already has a "New Thread" button linking to the editor,
so a separate hub button and subnav pill for the editor is redundant.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix DID mismatch: server now stores and reads proper did🔑z6Mk... DIDs
from database instead of deriving truncated did🔑${slice(0,32)}
- Add PRF extension to WebAuthn create/get flows for client-side key derivation
- Derive DID, signing keys, encryption keys, and EOA wallet from passkey PRF
- Auto-upgrade truncated DIDs to proper format on sign-in
- Add POST /api/account/upgrade-did endpoint for DID migration
- Add 5-step educational registration wizard (identity, passkey, DID, wallet, security)
- Add email/username field to sign-in for scoped passkey selection
- Add magic link email login for external devices without passkeys
- Add POST /api/auth/magic-link and GET /magic-login verification page
- Add mintWelcomeBalance() for 5 fUSDC to new users
- Store EOA wallet address during registration when PRF available
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix QR code (replace broken Node.js import with api.qrserver.com API)
- Rename "Share Room" → "Share rMap" across UI
- Add "hidden" precision level replacing ghost mode toggle
- Unified 5-level privacy panel (Exact → Hidden/Ghost) as button list
- Pulsing blue dot self-marker (replaces emoji circle for own position)
- Locate-me FAB (bottom-left, both mobile and desktop)
- Mobile: edge-to-edge map, floating FAB menu with staggered animations
- Mobile: bottom sheet for participants (peek/expand with touch drag)
- Mobile: hide sidebar/controls/privacy panel, overlay compact nav bar
- Extract shared participant list helpers for desktop sidebar + mobile sheet
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace broken encryptid-token localStorage reads with getAccessToken/getUsername
from rspace-header. Add forwarding status check against EncryptID API with
enable/disable/dismiss banner on mailboxes view.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove the auto-opening calendar on shape selection and the drag-to-calendar
compact mode. The 📅 icon on selected shapes remains as the entry point.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Space dropdown showed "Request Access" for the owner's own space because
the /api/spaces endpoint only checked claims.sub against ownerDID, missing
the did🔑 format used by auto-provisioned spaces. Now uses dual-check
matching the resolveRole helper pattern.
Also fixes 15 pre-existing TypeScript errors:
- server/index.ts: add Hono AppEnv type for context variables
- modules/rnetwork/mod.ts: cast tuple index to number for arithmetic
- modules/rsplat/folk-splat-viewer.ts: type CDN-loaded three.js as any
- modules/rtube/mod.ts: cast Uint8Array to BlobPart for FormData
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Space creation was broken because the canvas module has id "rspace" but
all navigation URLs used "/canvas". On production subdomain routing this
resulted in 404s after creating a space.
- Switch create-space form from deprecated /api/communities to /api/spaces
- Replace all /canvas navigation URLs with /rspace to match module ID
- Fix DID matching in space listing to check both sub and did:key formats
- Add proper client DID support in EncryptID registration flow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New gallery landing page at /campaigns showing all campaign workflows as
cards with miniature SVG previews. Click a card to open the editor at
?workflow=<id>. Editor gains back-link to dashboard and workflow attribute
for deep-linking.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add global polyfills for AbortSignal.timeout() (Safari <17, Firefox <122)
and crypto.randomUUID() (Safari <15.4, Firefox <95) in shell HTML templates.
Add -webkit-backdrop-filter prefix across 13 files for older Safari support.
Add Firefox scrollbar (scrollbar-width/scrollbar-color), range input
(::-moz-range-thumb/track), and color-mix() rgba fallbacks. Create shared
compat.ts utility module. Lowers browser floor from Safari 17/Firefox 122
to Safari 15.4/Firefox 95.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Covers 19 test cases: space CRUD, member add by username, role changes
(viewer/member/moderator/admin), email invites, removal, auth guards.
Run with: ./e2e/tests/space-members-api.sh <AUTH_TOKEN>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Mailcow rejects noreply@rspace.online because the authenticated user
is noreply@rmail.online. Updated all SMTP_FROM and SMTP_USER defaults
to use rmail.online consistently: spaces invites, rSplat notifications,
EncryptID auth emails, and rCart payment receipts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
On mobile (<=640px), the header right section was too crowded with icons.
Now hides notification bell, share panel, and settings gear buttons, and
adds equivalent mobile-only items in the identity dropdown menu. Share
uses native navigator.share() when available.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract canvas inline share panel into reusable <rstack-share-panel> web component
and add it to the shell header between notification bell and settings gear. Canvas
now uses the component too, removing ~230 lines of inline HTML/CSS/JS.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The result fetch was constructing its own URL instead of using the
response_url returned by fal.ai's status poll. This caused 422 errors.
Now captures response_url from poll and uses it for result retrieval.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The spaces module was defaulting to http://localhost:3000 for EncryptID
API calls, which resolves to the rspace container itself (both run on
port 3000). Changed to http://encryptid:3000 matching server/index.ts.
Also improved error surfacing in /members/add endpoint.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phone photos (3-4MB, 4000px+) were failing with "Invalid image" on
fal.ai Hunyuan3D. Now resizes to max 1024px JPEG with sharp before
submitting, and uses PUBLIC_ORIGIN HTTPS URL instead of data URI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the floating action button toggle with the same collapse/expand
behavior as desktop. Toolbar sits as a compact icon column on the left,
panels open to the right, and corner tools move to bottom-right.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two race conditions caused closed tabs to resurrect:
1. syncTabsFromServer() fetch completing after a local close, merging
the stale server response back in
2. Debounced PUT killed by page navigation when closing the active tab,
so the server never learned about the close
Fix: track closed moduleIds per session to skip during merge, and flush
server PUT with keepalive:true before navigation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The publicUrl helper was generating http:// URLs (x-forwarded-proto from
Traefik), causing fal.ai to fail with "Invalid image" 422 errors. Now
reads the staged image from disk and sends as base64 data URI for
reliable delivery. Also bumps poll timeout from 5 to 8 minutes and
surfaces actual fal.ai error messages to the client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Peer-to-peer RV/camper rentals within community trust networks.
Forked from rBnb with vehicle-specific concepts: specs, mileage
policies, pickup/dropoff locations, and dry humor throughout.
4 seed vehicles, full CRUD API, Leaflet map with pickup/dropoff
markers, rental request flow, endorsement tags including
"suspiciously_clean" and "smells_like_adventure".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The communitySlug derivation was parsing path segments (e.g. /rcal) as
part of the space name instead of using the subdomain. On
jeff.rspace.online/rcal, this caused communitySlug to be "rcal" instead
of "jeff", making tab navigation redirect to rcal.rspace.online.
Now: on subdomain hosts, space always comes from the subdomain. Path
segments are only parsed for the space on localhost.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add four reminder scheduling affordances to the canvas:
- Floating 📅 icon on selected shapes toggles the reminder widget
- Right-click "Schedule a reminder" context menu option
- Drag-to-calendar compact mode (shows after 200ms of shape movement)
- Email notification via EncryptID on reminder creation
Closes TASK-122
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Hide CrowdSurf from app switcher (hidden: true) since it's now a
sub-tab of rChoices
- Replace dead outputPaths (Polls/Results with no routes) with actual
tabs: Spider Chart, Ranking, Voting, CrowdSurf
- Add /:tab route handler so sub-nav pills link to working URLs
- Component reads tab attribute for initial tab selection
- Remove internal .demo-tabs (shell sub-nav replaces them)
- Bump JS cache version to v=6
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
currentModuleId was a const that never updated on client-side tab
switches, causing close to either do nothing or switch to the wrong
tab. Now uses tabBar.active as source of truth and picks the nearest
remaining tab on close. Also adds touch long-press (400ms) drag
reorder for mobile tabs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace CrowdSurf tab placeholder with working swipe-card interface
populated from rChoices session data (or demo fallback). Uses seeded
PRNG (mulberry32 + djb2 hash) for deterministic daily sortition per
user, preventing position bias. Right-swipe = approve (casts vote via
local-first client), left-swipe = skip. Swipe state persists in
localStorage across page reloads. Includes summary view with
session-grouped approvals and reset functionality.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fal.ai needs to download the staged image. Using hardcoded PUBLIC_ORIGIN
(rspace.online) fails because Cloudflare redirects /data/ paths and the
subdomain (jeff.rspace.online) isn't matched. Now derives the public URL
from the request's Host header. Added logging for staged image URLs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cloudflare/Traefik 301-redirects /data/ paths to data.rspace.online, which
fal.ai can't follow. Staged images now served at /api/files/generated/ which
passes through correctly. Added route alias for backwards compat.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
In-memory gen3dJobs are lost on container restart. The poll was silently
swallowing 404s and looping forever. Now stops after 3 consecutive 404s
with a clear "server restarted" message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds margin-top to demo-tabs to prevent overlap with shell nav.
Hides tab labels on narrow screens (<=480px), showing only icons
so all 4 tabs fit. Bumps JS cache to v=4.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
activeLayerId was being written to the shared Automerge CRDT on every tab
switch, causing all open windows/devices to follow. Now active tab is
local-only. Adds REST API + server-side storage so authenticated users'
tab lists persist across sessions and devices.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Also fix canvas.html null reference crash when share-badge is stripped
by extractCanvasContent() header removal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a fourth sub-tab linking to the CrowdSurf module with teaser content.
Bumps JS cache version to v=3.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Browser ignores importmap when a <script type="module"> appears before it,
breaking Three.js imports and causing the 3D gen UI to hang at staging.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GLB models now render inline 3D previews using Google's <model-viewer> web
component with auto-rotate. AI-generated models show source image thumbnails.
Fixed fal.ai result fetch with retry logic and detailed logging for diagnosis.
Save flow now uses save-generated API with thumbnail_url passthrough.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Defer initThreeViewer to next animation frame so the DOM has laid out
before reading container dimensions. Fall back to viewport size instead
of hardcoded 800x600 when container reports zero dimensions. Add proper
MIME types for GLB/GLTF file serving.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implements the Crowdsurfing protocol (gospelofchange/Crowdsurfing) as an
rSpace module with full local-first Automerge CRDT sync. Users propose
activities with commitment thresholds, others swipe to join and declare
contributions, and activities trigger when enough people commit.
Module includes schemas, local-first client, swipe UI dashboard with
pointer gesture detection, landing page, seed template data, and
Vite build integration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The canvas header is stripped when served via renderShell (extractCanvasContent),
removing the #share-badge button. The JS then crashes on shareBadge.addEventListener
which prevents all canvas interaction. Add null guards for all share panel elements.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap formData() in try/catch with logging to diagnose Content-Type
issues through Cloudflare tunnel. Also fix client-side error handling
to clear progress timer and show actual error message on failure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Jeff Emmett
Jeff Emmett