# @leumas/touchdesign-web — Leumas Touchdesign at touchdesign.leumas.tech

Leumas Touchdesign at touchdesign.leumas.tech — node graphs that draw. Build generative visuals in the browser and export them anywhere: embed, subdomain, Infinity Display, video.


Node graphs that draw — build generative visuals in the browser and export them anywhere: embed,
subdomain, Infinity Display, video.

**Status: built.** Blueprint: [`products/TODOS/touchdesign.leumas.tech.md`](../TODOS/touchdesign.leumas.tech.md)
(§6a records the decisions made while building).

## What is where

| Piece | Lives in |
|---|---|
| The runtime, the 43 nodes, the 19 demos, the frame loop, the player | `@leumas/touchdesign` (`shared/packages/touchdesign`) |
| The xyflow editor and the Studio workspace | `@leumas/touchdesign/editor` · `@leumas/touchdesign/workspace` |
| The Imperium render mode and the HUD widget | `@leumas/touchdesign/register` · `@leumas/touchdesign/hud-widget` |
| The API | `products/leumas-api/src/{controllers,routes}/touchdesign.js` → `/api/touchdesign/*` (dynamic `td_designs`, `td_renders`) |
| The render runner (headless Chrome + ffmpeg) | `products/leumas-api/src/jobs/touchdesignRender.js` |
| The money | `policy.js` `touchdesign.*` (floor: run, export, 10s watermarked renders; tiers: saves, publish, render seconds) |
| The Studio app | `shared/apps/touchdesign` · `/admin/touchdesign` |
| The SDK | `@leumas/touchdesign-sdk` |
| This site | `src/content/pages.js` (the prose as data) · `src/content/nodes.generated.js` (from the engine at build) · `src/screens/*` |
| Guards | `pnpm check:touchdesign-public` · `pnpm smoke:touchdesign-site` |

## Why this can read a visitor's session with no configuration

`touchdesign.leumas.tech` is a platform-owned Imperium site row
(`shared/services/index/src/touchdesignSite.js`), served by the Imperium worker behind the IIS
`*.leumas.tech` wildcard. That worker forwards `/api` and the auth prefixes to leumas-api
**preserving the visitor's Host header and their cookies**, so every API call is same-origin.

[warning] **Never set `VITE_API_BASE`.** The session cookie is httpOnly and same-origin; an absolute API
origin turns every authenticated call cross-origin and the page renders as permanently signed out.

## Running it

```bash
pnpm dev:api                                    # :3000
pnpm dev:touchdesign                            # :5079
pnpm --filter @leumas/touchdesign-web build
pnpm check:touchdesign-public && pnpm smoke:touchdesign-site
```

[warning] `pnpm deploy:touchdesign` copies files but carries **no release stamp**. Only `pnpm ship` applies.

## The two lists that must never disagree

`src/pages.js` holds `PAGES` and `NOINDEX`, derived from `src/content/pages.js`. Every route the
router renders is in one of them; a route in neither is what `check:touchdesign-public` exists to
catch. The sitemap, llms.txt, robots.txt and the guard all read that one file.


---
Source: products/leumas-touchdesign/README.md
Canonical: https://docs.leumas.tech/p/products/touchdesign-web