@leumas/touchdesign-web
Leumas Touchdesign at touchdesign.leumas.tech — node graphs that draw. Build generative visuals in the browser and export them anywhere: embed, subdomain, Infinity Display, video.
@leumas/touchdesign-web — Leumas Touchdesign at touchdesign.leumas.tech
Node graphs that draw — build generative visuals in the browser and export them anywhere: embed, subdomain, Infinity Display, video.
Status: built. Blueprint: products/TODOS/touchdesign.leumas.tech.md (§6a records the decisions made while building).
What is where
| Piece | Lives in |
|---|---|
| The runtime, the 43 nodes, the 19 demos, the frame loop, the player | @leumas/touchdesign (shared/packages/touchdesign) |
| The xyflow editor and the Studio workspace | @leumas/touchdesign/editor · @leumas/touchdesign/workspace |
| The Imperium render mode and the HUD widget | @leumas/touchdesign/register · @leumas/touchdesign/hud-widget |
| The API | products/leumas-api/src/{controllers,routes}/touchdesign.js → /api/touchdesign/* (dynamic td_designs, td_renders) |
| The render runner (headless Chrome + ffmpeg) | products/leumas-api/src/jobs/touchdesignRender.js |
| The money | policy.js touchdesign.* (floor: run, export, 10s watermarked renders; tiers: saves, publish, render seconds) |
| The Studio app | shared/apps/touchdesign · /admin/touchdesign |
| The SDK | @leumas/touchdesign-sdk |
| This site | src/content/pages.js (the prose as data) · src/content/nodes.generated.js (from the engine at build) · src/screens/* |
| Guards | pnpm check:touchdesign-public · pnpm smoke:touchdesign-site |
Why this can read a visitor's session with no configuration
touchdesign.leumas.tech is a platform-owned Imperium site row (shared/services/index/src/touchdesignSite.js), served by the Imperium worker behind the IIS *.leumas.tech wildcard. That worker forwards /api and the auth prefixes to leumas-api preserving the visitor's Host header and their cookies, so every API call is same-origin.
[warning] Never set VITE_API_BASE. The session cookie is httpOnly and same-origin; an absolute API origin turns every authenticated call cross-origin and the page renders as permanently signed out.
Running it
pnpm dev:api # :3000
pnpm dev:touchdesign # :5079
pnpm --filter @leumas/touchdesign-web build
pnpm check:touchdesign-public && pnpm smoke:touchdesign-site[warning] pnpm deploy:touchdesign copies files but carries no release stamp. Only pnpm ship applies.
The two lists that must never disagree
src/pages.js holds PAGES and NOINDEX, derived from src/content/pages.js. Every route the router renders is in one of them; a route in neither is what check:touchdesign-public exists to catch. The sitemap, llms.txt, robots.txt and the guard all read that one file.