feat: Phase 1a — Map Editor

.claude/settings.json

@@ -1,32 +1,34 @@
 {
-  "permissions": {
-    "allow": [
-      "Bash(pnpm --filter @triplanetary/server db:migrate)",
-      "Bash(DATABASE_URL=postgresql://triplanetary:triplanetary@localhost:5432/triplanetary pnpm db:migrate)",
-      "Bash(DATABASE_URL=postgresql://triplanetary:triplanetary@localhost:5432/triplanetary ./node_modules/.bin/drizzle-kit migrate)",
-      "Bash(docker exec:*)",
-      "Bash(pnpm --filter @triplanetary/server test)",
-      "Bash(pnpm view:*)",
-      "Bash(node -e \"import\\('boardgame.io/server'\\).then\\(m => console.log\\(Object.keys\\(m\\)\\)\\)\")",
-      "Bash(node -e \"import\\('boardgame.io/server'\\).then\\(m => { const s = m.Server\\({ games: [] }\\); console.log\\(Object.keys\\(s\\)\\); }\\)\")",
-      "Bash(node -e \"const m = require\\('boardgame.io/server'\\); const s = m.Server\\({ games: [] }\\); console.log\\(Object.keys\\(s\\)\\);\")",
-      "Bash(node -e \"const m = require\\('boardgame.io/server'\\); const s = m.Server\\({ games: [], origins: ['http://localhost:3000'] }\\); console.log\\(s.app.constructor.name\\); console.log\\(typeof s.app.use\\);\")",
-      "Bash(node -e \"const m = require\\('./packages/server/node_modules/boardgame.io/dist/cjs/server.js'\\); const s = m.Server\\({ games: [], origins: ['http://localhost:3000'] }\\); console.log\\(s.app.constructor.name\\); console.log\\(typeof s.app.use\\); console.log\\(typeof s.router\\);\")",
-      "Bash(node -e \"const m = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/boardgame.io@0.50.2/node_modules/boardgame.io/dist/cjs/server.js'\\); const s = m.Server\\({ games: [], origins: ['http://localhost:3000'] }\\); console.log\\('app type:', s.app.constructor.name\\); console.log\\('router type:', typeof s.router\\); console.log\\('router keys:', s.router && Object.keys\\(s.router\\).slice\\(0,5\\)\\);\")",
-      "Bash(timeout 8 tsx src/index.ts)",
-      "Bash(pnpm --filter @triplanetary/server exec timeout 8 tsx src/index.ts)",
-      "Bash(curl -s localhost:8000/api/health)",
-      "Bash(curl -s localhost:8000/games)",
-      "Bash(node -e \"const p = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/boardgame.io@0.50.2/node_modules/boardgame.io/package.json'\\); console.log\\(JSON.stringify\\(p.exports, null, 2\\)\\)\")",
-      "Bash(node -e \"const p = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/boardgame.io@0.50.2/node_modules/boardgame.io/package.json'\\); console.log\\(p.main, p.module, p.types\\)\")",
-      "Read(//private/tmp/**)",
-      "Bash(node -e \"const f = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/is-generator-function@1.1.2/node_modules/generator-function/index.js'\\); console.log\\(typeof f, f\\(\\)\\)\")",
-      "Bash(node -e \"const f = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/is-generator-function@1.1.2/node_modules/is-generator-function/index.js'\\); console.log\\(f\\(async function\\(\\){}\\), f\\(function*\\(\\){}\\)\\)\")",
-      "Bash(node -e \"const cjs = require\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/boardgame.io@0.50.2/node_modules/boardgame.io/dist/cjs/server.js'\\); const s = cjs.Server\\({ games: [], origins: ['http://localhost:3000'] }\\); s.app.use\\(function\\(ctx, next\\) { return next\\(\\); }\\); console.log\\('koa app.use works'\\)\")",
-      "Bash(node -e ':*)",
-      "Bash(node -e \"const src = require\\('fs'\\).readFileSync\\('/Users/sam/Code/triplanetary/node_modules/.pnpm/boardgame.io@0.50.2/node_modules/boardgame.io/dist/cjs/server.js', 'utf8'\\); const idx = src.indexOf\\('run\\('\\); console.log\\(src.slice\\(idx, idx+600\\)\\);\")",
-      "Bash(pnpm add:*)",
-      "Bash(pnpm --filter @triplanetary/client test)"
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./scripts/post-edit-lint.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./scripts/post-edit-lint.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./scripts/post-edit-lint.sh"
+          }
+        ]
+      }
     ]
-  }
+  },
+  "permissions": {}
 }

.github/workflows/ci.yml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  lint-typecheck:
+    name: Lint & Typecheck
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build shared
+        run: pnpm --filter @triplanetary/shared build
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: triplanetary
+          POSTGRES_PASSWORD: triplanetary
+          POSTGRES_DB: triplanetary
+        ports:
+          - 5433:5432
+        options: >-
+          --health-cmd "pg_isready -U triplanetary -d triplanetary -h localhost"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DATABASE_URL: postgresql://triplanetary:triplanetary@localhost:5433/triplanetary
+      SESSION_SECRET: ci-test-secret
+      NODE_ENV: test
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build shared
+        run: pnpm --filter @triplanetary/shared build
+
+      - name: Wait for Postgres
+        run: |
+          for i in {1..30}; do
+            (echo > /dev/tcp/localhost/5433) >/dev/null 2>&1 && exit 0
+            echo "Postgres not ready yet ($i/30)..."
+            sleep 2
+          done
+          echo "Postgres did not become ready in time" >&2
+          exit 1
+
+      - name: Run migrations
+        run: pnpm --filter @triplanetary/server db:migrate
+
+      - name: Test
+        run: pnpm test
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build

.gitignore

@@ -4,3 +4,4 @@ dist/
 .turbo/
 *.tsbuildinfo
 .worktrees/
+.claude/settings.local.json

CLAUDE.md

@@ -115,3 +115,52 @@ pnpm --filter @triplanetary/shared build
 - **Phase 2** — Game engine (vector movement, gravity, combat)
 - **Phase 3** — Lobby refinements, multiplayer polish
 - **Phase 4** — AI bot
+
+---
+
+## Decision Log
+
+Append entries here whenever an architectural, convention, or tooling decision is made.
+
+### Single-port Koa server (boardgame.io + custom routes)
+boardgame.io's built-in Koa server is the only backend process. Custom `/api/*` routes mount directly on its Koa app rather than a separate server. Avoids a second port and proxying complexity. All custom middleware must be Koa-compatible; boardgame.io's internal routing conventions must be respected.
+
+### CommonJS for `shared` and `server` packages
+boardgame.io 0.50.x ships CJS-only with no ESM exports map — any ESM import fails. Do not add `"type": "module"` to `packages/shared` or `packages/server`. `packages/client` is ESM (Vite handles bundling).
+
+### ts-node --transpile-only as server dev runner (not tsx)
+tsx v4's ESM loader pollutes the CJS module cache, causing `TypeError: getGeneratorFunction is not a function` in koa-passport. Do not switch back to `tsx watch`. Note: transpile-only skips type checking at dev-server startup — run `pnpm typecheck` separately.
+
+### bodyParser scoped to /api router
+`koa-bodyparser` at app-level consumes the request stream before boardgame.io's `co-body` parser runs → `InternalServerError: stream is not readable` on match creation. Scope it to the `/api` Router only.
+
+### PostgreSQL on port 5433
+Port 5432 conflicts with a locally installed PostgreSQL. All connection strings and CI service definitions target `:5433`.
+
+### Custom pg session store (not connect-pg-simple)
+connect-pg-simple has CJS/ESM resolution issues in this module setup. Hand-rolled store in `session.ts` using plain `pool.query`. Expire column uses `NOW() + ($n * INTERVAL '1 millisecond')` — passing a JS `Date` into a `timestamp WITHOUT TIME ZONE` column strips timezone and causes `expire > NOW()` comparisons to fail.
+
+### Custom migration runner (not drizzle-kit migrate)
+drizzle-kit's `migrate` CLI fails with CJS/ESM resolution errors. Migrations are applied via `packages/server/src/db/migrate.ts` (run with `tsx`). New migration files must be manually registered in `meta/_journal.json`. CI calls `pnpm --filter @triplanetary/server db:migrate` (bypasses turbo) so `DATABASE_URL` reaches the subprocess.
+
+### Turbo env passthrough: declare env vars in turbo.json
+Turbo v2 does not forward env vars to task subprocesses unless declared under `"env": [...]` in the task config. Any task that reads env vars at runtime must declare them there.
+
+### Vite alias: @triplanetary/shared → TypeScript source
+Vite/Rollup cannot statically analyse `__exportStar` from tsc's CJS output — named exports appear missing at bundle time. `vite.config.ts` aliases `@triplanetary/shared` to `../shared/src/index.ts`. The server still imports from the compiled `dist/`.
+
+### Vitest fork isolation for server integration tests
+`pool: 'forks'` + `poolOptions: { forks: { isolate: true } }` in `packages/server/vitest.config.ts`. Without this, `pool.end()` in one test file's `afterAll` terminates the shared pg Pool used by concurrently-running test files.
+
+### Per-file email namespacing for server integration tests
+Test files run concurrently. A broad `DELETE FROM users` in one file's `beforeAll` races with another file's user registration. Each file owns a unique email prefix and cleans up only its own rows:
+
+| File | Namespace |
+|---|---|
+| `auth.test.ts` | `test@example.com` |
+| `auth-validation.test.ts` | `auth-val-*@test.com` |
+| `maps.test.ts` | `mapeditor-*@test.com` |
+| `maps-export.test.ts` | `export-test@test.com` |
+| `session.test.ts` | `test-session-*` (session table only) |
+
+New integration test files must choose a unique prefix and clean up only that prefix.