spb/sp-drive

1# CLAUDE.md — SP Drive23Self-hosted document storage for https://drive.spboucher.ai on the MacLustr cluster. The owner's full brief is in4`docs/brief.md`; decisions are in `docs/architecture.md`; what is really done is in `docs/progress.md`.56## Rules78- Real code only: every file, permission and event is persisted; no mock, no fake link, no inert button.9- After the first deployment the source of truth is the clone on the node (`mld status` → sp-drive); edit there, then10  `git push`. This laptop copy only served to create the app.11- Never touch SP Wallet or another service. Secrets stay out of the repository.12- Never log document content, link tokens or passwords. Public URLs are redacted in the request log.13- Every route that takes an identifier scopes it by owner; a foreign identifier answers 404.14- A directory named `icons` is ignored by the owner's global gitignore (`Icon?`): do not create one.1516## Commands1718```19pnpm install20pnpm typecheck          # shared, api, web, service worker21pnpm test               # vitest: real PostgreSQL (sp_drive_test), real clamd when ~/.cache/sp-drive-clamav has signatures22pnpm build              # dist/api.mjs, worker.mjs, cli.mjs, sheet-child.mjs, dist/web23scripts/dev-stack.sh    # API :8661 + web http://localhost:5183 ; scripts/dev-invite.sh <email> [--admin]24pnpm e2e                # Playwright against the dev stack25```2627## Layout2829`packages/shared` naming rules and limits · `services/api/src` API, worker, CLI, migrations · `apps/web/src` React app ·30`tests/e2e` Playwright · `infra` node configuration (clamd, mld manifest template) · `scripts` build, dev, backup, restore test.31