OpenMerch SDK

Commit cb30fe6eb2 deletes multiplayer end to end. next-app lost src/sync (orchestrator, yjs adapter, awareness, predictive sync, telemetry), the collaboration components/hooks, the proof-snapshot JWT plumbing, the /api/canvasdo routes, and the whole orchestrator/awareness/collaborator slice of the editor store — undo/redo and the history timeline now run purely on the SDK CanvasService registry. shared dropped its yjs mapping modules. In worker-editor the 1,800-line CanvasDOYjs durable object is deleted; the MCP session/actions API it secretly hosted was re-homed verbatim into a dedicated McpSessionStore DO (wrangler migration v8-mcp-session-store), and jwt-auth lost its proof-scope and DO-name path sniffing. yjs, y-protocols, y-websocket, and lib0 are out of every package.json. Verified live: worker boots, MCP session create→action→readback round-trips on :5173, /design renders and edits with zero console errors on :3005. next-app + shared + worker typechecks clean; 155/155 worker tests and 25/25 touched next-app tests green, including new McpSessionStore coverage.

The studio surface is the first consumer of the full SDK stack: @openmerch/react is real (EditorProvider + hooks, its own boundary rules and tests), and studio's save path now flows through the DocumentController — DesignDocument in/out, a rolling design_versions row per draft, thumbnails to Cloudflare Images, old payload shapes folded forward on read with their writer deleted. Live parity gate caught two real engine bugs before sign-off: the mount baseline marked every freshly opened document dirty (phantom autosave on open), and undo was off-by-one — the first click restored the state you were already in. Both fixed at the source: history is now an explicit checkpoint model where mount re-baselines and a lone baseline is not undoable. Verified in the browser: open→idle, edit→Unsaved changes→Saving…→Saved, reload persists the design with undo/redo correctly disabled, single-click undo/redo round-trips. 497 core + 3 react tests green.

The whole canvas engine — Fabric object model, CanvasService with all its managers, event bridge, snapshot/export, guides — moved out of the app into @openmerch/core. ~40k lines, originals deleted, 168 app files rewritten to import the SDK, Tilpas-branded engine names neutralized. The engine's last app couplings (zustand stores, the dead multiplayer seam, a server action) were severed first in a separate surgical pass. Verified end to end: core's boundary check + 483 unit tests green, app typecheck green, and a live browser run — editor boots, draft creates, a rectangle lands on the canvas and in the layer list with zero page errors (screenshot below). Test debt went down, not up: 26 previously-failing fabric tests now pass under core's test setup.

First SDK code landed. @openmerch/core now holds the versioned document schema (one document owning N print-area subtrees), the save-state machine where "Saved" can only ever mean an acknowledged write (unit-tested), typed redacted error envelopes, and all five provider seams: persistence, asset storage, AI image ops, fonts, POD. Import boundaries are enforced in CI from the first commit — core physically cannot import React, Next, or app code. garment-ir is renamed to @openmerch/garment-ir. Now extracting the ~40k-line canvas engine out of the app: a surgical pass is severing its store/sync couplings in place, then the wholesale move into core.

Adversarial review done: an independent gpt-5.5 pass produced 20 evidence-backed findings; all folded into the spec. Biggest upgrades: a save-state machine where "Saved" only ever means an acknowledged write, versioned document schema with migrations, full undo/history semantics (batching, branch-aware, selection excluded), typed + redacted error envelopes on every provider seam, and a hard ordering rule — the SDK save path must prove save→reload parity before Yjs gets deleted. Now scaffolding @openmerch/* and the headless core.

All three surfaces baselined with reports + ~70 screenshots (committed + pushed). Headline finds: /design autosave is silently broken — saves ride the Yjs websocket, the client falls back to an anonymous token before the user session hydrates, and the worker rejects every connection; the UI shows "Saving…" forever and a reload loses your edits. Strongest possible validation of the "delete Yjs, save through an explicit persistence adapter" decision. Also root-caused the editor boot hang: worker-editor was missing its Printify API key (env drift — fixed, boot passes now). /customize has a squeezed order-summary line + hardcoded "tee" CTA; studio's hex input mangles 3-digit colors; /design's crop inputs render garbled digits. Full defect tables live in harness/evidence/openmerch-baseline/.

Found your pnpm dev next-app had died (port 3000 is your MedicalTextbook dev server); tilpas now runs on :3005 against the hosted dev Supabase. Provisioned QA fixture user qa-openmerch@tilpas.test via admin API. Three parallel QA agents are now exercising /customize, /tilpas/studio, and /design end to end with screenshot evidence, while a fourth maps all editor code for the SDK spec.

Repo cleaned: recovered the uncommitted buyer-pack task, deploy hygiene, and docs into three grouped commits on codex/sota-garment-twin-plan, then branched feat/openmerch-sdk. Code-map agent is sweeping all editor code; baseline QA of the three surfaces starts now.