3 Commits

Include renames

Author	SHA1	Message	Date
kcar	67e47fc47f	feat(tlsync): fetch short-lived token from API before multiplayer connect ... - Remove VITE_TLSYNC_SECRET from browser env (no longer exposed to bundle) - Add useTlsyncToken hook that fetches /api/tlsync/token with Supabase auth - Extract TldrawCanvas sub-component: only renders after token is ready - Pass API-issued short-lived token to createSyncConnectionOptions - Add vite.config.ts blocklist to prevent secret leak (defense-in-depth) - Remove VITE_TLSYNC_SECRET from .env.example (server-side only now) Related: t_a69128a1 (API token endpoint), t_41a844a7 (this task)	2026-05-28 18:00:43 +01:00
kcarandClaude Sonnet 4.6	d3c2a9bdff	security: pass TLSYNC_SECRET token in sync WebSocket URI ... Reads VITE_TLSYNC_SECRET from env and appends ?token=... to the /connect/:roomId WebSocket URI so tlsync server can authenticate connections. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-05-21 17:09:39 +00:00
kcar	8a7ab3ac24	Initial commit	2025-07-11 13:21:49 +00:00