Logux DB refactoring

.claude/settings.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "pnpm quick || exit 2"
+            "command": "out=$(pnpm -w quick 2>&1) || { printf '%s\\n' \"$out\" >&2; exit 2; }"
           }
         ]
       }

.devcontainer/Dockerfile

@@ -2,19 +2,22 @@
 # so every developer will have the same environment
 
 # registry.fedoraproject.org/fedora:44
-FROM registry.fedoraproject.org/fedora@sha256:590825dbaee41a97a162ecdffc3305264bd11cb3ff1e9cfd710d41ca5f936134
+FROM registry.fedoraproject.org/fedora@sha256:b4087c9dd39f6bc163b4f5da1534328f093892ed586b70d0b1ab9c68e354865d
 
 ARG TARGETARCH
 
-ENV NODE_VERSION=26.5.1 \
-  NODE_CHECKSUM_X64=cc7b3484ade63bd203a9d304f21ec37a3b622b988d7bdecf1dc4d68fc44a91b7 \
-  NODE_CHECKSUM_ARM64=0b6b0cc2a1eecbe736f9918de8b5a6c9a48d286b88bec1298a3c1e3376182ea8
+ENV NODE_VERSION=26.7.0 \
+  NODE_CHECKSUM_X64=982aa24dd8be4c889c6a8ab337ddff3b0896645b20f4239356e80552c16277ee \
+  NODE_CHECKSUM_ARM64=afc7a004018485092ac8985b817b0d5684472bd9472e0b57d2ab88737e50090d
 
-ENV PNPM_VERSION=11.18.0 \
-  PNPM_CHECKSUM_X64=f4e62794c56f7a1ad01097f94b90ca95680080aa2e83ebc3d0a751fb8aa8e4ad \
-  PNPM_CHECKSUM_ARM64=f9c09bb564421d9d39dfff60af41df88a4864af5637afdabe5f54d12853f8426
+ENV PNPM_VERSION=11.21.0 \
+  PNPM_CHECKSUM_X64=aadc489ce4473c2af0fec06a5c19e113b5793d404eac49853c8153bf4b0d8263 \
+  PNPM_CHECKSUM_ARM64=64eb219b008f7a4c176d81fbce919c20b0b7e093e815cbb669d46e681451f43b
 
 RUN dnf install -yq zsh micro git tig psmisc procps-ng awk libatomic wget \
+  gtk3 nss nspr alsa-lib cups-libs mesa-libgbm dbus-libs libX11-xcb \
+  libXcomposite libXdamage libXrandr libXcursor libXi libxkbcommon \
+  google-noto-sans-fonts google-noto-emoji-fonts \
   && dnf clean all \
   && rm -rf /var/cache/dnf
 

.devcontainer/devcontainer.json

@@ -4,6 +4,9 @@
   },
   "runArgs": [
     "--net=bridge",
+    "--shm-size=1g",
+    "--security-opt",
+    "seccomp=unconfined",
     "-p",
     "2553:2553",
     "-p",

.github/actions/deploy/action.yml

@@ -35,7 +35,7 @@ runs:
         INPUTS_TAG: ${{ inputs.tag }}
         INPUTS_CONTEXT: ${{ inputs.context }}
     - name: Login to GitHub Container Registry
-      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}

.github/actions/init-node/action.yml

@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
     - name: Install Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:

.github/workflows/audit.yml

@@ -14,15 +14,15 @@ on:
       - pnpm-lock.yaml
   schedule:
     - cron: '00 23 * * *' # Runs at midnight UTC every day
-permissions:
-  contents: read
 jobs:
   audit:
     name: Audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -48,9 +48,12 @@ jobs:
   socket:
     name: Check via Socket
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -80,4 +83,5 @@ jobs:
           socketcli \
             --target-path $GITHUB_WORKSPACE \
             --scm github \
-            --pr-number $PR_NUMBER
+            --pr-number $PR_NUMBER \
+            --disable-overview

.github/workflows/clean-images.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/docs.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit # Allow all to validate links
       - name: Checkout the repository

.github/workflows/format.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -33,7 +33,8 @@ jobs:
       - name: Checkout the repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          persist-credentials: false
+          persist-credentials: true
+          ref: ${{ github.head_ref || github.ref_name }}
       - name: Initialize Node.js
         uses: ./.github/actions/init-node
       - name: Check for today commits

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/messages.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/preview-clean.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/preview-close.yml

@@ -25,7 +25,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'preview')
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/preview-deploy.yml

@@ -18,7 +18,7 @@ jobs:
       group: staging-web
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -70,7 +70,7 @@ jobs:
       - name: Load Docker image
         run: docker load < image.tar
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/preview-prepare.yml

@@ -27,7 +27,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'preview')
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/workflows.yml

@@ -24,6 +24,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint CI workflows
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           advanced-security: false

.mcp.json

@@ -0,0 +1,44 @@
+{
+  "mcpServers": {
+    "chromium": {
+      "args": [
+        "-c",
+        "./node_modules/.bin/playwright-mcp install-browser chromium 1>&2 && exec ./node_modules/.bin/playwright-mcp \"$@\"",
+        "playwright-mcp",
+        "--headless",
+        "--browser",
+        "chromium",
+        "--caps",
+        "devtools",
+        "--viewport-size",
+        "1280,800",
+        "--user-data-dir",
+        "/home/developer/.local/share/playwright-chromium",
+        "--output-dir",
+        "/home/developer/.local/share/playwright-output/chromium",
+        "--save-session"
+      ],
+      "command": "sh"
+    },
+    "firefox": {
+      "args": [
+        "-c",
+        "./node_modules/.bin/playwright-mcp install-browser firefox 1>&2 && exec ./node_modules/.bin/playwright-mcp \"$@\"",
+        "playwright-mcp",
+        "--headless",
+        "--browser",
+        "firefox",
+        "--caps",
+        "devtools",
+        "--viewport-size",
+        "1280,800",
+        "--user-data-dir",
+        "/home/developer/.local/share/playwright-firefox",
+        "--output-dir",
+        "/home/developer/.local/share/playwright-output/firefox",
+        "--save-session"
+      ],
+      "command": "sh"
+    }
+  }
+}

.node-version

@@ -1 +1 @@
-26.5.1
+26.7.0

AGENTS.md

@@ -16,6 +16,8 @@ In all interactions, plans, and commit messages, be extremely concise and sacrif
 ## Architecture
 
 - Avoid adding dependencies.
+- Keep non-browser logic in `core/`. Client folders should have only environment-specific code.
+- Update `README.md` of the package on every new script, folder, or tool.
 
 ## LLMS
 
@@ -27,3 +29,7 @@ In all interactions, plans, and commit messages, be extremely concise and sacrif
 ## Testing
 
 - Run specific test by `pnpm bnt path/to/test.test.ts -t 'test name'`
+
+## Browser
+
+- Use Playwright MCP for visual issues and client database bugs. See [docs/browser.md](./docs/browser.md).

CONTRIBUTING.md

@@ -81,11 +81,10 @@ To fill your web clients with real posts:
 4. Open browser DevTools.
 5. Run `fillFeedsWithPosts()`.
 
-To run the visual testing tool (Storybook), run it from the `web/` folder:
+To run the visual testing tool (Storybook):
 
 ```sh
-cd web/
-pnpm visual
+pnpm -F web visual
 ```
 
 It will show all UI components and all possible states of pages. It is the best tool to test browser compatibility or change CSS.

README.md

@@ -77,7 +77,7 @@ The source of truth in the client is a list of changes (action log). An action i
 }
 ```
 
-To render the UI, the client reduces actions from the log into the state (objects of feeds, posts, etc.). We store the state cache in [Nano Stores](https://github.com/nanostores/nanostores).
+To render the UI, the client reduces actions from the log into SQL tables (feeds, posts, etc.) defined in [`core/schema.ts`](./core/schema.ts). The UI subscribes to reactive SQL queries from [Nano Stores SQL](https://github.com/nanostores/sql). Web keeps the database in SQLite compiled to WebAssembly, Node.js tests use in-memory SQLite.
 
 The log simplifies synchronization. We just need to track the last synchronized action and send all actions after that one.
 
@@ -137,11 +137,11 @@ Each project has its own tools, too.
 - `pnpm test`: run all tests.
 - `pnpm quick`: run quick checks for changed files.
 - `pnpm offline`: run all tests expect which need Internet. It is useful for developing in airplane/train.
-- `pnpm start`: run proxy and web client development server.
+- `pnpm start`: run server and web client development server.
 - `pnpm format`: fix code style in all files.
 - `pnpm clean`: remove all temporary files.
-- `pnpm check-opml`: test loaders with user’s OPML RSS export.
-- `pnpm test-loaders`: test loaders with different blogging platforms.
+- `pnpm -F loader-tests check-opml`: test loaders with user’s OPML RSS export.
+- `pnpm -F loader-tests test`: test loaders with different blogging platforms.
 - `pnpm unused-messages`: check that all messages are used.
 - `pnpm update-env`: check for Node.js and pnpm updates.
 - `pnpm update-review`: run Multiocular to review updates.
@@ -177,13 +177,10 @@ The server doesn’t see those actions because clients encrypt them before sendi
 
 ## Client Storage
 
-The clients store a list of changes (action log). Durin
-console.log(client1.log.entries())g the start, the client reduces all necessary actions from the log to the [Logux SyncMap stores](https://logux.org/web-api/#globals-syncmaptemplate).
+The clients store a list of changes (action log). During the start, the client reduces all necessary actions from the log to the SQLite table on OPFS.
 
 For simple things like client local settings, we use [Nano Store Persistent](https://github.com/nanostores/persistent).
 
-The web client uses IndexedDB to store log and `localStorage` for the client’s settings.
-
 ## Test Strategy
 
 If any mistake happens a few times, we should add an automatic tool to **prevent mistakes** in the future. Possible strategies:
@@ -239,7 +236,7 @@ How we choose dependencies:
 
 You can use [bundlejs.com](https://bundlejs.com/) and [npmgraph.js.org](https://npmgraph.js.org) to get the size in bundle, `node_modules`, and number of sub-dependencies.
 
-After adding a web client dependency, do not forget to call `cd web && pnpm size` to check the real size of dependency in our JS bundle.
+After adding a web client dependency, do not forget to call `pnpm -F web size` to check the real size of dependency in our JS bundle.
 
 We put to `dependencies` only dependencies we need for production deploy. All other dependencies you should put to `devDependencies`. During production deploy we will use `pnpm install --prod` to reduce security risks of having malicious code in some dependency.
 

api/http/utils.ts

@@ -76,9 +76,7 @@ export function createRequester<Params extends object, ResponseJSON>(
 }
 
 export interface Endpoint<
-  // Need to put it inside type to pass all types to server in a single variable
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  Response,
+  _Response,
   Request,
   UrlParams extends Record<string, string> = Record<never, string>
 > {

api/package.json

@@ -7,13 +7,13 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@logux/actions": "0.5.0"
+    "@logux/actions": "github:logux/actions#next"
   },
   "devDependencies": {
-    "@logux/core": "0.10.0"
+    "@logux/core": "github:logux/core#next"
   },
   "engines": {
-    "node": "^26.5.0",
+    "node": "^26.7.0",
     "pnpm": "^11.0.0"
   }
 }