Drop — Share & Co-edit

BPMN Kit Drop is the shortest path between a diagram on your machine and the person who needs to look at it. Drag a file onto the page, get a short link back, send it. Whoever opens the link sees the diagram rendered in their browser — no account, no modeler install, and no Camunda cluster anywhere in the story.

It is also where a review happens. A drop is not frozen: anyone with the link can take the edit baton, change the diagram, and everyone else watching sees the change arrive.

Sharing a file

Open https://bpmnkit.com/drop and drop a file onto the page — the whole page is the target — or paste one from the clipboard. .bpmn, .dmn and .form are all rendered; .xml and .json are accepted and sniffed for the kinds above.

The share id is 11 base58 characters — about 64 bits, so a drop is unguessable and unlistable, but it is not access-controlled: anyone holding the link can view the diagram and take a turn editing it. Treat a drop the way you would treat an unlisted link, not the way you would treat a private repository.

You can also start a drop from a diagram you just drew rather than a file you already had: the browser editor has Share as a drop in its main menu, which uploads the open diagram through the same endpoint and the same checks.

From the command line

A drop is a plain HTTP upload, so curl works:

curl -s -X POST https://bpmnkit.com/drop/api/drops \
  -F [email protected]
# → { "shareId": "7Fq2mKd9xTs", "url": "https://bpmnkit.com/drop/7Fq2mKd9xTs", "files": [...] }

And the stored file comes back either as uploaded or as the parsed model:

curl -s https://bpmnkit.com/drop/<shareId>/manifest.json
curl -s "https://bpmnkit.com/drop/<shareId>/f/order-process.bpmn"                # original bytes
curl -s "https://bpmnkit.com/drop/<shareId>/f/order-process.bpmn?format=json"    # @bpmnkit/core model

Reviewing it together

Everything below happens on the share page itself — there is nothing to install on either end.

Live presence. The topbar counts the people who have the drop open, and says when one of them is editing. A diagram moving under a reader’s eyes is only unsettling when nothing on the page explains it.

One writer at a time. Editing is a baton, not a merge. Press Edit to claim it and the diagram becomes editable for you and stays live for everyone else; press Done to hand it back. A second person pressing Edit while you hold it is told who has it. There is no conflict resolution because there is never a second writer to conflict with.

No save button. Changes persist as you make them, so there is no moment at which a reviewer can lose work by closing the tab — and none at which they can be asked whether they meant it. That is what makes the version log below load-bearing rather than a nicety.

Version history. Every file keeps the original it was uploaded as, pinned and never overwritten, plus its ten most recent milestones. Repeated saves inside an hour collapse into one milestone, and a new editing session always starts its own, so a stranger editing at 10:45 cannot overwrite the previous editor’s 10:30 state. Restoring appends: the state being replaced becomes a milestone first, so restoring can never be the thing that loses work. Undoing a restore is another restore.

Visual diff. Two drops can be put side by side at /drop/<before>/diff/<after>: added, removed, changed and moved elements marked on synchronised canvases, with pan and zoom locked together. The same diff is available offline as casen diff bpmn and as a plugin in @bpmnkit/plugins.

Editing is limited to BPMN files with a single process — the editor handles one process at a time — and the built-in demo drop is read-only, though Edit a copy will upload it as a drop of your own.

Rate limiting the edit baton

Because a drop is editable by anyone holding the link, claiming the baton can be put behind a Turnstile challenge — one challenge per editing session, not per keystroke. It is invisible to somebody who takes the baton once and edits for half an hour, and a real cost to a script that wants to rewrite every drop it can find. On a self-hosted deployment it is configuration (TURNSTILE_SITE_KEY and TURNSTILE_SECRET); with neither set, claims are not challenged.

Running your own

Drop is a single Cloudflare Worker in the monorepo (apps/drop), MIT-licensed like everything else. Files live in D1 as the typed @bpmnkit/core model alongside the byte-faithful original; presence and live editing are a Durable Object per share.

pnpm --filter @bpmnkit/drop build
wrangler d1 migrations apply bpmnkit-drop --local
wrangler dev --local --port 8787 \
  --var DROP_ADMIN_TOKEN:devtoken --var REPORT_IP_SALT:devsalt

That runs the Worker, D1 and the Durable Object in a local simulator, so the whole app works offline with no Cloudflare account. For a real deployment, pnpm --filter @bpmnkit/drop provision is an idempotent script that creates the database, applies the migrations, builds the client bundles and deploys the Worker; re-running it skips whatever is already in place. See apps/drop/DEPLOY.md for the full runbook.

What Drop is not

• Not a permission system. Link-holders are editors. If a diagram should not be editable by whoever it reaches, do not put it in a drop.
• Not storage. A drop expires 90 days after it was last touched, and the version log holds eleven states, not every state.
• Not a modeler. It renders and edits one process at a time. For authoring, use the browser editor, the VS Code extension or the builder API.