feat: promote dev foundation and launch prep to main

.env.example

@@ -0,0 +1,16 @@
+# Workspace-level shared defaults
+NODE_ENV="development"
+
+# Convex
+WRAPPER_CONVEX_URL="https://your-project.convex.cloud"
+CONVEX_URL="https://your-project.convex.cloud"
+
+# Web/auth origin
+SITE_URL="http://localhost:3000"
+WRAPPER_AUTH_ORIGIN="http://localhost:3000"
+
+# Relay
+WRAPPER_RELAY_URL="ws://localhost:8080"
+
+# Billing entitlement (backend)
+WRAPPER_AUTUMN_RELAY_SHARE_FEATURE_ID="can_share_relay"

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - dev
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fast:
+    name: Fast lane (lint/format/types)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.5"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Lint
+        run: bunx turbo run lint
+
+      - name: Format check
+        run: bunx turbo run format:check
+
+      - name: Type check
+        run: bunx turbo run check-types
+
+  full:
+    name: Full lane (unit + e2e + relay smoke)
+    runs-on: ubuntu-latest
+    needs: fast
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.5"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Test
+        run: bunx turbo run test
+
+      - name: Web production build
+        run: bun run --cwd apps/web build
+        env:
+          BETTER_AUTH_SECRET: ci-better-auth-secret
+          ENVIRONMENT: production
+          NEXT_PUBLIC_CONVEX_URL: https://example.convex.cloud
+          NEXT_PUBLIC_CONVEX_SITE_URL: https://example.convex.site
+
+      - name: Web Cloudflare bundle build
+        run: bun run --cwd apps/web build:cloudflare
+        env:
+          BETTER_AUTH_SECRET: ci-better-auth-secret
+          ENVIRONMENT: production
+          NEXT_PUBLIC_CONVEX_URL: https://example.convex.cloud
+          NEXT_PUBLIC_CONVEX_SITE_URL: https://example.convex.site
+
+      - name: Backend deploy dry run
+        run: |
+          if [ -z "$CONVEX_DEPLOY_KEY" ]; then
+            echo "::warning::CONVEX_DEPLOY_KEY is not configured; skipping Convex deploy dry-run."
+            exit 0
+          fi
+          bun run --cwd packages/backend deploy:dry-run
+        env:
+          BETTER_AUTH_SECRET: ci-better-auth-secret
+          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
+          ENVIRONMENT: production
+
+      - name: Relay smoke (local runtime)
+        run: |
+          CONVEX_URL="https://example.convex.cloud" bun run --cwd apps/relay start &
+          RELAY_PID=$!
+          trap "kill $RELAY_PID" EXIT
+          sleep 3
+          RELAY_URL="http://127.0.0.1:8080" bun run --cwd apps/relay smoke

.github/workflows/fly-deploy.yml

@@ -0,0 +1,34 @@
+# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
+
+name: Fly Deploy
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "apps/relay/**"
+      - ".github/workflows/fly-deploy.yml"
+  workflow_dispatch:
+jobs:
+  deploy:
+    name: Deploy relay app
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-relay-group
+      cancel-in-progress: false
+    env:
+      FLY_APP_NAME: wrapper-dry-pathway-1935
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.5"
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+      - run: flyctl deploy --remote-only --config apps/relay/fly.toml --app "$FLY_APP_NAME"
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+      - run: |
+          RELAY_URL="https://${FLY_APP_NAME}.fly.dev" bun run --cwd apps/relay smoke
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

.github/workflows/lint-format.yml

@@ -0,0 +1,34 @@
+name: Lint and Format
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - dev
+
+concurrency:
+  group: lint-format-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-format:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.5"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Lint
+        run: bunx turbo run lint
+
+      - name: Format check
+        run: bunx turbo run format:check

.github/workflows/release-cli.yml

@@ -0,0 +1,161 @@
+name: Release CLI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/cli/**"
+      - ".github/workflows/release-cli.yml"
+      - ".github/workflows/update-homebrew-tap.yml"
+  workflow_dispatch:
+
+jobs:
+  check-version:
+    name: Check CLI Version Change
+    runs-on: ubuntu-latest
+    outputs:
+      version-changed: ${{ steps.check.outputs.changed }}
+      new-version: ${{ steps.check.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Check if version changed
+        id: check
+        run: |
+          CURRENT=$(node -p "require('./apps/cli/package.json').version")
+          echo "version=$CURRENT" >> $GITHUB_OUTPUT
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          git checkout HEAD~1 -- apps/cli/package.json 2>/dev/null || true
+          PREVIOUS=$(node -p "require('./apps/cli/package.json').version" 2>/dev/null || echo "0.0.0")
+          git checkout HEAD -- apps/cli/package.json
+
+          if [ "$CURRENT" != "$PREVIOUS" ]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+
+  build-cli:
+    name: Build CLI (${{ matrix.platform }})
+    needs: check-version
+    if: needs.check-version.outputs.version-changed == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            platform: darwin-arm64
+            target: bun-darwin-arm64
+            archive: wrapper-darwin-arm64.tar.gz
+            helper: wrapper-pty-helper-aarch64-macos-none
+          - os: macos-latest
+            platform: darwin-x64
+            target: bun-darwin-x64
+            archive: wrapper-darwin-x86_64.tar.gz
+            helper: wrapper-pty-helper-x86_64-macos-none
+          - os: ubuntu-latest
+            platform: linux-x64
+            target: bun-linux-x64
+            archive: wrapper-linux-x86_64.tar.gz
+            helper: wrapper-pty-helper-x86_64-linux-musl
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.5"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Build standalone binary
+        run: |
+          mkdir -p dist
+          bun build --compile --target="${{ matrix.target }}" apps/cli/index.ts --outfile dist/wrapper
+
+      - name: Package archive
+        run: |
+          mkdir -p staging/bin
+          cp dist/wrapper staging/bin/wrapper
+          chmod +x staging/bin/wrapper
+          cp "apps/cli/bin/${{ matrix.helper }}" "staging/bin/${{ matrix.helper }}"
+          tar -czf "dist/${{ matrix.archive }}" -C staging .
+
+      - name: Upload archive artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-${{ matrix.platform }}
+          path: dist/${{ matrix.archive }}
+          if-no-files-found: error
+
+  release:
+    name: Create GitHub Release
+    needs: [check-version, build-cli]
+    if: needs.check-version.outputs.version-changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      sha_darwin_arm64: ${{ steps.shas.outputs.sha_darwin_arm64 }}
+      sha_darwin_x64: ${{ steps.shas.outputs.sha_darwin_x64 }}
+      sha_linux_x64: ${{ steps.shas.outputs.sha_linux_x64 }}
+    env:
+      VERSION: ${{ needs.check-version.outputs.new-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download archives
+        uses: actions/download-artifact@v4
+        with:
+          pattern: cli-*
+          path: dist
+          merge-multiple: true
+
+      - name: Compute checksums
+        id: shas
+        run: |
+          echo "sha_darwin_arm64=$(sha256sum dist/wrapper-darwin-arm64.tar.gz | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+          echo "sha_darwin_x64=$(sha256sum dist/wrapper-darwin-x86_64.tar.gz | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+          echo "sha_linux_x64=$(sha256sum dist/wrapper-linux-x86_64.tar.gz | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Write checksums file
+        run: |
+          cd dist
+          sha256sum wrapper-darwin-arm64.tar.gz wrapper-darwin-x86_64.tar.gz wrapper-linux-x86_64.tar.gz > checksums.txt
+          cat checksums.txt
+
+      - name: Create or update release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ env.VERSION }}
+          name: Wrapper v${{ env.VERSION }}
+          generate_release_notes: true
+          files: |
+            dist/wrapper-darwin-arm64.tar.gz
+            dist/wrapper-darwin-x86_64.tar.gz
+            dist/wrapper-linux-x86_64.tar.gz
+            dist/checksums.txt
+
+  update-homebrew:
+    name: Update Homebrew Tap
+    needs: [check-version, release]
+    if: needs.check-version.outputs.version-changed == 'true'
+    uses: ./.github/workflows/update-homebrew-tap.yml
+    with:
+      version: ${{ needs.check-version.outputs.new-version }}
+      sha_darwin_arm64: ${{ needs.release.outputs.sha_darwin_arm64 }}
+      sha_darwin_x64: ${{ needs.release.outputs.sha_darwin_x64 }}
+      sha_linux_x64: ${{ needs.release.outputs.sha_linux_x64 }}
+    secrets:
+      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}