feat/codions tools platform

.github/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - run: npm ci
+
+      # Runtimes first: the web app type-checks against their generated .d.ts, and
+      # the bundle contract test asserts against dist/.
+      - name: Build runtimes
+        run: npm run build:runtimes
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Format check
+        run: npm run format:check
+
+      - name: Build site
+        run: npm run build:web
+
+      - name: Test
+        run: npm test
+
+      # These bundles load on other people's sites; growth should be a decision.
+      - name: Bundle size budget
+        run: npm run size
+
+      # Every handler under api/sites/[siteId]/** must check ownership before any
+      # other query (ADR-0026) — catches a new widget's route copied from an existing
+      # one with the getOwnedSite() call forgotten.
+      - name: Ownership check
+        run: npm run authz-check
+
+      # The CDN URL pasted into third-party sites points at this exact path.
+      - name: Check published bundle path
+        run: test -f packages/floating-contact-button/dist/floating-contact.min.js
+
+      # The package README used to be copied from the repo root at publish time.
+      # Now that the root README describes the platform, the package must ship its own.
+      - name: Check package README ships with the tool docs
+        run: grep -q '@codions/floating-contact-button' packages/floating-contact-button/README.md

.github/workflows/deploy.yml

@@ -0,0 +1,45 @@
+name: Deploy
+
+# Nuxt SSR runs in a Cloudflare Worker; static files use Workers Assets.
+#
+# Triggered by CI finishing on main rather than by the push itself, so a commit
+# that fails lint/typecheck/tests never reaches production — see the CI workflow's
+# `verify` job. `workflow_dispatch` stays for a manual re-deploy of the last green
+# commit without needing a new push.
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+# `cancel-in-progress: false`: a running deploy must finish, not be pre-empted by a
+# newer commit's deploy starting out of order and leaving main on an older build.
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run build
+
+      - name: Deploy to Cloudflare
+        run: npx wrangler deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+# Publishing is driven by GitHub Releases, not by pushes: cutting a release is a
+# deliberate act. CI (ci.yml) covers every pull request and push to main.
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+
+      - run: npm run build
+
+      - name: Test
+        run: npm test
+
+      # Only the Floating Contact Button is published today. The consent manager is
+      # marked private until its API settles; flipping that is a one-line change in
+      # its package.json plus a line here.
+      - name: Publish @codions/floating-contact-button
+        run: npm publish -w packages/floating-contact-button --provenance --access public

.gitignore

@@ -1,12 +1,18 @@
 node_modules
 .DS_Store
 *.tgz
+.wrangler
+.nuxt
+.output
+.data
+.playwright-cli
+output/playwright
 
-# Root build outputs (CDN / GitHub Pages deployment)
-/dist
-/docs
+# Build outputs
+apps/*/dist
+packages/*/dist
 
-# Package build outputs
-packages/lib/dist
-packages/lib/README.md
-packages/docs/dist
+# Third-party static clone kept locally for reference/evidence only — see
+# roadmap/06-widgets/README.md. Not our source, never committed (includes its own
+# nested .git and is not ours to distribute).
+roadmap/_references

.nvmrc

@@ -0,0 +1 @@
+24

.prettierignore

@@ -0,0 +1,9 @@
+dist
+node_modules
+package-lock.json
+.wrangler
+CHANGELOG.md
+**/worker-configuration.d.ts
+# Third-party static clone kept for reference/evidence only — see
+# roadmap/06-widgets/README.md. Not our source, never formatted.
+roadmap/_references

.prettierrc.json

@@ -0,0 +1,7 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "printWidth": 100,
+  "trailingComma": "all",
+  "arrowParens": "always"
+}