feat(infra): staging environment on Fly.io + CI deployment gate

.dockerignore

@@ -0,0 +1,14 @@
+node_modules
+.git
+tests
+benchmarks
+docs/analysis
+docs/superpowers
+docs/site/node_modules
+docs/site/dist
+docs/site/.astro
+*.md
+!docs/site/**/*.md
+!docs/site/**/*.mdx
+.dockerignore
+Dockerfile

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Dockerfile]
+indent_style = tab

.github/workflows/ci.yml

@@ -0,0 +1,174 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+    tags: ["v*"]
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  check:
+    name: Lint, Type-check & Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Download fonts
+        run: bun run fonts:download
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Type-check
+        run: bun run type-check
+
+      - name: Test
+        run: bun run test
+        env:
+          AUTH_ENABLED: "false"
+
+  publish-sdk-github:
+    name: Publish SDK to GitHub Packages
+    runs-on: ubuntu-latest
+    needs: check
+    if: github.ref == 'refs/heads/dev' && github.event_name == 'push'
+    permissions:
+      contents: read
+      packages: write
+    defaults:
+      run:
+        working-directory: sdk
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://npm.pkg.github.com
+          scope: '@atypical-consulting'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build SDK
+        run: bun run build
+
+      - name: Check if version is already published
+        id: version-check
+        run: |
+          PACKAGE_NAME=$(node -p "require('./package.json').name")
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version --registry https://npm.pkg.github.com 2>/dev/null; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "Version ${PACKAGE_VERSION} already published — skipping"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            echo "Version ${PACKAGE_VERSION} not yet published — will publish"
+          fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish to GitHub Packages
+        if: steps.version-check.outputs.published == 'false'
+        run: npm publish --registry https://npm.pkg.github.com
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-sdk-npm:
+    name: Publish SDK to npm registry
+    runs-on: ubuntu-latest
+    needs: check
+    if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: sdk
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          scope: '@atypical-consulting'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build SDK
+        run: bun run build
+
+      - name: Check if version is already published
+        id: version-check
+        run: |
+          PACKAGE_NAME=$(node -p "require('./package.json').name")
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version 2>/dev/null; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "Version ${PACKAGE_VERSION} already published — skipping"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            echo "Version ${PACKAGE_VERSION} not yet published — will publish"
+          fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish to npm
+        if: steps.version-check.outputs.published == 'false'
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  deploy-staging:
+    name: Deploy to Fly.io (Staging)
+    runs-on: ubuntu-latest
+    needs: check
+    if: github.ref == 'refs/heads/dev' && github.event_name == 'push'
+    environment: staging
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Deploy to staging
+        run: flyctl deploy --remote-only --config fly.staging.toml
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN_STAGING }}
+
+  deploy-production:
+    name: Deploy to Fly.io (Production)
+    runs-on: ubuntu-latest
+    needs: check
+    if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
+    environment: production
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Deploy to production
+        run: flyctl deploy --remote-only --config fly.toml
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

.github/workflows/reset-free-quotas.yml

@@ -0,0 +1,29 @@
+name: Reset Free Tier Quotas
+
+on:
+  schedule:
+    # 1st of each month at 00:05 UTC
+    - cron: '5 0 1 * *'
+  workflow_dispatch: # Allow manual trigger for testing
+
+jobs:
+  reset:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reset free-tier quotas
+        run: |
+          response=$(curl -s -w "\n%{http_code}" -X POST \
+            https://og-engine.com/admin/reset-free-quotas \
+            -H "Authorization: Bearer ${{ secrets.ADMIN_CRON_SECRET }}" \
+            -H "Content-Type: application/json")
+
+          http_code=$(echo "$response" | tail -1)
+          body=$(echo "$response" | head -n -1)
+
+          echo "Status: $http_code"
+          echo "Response: $body"
+
+          if [ "$http_code" != "200" ]; then
+            echo "::error::Reset failed with status $http_code"
+            exit 1
+          fi

.gitignore

@@ -3,6 +3,7 @@ node_modules/
 
 # Build output
 dist/
+docs-dist/
 
 # Astro
 .astro/
@@ -20,3 +21,11 @@ Thumbs.db
 .vscode/
 *.swp
 *.swo
+
+# Benchmark raw data (large JSON files)
+benchmarks/results/*.json
+
+# SQLite database
+data/*.db
+data/*.db-wal
+data/*.db-shm