feat: merge preview into main

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "voidhash",
+  "interface": {
+    "displayName": "Voidhash"
+  },
+  "plugins": [
+    {
+      "name": "voidhash",
+      "source": {
+        "source": "local",
+        "path": "./plugins/voidhash"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

.claude/launch.json

@@ -0,0 +1,23 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "studio",
+      "runtimeExecutable": "pnpm",
+      "runtimeArgs": ["--filter", "@voidhash/studio", "dev", "--port", "4830"],
+      "port": 4830
+    },
+    {
+      "name": "deployed",
+      "runtimeExecutable": "python3",
+      "runtimeArgs": [
+        "-m",
+        "http.server",
+        "4831",
+        "--directory",
+        "examples/react-native-example/.voidhash/.build"
+      ],
+      "port": 4831
+    }
+  ]
+}

.dockerignore

@@ -0,0 +1,13 @@
+.git
+.github
+.turbo
+**/.alchemy
+**/.next
+**/.output
+**/.turbo
+**/coverage
+**/dist
+**/node_modules
+**/.env
+**/.env.*
+*.log

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,75 @@
+name: Bug report
+description: Report a reproducible Community product or self-hosting defect.
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not report security vulnerabilities here. Follow SECURITY.md and use the private reporting channel.
+        Voidhash is currently in private alpha; older commits and unpublished artifacts are unsupported.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - Self-host runtime
+        - Backend API
+        - Dashboard or designer
+        - React Native SDK
+        - Web or Node SDK
+        - CLI or Studio
+        - Mimic
+        - Documentation
+        - Other Community package
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Provide the smallest reproducible sequence, project, or repository.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: input
+    id: revision
+    attributes:
+      label: Voidhash revision or package version
+      placeholder: Commit SHA or exact package version
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include OS, Node, pnpm, Docker, SDK platform, and relevant provider versions.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or diagnostics
+      description: Remove credentials, personal data, API keys, and customer content.
+      render: shell
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I reproduced this on the latest preview revision.
+          required: true
+        - label: This report does not contain a vulnerability or sensitive data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/voidhashcom/voidhash/security/policy
+    about: Report vulnerabilities privately; never disclose them in a public issue.
+  - name: Product documentation
+    url: https://voidhash.com/docs
+    about: Read the product and SDK documentation.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,42 @@
+name: Feature request
+description: Propose an improvement to the Community product or self-hosting experience.
+title: "feature: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: External pull-request intake is currently closed, but well-scoped product proposals are welcome.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Explain the user problem or operational limitation without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed outcome
+      description: Describe the observable behavior and who benefits.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: edition
+    attributes:
+      label: Intended edition
+      options:
+        - Community
+        - Cloud operations
+        - Enterprise
+        - Unsure
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context

.github/pull_request_template.md

@@ -0,0 +1,22 @@
+## Summary
+
+<!-- External pull-request intake is closed during private alpha and beta. -->
+
+## Validation
+
+- [ ] I ran the smallest relevant tests.
+- [ ] I ran `pnpm typecheck` and `pnpm test`, or documented why they do not apply.
+- [ ] Self-host or runtime changes pass the relevant Compose smoke suites.
+- [ ] I updated public JSDoc and user-facing documentation where behavior changed.
+
+## Publication boundary
+
+- [ ] `pnpm check:publication` passes.
+- [ ] Community code uses only `@voidhash/*` scopes and provider-neutral platform interfaces.
+- [ ] Every changed package retains the correct MIT or AGPL license metadata and license text.
+- [ ] The change contains no credentials, customer data, internal hostnames, or private operations/Enterprise code.
+
+## Security
+
+- [ ] I considered tenant isolation, authentication, replay/idempotency, storage ownership, and untrusted input where relevant.
+- [ ] I did not disclose a suspected vulnerability in this pull request.

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: Repository CI
+
+on:
+  push:
+    branches: [main, preview]
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repository-ci-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.1.3
+          run_install: false
+
+      - name: Check publication boundary
+        run: node scripts/check-publication-boundary.mjs
+
+      - name: Setup Node.js
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Restore Turborepo cache
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        uses: actions/cache@v4
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
+
+      - name: Install dependencies
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate purchase and restore contracts
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        run: pnpm test:purchase-restore
+
+      - name: Build
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        run: pnpm build --concurrency=2
+
+      - name: Typecheck
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        run: pnpm typecheck --concurrency=2
+
+      - name: Test
+        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+        run: pnpm test --concurrency=2
+
+  storekit-purchase-validation:
+    name: StoreKit purchase validation
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+    runs-on: macos-15
+    timeout-minutes: 15
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Test StoreKit transaction retention
+        run: swift test --package-path libraries/react-native
+
+      - name: Test StoreKit purchase and restore
+        working-directory: libraries/react-native
+        run: bash ios-storekit-tests/run-tests.sh