feat: relayauth integration — JWKS verification + path-scoped access

.github/workflows/ci.yml

@@ -0,0 +1,145 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go-test:
+    name: Go Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go-version:
+          - "1.22"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+
+      - name: Run tests
+        run: go test ./...
+
+  go-build:
+    name: Go Build
+    runs-on: ubuntu-latest
+    needs: go-test
+    strategy:
+      matrix:
+        go-version:
+          - "1.22"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+
+      - name: Build all binaries
+        run: make build
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: relayfile-binaries
+          path: bin/
+          if-no-files-found: error
+
+  sdk-typecheck:
+    name: SDK Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: packages/relayfile-sdk/package-lock.json
+
+      - name: Install SDK dependencies
+        working-directory: packages/relayfile-sdk
+        run: npm ci
+
+      - name: Build SDK
+        working-directory: packages/relayfile-sdk
+        run: npm run build
+
+      - name: Typecheck SDK
+        working-directory: packages/relayfile-sdk
+        run: npx tsc --noEmit
+
+  e2e:
+    name: E2E
+    runs-on: ubuntu-latest
+    needs:
+      - go-build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+          cache: true
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: packages/relayfile-sdk/package-lock.json
+
+      - name: Download binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: relayfile-binaries
+          path: bin
+
+      - name: Make binaries executable
+        run: chmod +x bin/*
+
+      - name: Run E2E suite
+        env:
+          CI: "true"
+        run: npx --yes tsx scripts/e2e.ts --ci
+
+  workers-typecheck:
+    name: Workers Typecheck
+    if: ${{ hashFiles('packages/server/tsconfig.json') != '' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: packages/server/package-lock.json
+
+      - name: Install worker dependencies
+        working-directory: packages/server
+        run: npm ci
+
+      - name: Typecheck workers
+        working-directory: packages/server
+        run: npx tsc --noEmit

.github/workflows/contract.yml

@@ -28,11 +28,11 @@ jobs:
           node-version: "20"
 
       - name: Install SDK deps
-        working-directory: sdk/relayfile-sdk
+        working-directory: packages/relayfile-sdk
         run: npm ci
 
       - name: Build SDK
-        working-directory: sdk/relayfile-sdk
+        working-directory: packages/relayfile-sdk
         run: npm run build
 
       - name: Validate contract surface

.github/workflows/publish-npm.yml

@@ -0,0 +1,174 @@
+name: Publish NPM Package
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version bump type"
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prerelease
+        default: patch
+      custom_version:
+        description: "Custom version (optional, overrides version type)"
+        required: false
+        type: string
+      dry_run:
+        description: "Dry run (do not actually publish)"
+        required: false
+        type: boolean
+        default: false
+      tag:
+        description: "NPM dist-tag"
+        required: false
+        type: choice
+        options:
+          - latest
+          - next
+          - beta
+          - alpha
+        default: latest
+
+concurrency:
+  group: publish-npm
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish-sdk:
+    name: Publish @relayfile/sdk
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: packages/relayfile-sdk/package-lock.json
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Update npm to latest
+        run: npm install -g npm@latest
+
+      - name: Install deps
+        working-directory: packages/relayfile-sdk
+        run: npm ci
+
+      - name: Version bump
+        id: version
+        working-directory: packages/relayfile-sdk
+        run: |
+          CUSTOM_VERSION="${{ github.event.inputs.custom_version }}"
+          VERSION_TYPE="${{ github.event.inputs.version }}"
+
+          if [ -n "$CUSTOM_VERSION" ]; then
+            npm version "$CUSTOM_VERSION" --no-git-tag-version --allow-same-version
+          else
+            npm version "$VERSION_TYPE" --no-git-tag-version
+          fi
+
+          NEW_VERSION="$(node -p "require('./package.json').version")"
+          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag_name=sdk-v$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Build
+        working-directory: packages/relayfile-sdk
+        run: npm run build
+
+      - name: Test
+        working-directory: packages/relayfile-sdk
+        run: npx tsc --noEmit
+
+      - name: Dry run check
+        if: github.event.inputs.dry_run == 'true'
+        working-directory: packages/relayfile-sdk
+        run: npm publish --dry-run --access public --tag "${{ github.event.inputs.tag }}" --ignore-scripts
+
+      - name: Publish
+        if: github.event.inputs.dry_run != 'true'
+        working-directory: packages/relayfile-sdk
+        run: npm publish --access public --provenance --tag "${{ github.event.inputs.tag }}" --ignore-scripts
+
+      - name: Commit version bump and create git tag
+        if: github.event.inputs.dry_run != 'true'
+        run: |
+          NEW_VERSION="${{ steps.version.outputs.new_version }}"
+          TAG_NAME="${{ steps.version.outputs.tag_name }}"
+
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+
+          git add packages/relayfile-sdk/package.json packages/relayfile-sdk/package-lock.json
+          git commit -m "chore(sdk): release v${NEW_VERSION}"
+          git tag -a "${TAG_NAME}" -m "SDK ${NEW_VERSION}"
+
+          git push origin HEAD:main
+          git push origin "${TAG_NAME}"
+
+      - name: Create GitHub Release
+        if: github.event.inputs.dry_run != 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.version.outputs.tag_name }}
+          name: ${{ steps.version.outputs.tag_name }}
+          body: |
+            ## @relayfile/sdk ${{ steps.version.outputs.new_version }}
+
+            Install:
+            ```bash
+            npm install @relayfile/sdk@${{ steps.version.outputs.new_version }}
+            ```
+
+            Dist-tag: `${{ github.event.inputs.tag }}`
+            Provenance: enabled via `npm publish --provenance`
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-cli:
+    name: Publish relayfile (CLI)
+    runs-on: ubuntu-latest
+    needs: publish-sdk
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Update npm to latest
+        run: npm install -g npm@latest
+
+      - name: Sync version with SDK
+        working-directory: packages/relayfile
+        run: |
+          SDK_VERSION="$(node -p "require('../relayfile-sdk/package.json').version")"
+          npm version "$SDK_VERSION" --no-git-tag-version --allow-same-version
+
+      - name: Dry run check
+        if: github.event.inputs.dry_run == 'true'
+        working-directory: packages/relayfile
+        run: npm publish --dry-run --access public --tag "${{ github.event.inputs.tag }}"
+
+      - name: Publish
+        if: github.event.inputs.dry_run != 'true'
+        working-directory: packages/relayfile
+        run: npm publish --access public --provenance --tag "${{ github.event.inputs.tag }}"