Project split: publishable core, package boundaries, private-path guard, push CI

.githooks/pre-commit

@@ -0,0 +1,3 @@
+#!/bin/sh
+# One-time setup: git config core.hooksPath .githooks
+exec bun scripts/check-private.ts --staged

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+# Push/PR checks, one job per project so a red job names what broke. core, ui and the shell each
+# typecheck (and ui builds) on their own; boundaries and private-guard are what make "on their own"
+# true rather than assumed (BASED-PKG-BOUNDARIES, BASED-PRIVATE-GUARD). No Rust here - the Tauri
+# build is exercised by build-macos.yml and release.yml.
+name: ci
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+jobs:
+  core:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run --cwd core typecheck
+
+  ui:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run --cwd ui typecheck
+      - run: bun run --cwd ui build
+
+  shell-tauri:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run --cwd shell-tauri typecheck
+
+  tests:
+    # Windows because the suite exercises keyring, platform paths and the native addons on the
+    # platform we actually ship first; integration tests self-skip without their databases.
+    runs-on: windows-2025
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run test
+
+  boundaries:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun scripts/check-boundaries.ts
+
+  private-guard:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun scripts/check-private.ts --tree

.github/workflows/release.yml

@@ -234,3 +234,40 @@ jobs:
           git add Casks/based.rb
           git commit -m "based $VERSION"
           git push
+
+  # BASED-CORE-PUBLISH: the same tag publishes @cyronius/based-core at the same version, so based.ai and
+  # anyone else embedding core pin to a number that matches a desktop release. Gated on the
+  # Windows job because that is where typecheck and the test suite run.
+  publish-core:
+    needs: [windows]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Check tag matches core/package.json version
+        run: |
+          VERSION=$(jq -r .version core/package.json)
+          TAG="${GITHUB_REF_NAME#v}"
+          if [ "$VERSION" != "$TAG" ]; then
+            echo "Tag v$TAG does not match core/package.json version $VERSION" >&2
+            exit 1
+          fi
+
+      - name: Publish @cyronius/based-core
+        working-directory: core
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -26,3 +26,9 @@ shell-tauri/icons/ios/
 *.pem
 *.key
 *_rsa_key*
+
+# The paid product (based.ai) lives in a sibling repo, never here. Backstop for scripts/check-private.ts.
+based-ai/
+paid/
+private/
+*.private/

CONTRIBUTING.md

@@ -9,10 +9,13 @@ Start with [docs/development.md](docs/development.md) for setup and dev loops.
 
 ```sh
 bun run typecheck
+bun run check
 bun test
 ```
 
-Both must pass. Integration tests self-skip without a SQL Server — that's expected and fine.
+All three must pass. Integration tests self-skip without a SQL Server — that's expected and fine.
+`check` keeps `core/` and `ui/` from importing each other and keeps private paths out of the repo;
+run `git config core.hooksPath .githooks` once so the second half also runs before each commit.
 
 Match the surrounding code. This codebase has a consistent house style: comments explain *why*, not
 *what*, and non-obvious workarounds carry the diagnosis that justifies them. Several files

README.md

@@ -573,9 +573,11 @@ weeks old, not years. Specifically:
   adding an engine is a descriptor plus an adapter — but these three are what's implemented.
 - **The installer is unsigned** — see the SmartScreen note above.
 - **No auto-update.** Watch releases, or check the version in the status bar against the latest.
+- **Core is a package.** `core/` publishes to npm as `@cyronius/based-core` at each release, so the engine
+  can be embedded without the desktop shell. The frontend talks to it over HTTP only.
 - Expect rough edges, and please [file them](https://github.com/Cyronius/based/issues).
 
-What isn't rough: there are **164 numbered requirements** in
+What isn't rough: there are **167 numbered requirements** in
 [specs/based/spec.md](specs/based/spec.md), each with either an executable test or a written
 verification procedure. If you want to know exactly what's specified to work, that's the file.