dual SDK builds, generated types, turbo, and changesets

[success-OG]

Summary

v2 SDK & shared packaging plus CI/DevEx for epics G and H.

closes #1301
closes #1305
closes #1309
closes #1313

#1301 Dual ESM/CJS SDK, exports map, tree-shaking

@syncro/sdk now ships ESM + CJS from tsup, with types per condition (import / require → .d.ts / .d.cts).

Subpath exports: ., ./webhooks, ./stellar, ./zk, ./contracts, ./types, ./errors. sideEffects: false. Stellar helpers resolve through @syncro/shared/stellar/memo instead of a relative source path.

Proven locally:

• attw: node16 (CJS + ESM) and bundler resolve every subpath
• Tree-shake fixture: dist/webhooks does not contain stellar/zk tokens (and vice versa). Sizes: webhooks 5.2KB, stellar 1.6KB, zk 4.3KB
• publint runs in CI
• Published size: unpacked 337,266 bytes, budget 400,000 (sdk/package-size.json)

CI: .github/workflows/sdk-package.yml

#1305 Generated DB + contract types

Database row types are generated from supabase/migrations → supabase/schema.snapshot.json + shared/src/generated/database.ts (60 tables, including SubscriptionsRow). A column change in a migration changes the generated Row type and fails consumers until they adapt.

Contract types come from shared/src/generated/soroban-abi.json (WASM when --wasm / CONTRACT_WASM_DIR is set). Shared TS and SDK bindings share that ABI. CI also fails if an ABI function name disappears from the listed Rust source.

Hand-written domain types live in shared/src/domain/ (subscription, payment, user, analytics, stealth). Old paths re-export from there. scripts/generate-schema-snapshot.sh still dumps SQL when the Supabase CLI is available, then always regenerates JSON/TS from migrations.

CI: .github/workflows/generated-types.yml (npm run check:generated)

#1309 Turbo task graph, affected PRs, remote cache

Turbo 2 across backend, client, sdk, shared, and contracts. sdk#typecheck depends on shared#build. PRs run --filter=...[origin/<base>]; main runs the full graph. GitHub Actions cache + TURBO_TOKEN / TURBO_TEAM for remote cache. Hit rate is written to the job summary.

Before: npm run typecheck --workspaces plus per-package jobs with no shared task cache. After: affected-only on PRs, cached task outputs, remote cache when token is set. Record p50 from Actions after ~20 PRs.

CI: .github/workflows/turbo.yml

#1313 Changesets, CI-only publish

• .changeset/ for @syncro/sdk and @syncro/shared
• PRs that touch sdk/ or shared/ without a changeset fail
• Version PR on main via changesets/action (changelog + bumps, including dependent packages)
• Publish only from CI on a tag (id-token: write, NPM_CONFIG_PROVENANCE=true). Local npm publish is rejected (scripts/assert-ci-publish.mjs)

CI: .github/workflows/changeset.yml, .github/workflows/release.yml

Secrets / vars to set

• TURBO_TOKEN, TURBO_TEAM (optional; enables Vercel remote cache)
• NPM_TOKEN (publish)

Test plan

• npm run generate && npm run check:generated
• npm run build -w sdk && npm run check:package -w sdk
• Confirm attw node16 + bundler stay green
• Open a PR that edits sdk/ with no changeset and confirm the changeset job fails
• Confirm Turbo PR job only runs affected packages; main runs the full graph
• After merge, confirm Version Packages PR is opened on main

[drips-wave]

@success-OG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits