Unify pre-release APIs and remove application setup friction

[tvanhens]

Ramose’s pre-release API exposed overlapping authoring paths, while Reef duplicated model types, credential handling, and deployment setup. This change consolidates the public API, uses Reef to exercise the supported application path, and strengthens package and release validation.

Public API and application changes

• Separate deployment exports (ramose) from portable authoring (ramose/db), keep owned operations as the public operation-authoring path, and remove internal helpers from public barrels.
• Consolidate advanced queries under Query.build and Query.rule; standardize ref() and enumeration(); rename client options to database and schema.
• Add EntityHandleFor for schema-derived component props, createAuthProvider in ramose/better-auth/client for cached and renewable credentials, and serverBinding for native Worker bindings.
• Replace Reef’s handwritten entity models and unsafe casts with inferred types. Use workspace references instead of duplicated slugs and typed queries instead of raw operation pull patterns.
• Route Reef through a public app Worker and private auth Worker so previews build once and deploy once. Show pending, saved, and rejected mutation receipts.
• Align the examples and public documentation with supported APIs.

Reliability and release preparation

• Harden binary decoding and malformed-input handling, preserve JSON property names, simplify canonical string encoding, and correct novelty reset behavior.
• Verify that browser bundles export usable values and avoid the Bun bundling failure caused by the package’s previous sideEffects metadata.
• Keep package, workspace, and lockfile versions synchronized; validate release arguments; restore exact files after dry runs; and strengthen release CI checks.
• Build documentation search locally through the Pagefind API and include documentation and release validation in bun run check.

Breaking changes

This intentionally replaces pre-release APIs without compatibility aliases. Consumers must update imports, query construction, field constructors, and client configuration. Reef’s schema and deployment topology also change: its stack returns appUrl, and workspace slugs remain routing fields on workspaces rather than being duplicated on issues and labels.

Validation

• bun run check: type checking, 1,780 unit tests, 188 browser tests, 127 local integration tests, two Reef end-to-end tests, documentation checks, package build, and release checks passed.
• Re-ran type checking, Reef integration tests, and release checks after the final implementation edits.
• Reef tests use Chromium against real local Workers and D1, covering sign-in, credential caching and renewal, offline reuse, denial and sign-out cleanup, forged-origin rejection, workspace writes, private notes, and visible mutation failures.
• Documentation production build passed and indexed all 43 pages.
• Staged diff passed whitespace checks.

Cloudflare edge tests and remote deployment were not run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T22:36:37.072545Z	698ce0b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Docs preview destroyed

This PR is closed; its preview stage has been torn down.

[github-actions]

Reef preview: https://ramose-reef-web-pr-644-kyizawfdh27tj36v.tvanhens.workers.dev

Deployed from 698ce0b as stage pr-644. Torn down when this PR closes.