feat(HAI-108): remove binary builds and configure npm publishing

- Remove binary build steps from CI and delete release/test-release workflows
- Replace release workflow with npm publish via version.yml and changesets
- Configure all packages (cli, core, dashboard, engine) for npm publishing
- Add package-config tests to verify publishConfig and package metadata
- Update README and documentation to reflect npm-based distribution

.github/workflows/ci.yml

@@ -24,9 +24,6 @@ jobs:
           node-version: "22"
           cache: pnpm
 
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
-
       - name: Install dependencies
         run: pnpm install
 
@@ -35,9 +32,3 @@ jobs:
 
       - name: Test
         run: pnpm test
-
-      - name: Build standalone binary
-        run: pnpm build:exe
-
-      - name: Verify binary exists
-        run: test -f packages/cli/dist/hai

.github/workflows/release.yml

@@ -1,159 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    name: Build (${{ matrix.binary }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: bun-linux-x64
-            binary: hai-linux-x64
-          - os: macos-latest
-            target: bun-darwin-arm64
-            binary: hai-darwin-arm64
-          - os: macos-13
-            target: bun-darwin-x64
-            binary: hai-darwin-x64
-          - os: windows-latest
-            target: bun-windows-x64
-            binary: hai-windows-x64.exe
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: pnpm
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
-
-      - name: Extract version from tag
-        run: |
-          VERSION="${GITHUB_REF#refs/tags/v}"
-          echo "RELEASE_VERSION=${VERSION}" >> $GITHUB_ENV
-          echo "Releasing version: ${VERSION}"
-
-      - name: Verify tag matches package version
-        run: |
-          PKG_VERSION=$(node -p "require('./packages/cli/package.json').version")
-          if [ "$RELEASE_VERSION" != "$PKG_VERSION" ]; then
-            echo "ERROR: Tag version ($RELEASE_VERSION) does not match packages/cli/package.json version ($PKG_VERSION)"
-            exit 1
-          fi
-          echo "Version check passed: $RELEASE_VERSION"
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Build
-        run: pnpm build
-
-      - name: Build standalone binary
-        run: pnpm --filter hai build:exe -- --target ${{ matrix.target }}
-
-      - name: Rename binary with platform and arch
-        run: |
-          PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            x86_64) ARCH="x64" ;;
-            aarch64) ARCH="arm64" ;;
-          esac
-          cp packages/cli/dist/hai packages/cli/dist/hai-${PLATFORM}-${ARCH}
-
-      # Code signing steps — activate when cross-platform matrix is in place (HAI-079)
-      - name: Sign macOS binaries
-        if: runner.os == 'macOS'
-        env:
-          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
-        run: |
-          for binary in packages/cli/dist/hai-darwin-*; do
-            [ -f "$binary" ] && bash scripts/sign-macos.sh "$binary"
-          done
-
-      - name: Sign Windows binaries
-        if: runner.os == 'Windows'
-        env:
-          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        run: |
-          Get-ChildItem packages/cli/dist/hai-windows-*.exe | ForEach-Object {
-            & .\scripts\sign-windows.ps1 $_.FullName
-          }
-        shell: pwsh
-
-      - name: Generate checksum (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          cd packages/cli/dist
-          sha256sum ${{ matrix.binary }} > ${{ matrix.binary }}.sha256
-
-      - name: Generate checksum (macOS)
-        if: runner.os == 'macOS'
-        run: |
-          cd packages/cli/dist
-          shasum -a 256 ${{ matrix.binary }} > ${{ matrix.binary }}.sha256
-
-      - name: Generate checksum (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          cd packages/cli/dist
-          $hash = (Get-FileHash -Algorithm SHA256 "${{ matrix.binary }}").Hash.ToLower()
-          "$hash  ${{ matrix.binary }}" | Out-File -Encoding ascii "${{ matrix.binary }}.sha256"
-
-      - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.binary }}
-          path: |
-            packages/cli/dist/${{ matrix.binary }}
-            packages/cli/dist/${{ matrix.binary }}.sha256
-
-  release:
-    name: Create Release
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Collect release files
-        run: |
-          mkdir -p release
-          find artifacts -type f -exec cp {} release/ \;
-          ls -la release/
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          generate_release_notes: true
-          files: release/*

.github/workflows/test-release.yml

@@ -1,142 +0,0 @@
-name: Test Release
-
-on:
-  workflow_dispatch:
-
-jobs:
-  build:
-    name: Test Build (${{ matrix.binary }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: bun-linux-x64
-            binary: hai-linux-x64
-          - os: macos-latest
-            target: bun-darwin-arm64
-            binary: hai-darwin-arm64
-          - os: macos-13
-            target: bun-darwin-x64
-            binary: hai-darwin-x64
-          - os: windows-latest
-            target: bun-windows-x64
-            binary: hai-windows-x64.exe
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: pnpm
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Build
-        run: pnpm build
-
-      - name: Build standalone binary
-        run: pnpm --filter hai build:exe -- --target ${{ matrix.target }}
-
-      - name: Rename binary with platform and arch
-        run: |
-          PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            x86_64) ARCH="x64" ;;
-            aarch64) ARCH="arm64" ;;
-          esac
-          cp packages/cli/dist/hai packages/cli/dist/hai-${PLATFORM}-${ARCH}
-
-      # Code signing steps — activate when cross-platform matrix is in place (HAI-079)
-      # Signing is skipped gracefully when secrets are not configured
-      - name: Sign macOS binaries
-        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE_BASE64 != ''
-        env:
-          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
-        run: |
-          for binary in packages/cli/dist/hai-darwin-*; do
-            [ -f "$binary" ] && bash scripts/sign-macos.sh "$binary"
-          done
-
-      - name: Sign Windows binaries
-        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
-        env:
-          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        run: |
-          Get-ChildItem packages/cli/dist/hai-windows-*.exe | ForEach-Object {
-            & .\scripts\sign-windows.ps1 $_.FullName
-          }
-        shell: pwsh
-
-      - name: Generate checksum (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          cd packages/cli/dist
-          sha256sum ${{ matrix.binary }} > ${{ matrix.binary }}.sha256
-
-      - name: Generate checksum (macOS)
-        if: runner.os == 'macOS'
-        run: |
-          cd packages/cli/dist
-          shasum -a 256 ${{ matrix.binary }} > ${{ matrix.binary }}.sha256
-
-      - name: Generate checksum (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          cd packages/cli/dist
-          $hash = (Get-FileHash -Algorithm SHA256 "${{ matrix.binary }}").Hash.ToLower()
-          "$hash  ${{ matrix.binary }}" | Out-File -Encoding ascii "${{ matrix.binary }}.sha256"
-
-      - name: Smoke test (Unix)
-        if: runner.os != 'Windows'
-        run: |
-          chmod +x packages/cli/dist/${{ matrix.binary }}
-          packages/cli/dist/${{ matrix.binary }} --help
-
-      - name: Smoke test (Windows)
-        if: runner.os == 'Windows'
-        run: .\packages\cli\dist\${{ matrix.binary }} --help
-
-      - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.binary }}
-          path: |
-            packages/cli/dist/${{ matrix.binary }}
-            packages/cli/dist/${{ matrix.binary }}.sha256
-
-  collect:
-    name: Collect Artifacts
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Upload combined archive
-        uses: actions/upload-artifact@v4
-        with:
-          name: hai-all-platforms
-          path: artifacts/**/*

.github/workflows/version.yml

@@ -1,4 +1,14 @@
-name: Version Packages
+# Release workflow: npm publishing via changesets
+#
+# This workflow runs on every push to main and does one of two things:
+# 1. If there are pending changesets: creates/updates a "Version Packages" PR
+#    that bumps versions and updates changelogs.
+# 2. If there are no pending changesets (i.e., a version PR was just merged):
+#    builds all packages and publishes them to npm.
+#
+# Requires NPM_TOKEN secret for npm authentication.
+
+name: Version & Release
 
 on:
   push:
@@ -8,10 +18,11 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
-  version:
-    name: Version Packages
+  release:
+    name: Version or Publish
     runs-on: ubuntu-latest
 
     steps:
@@ -26,31 +37,19 @@ jobs:
         with:
           node-version: "22"
           cache: pnpm
+          registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
-      - name: Create Release Pull Request or Tag
-        id: changesets
+      - name: Build
+        run: pnpm build
+
+      - name: Create Release Pull Request or Publish to npm
         uses: changesets/action@v1
         with:
           version: pnpm release:version
+          publish: pnpm -r publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push version tag
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        run: |
-          VERSION=$(node -p "require('./packages/cli/package.json').version")
-          TAG="v${VERSION}"
-
-          # Check if tag already exists
-          if git rev-parse "$TAG" >/dev/null 2>&1; then
-            echo "Tag $TAG already exists, skipping"
-            exit 0
-          fi
-
-          git tag "$TAG"
-          git push origin "$TAG"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}