refactor(platform): finalize the V2 architecture

Harden run admission, sandbox lifecycle, tenancy, migrations, and release orchestration.

Tighten auth, observability, and UI boundaries.

Remove V1, token-cost accounting, legacy compatibility, dead packages, and test harnesses.

Align preview routing with the owned production wildcard.

Author: iamjr15

.dependency-cruiser.cjs

@@ -0,0 +1,47 @@
+/** @type {import('dependency-cruiser').IConfiguration} */
+module.exports = {
+  forbidden: [
+    {
+      name: "no-circular",
+      severity: "error",
+      from: { path: "^(apps|packages)/" },
+      to: { circular: true },
+    },
+    {
+      name: "shared-packages-must-not-import-deployables",
+      severity: "error",
+      from: { path: "^packages/" },
+      to: { path: "^apps/" },
+    },
+    {
+      name: "deployables-must-not-import-other-deployables",
+      severity: "error",
+      from: { path: "^apps/([^/]+)/" },
+      to: { path: "^apps/", pathNot: "^apps/$1/" },
+    },
+    {
+      name: "tool-domains-must-not-import-peer-tool-domains",
+      severity: "error",
+      from: { path: "^packages/(tools-[^/]+)/" },
+      to: { path: "^packages/tools-[^/]+/", pathNot: "^packages/$1/" },
+    },
+    {
+      name: "vercel-web-must-not-import-worker-runtime-packages",
+      severity: "error",
+      from: { path: "^apps/web/" },
+      to: {
+        // Dependency Cruiser evaluates resolved file paths, not package specifiers.
+        path: "^packages/(agent-core|auth|billing|byok|db|observability|tools-[^/]+)(/|$)",
+      },
+    },
+    {
+      name: "deployables-must-use-db-repositories",
+      severity: "error",
+      from: { path: "^apps/" },
+      to: { path: "^packages/db/(src|dist)/schema(/|$)" },
+    },
+  ],
+  options: {
+    doNotFollow: { path: "node_modules" },
+  },
+};

.env.example

@@ -3,30 +3,37 @@ CLOUDFLARE_API_TOKEN=
 CLOUDFLARE_ACCOUNT_ID=
 OUTPUT_DOWNLOAD_SIGNING_SECRET=
 
-# Blaxel
-BL_API_KEY=
-BL_WORKSPACE=cheatcode
-BL_REGION=us-pdx-1
-BLAXEL_SANDBOX_IMAGE=sandbox/cheatcode-sandbox:yoo6c20wgw03
-BLAXEL_SANDBOX_MEMORY_MB=4096
+# Daytona
+DAYTONA_API_KEY=
+DAYTONA_API_URL=https://app.daytona.io/api
+DAYTONA_PREVIEW_HOST_SUFFIXES=daytonaproxy01.net,proxy.daytona.work
+DAYTONA_TARGET=us
+DAYTONA_SANDBOX_SNAPSHOT=
+DAYTONA_WEBHOOK_SIGNING_SECRET=
+PREVIEW_TOKEN_SECRET=
 
 # Supabase
-NEXT_PUBLIC_SUPABASE_URL=
-NEXT_PUBLIC_SUPABASE_ANON_KEY=
 DATABASE_URL=
 # SUPABASE_MIGRATION_URL belongs in .env.migrate only, never here.
 
 # Clerk
+# Local development uses pk_test_/sk_test_ keys. Configure pk_live_/sk_live_ only
+# in Vercel Production and production Cloudflare Worker secrets.
 NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=
 CLERK_SECRET_KEY=
 # Optional PEM public key for networkless Clerk token verification.
 CLERK_JWT_KEY=
+CLERK_AUTHORIZED_PARTIES=http://localhost:3000,http://127.0.0.1:3000
 CLERK_WEBHOOK_SIGNING_SECRET=
 
 # Polar
-NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID=
 POLAR_ACCESS_TOKEN=
+POLAR_SERVER=production
 POLAR_WEBHOOK_SECRET=
+POLAR_PRODUCT_ID_PRO=
+POLAR_PRODUCT_ID_PREMIUM=
+POLAR_PRODUCT_ID_ULTRA=
+POLAR_PRODUCT_ID_MAX=
 
 # Composio
 COMPOSIO_API_KEY=
@@ -41,3 +48,4 @@ INTERNAL_MAINTENANCE_SECRET=
 
 # Gateway
 NEXT_PUBLIC_GATEWAY_URL=http://localhost:8787
+NEXT_PUBLIC_PREVIEW_HOSTNAME=trycheatcode.com

.env.migrate.example

@@ -2,3 +2,10 @@
 # Supabase admin/DDL connection for the same project used by Hyperdrive, or
 # apply the migration through Supabase MCP and verify the Worker route.
 SUPABASE_MIGRATION_URL=postgresql://postgres:postgres@localhost:54322/postgres
+SUPABASE_MIGRATION_EXPECTED_HOST=localhost
+SUPABASE_MIGRATION_EXPECTED_DATABASE=postgres
+SUPABASE_MIGRATION_EXPECTED_ROLE=postgres
+# Query once from the intended database: select system_identifier from pg_control_system();
+# SUPABASE_MIGRATION_EXPECTED_SYSTEM_IDENTIFIER=replace_me
+# Required for audit archive applies so Wrangler cannot select an unintended account.
+# CLOUDFLARE_ACCOUNT_ID=00000000000000000000000000000000

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @iamjr15

.github/dependabot.yml

@@ -0,0 +1,72 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 10
+    groups:
+      workspace-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directories:
+      - /infra/containers/sandbox/app-generators
+      - /infra/containers/sandbox/app-templates/expo
+      - /infra/containers/sandbox/app-templates/next
+      - /infra/containers/sandbox/browser-driver
+      - /infra/containers/sandbox/doc-runtime
+      - /infra/containers/sandbox/extension-overrides/parquet-viewer
+      - /infra/containers/sandbox/package-manager
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:30"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 10
+    groups:
+      sandbox-runtime-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: docker
+    directory: /infra/containers/sandbox
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: pip
+    directory: /infra/containers/sandbox
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:15"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:30"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        patterns:
+          - "*"