diff --git a/.github/workflows/calver-release.yml b/.github/workflows/calver-release.yml
new file mode 100644
index 0000000..30c68bc
--- /dev/null
+++ b/.github/workflows/calver-release.yml
@@ -0,0 +1,36 @@
+name: calver-release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: compute calver tag
+        id: calver
+        run: |
+          base="$(date -u +%Y.%m.%d)"
+          git fetch --tags --quiet
+          tag="$base"
+          if git rev-parse -q --verify "refs/tags/$tag" > /dev/null; then
+            n=2
+            while git rev-parse -q --verify "refs/tags/$base-$n" > /dev/null; do
+              n=$((n + 1))
+            done
+            tag="$base-$n"
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: create release
+        run: gh release create "${{ steps.calver.outputs.tag }}" --generate-notes --title "${{ steps.calver.outputs.tag }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4d54a46
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: oxlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          install: true
+      - run: bun install --frozen-lockfile
+      - run: bun run lint
+
+  typecheck:
+    name: typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          install: true
+      - run: bun install --frozen-lockfile
+      - run: bun run typecheck
+
+  test:
+    name: vitest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          install: true
+      - run: bun install --frozen-lockfile
+      - run: bun run test
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          install: true
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+
+  all:
+    name: all checks pass
+    runs-on: ubuntu-latest
+    needs: [lint, typecheck, test, build]
+    if: ${{ always() }}
+    steps:
+      - run: echo "${{ needs.lint.result }} ${{ needs.typecheck.result }} ${{ needs.test.result }} ${{ needs.build.result }}"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..9fa1f9c
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,23 @@
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          config-file: release-please-config.json
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: build workspace packages after release PR opens
+        if: ${{ steps.release.outputs.release-created }}
+        run: bun install --frozen-lockfile
diff --git a/package.json b/package.json
index fcf7fd0..dae6d08 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,8 @@
     "oxfmt": "0.46.0",
     "oxlint": "1.61.0",
     "oxlint-tsgolint": "^0.22.1",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^2.1.0"
   },
   "engines": {
     "node": ">=22.0.0"
diff --git a/packages/protocol/src/connection-offer.test.ts b/packages/protocol/src/connection-offer.test.ts
index 73a0937..d79b627 100644
--- a/packages/protocol/src/connection-offer.test.ts
+++ b/packages/protocol/src/connection-offer.test.ts
@@ -20,7 +20,7 @@ describe("connection-offer", () => {
       offer: SAMPLE_OFFER,
       appBaseUrl: "https://app.supaplane.com",
     });
-    expect(url).toMatch(/^https:\/\/app\.supaplane\.run\/#offer=/);
+    expect(url).toMatch(/^https:\/\/app\.supaplane\.com\/#offer=/);
     const parsed = parseConnectionOfferFromUrl(url);
     expect(parsed).toEqual(SAMPLE_OFFER);
   });