Use published Convex package in wedding demo

[kvz]

Why

The wedding demo should dogfood what an application developer can actually install. Until now its package imports resolved to this repository's TypeScript source, even after a release.

Changes

• Consume the published @transloadit/convex@0.5.0 as an exact private example dependency; remove repository-source path aliases.
• Make Yarn install the registry package, and check resolution before the frontend build and production backend deploy. Exercise the installed component in the backend bundler test.
• Preserve Changesets root-package discovery and prevent a future version PR from prematurely moving the demo to an unpublished registry version.
• Keep candidate-package preview QA and the legacy local R2 test harness distinct and documented.
• Supply the small native Next album icon that the real browser pass found missing; no upload/auth/Storage policy changes.

Validation

• yarn check: 273 tests pass, no type errors.
• yarn example:build: pass; installed package resolves from example/node_modules, not repository source.
• Council review: fixed its release-discovery regression and removed the hard-coded expected version from the package-resolution test. Discovery test demonstrated red then green; a disposable Changesets release fixture advances the library to 0.5.1 without changing the demo's 0.5.0 dependency.
• yarn dedupe: no duplicate ranges.
• Published 0.5.0 verified on npm with provenance after Version Packages #46. PR CI 38796804160 passed after matching the branch preview's public backend URL to its actual Convex deployment. Merged as d4b59c60ee4762ae34bcfeaef639a4d1546da76f; main run 38797391532 passed the automatic production-demo deployment and real private-Storage upload/playback/original-byte/access-denial acceptance.
• Independent Opus 5.5 review reconciled real desktop/mobile screenshots, browser logs, upload exploration and source. Lab median LCP: 0.884 s desktop cold, 0.856 s warm, 4.928 s simulated slow mobile (3 samples/mode, not field p75). Mobile speed and a cleaner copyable starter remain useful follow-ups, not prerequisites to adopting the released package.
• The exploratory long-lived guest exposed an existing deployment key-rotation bug that fresh CI guests missed. Actual unexpired JWT signatures failed against replaced public keys and private images returned 500. Scoped fix and same-session deployment acceptance are tracked separately in #48; this PR did not change auth policy.

Merging uses the existing automatic wedding-demo deployment. No API2 production deployment or Storage enrollment change is included.

_{🤖 Claimed by kvz on studio1/convex since 2026-10-15 · resume: codex resume 019fa2ee-f994-79d0-9d50-071bf2cb7ad6}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
convex	Ready	Preview	Oct 15, 2026 7:50pm UTC