diff --git a/.cursor/environment.json b/.cursor/environment.json
new file mode 100644
index 00000000..40d667f2
--- /dev/null
+++ b/.cursor/environment.json
@@ -0,0 +1,4 @@
+{
+  "name": "frigg-api-module-library",
+  "install": "bash .cursor/install.sh"
+}
diff --git a/.cursor/install.sh b/.cursor/install.sh
new file mode 100755
index 00000000..4be5742c
--- /dev/null
+++ b/.cursor/install.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Warm-boot bootstrap for Cursor Cloud Agents (and local/CI parity).
+# Idempotent: safe to re-run. Must exit when finished.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+# Many module jest setups use mongodb-memory-server with a Mongo 5.x binary that
+# links against OpenSSL 1.1. Ubuntu 22.04+/24.04+ ship OpenSSL 3 by default.
+LIBSSL11_DEB_URL='https://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb'
+# SHA-256 of libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb (Ubuntu jammy / Launchpad).
+LIBSSL11_DEB_SHA256='7cf39d70a639017d1dd7c8d36daa2258063608688e449fddf40ffdd46f992a78'
+
+if ! ldconfig -p 2>/dev/null | grep -q 'libcrypto\.so\.1\.1 '; then
+  echo "[.cursor/install] Installing libssl1.1 for mongodb-memory-server"
+  sudo apt-get update -qq
+  TMP_DEB="$(mktemp /tmp/libssl1.1.XXXXXX.deb)"
+  curl -fsSL -o "$TMP_DEB" "$LIBSSL11_DEB_URL"
+  printf '%s  %s\n' "$LIBSSL11_DEB_SHA256" "$TMP_DEB" | sha256sum -c -
+  sudo dpkg -i "$TMP_DEB"
+  rm -f "$TMP_DEB"
+fi
+
+echo "[.cursor/install] node=$(node -v) npm=$(npm -v)"
+npm ci --no-audit --no-fund
+
+echo "[.cursor/install] Bootstrap complete"
diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
new file mode 100644
index 00000000..14ea11a4
--- /dev/null
+++ b/.github/workflows/pr-ci.yml
@@ -0,0 +1,73 @@
+# Fast PR checks for module changes targeting next/main.
+# Uses Nx affected scoped to packages/** so lockfile-only fan-out does not
+# re-run every workspace's credentialed integration suites.
+#
+# Targets that actually exist & pass offline on next:
+#   - test  (most packages; Module Builder modules use nock/mocks)
+#   - build (TypeScript packages: clio, pipedrive, zoho-crm, frigg-scale-test)
+# lint is omitted: almost every package only has mutating `lint:fix`, and the
+# few `lint` scripts fail without unpublished eslint config packages.
+name: PR CI
+
+on:
+  pull_request:
+    branches:
+      - next
+      - main
+
+concurrency:
+  group: pr-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  affected:
+    name: Affected build & test
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          # Match release.yml / package.json engines (>=18). .node-version is stale (16).
+          node-version: '18'
+          cache: npm
+
+      - name: Install (libssl1.1 + npm ci)
+        # Same bootstrap as Cloud Agents (.cursor/environment.json) so
+        # mongodb-memory-server modules work on Ubuntu 24.04 runners.
+        run: bash .cursor/install.sh
+
+      - name: Run Nx affected build & test (packages only)
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          BASE_REF="origin/${{ github.base_ref }}"
+          # Full history fetch into refs/remotes/origin/<base> — do not use
+          # --depth=1 (writes .git/shallow and breaks three-dot merge-base).
+          git fetch --no-tags origin "${{ github.base_ref }}"
+
+          # Fail the job if git cannot resolve the merge-base (no || true).
+          mapfile -t CHANGED < <(
+            git diff --name-only "${BASE_REF}...HEAD" -- 'packages/**'
+          )
+
+          if [[ ${#CHANGED[@]} -eq 0 || -z "${CHANGED[0]:-}" ]]; then
+            echo "No packages/** changes vs ${BASE_REF}; skipping Nx build/test."
+            exit 0
+          fi
+
+          echo "Package files changed (${#CHANGED[@]}):"
+          printf '  %s\n' "${CHANGED[@]}"
+
+          # Comma-separated list for nx --files (avoids lockfile marking every project affected)
+          FILES_CSV=$(printf '%s,' "${CHANGED[@]}")
+          FILES_CSV="${FILES_CSV%,}"
+
+          # Nx skips projects that lack a given target, so build only runs on TS packages.
+          npx nx affected -t build,test --files="$FILES_CSV" --parallel=3