Marcus-Rise · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026
diff --git a/.codex/skills/gothic-lock-solver/SKILL.md b/.codex/skills/gothic-lock-solver/SKILL.md
diff --git a/.codex/skills/gothic-lock-solver/agents/openai.yaml b/.codex/skills/gothic-lock-solver/agents/openai.yaml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    versioning-strategy: increase
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,162 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  TARGET_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+
+jobs:
+  build:
+    name: Build and benchmark
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.SOURCE_SHA }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 12.3.4
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.19.0
+          cache: pnpm
+      - name: Install tools and dependencies
+        run: |
+          npm install --global --ignore-scripts npm@12.0.2
+          pnpm install --frozen-lockfile
+      - name: Check and build the distribution
+        run: |
+          pnpm check
+          pnpm build
+          pnpm test:distribution
+      - name: Benchmark against the exact target SHA when available
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          args=()
+          if [[ -n "$TARGET_SHA" && "$TARGET_SHA" != 0000000000000000000000000000000000000000 ]]; then
+            args+=(--baseline-sha "$TARGET_SHA")
+            run_id=$(gh run list --repo "$GITHUB_REPOSITORY" --workflow ci.yml --commit "$TARGET_SHA" --status success --limit 1 --json databaseId --jq '.[0].databaseId // empty')
+            if [[ -n "$run_id" ]]; then
+              artifact_id=$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/artifacts" --jq ".artifacts[] | select(.name == \"benchmark-$TARGET_SHA\" and .expired == false) | .id")
+              if [[ -n "$artifact_id" ]]; then
+                gh run download "$run_id" --repo "$GITHUB_REPOSITORY" --name "benchmark-$TARGET_SHA" --dir "$RUNNER_TEMP/baseline"
+                args+=(--baseline-report "$RUNNER_TEMP/baseline/benchmark.json")
+              fi
+            fi
+          fi
+          pnpm benchmark "${args[@]}"
+      - name: Show the benchmark report
+        if: always()
+        run: test ! -f artifacts/benchmark/benchmark.md || cat artifacts/benchmark/benchmark.md >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: benchmark-${{ env.SOURCE_SHA }}
+          overwrite: true
+          path: artifacts/benchmark/
+          retention-days: 90
+      - name: Pack the built distribution
+        run: |
+          mkdir "$RUNNER_TEMP/package"
+          npm pack --ignore-scripts --pack-destination "$RUNNER_TEMP/package"
+          mkdir -p artifacts/build
+          mv "$RUNNER_TEMP/package/"*.tgz artifacts/build/package.tgz
+          cp artifacts/benchmark/benchmark.{json,md} artifacts/build/
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-${{ env.SOURCE_SHA }}
+          overwrite: true
+          path: artifacts/build/
+          if-no-files-found: error
+          retention-days: 90
+
+  test:
+    name: Node ${{ matrix.node }} / ${{ matrix.project }}
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { node: '22.23.2', project: node }
+          - { node: '24.19.0', project: node }
+          - { node: '26.8.1', project: node }
+          - { node: '24.19.0', project: chromium }
+          - { node: '24.19.0', project: firefox }
+          - { node: '24.19.0', project: webkit }
+    defaults:
+      run:
+        shell: bash
+    env:
+      NODE_VERSION: ${{ matrix.node }}
+      PROJECT: ${{ matrix.project }}
+      BROWSER: ${{ matrix.project == 'node' && 'none' || matrix.project }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.SOURCE_SHA }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 12.3.4
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+      - name: Install tools and dependencies
+        run: |
+          npm install --global --ignore-scripts npm@12.0.2
+          pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-${{ env.SOURCE_SHA }}
+          path: ${{ runner.temp }}/build
+      - name: Extract the same built distribution
+        run: tar -xzf "$RUNNER_TEMP/build/package.tgz" --strip-components=1 -C . package/dist
+      - name: Install the selected browser
+        if: matrix.project != 'node'
+        run: pnpm exec playwright install --with-deps "$PROJECT"
+      - name: Test the selected environment
+        run: |
+          if [[ "$PROJECT" == node && "$NODE_VERSION" == 24.19.0 ]]; then
+            pnpm test:coverage
+          else
+            pnpm exec vitest run --project "$PROJECT"
+          fi
+      - name: Verify browser pages and Workers
+        if: matrix.project != 'node'
+        run: |
+          node tests/e2e/build-fixtures.ts
+          pnpm exec playwright test --project "$PROJECT"
+      - name: Verify the installed build archive
+        run: pnpm verify:package --archive "$RUNNER_TEMP/build/package.tgz" --browser "$BROWSER"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-node-${{ matrix.node }}-${{ matrix.project }}
+          path: |
+            artifacts/coverage/
+            artifacts/playwright-report/
+            artifacts/test-results/
+          retention-days: 14
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,103 @@
+name: Release
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      ci_run_id:
+        description: Successful main-push CI run
+        type: string
+        required: true
+      version:
+        description: Stable version, for example 1.0.0
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: >-
+      github.ref == 'refs/heads/main' && vars.NPM_PUBLICATION_READY == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    environment: npm-production
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      CI_RUN_ID: ${{ inputs.ci_run_id || github.event.workflow_run.id }}
+      STABLE_VERSION: ${{ inputs.version }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.19.0
+          registry-url: https://registry.npmjs.org
+      - run: npm install --global --ignore-scripts npm@12.0.2
+      - name: Download the successful main CI package
+        run: |
+          [[ "$CI_RUN_ID" =~ ^[1-9][0-9]*$ ]]
+          gh api "repos/$GH_REPO/actions/runs/$CI_RUN_ID" > "$RUNNER_TEMP/run.json"
+          SOURCE_SHA=$(jq -er --arg repo "$GH_REPO" '
+            select(.repository.full_name == $repo and .head_repository.full_name == $repo and
+              .event == "push" and .head_branch == "main" and .status == "completed" and .conclusion == "success" and
+              (.path | split("@")[0]) == ".github/workflows/ci.yml" and (.head_sha | test("^[a-f0-9]{40}$"))) | .head_sha
+          ' "$RUNNER_TEMP/run.json")
+          gh run download "$CI_RUN_ID" --repo "$GH_REPO" --name "build-$SOURCE_SHA" --dir "$RUNNER_TEMP/build"
+          echo "SOURCE_SHA=$SOURCE_SHA" >> "$GITHUB_ENV"
+          echo "CI_RUN_ATTEMPT=$(jq -r .run_attempt "$RUNNER_TEMP/run.json")" >> "$GITHUB_ENV"
+      - name: Prepare version metadata and release files
+        run: |
+          tar -xzf "$RUNNER_TEMP/build/package.tgz" -C "$RUNNER_TEMP"
+          cd "$RUNNER_TEMP/package"
+          BASE_VERSION=$(jq -r .version package.json)
+          VERSION="${BASE_VERSION}-canary.${CI_RUN_ID}.${CI_RUN_ATTEMPT}.${SOURCE_SHA:0:12}"
+          NPM_TAG=canary
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$STABLE_VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+            VERSION="$STABLE_VERSION"
+            NPM_TAG=latest
+          fi
+          for file in package.json dist/manifest.json; do
+            jq --arg version "$VERSION" '.version = $version' "$file" > "$file.tmp"
+            mv "$file.tmp" "$file"
+          done
+          mkdir "$RUNNER_TEMP/release"
+          npm pack --ignore-scripts --silent --pack-destination "$RUNNER_TEMP/release"
+          mv "$RUNNER_TEMP/release/gothic-lock-solver-$VERSION.tgz" "$RUNNER_TEMP/release/package.tgz"
+          cp dist/*.js dist/*.mjs "$RUNNER_TEMP/release/"
+          cp "$RUNNER_TEMP/build/benchmark.json" "$RUNNER_TEMP/build/benchmark.md" "$RUNNER_TEMP/release/"
+          {
+            printf '# Gothic Lock Solver %s\n\nSource: `%s`.\n\n' "$VERSION" "$SOURCE_SHA"
+            printf 'npm: https://www.npmjs.com/package/gothic-lock-solver/v/%s\n\n' "$VERSION"
+            printf 'CDN: https://cdn.jsdelivr.net/npm/gothic-lock-solver@%s/dist/\n\n' "$VERSION"
+            cat "$RUNNER_TEMP/build/benchmark.md"
+          } > "$RUNNER_TEMP/release-notes.md"
+          cat "$RUNNER_TEMP/release-notes.md" >> "$GITHUB_STEP_SUMMARY"
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "NPM_TAG=$NPM_TAG" >> "$GITHUB_ENV"
+      - name: Publish npm package
+        run: npm publish "$RUNNER_TEMP/release/package.tgz" --access public --tag "$NPM_TAG" --ignore-scripts
+      - name: Create GitHub Release
+        run: |
+          flags=(--latest)
+          if [[ "$NPM_TAG" == canary ]]; then flags=(--prerelease --latest=false); fi
+          gh release create "v$VERSION" "$RUNNER_TEMP/release/"* --repo "$GH_REPO" \
+            --target "$SOURCE_SHA" --title "Gothic Lock Solver $VERSION" \
+            --notes-file "$RUNNER_TEMP/release-notes.md" "${flags[@]}"
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,10 @@
 node_modules/
 coverage/
+dist/
+artifacts/
+playwright-report/
+test-results/
+*.cpuprofile
 *.tmp
 project_sources/
 upload/

diff --git a/.oxlintrc.json b/.oxlintrc.json
@@ -0,0 +1,43 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": [
+    "typescript",
+    "unicorn",
+    "oxc"
+  ],
+  "categories": {
+    "correctness": "error"
+  },
+  "rules": {
+    "typescript/no-explicit-any": "error",
+    "typescript/no-non-null-assertion": "error",
+    "typescript/ban-ts-comment": [
+      "error",
+      {
+        "ts-ignore": true,
+        "ts-nocheck": true,
+        "ts-expect-error": "allow-with-description"
+      }
+    ]
+  },
+  "ignorePatterns": [
+    "dist/**",
+    "node_modules/**",
+    "artifacts/**",
+    "tests/e2e/distribution/fixtures/**"
+  ],
+  "overrides": [
+    {
+      "files": [
+        "src/**/*.ts",
+        "vite.config.ts"
+      ],
+      "rules": {
+        "max-depth": [
+          "error",
+          3
+        ]
+      }
+    }
+  ]
+}