tinovyatkin
diff --git a/‎.codecov.yml‎
Lines changed: 21 additions & 3 deletions b/‎.codecov.yml‎
Lines changed: 21 additions & 3 deletions
diff --git a/‎.eslintignore‎
Lines changed: 0 additions & 1 deletion b/‎.eslintignore‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎.eslintrc‎
Lines changed: 0 additions & 109 deletions b/‎.eslintrc‎
Lines changed: 0 additions & 109 deletions
diff --git a/‎.gitattributes‎
Lines changed: 23 additions & 0 deletions b/‎.gitattributes‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎.github/dependabot.yml‎
Lines changed: 27 additions & 0 deletions b/‎.github/dependabot.yml‎
Lines changed: 27 additions & 0 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 97 additions & 0 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 97 additions & 0 deletions
diff --git a/‎.github/workflows/lint.yml‎
Lines changed: 0 additions & 34 deletions b/‎.github/workflows/lint.yml‎
Lines changed: 0 additions & 34 deletions
diff --git a/‎.github/workflows/mehen.yml‎
Lines changed: 23 additions & 0 deletions b/‎.github/workflows/mehen.yml‎
Lines changed: 23 additions & 0 deletions
@@ -1,4 +1,22 @@
 coverage:
-  parsers:
-    javascript:
-      enable_partials: yes
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 2%
+    patch:
+      default:
+        target: 80%
+        threshold: 5%
+
+ignore:
+  - __tests__
+  - coverage
+  - bin
+  - keys
+  - images
+
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default
+  require_changes: false
@@ -0,0 +1,23 @@
+* text=auto eol=lf
+
+# Binary assets — never convert
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.pem binary
+*.p12 binary
+*.zip binary
+*.pkpass binary
+*.der binary
+*.cer binary
+*.crt binary
+
+# Apple .strings files are UTF-16LE with their own line-ending conventions;
+# never let git convert them.
+*.strings binary
+
+# Snapshot files must match byte-for-byte; treat as binary so LF stays LF.
+*.snapshot -text
@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      types:
+        patterns:
+          - "@types/*"
+      dev-dependencies:
+        dependency-type: development
+        exclude-patterns:
+          - "@types/*"
+      prod-dependencies:
+        dependency-type: production
+    # tsgo preview builds change frequently; let dependabot bump but
+    # review before merging.
+    ignore:
+      - dependency-name: "@typescript/native-preview"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
@@ -0,0 +1,97 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [24.x, 26.x]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - run: npm run lint
+      - run: node --test --experimental-test-coverage --test-reporter=spec "__tests__/*.ts"
+
+  coverage:
+    # Coverage is host/version-independent for a pure-JS library; run once on
+    # the canonical shard to avoid uploading 6 copies per PR.
+    runs-on: ubuntu-latest
+    needs: test
+    permissions:
+      contents: read
+      id-token: write # required for Codecov OIDC tokenless upload
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Run tests with lcov coverage
+        run: |
+          mkdir -p coverage
+          # --enable-source-maps makes the lcov reporter emit src/*.ts
+          # paths (as declared in the .js.map files tsgo generates),
+          # not the built dist/*.js. Codecov then annotates the actual
+          # source in PR comments without needing path rewrites.
+          node --enable-source-maps --test \
+            --experimental-test-coverage \
+            --test-coverage-exclude="__tests__/**" \
+            --test-reporter=spec \
+            --test-reporter-destination=stdout \
+            --test-reporter=lcov \
+            --test-reporter-destination=coverage/lcov.info \
+            "__tests__/*.ts"
+      - uses: codecov/codecov-action@v6
+        with:
+          use_oidc: true
+          files: coverage/lcov.info
+          fail_ci_if_error: true
+
+  bundle-smoke:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: esbuild single-file bundle (Lambda-style)
+        run: |
+          # --banner injects a createRequire shim so bundled CJS modules
+          # (e.g. @noble/hashes → node:crypto) can still resolve node
+          # builtins when the output format is ESM.
+          npx esbuild dist/index.js \
+            --bundle \
+            --platform=node \
+            --format=esm \
+            --target=node24 \
+            --banner:js="import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);" \
+            --outfile=/tmp/bundle.mjs
+          # Load the bundle from outside the repo so we prove it doesn't
+          # depend on node_modules being present at runtime.
+          node --input-type=module -e \
+            "import('file:///tmp/bundle.mjs').then(m => { if (!m.Pass || !m.Template) { console.error('missing exports'); process.exit(1); } })"
+      - name: ncc single-file bundle
+        run: |
+          npx @vercel/ncc build dist/index.js -o /tmp/ncc-out
+          node -e "const m = require('/tmp/ncc-out/index.js'); if (!m.Pass || !m.Template) { console.error('missing exports'); process.exit(1); }"
@@ -0,0 +1,23 @@
+name: Code metrics
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  mehen:
+    runs-on: ubuntu-latest
+    # Metrics only; don't block the merge queue on tool failures.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: ophidiarium/mehen@v0
+        with:
+          paths: src
+        continue-on-error: true