Changelog

Adds ai/query, ai/chat/create, ai/chat/query (401 without a game session), shader/1/{crc} and package/dll/1/{ident}/{rev} (engine-token binaries). None are usable by the site.

The repository is private and Actions minutes are billed. The checks the workflows ran are unchanged and run locally with npm run check; AUDIT.md records the decision.

/tools/* is ignored apart from a whitelist, so the deny file protecting the operator scripts and the PHPStan runner had not been committed; found by running the CI commands from a fresh clone.

• tests/run-php.sh [hermetic|integration|live|all]: assertions forced on, APCu on; a test that cannot run says why and exits 2, which fails the run; sections skipped inside a passing test are counted and shown
• test_player_history exited 0 when no database was available and test_tool_auth exited 0 with the example CRON_KEY: both silent passes, now exit 2 with a reason
• tests/_support.php: requireDatabase / requireLiveApi / requireAssertions; tests/setup-integration.sh writes a config.php for integration runs
• ci.yml: frontend (lint, tests, builds), php (syntax, hermetic tests, pinned PHPStan) and integration (PostgreSQL service, real site) jobs; no secrets, no external APIs, concurrency and timeouts set
• audit.yml (npm advisories) and live.yml (Facepunch API) are scheduled/manual so third parties cannot fail a pull request

phpstan.neon carried ~90 ignore patterns that hid every class of error; it now runs level 1 (unknown functions, classes, methods, constants; possibly-undefined variables) over backend, auth and mcp with seven narrow, commented ignores. tools/run-phpstan.sh (npm run analyse:php) uses the version pinned in composer.lock.

Real bugs found:

• obscureIpAddress() did not exist, so the personal-data export fataled for anyone with session history
• cache-management-api called CacheManager::getInstance(), which does not exist (the class is static), so invalidating by tag or pattern fataled; pattern LIKE wildcards in the input are now escaped
• search-api sent Cache-Control: public for the signed-in user's search history and the admin analytics
• two CompressionMiddleware classes (pages and API) shared a name; the API one is ApiCompressionMiddleware
• backend/controllers/ duplicated BaseController and PackageController and nothing loaded it; backend/services/PackageService.php called functions that do not exist and had no callers
• an invalid MCP tool example repeated the 'action' key

cache-management.js, dependency-graph.js, notification-bell.js, homepage-categories.js (an ES module the non-bundling build could never have run) and its only importer homepage-utils.js. Checked against templates, the core script list, imports and dynamic loads, the service worker, build config and tests. tests/test_js_referenced.php fails if a script in frontend/js is not referenced by another tracked file.

npm update within the existing semver ranges (package.json unchanged): postcss, esbuild, vitest/vite, browserslist, nanoid, js-yaml, svgo, undici, fast-uri, brace-expansion, colord and their transitive dependencies. npm audit now reports 0 with and without dev dependencies; the CSS bundle is byte-identical and lint, tests and builds pass. npm 10.9.4's resolver crashes on this tree, so the update was run with npm 11 via npx; the lockfile format is unchanged and npm ci accepts it.

• tests/run-php.sh (npm run test:php) runs the 32 standalone tests that need no config, database or network, with assertions forced on: test_global_stats_grid relies on assert() and passed vacuously under the default zend.assertions=-1
• .github/workflows/ci.yml runs ESLint, Stylelint, Vitest, the CSS build, a PHP syntax check and the PHP runner
• remove tabbable and fast-check, which nothing imports