johnyuki · devin-ai-integration · Apr 2, 2026 · Apr 6, 2026 · Apr 6, 2026 · Apr 6, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -9,7 +9,16 @@ updates:
     groups:
       updates:
         applies-to: version-updates
-        patterns: ["*"] #wildcard, needs brackets as bugfix apparently
+        patterns: ["*"] # wildcard, needs brackets as bugfix apparently
       security:
         applies-to: security-updates
         patterns: ["*"]
+  - package-ecosystem: "gomod"
+    directory: "/map-generator"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 0 # exclude version updates
+    groups:
+      golang:
+        applies-to: security-updates
+        patterns: ["*"]
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -34,6 +34,11 @@ on:
     branches:
       - "*"
 
+  # Nightly build: rebuild and deploy main to nightly.openfront.dev
+  # 07:00 UTC = 11:00 PM PST (midnight PDT during summer)
+  schedule:
+    - cron: "0 7 * * *"
+
 permissions: {}
 
 concurrency:
@@ -42,16 +47,16 @@ concurrency:
 
 jobs:
   deploy:
-    # Don't deploy on push if this is a fork
-    if: ${{ github.event_name == 'workflow_dispatch' || github.repository == 'openfrontio/OpenFrontIO' }}
+    # Deploy on push/schedule/workflow_dispatch (see "on:") unless this is a fork
+    if: ${{ github.repository == 'openfrontio/OpenFrontIO' }}
     # Use different logic based on event type
     name: Deploy to ${{ inputs.target_domain || 'openfront.dev' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: ${{ inputs.target_domain == 'openfront.io' && 'prod' || '' }}
     env:
       DOMAIN: ${{ inputs.target_domain || 'openfront.dev' }}
-      SUBDOMAIN: ${{ github.event_name == 'push' && github.ref_name || inputs.target_subdomain || 'main' }}
+      SUBDOMAIN: ${{ github.event_name == 'schedule' && 'nightly' || github.event_name == 'push' && github.ref_name || inputs.target_subdomain || 'main' }}
     steps:
       - uses: actions/checkout@v6
       - name: 📝 Update job summary
@@ -79,7 +84,7 @@ jobs:
           gh api octocat
       - name: 📝 Create deployment
         if: ${{ github.repository == 'openfrontio/OpenFrontIO' && steps.generate-token.outputs.token != '' }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         id: deployment
         env:
           ENVIRONMENT: ${{ inputs.target_domain == 'openfront.io' && 'prod' || 'staging' }}
@@ -129,10 +134,10 @@ jobs:
           GHCR_REPO: ${{ vars.GHCR_REPO }}
           GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
           ENV: ${{ inputs.target_domain == 'openfront.io' && 'prod' || 'staging' }}
-          HOST: ${{ github.event_name == 'workflow_dispatch' && inputs.target_host || 'staging' }}
+          HOST: ${{ github.event_name == 'workflow_dispatch' && inputs.target_host || 'staging' }} # schedule and push both use staging
+          CDN_BASE: ${{ vars.CDN_BASE }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
-          TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
           API_KEY: ${{ secrets.API_KEY }}
           SERVER_HOST_MASTERS: ${{ secrets.SERVER_HOST_MASTERS }}
           SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
@@ -161,7 +166,7 @@ jobs:
           echo "::endgroup::"
       - name: 🔄 Update deployment status
         if: ${{ always() && github.repository == 'openfrontio/OpenFrontIO' && steps.generate-token.outputs.token != '' && steps.deployment.outcome == 'success' && steps.deployment.outputs.deployment_id != '' }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           FQDN: ${{ env.FQDN }}
           DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}

diff --git a/.github/workflows/pr-author.yml b/.github/workflows/pr-author.yml
@@ -13,4 +13,4 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: toshimaru/auto-author-assign@4d585cc37690897bd9015942ed6e766aa7cdb97f
+      - uses: toshimaru/auto-author-assign@bdd7688cbf9e6d5683f02f8c7d8ae4062a254b6d
diff --git a/.github/workflows/pr-description.yml b/.github/workflows/pr-description.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             if (context.eventName === 'merge_group') {
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             if (context.eventName === 'merge_group') {

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -67,10 +67,10 @@ jobs:
           GHCR_REPO: openfront-prod
           GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
           DOMAIN: ${{ vars.DOMAIN }}
+          CDN_BASE: ${{ vars.CDN_BASE }}
           IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
-          TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
           API_KEY: ${{ secrets.API_KEY }}
           SERVER_HOST_STAGING: ${{ secrets.SERVER_HOST_STAGING }}
           SSH_KEY: ~/.ssh/id_rsa
@@ -117,10 +117,10 @@ jobs:
           GHCR_REPO: ${{ vars.GHCR_REPO }}
           GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
           DOMAIN: ${{ vars.DOMAIN }}
+          CDN_BASE: ${{ vars.CDN_BASE }}
           IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
-          TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
           API_KEY: ${{ secrets.API_KEY }}
           SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
           SSH_KEY: ~/.ssh/id_rsa
@@ -167,10 +167,10 @@ jobs:
           GHCR_REPO: ${{ vars.GHCR_REPO }}
           GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
           DOMAIN: ${{ vars.DOMAIN }}
+          CDN_BASE: ${{ vars.CDN_BASE }}
           IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
-          TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
           API_KEY: ${{ secrets.API_KEY }}
           SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
           SSH_KEY: ~/.ssh/id_rsa
@@ -217,10 +217,10 @@ jobs:
           GHCR_REPO: ${{ vars.GHCR_REPO }}
           GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
           DOMAIN: ${{ vars.DOMAIN }}
+          CDN_BASE: ${{ vars.CDN_BASE }}
           IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
           OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
-          TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
           API_KEY: ${{ secrets.API_KEY }}
           SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
           SSH_KEY: ~/.ssh/id_rsa

diff --git a/.gitignore b/.gitignore
@@ -9,7 +9,8 @@ resources/.DS_Store
 .env*
 .DS_Store
 .clinic/
-CLAUDE.md
+NOTES.md
+.claude/
 .idea/
 # this is autogenerated by script
 src/assets/

diff --git a/.vscode/extensions.json b/.vscode/extensions.json
@@ -0,0 +1,6 @@
+{
+  "recommendations": [
+    "socketsecurity.vscode-socket-security",
+    "esbenp.prettier-vscode"
+  ]
+}
diff --git a/.vscode/launch.json b/.vscode/launch.json
@@ -4,7 +4,7 @@
     {
       "type": "node",
       "request": "launch",
-      "name": "Debug Jest Tests",
+      "name": "Debug Tests",
       "runtimeExecutable": "npm",
       "runtimeArgs": ["run-script", "test"],
       "console": "integratedTerminal",

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -0,0 +1,84 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+```bash
+npm run inst             # Install deps (uses npm ci --ignore-scripts — do NOT use npm install)
+npm run dev              # Run client + server in dev mode with hot reload
+npm run start:client     # Client only
+npm run start:server-dev # Server only
+npm test                 # Run all tests (Vitest)
+npm run test:coverage    # Tests with coverage
+npm run lint             # ESLint
+npm run lint:fix         # ESLint with auto-fix
+npm run format           # Prettier
+npm run build-prod       # Production build
+```
+
+**Run a single test file:**
+
+```bash
+npx vitest tests/YourTest.test.ts --run
+npx vitest NationAllianceBehavior --run # match by name pattern
+```
+
+## Architecture
+
+OpenFront.io is a real-time multiplayer territorial strategy game. There are four components:
+
+1. **`src/core/`** — Deterministic game simulation. Pure TypeScript with **no external dependencies**. Must remain fully deterministic (seeded PRNG, no floating-point math). Runs in a Web Worker thread. All `src/core` changes **must** include tests.
+2. **`src/client/`** — Rendering (Pixi.js/WebGL), UI (Lit web components + Tailwind CSS 4), WebSocket communication.
+3. **`src/server/`** — Game coordination, intent relay, WebSocket management (Node.js/Express/ws).
+4. **API** — Closed-source Cloudflare Worker handling auth, stats, cosmetics, monetization. Not in this repo.
+
+### Simulation Flow (Intent → Execution)
+
+The game simulation runs **on each client**, not the server. The server only relays intents.
+
+1. Player action → client creates an **Intent** → sent to server
+2. Server bundles all intents for the tick into a **Turn** → relays to all clients
+3. Client forwards Turn to the Core worker
+4. Core creates an **Execution** for each intent
+5. Core calls `executeNextTick()` — all executions run and mutate game state
+6. Core sends **GameUpdates** back to client → client renders
+
+Intents and all wire messages are Zod-validated schemas defined in `src/core/Schemas.ts`.
+
+### CDN / Static Assets
+
+The game server only serves `index.html` and the WebSocket. All other assets (JS bundle, images, maps, worker) come from a CDN bucket. `CDN_BASE` is an empty string in dev (falls back to same-origin) and a full origin (e.g. `https://cdn.example.com`) in production. It is set as both a Vite build-time variable and a server runtime env var.
+
+## Key Files
+
+| File                        | Purpose                                |
+| --------------------------- | -------------------------------------- |
+| `src/core/Schemas.ts`       | All intent/message types (Zod schemas) |
+| `src/core/GameRunner.ts`    | Simulation orchestrator                |
+| `src/core/game/GameImpl.ts` | Game state implementation              |
+| `src/server/GameServer.ts`  | Main WebSocket server, game loop       |
+| `src/server/Master.ts`      | Lobby and game registry                |
+| `tests/util/Setup.ts`       | Test helper — creates test games       |
+| `docs/Architecture.md`      | Architecture overview                  |
+| `docs/Auth.md`              | JWT/auth flow                          |
+| `docs/API.md`               | Public API endpoints                   |
+| `vite.config.ts`            | Build config, CDN handling             |
+
+## UI Text / i18n
+
+All user-visible text must go through `translateText()` and have a corresponding entry added to `resources/lang/en.json`. Translations are managed via Crowdin. DO NOT modify any other translation files.
+
+## Testing Patterns
+
+Tests use a `setup()` helper from `tests/util/Setup.ts` that creates a full game instance with map data from `tests/testdata/maps/`. Write tests that exercise the core simulation directly — not mocks.
+
+## Tech Stack
+
+- **Bundler:** Vite + TypeScript 5.7
+- **Rendering:** Pixi.js (WebGL)
+- **UI Components:** Lit (LitElement) + Tailwind CSS 4
+- **Audio:** Howler.js
+- **Schemas/Validation:** Zod
+- **Testing:** Vitest
+- **Server:** Node.js, Express, ws (WebSocket)
diff --git a/CREDITS.md b/CREDITS.md
@@ -44,6 +44,11 @@ Licensed under [Open Data Commons Open Database License (ODbL)](https://opendata
 Copernicus Global Digital Elevation Models distributed by OpenTopography.
 Copyright © opentopography.org. All Rights Reserved. [Terms of Use](https://opentopography.org/usageterms)
 
+### NASA
+
+[NASA Earth Observatory](https://science.nasa.gov/earth/earth-observatory/blue-marble-next-generation/topography-bathymetry-maps/)
+[Public Domain](https://www.nasa.gov/nasa-brand-center/images-and-media/)
+
 ### Hawaii Relief Map
 
 [USA Hawaii relief location map](https://commons.wikimedia.org/wiki/File:USA_Hawaii_relief_location_map.svg) by NordNordWest
@@ -64,10 +69,45 @@ Licensed under [CC0 1.0.](https://creativecommons.org/publicdomain/zero/1.0/lega
 [NASA/JPL-Caltech](https://www.jpl.nasa.gov/images/pia10748-our-milky-way-gets-a-makeover-artist-concept/)
 [Public Domain](https://www.jpl.nasa.gov/jpl-image-use-policy/)
 
+### Strait Of Malacca Map
+
+[https://commons.wikimedia.org/wiki/User:Sadalmelik#/media/File:Sumatra_Topography.png](https://commons.wikimedia.org/wiki/File:Sumatra_Topography.png#/media/File:Sumatra_Topography.png)
+Sadalmelik - Own work
+Topographic map of Sumatra. Created with GMT from publicly released SRTM data. For locator version, see Image:Sumatra Locator Topography.png
+CC BY-SA 3.0
+File:Sumatra Topography.png
+
+### Luna (The Moon) Map
+
+[https://svs.gsfc.nasa.gov/4720#section_credits]
+NASA's Scientific Visualization Studio
+Visualizer
+Ernie Wright (USRA) ORCID logo.
+Scientist
+Noah Petro (NASA/GSFC) ORCID logo.
+
+### Antarctica Map
+
+Polar Geospatial Center, 2018, "PGC Map Catalog", https://doi.org/10.7910/DVN/6R8F7U, Harvard Dataverse, V1, [2364], [Apr-02-2026].
+[Terms of Use](https://www.pgc.umn.edu/guides/user-services/acknowledgement-policy/)
+
+[U.S. Geological Survey](https://earthexplorer.usgs.gov/metadata/4980/GT30ANTARCPS/)
+[Public Domain](https://www.doi.gov/copyright)
+
+### Los Angeles Map
+
+© [OpenStreetMap contributors](https://www.openstreetmap.org/copyright)  
+Licensed under ODbL
+
 ## Icons
 
 ### [The Noun Project](https://thenounproject.com/)
 
 Stats icon by [Meko](https://thenounproject.com/mekoda/) – https://thenounproject.com/icon/stats-4942475/
 Pay Per Click icon by [Fauzan Adiima](https://thenounproject.com/creator/fauzan94/) – https://thenounproject.com/icon/pay-per-click-2586454/
 Medal icon by [Snow](https://thenounproject.com/snowdoll/) – https://thenounproject.com/icon/medal-4567887/
+
+### Flags
+
+[Wikimedia Commons](https://commons.wikimedia.org/wiki/Flag)
+Licensed under [CC BY-SA 3.0 DE](https://creativecommons.org/licenses/by-sa/3.0/de/deed.en)
diff --git a/Dockerfile b/Dockerfile
@@ -77,7 +77,7 @@ ENV GIT_COMMIT="$GIT_COMMIT"
 RUN <<'EOF' tee /usr/local/bin/start.sh
 #!/bin/sh
 if [ "$DOMAIN" = openfront.dev ] && [ "$SUBDOMAIN" != main ]; then
-    exec timeout 18h /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
+    exec timeout 25h /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
 else
     exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
 fi

diff --git a/README.md b/README.md
@@ -1,8 +1,8 @@
 <p align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="resources/images/OpenFrontLogoDark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="resources/images/OpenFrontLogo.svg">
-    <img src="resources/images/OpenFrontLogo.svg" alt="OpenFrontIO Logo" width="300">
+    <source media="(prefers-color-scheme: dark)" srcset="proprietary/images/OpenFrontLogoDark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="proprietary/images/OpenFrontLogo.svg">
+    <img src="proprietary/images/OpenFrontLogo.svg" alt="OpenFrontIO Logo" width="300">
   </picture>
 </p>
 

diff --git a/deploy.sh b/deploy.sh
@@ -134,10 +134,10 @@ ENV=$ENV
 HOST=$HOST
 GHCR_IMAGE=$GHCR_IMAGE
 GHCR_TOKEN=$GHCR_TOKEN
-TURNSTILE_SECRET_KEY=$TURNSTILE_SECRET_KEY
 API_KEY=$API_KEY
 DOMAIN=$DOMAIN
 SUBDOMAIN=$SUBDOMAIN
+CDN_BASE=$CDN_BASE
 OTEL_EXPORTER_OTLP_ENDPOINT=$OTEL_EXPORTER_OTLP_ENDPOINT
 OTEL_AUTH_HEADER=$OTEL_AUTH_HEADER
 EOL

diff --git a/docs/API.md b/docs/API.md
@@ -1,5 +1,7 @@
 # API Usage
 
+> **Warning:** Rate limits are very strict. Join the [Discord](https://discord.gg/K9zernJB5z) to request higher rate limits.
+
 ## Games
 
 ### List Game Metadata
@@ -207,10 +209,24 @@ GET https://api.openfront.io/public/clan/:clanTag/sessions
 
 - `start` (optional): ISO 8601 timestamp
 - `end` (optional): ISO 8601 timestamp
+- `page` (optional): Page number, 1-200 (default: 1)
+- `limit` (optional): Results per page, 1-50 (default: 20)
+
+**Response:**
+
+```json
+{
+  "results": [ ... ],
+  "total": 150,
+  "page": 1,
+  "limit": 20
+}
+```
+
+Results are ordered by game start time, newest first.
 
 **Example**
 
 ```bash
-curl https://api.openfront.io/public/clan/UN/sessions?start=2025-11-15T00:00:00Z &
-end=2025-11-18T23:59:59Z
+curl "https://api.openfront.io/public/clan/UN/sessions?start=2025-11-15T00:00:00Z&end=2025-11-18T23:59:59Z&limit=10&page=1"
 ```