v2.1.2

.env.template

@@ -1,7 +1,7 @@
 NODE_ENV=development
 
 NEXT_PUBLIC_API_URL=https://scriptio.app
-NEXT_PUBLIC_COLLAB_WEBSOCKET_URL=ws://127.0.0.1:8787
+NEXT_PUBLIC_CLOUD_URL=http://127.0.0.1:8787
 
 # Secrets
 AUTH_SECRET=
@@ -18,7 +18,6 @@ DB_NAME=scriptio
 
 # Basic Auth (htpasswd format, escape $ as $$ in this file)
 PROD_AUTH_USERS=
-STAGING_AUTH_USERS=
 MONITORING_AUTH_USERS=
 
 # Monitoring

.github/actions/apply-version/action.yml

@@ -24,19 +24,26 @@ runs:
               SEMVER=$(echo "$INPUT_VERSION" | cut -d. -f1-3)
               MAJOR=$(echo "$INPUT_VERSION" | cut -d. -f1)
               MINOR=$(echo "$INPUT_VERSION" | cut -d. -f2)
+              PATCH=$(echo "$INPUT_VERSION" | cut -d. -f3)
+              REVISION=$(echo "$INPUT_VERSION" | cut -d. -f4)
 
               if [[ "$INPUT_STAGING" == "true" ]]; then
                   PRODUCT_NAME="Scriptio (Staging)"
                   WINDOW_TITLE="Scriptio (Staging)"
                   APPSTORE_IDENTIFIER="app.scriptio.staging"
                   WINDOWS_IDENTIFIER="ArkoLogic.ScriptioStaging"
-                  MSIX_VERSION="${MAJOR}.${MINOR}.${GITHUB_RUN_NUMBER:-1}.0"
+                  # MS Store reserves the 4th version field (must stay 0). Staging's
+                  # build counter (REVISION) sits in that slot, so fold PATCH+REVISION
+                  # into the 3rd field to keep MSIX versions strictly increasing
+                  # across staging pushes and release bumps.
+                  MSIX_VERSION="${MAJOR}.${MINOR}.$(( PATCH * 10000 + REVISION )).0"
               else
                   PRODUCT_NAME="Scriptio"
                   WINDOW_TITLE="Scriptio"
                   APPSTORE_IDENTIFIER="app.scriptio"
                   WINDOWS_IDENTIFIER="ArkoLogic.Scriptio"
-                  MSIX_VERSION="$INPUT_VERSION"
+                  # Release builds carry REVISION=0, so the app version is Store-legal as-is.
+                  MSIX_VERSION="${MAJOR}.${MINOR}.${PATCH}.0"
               fi
 
               jq --arg v "$SEMVER" --arg t "$WINDOW_TITLE" --arg n "$PRODUCT_NAME" \

.github/actions/compute-version/action.yml

@@ -14,6 +14,9 @@ outputs:
     git_tag:
         description: Tag to create on release (e.g. 2.0.1). Empty on other branches.
         value: ${{ steps.compute.outputs.git_tag }}
+    commit_sha:
+        description: Short git commit SHA.
+        value: ${{ steps.compute.outputs.commit_sha }}
 
 runs:
     using: composite
@@ -69,3 +72,4 @@ runs:
               echo "short_version=$SHORT_VERSION" >> $GITHUB_OUTPUT
               echo "revision=$REVISION" >> $GITHUB_OUTPUT
               echo "git_tag=$GIT_TAG" >> $GITHUB_OUTPUT
+              echo "commit_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

.github/actions/setup-desktop-build/action.yml

@@ -1,5 +1,5 @@
 name: Setup Desktop Build Toolchain
-description: Installs Node.js, Rust with platform-appropriate targets, MSIX bundler on Windows, and runs npm install.
+description: Installs Node.js, Rust with platform-appropriate targets, MSIX bundler on Windows, and runs npm ci.
 
 inputs:
     platform:
@@ -39,4 +39,4 @@ runs:
 
         - name: Install dependencies
           shell: bash
-          run: npm install
+          run: npm ci

.github/workflows/checks.yaml

@@ -17,14 +17,14 @@ jobs:
                   cache: "npm"
 
             - name: Install dependencies
-              run: npm install
+              run: npm ci
 
             - name: Lint
               run: npm run lint
               continue-on-error: true
 
             - name: Typecheck
-              run: npx tsc --noEmit
+              run: npx prisma generate && npx tsc --noEmit
 
     build-macos:
         runs-on: macos-latest
@@ -59,3 +59,104 @@ jobs:
 
             - name: Build Docker image
               run: docker compose build app-prod
+
+    benchmark:
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                browser: [chromium, webkit]
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: "25.2.1"
+                  cache: "npm"
+
+            - name: Install dependencies
+              run: npm ci
+
+            - name: Get Playwright version
+              id: pw-version
+              run: echo "version=$(node -e "console.log(require('./node_modules/playwright-core/package.json').version)")" >> $GITHUB_OUTPUT
+
+            - name: Cache Playwright browser
+              uses: actions/cache@v4
+              id: pw-cache
+              with:
+                  path: ~/.cache/ms-playwright
+                  key: playwright-${{ matrix.browser }}-${{ steps.pw-version.outputs.version }}
+
+            - name: Install Playwright browser and system deps
+              if: steps.pw-cache.outputs.cache-hit != 'true'
+              run: npx playwright install --with-deps ${{ matrix.browser }}
+
+            - name: Install Playwright system deps only
+              if: steps.pw-cache.outputs.cache-hit == 'true'
+              run: npx playwright install-deps ${{ matrix.browser }}
+
+            - name: Run benchmarks
+              run: npx vitest bench --project ${{ matrix.browser }}
+
+            - name: Upload benchmark results
+              uses: actions/upload-artifact@v4
+              with:
+                  name: bench-results-${{ matrix.browser }}
+                  path: bench-results.json
+                  retention-days: 90
+                  overwrite: true
+
+    benchmark-compare:
+        runs-on: ubuntu-latest
+        needs: benchmark
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: "25.2.1"
+                  cache: "npm"
+
+            - name: Download chromium results
+              uses: actions/download-artifact@v4
+              with:
+                  name: bench-results-chromium
+                  path: bench-current-chromium
+
+            - name: Download webkit results
+              uses: actions/download-artifact@v4
+              with:
+                  name: bench-results-webkit
+                  path: bench-current-webkit
+
+            - name: Merge current results
+              run: node scripts/merge-bench.mjs bench-current-chromium/bench-results.json bench-current-webkit/bench-results.json > bench-results.json
+
+            - name: Download previous benchmark baseline
+              uses: dawidd6/action-download-artifact@v9
+              continue-on-error: true
+              with:
+                  name: bench-results
+                  path: bench-baseline
+                  workflow: checks.yaml
+                  branch: ${{ github.ref_name }}
+                  if_no_artifact_found: warn
+
+            - name: Compare and report
+              run: |
+                  if [ -f bench-baseline/bench-results.json ]; then
+                    node scripts/compare-bench.mjs bench-baseline/bench-results.json bench-results.json >> $GITHUB_STEP_SUMMARY
+                  else
+                    echo "<h2>Benchmark Results</h2><p>No baseline found — results uploaded as the new baseline.</p>" >> $GITHUB_STEP_SUMMARY
+                  fi
+              continue-on-error: true
+
+            - name: Upload merged benchmark results as new baseline
+              uses: actions/upload-artifact@v4
+              with:
+                  name: bench-results
+                  path: bench-results.json
+                  retention-days: 90
+                  overwrite: true

.github/workflows/deploy-release.yaml

@@ -16,6 +16,7 @@ jobs:
             short_version: ${{ steps.version.outputs.short_version }}
             revision: ${{ steps.version.outputs.revision }}
             git_tag: ${{ steps.version.outputs.git_tag }}
+            commit_sha: ${{ steps.version.outputs.commit_sha }}
         steps:
             - uses: actions/checkout@v6
               with:
@@ -27,7 +28,7 @@ jobs:
 
     publish-macos:
         runs-on: macos-latest
-        needs: prepare
+        needs: [prepare, deploy-web]
         env:
             APP_PATH: src-tauri/target/universal-apple-darwin/release/bundle/macos/Scriptio.app
             PKG_PATH: Scriptio.pkg
@@ -41,7 +42,7 @@ jobs:
                   p12-password: ${{ secrets.APPLE_CERT_PASSWORD }}
 
             - name: Download provisioning profile
-              uses: apple-actions/download-provisioning-profiles@v5
+              uses: apple-actions/download-provisioning-profiles@v6
               with:
                   bundle-id: "app.scriptio"
                   profile-type: "MAC_APP_STORE"
@@ -52,7 +53,6 @@ jobs:
             - name: Copy provisioning profile to known path
               run: |
                   PROFILE=$(ls "$HOME/Library/MobileDevice/Provisioning Profiles/"*.provisionprofile \
-                               "$HOME/Library/MobileDevice/Provisioning Profiles/"*.mobileprovision \
                              2>/dev/null | head -n 1)
                   cp "$PROFILE" src-tauri/embedded.provisionprofile
 
@@ -71,7 +71,9 @@ jobs:
               env:
                   APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
                   NEXT_PUBLIC_API_URL: https://scriptio.app
+                  NEXT_PUBLIC_CLOUD_URL: https://cloud.scriptio.app
                   NEXT_PUBLIC_APP_VERSION: ${{ needs.prepare.outputs.version }}
+                  NEXT_PUBLIC_COMMIT_SHA: ${{ needs.prepare.outputs.commit_sha }}
 
             - name: Build signed .pkg installer
               run: |
@@ -81,17 +83,18 @@ jobs:
                     "$PKG_PATH"
 
             - name: Upload to App Store Connect
-              uses: apple-actions/upload-testflight-build@v3
+              uses: apple-actions/upload-testflight-build@v5
               with:
                   app-path: ${{ env.PKG_PATH }}
                   issuer-id: ${{ secrets.APPSTORE_ISSUER_ID }}
                   api-key-id: ${{ secrets.APPSTORE_KEY_ID }}
                   api-private-key: ${{ secrets.APPSTORE_API_KEY_P8 }}
+                  backend: "altool"
                   app-type: "macos"
 
     publish-windows:
         runs-on: windows-latest
-        needs: prepare
+        needs: [prepare, deploy-web]
         env:
             APP_PATH: src-tauri/target/msix/Scriptio.msixbundle
         steps:
@@ -111,7 +114,9 @@ jobs:
               run: npm run build:windows
               env:
                   NEXT_PUBLIC_API_URL: https://scriptio.app
+                  NEXT_PUBLIC_CLOUD_URL: https://cloud.scriptio.app
                   NEXT_PUBLIC_APP_VERSION: ${{ needs.prepare.outputs.version }}
+                  NEXT_PUBLIC_COMMIT_SHA: ${{ needs.prepare.outputs.commit_sha }}
 
             - name: Rename output to fixed name
               run: |
@@ -130,6 +135,24 @@ jobs:
             - name: Publish to Microsoft Store
               run: msstore publish "$env:APP_PATH" -id "9P4M1XPHJKS1"
 
+    deploy-cloud:
+        runs-on: ubuntu-latest
+        needs: prepare
+        steps:
+            - uses: actions/checkout@v6
+
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: "25.2.1"
+                  cache: "npm"
+
+            - run: npm ci
+
+            - name: Deploy Cloudflare Worker (production)
+              run: npm run cloud:deploy:prod
+              env:
+                  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
     deploy-web:
         runs-on: ubuntu-latest
         needs: prepare
@@ -161,6 +184,7 @@ jobs:
                       ${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.version }}
                   build-args: |
                       NEXT_PUBLIC_API_URL=https://scriptio.app
+                      NEXT_PUBLIC_CLOUD_URL=https://cloud.scriptio.app
                       NEXT_PUBLIC_COMMIT_SHA=${{ env.COMMIT_SHA }}
                       NEXT_PUBLIC_APP_VERSION=${{ needs.prepare.outputs.version }}
 
@@ -190,7 +214,7 @@ jobs:
 
     tag-release:
         runs-on: ubuntu-latest
-        needs: [prepare, publish-macos, publish-windows, deploy-web]
+        needs: [prepare, deploy-web]
         steps:
             - uses: actions/checkout@v6
               with: