diff --git a/.env.test b/.env.test
index bb2f23dc..d965c94a 100644
--- a/.env.test
+++ b/.env.test
@@ -1,13 +1,14 @@
 # Test environment — committed on purpose.
 # Dummy but format-valid values that satisfy src/types/environment.ts so the
 # app can boot for E2E tests. Flows depending on real external services will
-# not work with these: AI generation (OpenAI/Anthropic), Mapbox geocoding,
+# not work with these: AI generation (Anthropic), Mapbox geocoding,
 # email (UseSend), Umami analytics, status-page heartbeat.
 # Prerequisite: `docker compose up -d` (Mongo, Redis, S3 must be reachable).
 
 # Not the real dev-server port (3000): that literal can also appear hardcoded
 # in vendor code.
 SERVER_HOST=localhost:39217
+PRODUCTION_HOST=daniel.heene.io
 SERVER_URL=http://localhost:39217
 NEXT_PUBLIC_SERVER_URL=http://localhost:39217
 NEXT_PUBLIC_STATUS_PAGE_URL=http://localhost:3001
@@ -37,7 +38,6 @@ USESEND_API_KEY=test-key
 USESEND_DEFAULT_FROM_ADDRESS=test@example.com
 USESEND_DEFAULT_FROM_NAME=Test
 
-OPENAI_API_KEY=sk-test
 ANTHROPIC_API_KEY=sk-ant-test
 MAPBOX_API_KEY=pk.test
 UNSPLASH_ACCESS_KEY=
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 56d26d63..00000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-paths:
-  .github/workflows/ci.yml:
-    ignore:
-      # The E2E job reads these from the Testing environment (`environment:
-      # Testing`), which a reusable workflow gets without declaring them under
-      # `workflow_call.secrets`; declaring them there left them empty.
-      - 'property "(test_services_host|database_url|redis_url|s3_endpoint|s3_bucket|s3_region|s3_access_key|s3_secret_key|ts_oauth_client_id|ts_oauth_secret)" is not defined'
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 6ba40c2a..dbfb8e3b 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -17,7 +17,7 @@ runs:
         node-version: 26
 
     - name: Cache Bun packages
-      uses: actions/cache@v4 # TODO: pin to a commit SHA like the other actions
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.bun/install/cache
         key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 201aa418..5a83ab3c 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -154,6 +154,7 @@ jobs:
       # per-branch NODE_ENV build arg is gone with the Docker build phase.
       NODE_ENV: production
       SERVER_HOST: ${{ secrets.SERVER_HOST }}
+      PRODUCTION_HOST: ${{ secrets.PRODUCTION_HOST }}
       SERVER_URL: ${{ secrets.SERVER_URL }}
       NEXT_PUBLIC_SERVER_URL: ${{ secrets.NEXT_PUBLIC_SERVER_URL }}
       NEXT_PUBLIC_STATUS_PAGE_URL: ${{ secrets.NEXT_PUBLIC_STATUS_PAGE_URL }}
@@ -177,7 +178,6 @@ jobs:
       USESEND_API_KEY: ${{ secrets.USESEND_API_KEY }}
       USESEND_DEFAULT_FROM_ADDRESS: ${{ secrets.USESEND_DEFAULT_FROM_ADDRESS }}
       USESEND_DEFAULT_FROM_NAME: ${{ secrets.USESEND_DEFAULT_FROM_NAME }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       MAPBOX_API_KEY: ${{ secrets.MAPBOX_API_KEY }}
       UNSPLASH_ACCESS_KEY: ${{ secrets.UNSPLASH_ACCESS_KEY }}
@@ -209,6 +209,17 @@ jobs:
       - name: Run database migrations
         run: bun run migrate
 
+      # Webpack's persistent cache; the only part of .next worth restoring
+      # between builds.
+      - name: Restore Next.js build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .next/cache
+          key: next-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ github.sha }}
+          restore-keys: |
+            next-${{ runner.os }}-${{ hashFiles('bun.lock') }}-
+            next-${{ runner.os }}-
+
       # One build against this environment's real values — no separate
       # test-env compile to reconcile with afterward (see lint-and-test.yml's
       # `e2e` job for the PR-time equivalent, which uses .env.test instead).
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index b14a0a22..2fad0356 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -43,7 +43,7 @@ jobs:
         run: bun run lint
 
       - name: Check dependency version groups
-        run: bun run deps:lint
+        run: bun run packages:lint
 
       # Generated files are committed; a stale one means someone changed a
       # collection/field/block without running `bun run generate`.
@@ -94,7 +94,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4 # TODO: pin to a commit SHA like the other actions
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage
           path: coverage/
diff --git a/AGENTS.md b/AGENTS.md
index e59ace98..d22924d2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,15 +30,17 @@ See `README.md` for setup/run instructions; this file focuses on conventions and
 
 ```bash
 bun install              # install deps (Bun only — see packageManager in package.json)
-bun run dev              # runs Next.js dev server + Storybook in parallel
-bun run dev:app          # Next.js dev server only
-bun run generate         # regenerate Payload types + import map (run after changing collections/fields)
-bun run build            # production build
+bun run dev              # Next.js dev server via scripts/dev.mjs (--tunnel opens the Cloudflare Tunnel)
+bun run dev:app          # plain `next dev`, without the tunnel wrapper
+bun run dev:storybook    # Storybook on :6006 (not started by `bun run dev`)
+bun run generate         # regenerate Next route types, Payload types + import map
+bun run build            # production build (`next build --webpack`)
+bun run typecheck        # tsc --noEmit
+bun run analyze          # production build with @next/bundle-analyzer reports
 bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
-bun run format           # oxfmt (formatting and import order only)
 bun run test             # unit tests (Vitest)
-bun run deps:lint        # syncpack: dependency version groups
+bun run packages:lint        # syncpack: dependency version groups
 bun run test:e2e         # Playwright E2E (needs docker compose up -d)
 ```
 
@@ -55,11 +57,19 @@ files import generated types from `src/types/payload.ts` and `@/types/collection
 Don't let those block your task, but do not introduce new lint errors or warnings, and prefer
 fixing warnings in files you already touch.
 
+`syncpack.config.mjs` pins each package family (Payload, Storybook, Vitest, Playwright, React) to
+one version with `pinVersion`; to upgrade a family, change its pin and run `bun run packages:fix`
+(`packages:update` skips pinned families). Pins rather than `sameRange`: syncpack only compares
+one dependency across packages, so in this single-package repo no policy catches `react` and
+`react-dom` drifting apart. `scripts/e2e-docker.sh` derives its image tag from the installed
+`@playwright/test`.
+
 Always spell scripts `bun run <script>`: bare `bun test` and `bun build` run Bun's own test runner
 and bundler, not the package scripts.
 
 Commits go through Lefthook (`lefthook.yml`): `pre-commit` runs `oxfmt` then `oxlint --fix` on
-staged files (re-staging the fixes), `commit-msg` enforces Conventional
+staged files (re-staging the fixes) and, when `package.json` is staged, `syncpack format` + `fix`
+followed by `bun install` (re-staging `bun.lock`); `commit-msg` enforces Conventional
 Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
 `test`, `build`, `ci`, `perf`, `style`, `revert`); scopes are unrestricted.
 
@@ -76,7 +86,7 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   4. `@/**` path-alias imports
   5. relative imports
   6. style imports
-  Run `bun run format` (or your editor's Oxc integration) instead of manually sorting imports.
+  Run `bun run lint:fix` (or your editor's Oxc integration) instead of manually sorting imports.
 - `tsconfig.json` has `"strict": false` — do not rely on the compiler to catch null/undefined
   bugs; be explicit and defensive, especially in Payload hooks and access-control functions.
 - `import type` vs. value imports is **not** enforced (`typescript/consistent-type-imports` is off) — either style is
@@ -94,7 +104,8 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   the two hook flavors stay visually distinct — React hooks in `src/lib/hooks/` are camelCase named
   after the hook (`useIsMobile.ts`), Payload lifecycle hooks in `src/lib/payloadHooks/` are
   camelCase named after what they do (`generateChecksum.ts`). Plain utils use camelCase
-  (`generateSlug.ts`).
+  (`generateSlug.ts`). `src/components/hooks/` is an older second home for React hooks (one of
+  them kebab-case, `use-server-sent-events.ts`); put new hooks in `src/lib/hooks/`.
 - **Fields**: folder name has no suffix (`src/fields/Slug/`), but the exported factory function
   has an `XField` suffix (`SlugField`, `TitleField`). Keep this pattern for new fields.
 - **Globals**: naming is currently inconsistent (`SiteSettings`, `SettingsGlobalUser`,
@@ -125,9 +136,9 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   functions), `hooks/` (React hooks), `payloadHooks/` (Payload collection/global lifecycle hooks —
   distinct from `hooks/`, don't conflate the two), `anthropic/` and `mapbox/` (external API
   clients, same shape as `unsplash/`), plus `actions/`, `fetchers/`, `date/`, `i18n/`, `jsonLd/`,
-  `redirects/`, `references/`, `seed/`, `shiki/`, `sse/`, `umami/`, `unsplash/`. A new
-  external API client or hook goes in the matching subfolder; a handful of genuinely standalone
-  utilities stay flat at the top of `src/lib/`.
+  `blog/`, `lexical/`, `migrations/`, `redirects/`, `references/`, `seed/`, `shiki/`, `sse/`,
+  `umami/`, `unsplash/`. A new external API client or hook goes in the matching subfolder; a
+  handful of genuinely standalone utilities stay flat at the top of `src/lib/`.
 - **Collections/Blocks/Fields/Globals** are factory-function based — most fields (e.g.
   `TitleField()`, `SlugField()`) accept an `overrides` object rather than being edited in place.
   Reuse existing field factories instead of inlining raw Payload field configs when one exists.
@@ -141,7 +152,7 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   only inside the grid's Suspense boundary so the shell still prerenders. `src/lib/blog/listing.ts`
   owns the params (sort options, parsing, href building); `proxy.ts` uses it to redirect
   non-canonical forms (legacy `/page/<n>` segments, `page=1`, unknown sorts) and to mark non-default
-  sorts `noindex`. The RSS feed (`/blog/feed.xml`) and `app/sitemap.ts` cache under the `posts` tag,
+  sorts `noindex`. The RSS feed (`/blog/feed.xml`) and `app/(frontend)/sitemap.ts` cache under the `posts` tag,
   which `revalidateBlogPost` invalidates.
 - **Dashboard widgets** (`src/widgets/`): async server components registered in `payload.config.ts`
   under `admin.dashboard.widgets`. Each widget has a `slug`, `Component` path, and optional
@@ -150,6 +161,26 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   `*.client.tsx` files and call server actions from `src/lib/actions/` for mutations.
 - **Server actions** (`src/lib/actions/`): `'use server'` functions for admin mutations (job
   rescheduling, cancellation, etc.). Use `useTransition` on the client side when calling them.
+- **Claude calls** (`src/lib/anthropic/`): every fetcher goes through `generateAnthropicText()`,
+  which owns the model IDs (`ANTHROPIC_MODEL`, Haiku 5.5; `ANTHROPIC_TRANSLATION_MODEL`, Sonnet
+  5.5, for résumé translation only), effort, timeout and output limit, and throws when
+  the answer was cut off or declined rather than returning partial text. Give the model the
+  content itself (wrapped in tags), never a URL: it cannot fetch. These modules are plain server
+  modules, not `'use server'` files, and the worker imports them too, so `server-only` (which
+  throws outside Next) is not an option. Callers that run inside a save (`generateAlt`) catch the
+  error so a Claude outage never blocks the write.
+- **Plugins** (`src/plugins/`): `redirects` and `references` are local Payload plugins that add the
+  `Redirects` and `References` collections; `bun run refs:backfill` rebuilds the reference index.
+- **Stories** live in `.storybook/components/*.stories.tsx`, not next to the components; the
+  design-foundation and shader docs are MDX under `.storybook/foundations/` and
+  `.storybook/shaders/`.
+- **`app/global-error.tsx`, `app/robots.ts` and `app/manifest.ts`** have to stay at the root of
+  `app/`: inside a route group Next silently ignores all three (no error, the URL just 404s).
+  `sitemap.ts` is the exception and works from `app/(frontend)/`. `global-error.tsx` replaces the
+  root layout, so it imports the stylesheet and fonts itself.
+- **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
+  maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
+  content.
 
 ## Environment-specific values
 
@@ -167,15 +198,16 @@ the Next.js bundle; their **handlers** are not. Each handler lives in `handlers/
 config points at it with `handler: handlerPath('<name>.ts')` (Payload loads string handlers at run
 time). A handler module must use `req.payload` instead of `getPayload({ config })`. The web process
 only enqueues jobs (never `runByID`); the worker
-(`scripts/start-worker.mjs`, polling every 5 seconds) runs them.
+(`scripts/start-worker.mjs`, polling every 5 seconds) runs them. The app process runs jobs itself
+only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
 
 ## Security Guardrails (found during review — respect these when touching related code)
 
 - **SSE / Redis channels** (`app/(frontend)/api/sse/route.ts`): the `channel` query param is
   matched against an allowlist (`src/lib/sse/channels.ts`) before `subscribe()` ever sees it, and
-  per-job channels (`bilingual-translate:`, `seed-task:`) additionally require a signed-in
-  `payload.auth()` session. The public channels in `SSE_CHANNELS` (e.g. `service-status`) stay
-  unauthenticated by design. If you add a new channel that carries non-public data, add it to the
+  per-job channels (`bilingual-translate:`, `seed-task:`, `scheduled-job:`, `resume-generate:`)
+  additionally require a signed-in `payload.auth()` session. The public channels in `SSE_CHANNELS`
+  (e.g. `service-status`) stay unauthenticated by design. If you add a new channel that carries non-public data, add it to the
   authenticated branch rather than `SSE_CHANNELS` — see the route's own comments for the exact
   split.
 - **Raw SVG rendering**: `src/collections/ResumeCustomers` stores raw SVG markup rendered via
@@ -193,20 +225,37 @@ only enqueues jobs (never `runByID`); the worker
   `src/types/environment.ts` declares the schema and is the only place the full set of
   variables is enumerated. The one committed env file is `.env.test`, which holds dummy,
   format-valid values for E2E runs.
-- New authenticated API routes should mirror `app/(frontend)/api/preview/route.ts`'s pattern of
-  pairing a shared-secret check with a real `payload.auth()` session check where feasible.
+- **Semgrep** runs on every PR (`lint-and-test.yml`, rulesets `nodejs`, `typescript`, `react`,
+  `secrets`) and fails the check on any finding. A reviewed, accepted finding is marked on its own
+  line with `// nosemgrep: <rule> -- <reason>` (see `src/components/LogoCarousel/LogoCarousel.tsx`).
+- New authenticated API routes and server actions need a real `payload.auth()` session check, as
+  in the SSE route's per-job branch and `src/lib/actions/enqueueBilingualTranslation.ts` — a Server
+  Action is its own reachable endpoint, whichever page renders the button. Inline `'use server'`
+  functions in admin field components call `requireSession()` (`src/lib/actions/requireSession.ts`)
+  first. A server-side fetch of an uploaded file goes through `resolveOwnMediaUrl()`
+  (`src/lib/resolveOwnMediaUrl.ts`), which rejects any other origin. Compare shared secrets
+  with `crypto.timingSafeEqual` and accept only same-site relative redirect targets, as
+  `app/(frontend)/api/preview/route.ts` does (that route checks `PREVIEW_SECRET` only, no session).
+- **Production detection**: `NODE_ENV` cannot tell environments apart (every deployed image runs
+  `production`). Use `isProductionHost()` (`src/lib/isProductionHost.ts`), which compares
+  `SERVER_HOST` with `PRODUCTION_HOST` and reads an unset value as "not production". Outside
+  production `app/robots.ts` disallows all crawlers and `src/pdf/index.tsx` stamps
+  PDFs as DRAFT.
 
 ## Known Issues / Tech Debt (baseline, not blocking, but don't add more)
 
 - `bun run lint` passes but reports pre-existing warnings, mostly `no-explicit-any`, `no-unused-vars`,
-  `no-img-element` and the React Compiler rules (`set-state-in-effect`, `purity`, `refs`), which
+  `no-img-element`, the React Compiler rules (`set-state-in-effect`, `purity`, `refs`), and the
+  backlog of the `tailwindcss/*` and vendored `anti-slop/*` rules (`tools/oxlint/anti-slop/`), which
   `oxlint.config.ts` keeps at `warn` until they are cleaned up.
-- Leftover debug `console.log`s (e.g. `src/collections/ResumeJobs/index.ts`,
-  `src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx`) and commented-out dead code (e.g.
-  `src/collections/ResumeSkillTags/index.ts`) exist and should be cleaned up opportunistically.
-- `package.json` `overrides` pins `postcss-merge-rules` to `9.0.4`: `9.0.6` throws
-  `RangeError: Invalid string length` while cssnano minifies Payload's admin CSS in the
-  production build. Lift the pin once a newer release builds cleanly (`bun run build`).
+- A leftover debug `console.log` (`src/components/VideoMedia/VideoMedia.tsx`) and commented-out dead
+  code (e.g. `src/collections/ResumeSkills/index.ts`,
+  `src/components/ResumeRenderer/sections/Hero/Hero.tsx`) exist and should be cleaned up
+  opportunistically.
+- `package.json` `overrides` pins `pdfjs-dist` to `5.4.296` because `patches/pdfjs-dist@5.4.296.patch`
+  targets that exact version (it gives the fake-worker import a default `workerSrc`, see
+  vercel/next.js#65406). Bumping `pdfjs-dist` means regenerating the patch.
+- The E2E job in `lint-and-test.yml` is commented out, so Playwright only runs locally.
 - No app-level rate limiting exists on public API routes.
 - No shared logging abstraction — error logging is ad hoc `console.error` calls.
 
@@ -217,11 +266,11 @@ only enqueues jobs (never `runByID`); the worker
   test; E2E specs live in `e2e/*.spec.ts` (never `*.spec.ts` under `src/`).
 - Shared mocks live in `vitest.setup.ts`: `payload` (`getPayload` stubbed via `importOriginal`
   spread — never replace the whole module, value imports from it are used at runtime),
-  `next/cache` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and `neotraverse` are
-  intentionally NOT mocked — their real behavior is the contract under test.
+  `next/cache`, `server-only` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and
+  `neotraverse` are intentionally NOT mocked — their real behavior is the contract under test.
 - `TZ=UTC` is forced in `vitest.setup.ts` and date tests depend on it. Anything touching
   `Interval.setToX()` or `getLocalISOString` needs `vi.useFakeTimers()` + `vi.setSystemTime()`.
-  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `PREVIEW_SECRET`).
+  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `SERVER_HOST`, `PRODUCTION_HOST`, `PREVIEW_SECRET`).
 - There is no CI-enforced coverage threshold; when fixing a bug, add a regression test near
   existing tests for that module if a suitable test file already exists.
 
diff --git a/README.md b/README.md
index 9614ad65..40741721 100644
--- a/README.md
+++ b/README.md
@@ -12,21 +12,21 @@ This repository contains the source code for the personal website, blog, and res
 - **Framework**: [Next.js 16](https://nextjs.org/) (App Router, React 19)
 - **CMS**: [Payload CMS 3.x](https://payloadcms.com/)
 - **Database**: [MongoDB 8](https://www.mongodb.com/) (via `@payloadcms/db-mongodb`)
-- **Cache & Pub/Sub**: [Redis 8](https://redis.io/) (`@payloadcms/kv-redis`, `@trieb.work/nextjs-turbo-redis-cache`, and custom SSE pub/sub handler)
+- **Cache & Pub/Sub**: [Redis 8](https://redis.io/) (`@payloadcms/kv-redis` for Payload's KV store, plus `src/lib/RedisHandler.ts` for app-level caching and the SSE pub/sub layer)
 - **Storage**: S3-compatible storage ([RustFS](https://rustfs.com) in local dev via Docker, AWS S3 / Cloudflare R2 in production via `@payloadcms/storage-s3`)
 - **Styling**: [Tailwind CSS 4](https://tailwindcss.com/), PostCSS, Tailwind Variants
 - **Component Development**: [Storybook 10](https://storybook.js.org/)
-- **Linting & Formatting**: [Oxlint](https://oxc.rs/docs/guide/usage/linter) and [Oxfmt](https://oxc.rs/docs/guide/usage/formatter) (no ESLint/Prettier)
+- **Linting & Formatting**: [Oxlint](https://oxc.rs/docs/guide/usage/linter) and [Oxfmt](https://oxc.rs/docs/guide/usage/formatter) (no ESLint/Prettier), with `oxlint-tailwindcss` and a vendored `anti-slop` rule plugin (`tools/oxlint/anti-slop/`)
 - **Package Manager**: [Bun](https://bun.sh/) (`^1.4.0`, pinned `bun@1.4.2`); Node.js still runs Next, Payload and the scripts
 - **Testing**: [Vitest](https://vitest.dev/) (Unit), [Playwright](https://playwright.dev/) (E2E)
 - **Integrations & Services**:
   - **Analytics**: [Umami](https://umami.is/) (Optional)
-  - **Transactional Email**: [UseSend](https://usesend.com/) / [React Email](https://react.email/) (Optional)
-  - **AI Metadata & Alt-Text**: OpenAI / Anthropic (Optional)
-  - **Address & Geocoding**: Mapbox (Optional)
+  - **Transactional Email**: [UseSend](https://usesend.com/) / [React Email](https://react.email/)
+  - **AI Metadata, Alt-Text, Excerpts & Translation**: Anthropic Claude via the [AI SDK](https://ai-sdk.dev/) (`src/lib/anthropic/`)
+  - **Address & Geocoding**: Mapbox
   - **Stock Photos**: Unsplash API (Optional)
   - **Icons**: Self-hosted Iconify API (`https://icons.heene.io`)
-  - **Dev Tunnel**: Cloudflare Tunnel (Optional)
+  - **Dev Tunnel**: Cloudflare Tunnel (Optional, `bun run dev --tunnel`)
 
 ---
 
@@ -77,7 +77,7 @@ bun install
 
 ### 4. Generate Payload Types & Import Map
 
-Payload requires generated TypeScript types and an import map for the admin panel:
+Payload requires generated TypeScript types and an import map for the admin panel (this also runs `next typegen` for the route types):
 
 ```bash
 bun run generate
@@ -87,17 +87,18 @@ bun run generate
 
 ### 5. Run the Application
 
-Start the development server (runs Next.js dev server and Storybook in parallel):
+Start the Next.js development server:
 
 ```bash
-bun run dev
+bun run dev              # http://localhost:3000
+bun run dev --tunnel     # same, also exposed through the Cloudflare Tunnel (needs CLOUDFLARE_TUNNEL_*)
 ```
 
-Or run services independently:
+Storybook and the email previews run as separate processes:
 
 ```bash
-bun run dev:app          # Next.js dev server only (http://localhost:3000)
-bun run dev:storybook    # Storybook only (http://localhost:6006)
+bun run dev:app          # Plain `next dev`, without the --tunnel wrapper
+bun run dev:storybook    # Storybook (http://localhost:6006)
 bun run dev:email        # React Email preview server (http://localhost:3005)
 ```
 
@@ -113,11 +114,15 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 ## Entry Points
 
 - **Next.js App Router**:
-  - `app/(frontend)/`: Public website pages, layouts, and API routes (`/api/preview`, `/api/sse`, `/api/heartbeat`, `/api/health/*`, etc.). Dynamic pages are under `[slug]/`.
-  - `app/(payload)/`: Payload CMS admin panel routes (`/admin`).
+  - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
+  - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
+  - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
+  - `app/robots.ts`, `app/manifest.ts`, `app/global-error.tsx`: Crawler rules, the web app manifest and the root error boundary. These three have to stay at the root of `app/`; Next.js does not pick them up inside a route group. `robots.txt` disallows everything unless `SERVER_HOST` equals `PRODUCTION_HOST`.
+  - `app/(frontend)/sitemap.ts`: The sitemap.
+- **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
-- **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`.
-- **Dev Runner**: `scripts/dev.mjs` (handles `--tunnel` Cloudflare tunnel argument and orchestrates dev processes).
+- **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`. The web process only enqueues jobs; the worker runs them.
+- **Dev Runner**: `scripts/dev.mjs` (a `next dev` wrapper that owns the `--tunnel` flag).
 - **Environment Loader**: `scripts/load-env.mjs` (fetches active Doppler secrets into `.env.local`).
 
 ---
@@ -126,45 +131,54 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 
 | Script | Description |
 | --- | --- |
-| `bun run dev` | Starts Next.js dev server and Storybook in parallel (supports `--tunnel`). |
-| `bun run dev:app` | Starts Next.js development server only (`localhost:3000`). |
-| `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
-| `bun run build` | Production build (compiles the Next.js bundle). |
-| `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
-| `bun run start:storybook` | Serves the static Storybook build on port 3020. |
-| `bun run start:app` | Starts the production Next.js application server. |
-| `bun run start:worker` | Runs standalone background jobs worker and health monitoring server. |
-| `bun run load-env` | Writes `.env.local` from active Doppler config (`--check` validates drift). |
-| `bun run generate` | Runs `generate:types` and `generate:importmap` in parallel. |
-| `bun run generate:types` | Generates TypeScript types for Payload collections and globals (`src/types/payload.ts`). |
-| `bun run generate:importmap` | Regenerates Payload admin component import map. |
+| `bun run _email` | Wrapper to execute React Email CLI commands. |
+| `bun run _next` | Wrapper to execute Next.js CLI commands with telemetry disabled. |
 | `bun run _payload` | Wrapper to execute Payload CLI commands (used by `migrate`, `generate` and the other scripts). |
-| `bun run migrate` | Runs database migrations via Payload CLI. |
-| `bun run ci` | Local convenience: runs database migrations and a full production build (CI itself runs the steps separately). |
-| `bun run lint` | Runs `oxlint` and `oxfmt --check` (linting and format checks). |
-| `bun run lint:fix` | Runs `oxlint --fix` and `oxfmt` to auto-fix what they can. |
-| `bun run format` | Runs `oxfmt` to fix formatting and import order. |
-| `bun run typecheck` | Runs TypeScript typechecker (`tsc --noEmit`). |
-| `bun run deps:lint` | Runs Syncpack to check dependency version consistency across packages. |
-| `bun run deps:fix` | Runs Syncpack to automatically align dependency versions. |
-| `bun run deps:update` | Updates dependency versions using Syncpack. |
-| `bun run chore:format` | Formats `package.json` field order using Syncpack. |
+| `bun run _storybook` | Wrapper to execute Storybook CLI commands. |
+| `bun run analyze` | Production build with `@next/bundle-analyzer`; opens the bundle reports when it finishes. |
+| `bun run build` | Production build (`next build --webpack`). |
+| `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
 | `bun run chore:reinstall` | Cleans `node_modules` and `bun.lock`, then runs fresh `bun install`. |
+| `bun run ci` | Local convenience: runs database migrations and a full production build (CI itself runs the steps separately). |
+| `bun run dev` | Starts the Next.js dev server through `scripts/dev.mjs` (`localhost:3000`, supports `--tunnel`). |
+| `bun run dev:app` | Starts the Next.js dev server directly, without the tunnel wrapper. |
 | `bun run dev:email` | Starts React Email development server on port 3005 (`src/emails`). |
-| `bun run seed:topics` | Seeds fixture blog topics (`--clean` to remove). |
-| `bun run seed:posts` | Seeds fixture blog posts and media (`--clean` to remove, `--count <n>` to set quantity). |
-| `bun run seed:pages` | Seeds fixture pages (`--clean` to remove, `--count <n>` to set quantity). |
-| `bun run seed:resume-documents` | Seeds an older and a newer fixture resume document without PDFs (`--clean` to remove). |
+| `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
+| `bun run generate` | Runs `generate:next-types`, `generate:payload-types` and `generate:importmap` in sequence. |
+| `bun run generate:importmap` | Regenerates Payload admin component import map (`app/(payload)/admin/importMap.js`). |
+| `bun run generate:next-types` | Generates Next.js route types (`next typegen`). |
+| `bun run generate:payload-types` | Generates TypeScript types for Payload collections and globals (`src/types/payload.ts`). |
 | `bun run links:migrate` | Runs database migration for link field naming. |
+| `bun run lint` | Runs `oxlint` and `oxfmt --check` (linting and format checks). |
+| `bun run lint:fix` | Runs `oxlint --fix` and `oxfmt` to auto-fix what they can. |
+| `bun run load-env` | Writes `.env.local` from active Doppler config (`--check` validates drift). |
+| `bun run migrate` | Runs database migrations via Payload CLI. |
+| `bun run packages:fix` | Runs Syncpack to automatically align dependency versions. |
+| `bun run packages:format` | Formats `package.json` field order using Syncpack. |
+| `bun run packages:lint` | Runs Syncpack to check dependency version consistency across packages. |
+| `bun run packages:update` | Updates dependency versions using Syncpack. |
+| `bun run prepare` | Installs Lefthook Git hooks. |
 | `bun run refs:backfill` | Rebuilds content reference index table. |
+| `bun run release` | Runs semantic-release to calculate version, tag, and publish changelog. |
+| `bun run release:dry-run` | Runs semantic-release in dry-run mode. |
+| `bun run seed:pages` | Seeds fixture pages (`-- --count <n>`, default 10; `seed:pages:clean` removes them). |
+| `bun run seed:pages:clean` | Removes fixture pages. |
+| `bun run seed:posts` | Seeds fixture blog posts and media (`-- --count <n>`, default 10; `seed:posts:clean` removes them). |
+| `bun run seed:posts:clean` | Removes fixture blog posts and media. |
+| `bun run seed:resume-documents` | Seeds an older and a newer fixture resume document without PDFs (`seed:resume-documents:clean` removes them). |
+| `bun run seed:resume-documents:clean` | Removes fixture resume documents. |
+| `bun run seed:topics` | Seeds fixture blog topics (`-- --count <n>`, default 6; `seed:topics:clean` removes them). |
+| `bun run seed:topics:clean` | Removes fixture blog topics. |
+| `bun run start:app` | Starts the production Next.js application server. |
+| `bun run start:storybook` | Serves the static Storybook build on port 3020. |
+| `bun run start:worker` | Runs standalone background jobs worker and health monitoring server. |
 | `bun run test` | Runs unit tests once via Vitest. |
-| `bun run test:watch` | Runs Vitest in interactive watch mode. |
 | `bun run test:coverage` | Runs Vitest with v8 code coverage reporting. |
 | `bun run test:e2e` | Runs Playwright E2E tests against `.env.test`. |
+| `bun run test:e2e:docker` | Runs Playwright E2E tests inside Docker Chromium container, against a dev server on the host. |
 | `bun run test:e2e:ui` | Runs Playwright E2E tests with interactive UI. |
-| `bun run test:e2e:docker` | Runs Playwright E2E tests inside Docker Chromium container. |
-| `bun run release` | Runs semantic-release to calculate version, tag, and publish changelog. |
-| `bun run release:dry-run` | Runs semantic-release in dry-run mode. |
+| `bun run test:watch` | Runs Vitest in interactive watch mode. |
+| `bun run typecheck` | Runs TypeScript typechecker (`tsc --noEmit`). |
 
 ---
 
@@ -178,10 +192,13 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | --- | --- | --- |
 | `NODE_ENV` | Optional (`development` \| `production` \| `test`) | Runtime environment (defaults to `development`). |
 | `SERVER_HOST` | **Required** | Host/port used for server-side URL construction. |
-| `SERVER_URL` | **Required** (URL) | Public URL of the server (inlined into client bundle at build time). |
+| `PRODUCTION_HOST` | **Required** | Host of the production site. An environment counts as production when `SERVER_HOST` equals it; everywhere else `robots.txt` disallows all crawlers and generated PDFs carry a DRAFT watermark. |
+| `SERVER_URL` | **Required** (URL) | Public URL of the site, read server-side. |
+| `NEXT_PUBLIC_SERVER_URL` | **Required** (URL) | Same value as `SERVER_URL`, exposed to the browser for the live-preview listener. |
+| `RESUME_REDIRECT_URL_BASE` | **Required** (URL) | Base URL for the redirect target of `/download/resume.pdf` and localized resume jobs. |
 | `PAYLOAD_SECRET` | **Required** | Secret key used to encrypt Payload JWT tokens. |
 | `PREVIEW_SECRET` | **Required** | Shared secret for draft/preview authentication. |
-| `CRON_SECRET` | **Required** | Secret token reserved for securing cron/scheduled tasks. |
+| `CRON_SECRET` | **Required** | Reserved for securing cron/scheduled routes; declared but not read anywhere yet. |
 
 ### Database & Cache
 
@@ -204,16 +221,17 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
-| `PAYLOAD_JOBS_ENABLE_APP_WORKERS` | Optional (`true` \| `false`) | Enables embedded job workers in the main Next.js app process (defaults to `false`). |
+| `PAYLOAD_JOBS_ENABLE_APP_WORKERS` | Optional (`true` \| `false`) | Enables embedded job workers in the main Next.js app process (defaults to `false`; the standalone worker normally runs the jobs). |
 
 ### Status Page
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
-| `STATUS_PAGE_URL` | **Required** (URL) | Public status page URL (inlined into client bundle). |
-| `STATUS_PAGE_HEARTBEAT_URL` | **Required** (URL) | Heartbeat monitoring URL pinged server-side. |
+| `NEXT_PUBLIC_STATUS_PAGE_URL` | **Required** (URL) | Public status page URL, read in the browser. |
+| `STATUS_PAGE_HEARTBEAT_URL` | **Required** (URL) | Status page heartbeat endpoint the server fetches (Redis-cached) for the service-status indicator. |
+| `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` | Optional (URL) | Push monitor URL the worker's `heartbeatPing` job calls every minute; without it the job only logs. |
 
-### Analytics & Email (Optional)
+### Analytics & Email
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
@@ -231,8 +249,7 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
 | `NEXT_PUBLIC_ICONIFY_API` | Optional (URL) | Self-hosted Iconify API (defaults to `https://icons.heene.io`). |
-| `OPENAI_API_KEY` | **Required** | API key for OpenAI (used for automated alt-text and meta descriptions). |
-| `ANTHROPIC_API_KEY` | **Required** | API key for Anthropic Claude (alternative AI generation provider). |
+| `ANTHROPIC_API_KEY` | **Required** | API key for Anthropic Claude (alt-text, meta descriptions, blog excerpts, resume translation). |
 | `MAPBOX_API_KEY` | **Required** | Mapbox access token for address and coordinate lookups. |
 | `UNSPLASH_ACCESS_KEY` | Optional | Unsplash API access key for stock photo search & direct media import. |
 
@@ -244,7 +261,7 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | `CLOUDFLARE_TUNNEL_URL` | Optional (URL) | Target URL for Cloudflare tunnel. |
 | `CLOUDFLARE_TUNNEL_TOKEN` | Optional | Cloudflare tunnel authentication token. |
 
-> **Build-Time Inlining Notice**: route shells rendered at build time with `cacheComponents: true` capture server-side values. Ensure correct values are present during `bun run build`.
+> **Build-Time Inlining Notice**: `NEXT_PUBLIC_*` values are inlined into the client bundle, and route shells prerendered with `cacheComponents: true` capture server-side values. Ensure correct values are present during `bun run build`.
 
 ---
 
@@ -254,43 +271,59 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 .
 ├── app/                          # Next.js App Router
 │   ├── (frontend)/               # Public website routes, layouts, and API routes
-│   │   ├── [slug]/               # Dynamic page routes
-│   │   ├── api/                  # API endpoints (preview, sse, health, heartbeat, icons, etc.)
+│   │   ├── [slug]/               # CMS-driven pages
+│   │   ├── api/                  # Route handlers (preview, sse, health, icons/collection)
+│   │   ├── blog/                 # Blog listing, topics, posts, and the RSS feed (feed.xml)
+│   │   ├── download/             # /download/resume.pdf redirect
+│   │   ├── resume/               # Resume documents by slug
+│   │   ├── sitemap.ts            # Sitemap
 │   │   └── layout.tsx            # Frontend root layout
-│   └── (payload)/                # Payload CMS admin routes
-│       ├── admin/                # Payload admin UI routes
-│       ├── api/                  # Payload REST & GraphQL API endpoints
-│       └── layout.tsx            # Payload admin layout
+│   ├── (payload)/                # Payload CMS admin routes
+│   │   ├── admin/                # Payload admin UI routes (and the generated import map)
+│   │   ├── api/                  # Payload REST API endpoints
+│   │   └── layout.tsx            # Payload admin layout
+│   ├── llms.txt/                 # Public /llms.txt route
+│   ├── robots.ts                 # Crawler rules           ┐
+│   ├── manifest.ts               # Web app manifest        ├ must stay at the app root
+│   └── global-error.tsx          # Root error boundary     ┘
 ├── src/                          # Application source code
-│   ├── access/                   # Payload access control policies (anyone, authenticated, etc.)
-│   ├── blocks/                   # Reusable Payload blocks (Hero, Content, Resume, Media, etc.)
-│   ├── collections/              # Payload collections (Media, Pages, Posts, Resume*, Users, etc.)
-│   ├── components/               # React UI components & Storybook stories
-│   ├── contexts/                 # React context providers (theme, locale, etc.)
+│   ├── blocks/                   # Payload blocks (rich text, code, feature cards, resume sections, etc.)
+│   ├── collections/              # Payload collections (Media*, Pages, BlogPosts, BlogTopics, Resume*, Redirects, References, Users)
+│   ├── components/               # React UI components
 │   ├── emails/                   # React Email templates
 │   ├── fields/                   # Reusable Payload field factories (Slug, HeroSlides, Link, etc.)
 │   ├── fonts/                    # Custom font definitions
-│   ├── globals/                  # Payload globals (SiteSettings, PDFGeneratorSettings, etc.)
-│   ├── hooks/                    # Custom React hooks
-│   ├── jobs-queue/               # Payload background jobs, tasks, workflows, and health checks
-│   ├── lib/                      # Utilities (RedisHandler, SSE, image optimization, seeding, etc.)
+│   ├── globals/                  # Payload globals (SiteSettings, SettingsGlobalUser, PDFGeneratorSettings)
+│   ├── jobs-queue/               # Payload job tasks, workflows, their handlers, and health checks
+│   ├── lib/                      # Utilities, grouped by domain: access/, hooks/, payloadHooks/, actions/,
+│   │                             #   fetchers/, sse/, seed/, redirects/, references/, anthropic/, etc.
 │   ├── migrations/               # Database migration scripts
 │   ├── pdf/                      # PDF resume generator components (@react-pdf/renderer)
-│   ├── plugins/                  # Custom Payload plugins
-│   ├── stories/                  # Global Storybook configurations & documentation
+│   ├── plugins/                  # Custom Payload plugins (redirects, references)
 │   ├── styles/                   # CSS and Tailwind 4 stylesheets
 │   ├── types/                    # TypeScript declarations, environment schema, generated types
 │   └── widgets/                  # Custom Payload dashboard widgets
-├── public/                       # Static public assets (favicons, icons, robots.txt)
-├── scripts/                      # Utility scripts (dev runner, worker, seeders, environment loader)
-├── docs/                         # Specifications, architecture notes, and design plans
+├── .storybook/                   # Storybook config, component stories, and foundations/shaders docs (MDX)
+├── .github/                      # Workflows (lint-and-test, build-and-deploy), setup action, Dependabot
+├── public/                       # Static public assets (favicons, OG image, Payload admin assets)
+├── scripts/                      # Utility scripts (dev runner, worker, seeders, environment loader, image assembly)
+├── tools/oxlint/anti-slop/       # Vendored Oxlint rule plugin
+├── patches/                      # Bun dependency patches (pdfjs-dist)
 ├── e2e/                          # Playwright end-to-end test specs
+├── Dockerfile                    # COPY-only images: app, worker, storybook
 ├── docker-compose.yml            # Local development infrastructure (MongoDB, Redis, RustFS)
-├── next.config.ts                # Next.js configuration & Payload integration
+├── next.config.ts                # Next.js configuration, env validation & Payload integration
 ├── payload.config.ts             # Payload CMS master configuration
+├── proxy.ts                      # Next.js request proxy (blog URL canonicalization)
+├── instrumentation.ts            # Next.js server instrumentation hook
+├── instrumentation-client.ts     # First-pageview Umami tracking
+├── llms.txt                      # Entry points of this repository for AI coding agents
 ├── oxlint.config.ts              # Oxlint rules
 ├── oxfmt.config.ts               # Oxfmt formatting and import order
 ├── lefthook.yml                  # Git hooks
+├── commitlint.config.mjs         # Conventional Commits rules
+├── release.config.mjs            # semantic-release configuration
+├── syncpack.config.mjs           # Dependency version groups
 ├── bunfig.toml                   # Bun install settings
 ├── playwright.config.ts          # Playwright E2E configuration
 ├── vitest.config.ts              # Vitest unit test configuration
@@ -313,7 +346,7 @@ bun run test:coverage    # Generate test coverage report
 ```
 
 - Configuration: `vitest.config.ts`.
-- Mocks & environment: `vitest.setup.ts` forces `TZ=UTC` and mocks `payload`, `next/cache`, and `redis`. Real implementations of `tailwind-merge`, `date-fns`, `slugify`, `pupa`, and `neotraverse` are tested directly.
+- Mocks & environment: `vitest.setup.ts` forces `TZ=UTC` and mocks `payload`, `next/cache`, `server-only`, and `redis`. Real implementations of `tailwind-merge`, `date-fns`, `slugify`, `pupa`, and `neotraverse` are tested directly.
 
 ### End-to-End Tests (Playwright)
 
@@ -329,6 +362,9 @@ bun run test:e2e:docker  # Run tests in Playwright Docker Chromium container
 1. Run `docker compose up -d` so MongoDB, Redis, and RustFS storage are active.
 2. E2E tests execute using `.env.test` with dummy valid credentials.
 3. `bun run test:e2e` automatically starts or reuses the local dev server. For Docker tests (`bun run test:e2e:docker`), start the dev server beforehand with `bun run dev:app`.
+4. `E2E_BASE_URL`, `E2E_SERVER_COMMAND` and `E2E_NO_SERVER` override the target URL, the server command, and whether Playwright starts a server at all (see `playwright.config.ts`).
+
+> The E2E job in CI is currently disabled (commented out in `lint-and-test.yml`); run the suite locally.
 
 ---
 
@@ -338,20 +374,26 @@ Seed fixture content into local MongoDB for development and testing:
 
 ```bash
 # Seed Topics (categories)
-bun run seed:topics          # Creates fixture blog topics
+bun run seed:topics          # Creates 6 fixture blog topics
 bun run seed:topics:clean    # Removes seeded blog topics
 
 # Seed Blog Posts (with images)
-bun run seed:posts           # Creates blog topics & 30 posts with downloaded images
+bun run seed:posts           # Creates blog topics & 10 posts with downloaded images
 bun run seed:posts:clean     # Removes seeded posts and associated media
-# Pass custom count via: bun run seed:posts -- --count 10
+# Pass custom count via: bun run seed:posts -- --count 25
 
 # Seed Pages
-bun run seed:pages           # Creates standard fixture pages
+bun run seed:pages           # Creates 10 fixture pages
 bun run seed:pages:clean     # Removes seeded pages
 # Pass custom count via: bun run seed:pages -- --count 5
+
+# Seed Resume Documents
+bun run seed:resume-documents        # Creates an older and a newer resume document (no PDFs)
+bun run seed:resume-documents:clean  # Removes them
 ```
 
+The same seed/clean logic (`src/lib/seed/`) is also available from the admin panel, where it runs as a queued job.
+
 - Seeders are idempotent and match by slug.
 - Article prose and layouts are deterministic per title using a seeded pseudo-random generator.
 - Images are downloaded from `picsum.photos` and uploaded into Payload media.
@@ -360,19 +402,18 @@ bun run seed:pages:clean     # Removes seeded pages
 
 ## CI / CD & Deployment
 
-Everything is built in CI; Docker images only `COPY` finished output (no package manager, installs or builds inside an image). The checks live in `.github/workflows/ci.yml` and are reused by pull requests (`lint-and-test.yml`) and pushes (`build-and-deploy.yml`).
+Everything is built in CI; Docker images only `COPY` finished output (no package manager, installs or builds inside an image). Pull requests are gated by `lint-and-test.yml`, pushes are built and deployed by `build-and-deploy.yml`. Both use the composite action `.github/actions/setup` (Bun, Node.js 26, `bun install --frozen-lockfile`).
 
-- **`ci.yml`** (pull requests and pushes):
-  1. **Lint**: `commitlint` (PRs), `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files match `bun run generate`, and `actionlint`.
-  2. **Unit Tests**: `vitest run --coverage`.
-  3. **Compile**: `next build --experimental-build-mode=compile` with `.env.test` values. It needs no database and must not inline any environment-specific value; `scripts/check-env-leak.mjs` fails the job if a `.env.test` value ends up in `.next`.
-  4. **E2E** (environment `Testing`): resets the shared Testing services (Mongo and Redis rebuilt through Dokploy, S3 bucket emptied; `scripts/reset-test-services.mjs`), migrates, seeds, runs `next build --experimental-build-mode=generate` (prerender/PPR), assembles `out/web` and runs Playwright against `node out/web/server.js`. Forks and dependabot cannot read the Testing secrets and use local containers (`docker compose`) instead.
-- **Pushes to `develop` / `main`** (`build-and-deploy.yml`):
-  1. **Semantic Versioning**: semver bump and tag/changelog via `semantic-release`. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
-  2. **CI**: the jobs above.
-  3. **Deploy** (environment `Production` on `main`, `Development` on `develop`): downloads the tested compile, runs `bun run migrate` against the target database, runs `--experimental-build-mode=generate` with that environment's values, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks.
+- **Pull requests to `main` / `develop`** (`lint-and-test.yml`, required by branch protection):
+  1. **Lint**: `commitlint` over the PR's commits, `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files (`src/types/payload.ts`, the admin import map) match `bun run generate`, and `actionlint`.
+  2. **Semgrep**: static security analysis with the `nodejs`, `typescript`, `react` and `secrets` rulesets. Accepted findings are marked in place with `// nosemgrep: <rule>` and a reason.
+  3. **Unit Tests**: `vitest run --coverage`, with the coverage report uploaded as an artifact.
+  4. **E2E**: currently disabled (the job is commented out in the workflow).
+- **Pushes to `develop` / `main`** (`build-and-deploy.yml`, also runnable through `workflow_dispatch` on those two branches):
+  1. **Bump version**: semver bump, tag and changelog via `semantic-release` (`release.config.mjs`), committed as a GitHub App so the push passes `main`'s ruleset. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
+  2. **Deploy** (environment `Production` on `main`, `Development` on `develop`): connects to the tailnet, runs `bun run migrate` against the target database, runs one `next build --webpack` with that environment's values, builds Storybook, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, boot-checks each one as a real container (`/api/health` on 3000, `/health` on 3010, Storybook on 3020), pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks. The lint and test jobs are not re-run here; the merged commit already passed them as PR checks.
 
-Each push to `main`/`develop` builds and deploys against that environment's real secrets, so environment-specific values the browser needs (site URL, status page, Umami) are ordinary `NEXT_PUBLIC_*` environment variables read via `process.env.NEXT_PUBLIC_*`.
+Each push to `main`/`develop` builds and deploys against that environment's real secrets, so environment-specific values the browser needs (site URL, status page, Umami, the Iconify API) are ordinary `NEXT_PUBLIC_*` environment variables read via `process.env.NEXT_PUBLIC_*`.
 
 ---
 
@@ -380,7 +421,7 @@ Each push to `main`/`develop` builds and deploys against that environment's real
 
 Lefthook (`lefthook.yml`) manages Git hooks, installed automatically during `bun install`:
 
-- `pre-commit`: Runs `oxfmt` and `oxlint --fix` on staged files, and syncpack when `package.json` changes.
+- `pre-commit`: Runs `oxfmt` and `oxlint --fix` on staged files. When `package.json` is staged it also runs syncpack (`format` + `fix`) and `bun install`, re-staging `bun.lock`.
 - `commit-msg`: Enforces [Conventional Commits](https://www.conventionalcommits.org/) format using `commitlint`.
 
 Example valid commit messages:
diff --git a/app/(frontend)/blog/post/[slug]/opengraph-image.tsx b/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
index 77218609..23b3ec02 100644
--- a/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
+++ b/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
@@ -3,10 +3,9 @@ import { notFound } from 'next/navigation'
 import { ImageResponse } from 'takumi-js/response'
 
 import { fetchSiteSettingsCached } from '@/lib/fetchers'
+import { fetchPostBySlug } from '@/lib/fetchers/fetchPostBySlug'
 import { resolveOgBackground } from '@/lib/resolveOgBackground'
 
-import { queryPostBySlug } from './page'
-
 export const alt = 'Blog post'
 
 export const size = {
@@ -23,7 +22,7 @@ type Props = {
 export default async function Image({ params }: Props) {
   const { slug } = await params
 
-  const post = await queryPostBySlug({
+  const post = await fetchPostBySlug({
     slug: slug ?? '',
   })
 
diff --git a/app/(frontend)/blog/post/[slug]/page.tsx b/app/(frontend)/blog/post/[slug]/page.tsx
index 59dc7a30..1725f10f 100644
--- a/app/(frontend)/blog/post/[slug]/page.tsx
+++ b/app/(frontend)/blog/post/[slug]/page.tsx
@@ -1,8 +1,5 @@
-// oxlint-disable -- reason
-
-import { cache, Suspense } from 'react'
+import { Suspense } from 'react'
 import type { Metadata } from 'next'
-import { cacheLife, cacheTag } from 'next/cache'
 import { draftMode } from 'next/headers'
 import Link from 'next/link'
 import { notFound } from 'next/navigation'
@@ -16,13 +13,12 @@ import { LinkList } from '@/components/ArticleSidebar/LinkList'
 import { HeroMedia } from '@/components/HeroMedia'
 import { RichText } from '@/components/RichText'
 import { extractHeadings } from '@/lib/extractHeadings'
+import { fetchPostBySlug } from '@/lib/fetchers/fetchPostBySlug'
 import { generateMeta } from '@/lib/generateMeta'
-import { reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { generateBlogPosting, generateBreadcrumbList } from '@/lib/jsonLd'
 import { placeholderParams } from '@/lib/placeholderParams'
-import { resolveRelations } from '@/lib/resolveRelation'
 import { highlightRichText } from '@/lib/shiki/highlightRichText'
-import { CollectionData, CollectionSlug } from '@/types/collections'
+import { CollectionSlug } from '@/types/collections'
 import { LinkGroupData } from '@/types/payload'
 
 import { size } from './opengraph-image'
@@ -33,11 +29,25 @@ export async function generateStaticParams() {
   })
 
   const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
+    collection: CollectionSlug.BlogPosts,
     draft: false,
     limit: 1000,
     overrideAccess: false,
     pagination: false,
+    where: {
+      or: [
+        {
+          _status: {
+            equals: 'published',
+          },
+        },
+        {
+          _status: {
+            exists: false,
+          },
+        },
+      ],
+    },
     select: {
       slug: true,
     },
@@ -52,18 +62,20 @@ export async function generateStaticParams() {
   }))
 }
 
-type PageProps = {
-  params: Promise<{
-    slug?: string
-  }>
+export default async function BlogPostShell(props: PageProps<'/blog/post/[slug]'>) {
+  return (
+    <Suspense>
+      <BlogPost {...props} />
+    </Suspense>
+  )
 }
 
-export default async function Page({ params: paramsPromise }: PageProps) {
-  const { slug } = await paramsPromise
+async function BlogPost({ params }: PageProps<'/blog/post/[slug]'>) {
+  const { slug } = await params
+  const { isEnabled: draft } = await draftMode()
+
+  const post = await fetchPostBySlug({ slug, draft })
 
-  const post = await queryPostBySlug({
-    slug,
-  })
   if (!post) return notFound()
 
   const { title, content, hero, createdAt, updatedAt, topics, links } = post
@@ -79,6 +91,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   const topicList = (topics ?? [])
     .map(({ value }) => value)
     .filter((value) => typeof value === 'object' && value !== null)
+
   const primaryTopic = topicList[0]
 
   const heroImageData = {
@@ -89,6 +102,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   }
 
   // Generate BlogPosting schema
+  // oxlint-disable-next-line no-unused-vars
   const blogPostingSchema = generateBlogPosting({
     headline: title,
     url: postUrl,
@@ -103,6 +117,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   })
 
   // Generate BreadcrumbList schema
+  // oxlint-disable-next-line no-unused-vars
   const breadcrumbSchema = generateBreadcrumbList([
     {
       name: 'Home',
@@ -118,16 +133,16 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   ])
 
   return (
-    <div className="flex  w-full flex-col bg-background text-foreground">
+    <div className="flex w-full flex-col bg-background text-foreground">
       <div className="flex flex-1 items-center justify-center">
-        <section className="pb-32 w-full">
+        <section className="w-full pb-32">
           <HeroMedia fallbackAlt={title} slides={hero?.slides}>
             <div className="pt-40 pb-16">
               <div className="container flex flex-col items-center gap-8 text-center">
                 <nav aria-label="breadcrumb">
-                  <ol className="text-foreground/70 gap-1.5 text-sm sm:gap-2.5 flex flex-wrap items-center justify-center wrap-break-word">
-                    <li className="gap-1.5 inline-flex items-center">
-                      <Link className="hover:text-foreground transition-colors" href="/blog">
+                  <ol className="flex flex-wrap items-center justify-center gap-1.5 text-sm wrap-break-word text-foreground/70 sm:gap-2.5">
+                    <li className="inline-flex items-center gap-1.5">
+                      <Link className="transition-colors hover:text-foreground" href="/blog">
                         Blog
                       </Link>
                     </li>
@@ -136,9 +151,9 @@ export default async function Page({ params: paramsPromise }: PageProps) {
                         <li aria-hidden="true" className="[&>svg]:size-3.5">
                           /
                         </li>
-                        <li className="gap-1.5 inline-flex items-center">
+                        <li className="inline-flex items-center gap-1.5">
                           <Link
-                            className="hover:text-foreground transition-colors"
+                            className="transition-colors hover:text-foreground"
                             href={`/blog/${primaryTopic.slug}`}
                           >
                             {primaryTopic.title}
@@ -148,11 +163,11 @@ export default async function Page({ params: paramsPromise }: PageProps) {
                     )}
                   </ol>
                 </nav>
-                <div className="flex w-full max-w-5xl  flex-col gap-5 text-white">
-                  <div className="flex items-center justify-center gap-2.5 font-mono font-semibold text-sm text-white/80">
+                <div className="flex w-full max-w-5xl flex-col gap-5 text-white">
+                  <div className="flex items-center justify-center gap-2.5 font-mono text-sm font-semibold text-white/80">
                     <time dateTime={createdAt}>{format(createdAt, 'MMMM d, yyyy')}</time>
                   </div>
-                  <h1 className="text-[2.5rem] leading-[1.1] font-semibold font-mono text-balance md:text-6xl lg:text-7xl">
+                  <h1 className="font-mono text-[2.5rem] leading-[1.1] font-semibold text-balance md:text-6xl lg:text-7xl">
                     {title}
                   </h1>
                   {post.meta?.description && (
@@ -180,7 +195,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
           </HeroMedia>
 
           <div className="container pt-20">
-            <div className="mx-auto grid w-full max-w-7xl lg:grid-cols-12 gap-16 items-start">
+            <div className="mx-auto grid w-full max-w-7xl items-start gap-16 lg:grid-cols-12">
               {/* scroll-mt keeps TOC anchor targets clear of the fixed header */}
               <article className="min-w-0 lg:col-span-8 [&_h2]:scroll-mt-24 [&_h3]:scroll-mt-24 [&_h4]:scroll-mt-24">
                 {content ? (
@@ -199,7 +214,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
               </article>
 
               <ArticleSidebar
-                className="lg:col-span-4 w-auto"
+                className="w-auto lg:col-span-4"
                 sections={[
                   headings &&
                     headings.length > 0 && {
@@ -222,73 +237,13 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   )
 }
 
-export async function generateMetadata({ params: paramsPromise }: PageProps): Promise<Metadata> {
-  const { slug } = await paramsPromise
-  const doc = await queryPostBySlug({
-    slug,
-  })
+export async function generateMetadata({
+  params,
+}: PageProps<'/blog/post/[slug]'>): Promise<Metadata> {
+  const { slug } = await params
+  const doc = await fetchPostBySlug({ slug })
+
   return generateMeta({
     doc,
   })
 }
-
-const queryPublishedPostBySlug = async (
-  slug: string,
-): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-  'use cache'
-  cacheLife('max')
-  cacheTag(CollectionSlug.BlogPosts)
-
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
-    draft: false,
-    limit: 1,
-    pagination: false,
-    overrideAccess: false,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  if (!docs[0]) return null
-
-  return reduceDataToBilingualLanguage(await resolveRelations(docs[0]))
-}
-
-const queryDraftPostBySlug = async (
-  slug: string,
-): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
-    draft: true,
-    limit: 1,
-    pagination: false,
-    overrideAccess: true,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  if (!docs[0]) return null
-
-  return reduceDataToBilingualLanguage(await resolveRelations(docs[0]))
-}
-
-export const queryPostBySlug = cache(
-  async ({ slug }: { slug: string }): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-    const { isEnabled: draft } = await draftMode()
-    return draft ? queryDraftPostBySlug(slug) : queryPublishedPostBySlug(slug)
-  },
-)
diff --git a/app/(frontend)/resume/[slug]/opengraph-image.tsx b/app/(frontend)/resume/[slug]/opengraph-image.tsx
index f24ecd44..d4df31fd 100644
--- a/app/(frontend)/resume/[slug]/opengraph-image.tsx
+++ b/app/(frontend)/resume/[slug]/opengraph-image.tsx
@@ -2,7 +2,7 @@ import { notFound } from 'next/navigation'
 
 import { ImageResponse } from 'takumi-js/response'
 
-import { resolveResumeDocument } from './page'
+import { fetchDocumentBySlug } from '@/lib/fetchers/fetchDocumentBySlug'
 
 export const alt = 'Resume'
 
@@ -19,7 +19,7 @@ type Props = {
 
 export default async function Image({ params }: Props) {
   const { slug } = await params
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug })
 
   if (!resume) notFound()
 
diff --git a/app/(frontend)/resume/[slug]/page.tsx b/app/(frontend)/resume/[slug]/page.tsx
index 29dd3b32..835d3efb 100644
--- a/app/(frontend)/resume/[slug]/page.tsx
+++ b/app/(frontend)/resume/[slug]/page.tsx
@@ -1,5 +1,6 @@
 import { Suspense } from 'react'
 import type { Metadata } from 'next'
+import { draftMode } from 'next/headers'
 import Link from 'next/link'
 import { notFound } from 'next/navigation'
 import config from '@payload-config'
@@ -13,8 +14,8 @@ import type { HeroMediaItem } from '@/components/HeroMedia/HeroSlide'
 import { ResumeChecksumValidator } from '@/components/ResumeCheckumValidatior/ResumeChecksumValidator'
 import { ResumeNewerVersionsChecker } from '@/components/ResumeNewerVersionsChecker'
 import { fetchGlobalUserSettingsCached, fetchSiteSettingsCached } from '@/lib/fetchers'
-import { fetchLatestResumeDocument } from '@/lib/fetchers/fetchLatestResumeDocument'
-import { fetchResumeDocumentBySlug } from '@/lib/fetchers/fetchResumeDocumentBySlug'
+import { fetchDocumentBySlug } from '@/lib/fetchers/fetchDocumentBySlug'
+import { generateContentURL } from '@/lib/generateContentURL'
 import { placeholderParams } from '@/lib/placeholderParams'
 import { CollectionSlug } from '@/types/collections'
 import { MediaImage } from '@/types/payload'
@@ -27,21 +28,10 @@ const validateAnchorId = 'validate'
 
 /**
  * Reserved slug value that resolves to whichever document is actually
- * newest, rather than one fixed row — see `resolveResumeDocument`.
+ * newest, rather than one fixed row — see `fetchDocumentBySlug`.
  */
 const LATEST_RESUME_SLUG = 'latest'
 
-/**
- * Resolves the `[slug]` param to a document: `fetchLatestResumeDocument()`
- * for the reserved `latest` value (a single KV-cached lookup, no query
- * against a stale slug), `fetchResumeDocumentBySlug()` for every other
- * value. `proxy.ts` used to rewrite `/resume/latest` to the real slug before
- * this route ever ran; that rewrite is gone, so `latest` now reaches here
- * directly and is handled the same way `opengraph-image.tsx` needs it to be.
- */
-export const resolveResumeDocument = async (slug: string) =>
-  slug === LATEST_RESUME_SLUG ? fetchLatestResumeDocument() : fetchResumeDocumentBySlug(slug)
-
 /** First populated thumbnail for a locale, or `null` if that set is empty/unpopulated. */
 const firstThumbnail = (
   thumbnails: {
@@ -54,11 +44,51 @@ const firstThumbnail = (
   return (populated?.value as MediaImage | undefined) ?? null
 }
 
-export default async function ResumeDocumentPage({ params }: PageProps<'/resume/[slug]'>) {
+export async function generateStaticParams() {
+  const payload = await getPayload({
+    config,
+  })
+
+  const { docs = [] } = await payload.find({
+    collection: CollectionSlug.ResumeDocuments,
+    draft: false,
+    limit: 1000,
+    // The collection denies anonymous reads and has no drafts to filter out.
+    overrideAccess: true,
+    pagination: false,
+    select: {
+      slug: true,
+    },
+  })
+
+  if (docs.length === 0) {
+    return placeholderParams('/resume/[slug]')
+  }
+
+  return [
+    {
+      slug: 'latest',
+    },
+    ...docs.map(({ slug }) => ({
+      slug,
+    })),
+  ]
+}
+
+export default async function ResumeDocumentShell(props: PageProps<'/resume/[slug]'>) {
+  return (
+    <Suspense>
+      <ResumeDocument {...props} />
+    </Suspense>
+  )
+}
+
+async function ResumeDocument({ params }: PageProps<'/resume/[slug]'>) {
   const { slug } = await params
+  const { isEnabled: draft } = await draftMode()
 
   const isLatestSlug = slug === LATEST_RESUME_SLUG
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug, draft })
 
   if (!resume) return notFound()
 
@@ -213,42 +243,9 @@ export default async function ResumeDocumentPage({ params }: PageProps<'/resume/
   )
 }
 
-export async function generateStaticParams() {
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug.ResumeDocuments,
-    draft: false,
-    pagination: false,
-    select: {
-      slug: true,
-    },
-  })
-
-  if (docs.length === 0) {
-    return placeholderParams('/resume/[slug]')
-  }
-
-  // `latest` used to be handled entirely by proxy.ts rewriting it to the
-  // real slug before this route ever ran; that rewrite is gone, so it needs
-  // its own static param now — resolveResumeDocument gives it real content
-  // via fetchLatestResumeDocument rather than a document literally slugged
-  // 'latest'.
-  return [
-    {
-      slug: LATEST_RESUME_SLUG,
-    },
-    ...docs.map(({ slug }) => ({
-      slug,
-    })),
-  ]
-}
-
 export async function generateMetadata({ params }: PageProps<'/resume/[slug]'>): Promise<Metadata> {
   const { slug } = await params
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug })
 
   const {
     general: { siteName },
@@ -267,6 +264,12 @@ export async function generateMetadata({ params }: PageProps<'/resume/[slug]'>):
   return {
     title,
     description,
+    alternates: {
+      canonical: generateContentURL({
+        collection: CollectionSlug.ResumeDocuments,
+        slug: resume?.slug,
+      }),
+    },
     creator: name,
     authors: name
       ? [
diff --git a/app/sitemap.ts b/app/(frontend)/sitemap.ts
similarity index 100%
rename from app/sitemap.ts
rename to app/(frontend)/sitemap.ts
diff --git a/app/global-error.tsx b/app/global-error.tsx
index b50dd94c..26a366a7 100644
--- a/app/global-error.tsx
+++ b/app/global-error.tsx
@@ -1,9 +1,15 @@
 'use client'
 
+import '#frontend.css'
+import PPSupplyMono from '@/fonts/pp-supply-mono/next'
+import PPSupplySans from '@/fonts/pp-supply-sans/next'
+
 /**
  * Root error boundary.
  *
- * It replaces the entire document, so it carries its own html/body.
+ * It replaces the entire document, root layout included, so it carries its own
+ * html/body and loads the stylesheet and fonts itself. Next only resolves this
+ * file at the root of `app/`, never inside a route group.
  */
 export default function GlobalError({
   error,
@@ -15,7 +21,11 @@ export default function GlobalError({
   reset: () => void
 }) {
   return (
-    <html lang="en">
+    <html
+      lang="en"
+      className={`${PPSupplySans.variable} ${PPSupplyMono.variable}`}
+      data-theme="system"
+    >
       <body className="flex min-h-svh flex-col items-center justify-center gap-6 bg-background p-8 text-foreground">
         <div className="flex max-w-md flex-col items-center gap-4 text-center">
           <h1 className="font-mono text-2xl font-semibold">Something went wrong</h1>
diff --git a/app/(frontend)/manifest.ts b/app/manifest.ts
similarity index 100%
rename from app/(frontend)/manifest.ts
rename to app/manifest.ts
diff --git a/app/robots.test.ts b/app/robots.test.ts
index bfc43e01..ded5d73e 100644
--- a/app/robots.test.ts
+++ b/app/robots.test.ts
@@ -2,12 +2,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import robots from './robots'
 
-const rulesFor = async (agent: string) => {
+const allRules = async () => {
   const { rules } = await robots()
 
-  return (Array.isArray(rules) ? rules : [rules]).find(({ userAgent }) =>
-    Array.isArray(userAgent) ? userAgent.includes(agent) : userAgent === agent,
-  )
+  return Array.isArray(rules) ? rules : [rules]
 }
 
 describe('robots', () => {
@@ -15,30 +13,63 @@ describe('robots', () => {
     vi.unstubAllEnvs()
   })
 
-  it('lets search engines render pages and load uploads', async () => {
-    const rule = await rulesFor('Googlebot')
+  describe('on production', () => {
+    const stubProduction = () => {
+      vi.stubEnv('PRODUCTION_HOST', 'daniel.heene.io')
+      vi.stubEnv('SERVER_HOST', 'daniel.heene.io')
+      vi.stubEnv('SERVER_URL', 'https://daniel.heene.io')
+    }
 
-    expect(rule.allow).toEqual(expect.arrayContaining(['/', '/api/*/file/']))
-    expect(rule.disallow).toEqual(expect.arrayContaining(['/admin', '/api']))
-    expect(rule.disallow).not.toContain('/_next')
-  })
+    it('applies one rule to every crawler', async () => {
+      stubProduction()
+      const rules = await allRules()
 
-  it('gives link-preview bots the same access as search engines', async () => {
-    expect(await rulesFor('Twitterbot')).toEqual(await rulesFor('Googlebot'))
-  })
+      expect(rules).toHaveLength(1)
+      expect(rules[0].userAgent).toEqual(['*'])
+    })
+
+    it('lets crawlers render pages and load uploads', async () => {
+      stubProduction()
+      const [rule] = await allRules()
 
-  it('limits every other crawler to /llms.txt', async () => {
-    const rule = await rulesFor('*')
+      expect(rule.allow).toEqual(['/', '/api/*/file/'])
+      expect(rule.disallow).toEqual(['/admin', '/api'])
+      expect(rule.disallow).not.toContain('/_next')
+    })
 
-    expect(rule.allow).toEqual(['/llms.txt'])
-    expect(rule.disallow).toEqual(['/'])
+    it('points at the sitemap and sends no Host directive', async () => {
+      stubProduction()
+      const result = await robots()
+
+      expect(result.sitemap).toBe('https://daniel.heene.io/sitemap.xml')
+      expect(result.host).toBeUndefined()
+    })
   })
 
-  it('points at the sitemap and sends no Host directive', async () => {
-    vi.stubEnv('SERVER_URL', 'https://example.com')
-    const result = await robots()
+  describe('everywhere else', () => {
+    it.each(['daniel.heene.dev', 'localhost:3000', 'staging.daniel.heene.io'])(
+      'disallows everything on %s',
+      async (host) => {
+        vi.stubEnv('PRODUCTION_HOST', 'daniel.heene.io')
+        vi.stubEnv('SERVER_HOST', host)
+        vi.stubEnv('SERVER_URL', `https://${host}`)
+        const result = await robots()
+
+        expect(await allRules()).toEqual([
+          {
+            userAgent: ['*'],
+            disallow: ['/'],
+          },
+        ])
+        expect(result.sitemap).toBeUndefined()
+      },
+    )
+
+    it('disallows everything when PRODUCTION_HOST is unset', async () => {
+      vi.stubEnv('PRODUCTION_HOST', undefined)
+      vi.stubEnv('SERVER_HOST', 'daniel.heene.io')
 
-    expect(result.sitemap).toBe('https://example.com/sitemap.xml')
-    expect(result.host).toBeUndefined()
+      expect((await allRules())[0].disallow).toEqual(['/'])
+    })
   })
 })
diff --git a/app/robots.ts b/app/robots.ts
index 6bae6136..31cd6ef6 100644
--- a/app/robots.ts
+++ b/app/robots.ts
@@ -1,30 +1,23 @@
 import type { MetadataRoute } from 'next'
 
-// Search engines index the site. Link-preview bots only fetch a shared URL to
-// render its card, so they get the same access. Everyone else, AI training
-// crawlers included, is limited to /llms.txt.
-const SEARCH_ENGINES = ['Googlebot', 'Bingbot', 'YandexBot', 'DuckDuckBot', 'Applebot']
-
-const LINK_PREVIEW_BOTS = [
-  'Twitterbot',
-  'facebookexternalhit',
-  'LinkedInBot',
-  'Slackbot',
-  'Discordbot',
-  'TelegramBot',
-  'WhatsApp',
-]
+import { isProductionHost } from '@/lib/isProductionHost'
 
 export default async function robots(): Promise<MetadataRoute.Robots> {
+  if (!isProductionHost()) {
+    return {
+      rules: [
+        {
+          userAgent: ['*'],
+          disallow: ['/'],
+        },
+      ],
+    }
+  }
+
   return {
     rules: [
       {
-        userAgent: '*',
-        allow: ['/llms.txt'],
-        disallow: ['/'],
-      },
-      {
-        userAgent: [...SEARCH_ENGINES, ...LINK_PREVIEW_BOTS],
+        userAgent: ['*'],
         // /_next stays crawlable: rendering needs its JS, CSS and /_next/image.
         // Uploads are served from /api/<collection>/file/, which must stay
         // reachable even though the rest of /api is not.
diff --git a/bun.lock b/bun.lock
index d91c9dab..15785687 100644
--- a/bun.lock
+++ b/bun.lock
@@ -43,15 +43,15 @@
         "mediabunny": "^1.65.2",
         "nanoid": "^6.0.1",
         "neotraverse": "^1.0.1",
-        "next": "^16.3.6",
+        "next": "^16.4.6",
         "next-themes": "^0.4.6",
         "ogl": "^1.0.11",
         "payload": "^3.93.0",
         "pdf-parse": "^2.4.5",
         "pretty-ms": "^9.3.1",
         "pupa": "^3.3.0",
-        "react": "^19.3.0",
-        "react-dom": "^19.3.0",
+        "react": "^19.3.1",
+        "react-dom": "^19.3.1",
         "react-email": "^6.11.0",
         "recharts": "^3.10.1",
         "redis": "^6.3.1",
@@ -59,10 +59,9 @@
         "sharp": "^0.35.4",
         "shiki": "^4.4.3",
         "svgo": "^4.1.0",
-        "tailwind-merge": "^3.7.0",
-        "tailwind-variants": "^3.3.1",
-        "tailwindcss": "^4.3.3",
-        "takumi-js": "^2.14.0",
+        "tailwind-variants": "^4.0.2",
+        "tailwindcss": "^4.3.5",
+        "takumi-js": "^2.20.0",
         "timestring": "^7.0.0",
         "tw-easing-gradients": "^1.2.0",
         "type-fest": "^5.10.0",
@@ -72,8 +71,9 @@
       "devDependencies": {
         "@commitlint/cli": "^21.2.3",
         "@commitlint/config-conventional": "^21.2.3",
-        "@oxlint/plugins": "^1.86.0",
-        "@playwright/test": "~1.63.0",
+        "@next/bundle-analyzer": "^16.4.6",
+        "@oxlint/plugins": "^1.93.0",
+        "@playwright/test": "~1.65.0",
         "@react-email/ui": "^6.11.0",
         "@semantic-release/changelog": "^7.0.0",
         "@semantic-release/commit-analyzer": "^13.0.1",
@@ -102,15 +102,15 @@
         "autoprefixer": "^10.6.1",
         "cssnano": "^9.0.5",
         "lefthook": "^2.1.14",
-        "oxfmt": "^0.76.0",
-        "oxlint": "^1.86.0",
+        "oxfmt": "^0.78.0",
+        "oxlint": "^1.93.0",
         "oxlint-tailwindcss": "^1.16.0",
         "oxlint-tsgolint": "^7.0.2006",
-        "playwright": "~1.64.1",
+        "playwright": "~1.65.0",
         "postcss": "^8.5.28",
         "react-docgen-typescript": "^2.4.0",
         "semantic-release": "^25.0.9",
-        "serve": "^14.2.6",
+        "serve": "^14.2.7",
         "storybook": "^10.6.0",
         "styled-jsx": "^5.1.7",
         "syncpack": "^15.3.3",
@@ -314,6 +314,8 @@
 
     "@date-fns/tz": ["@date-fns/tz@1.2.0", "", {}, "sha512-LBrd7MiJZ9McsOgxqWX7AaxrDjcFVjWH/tIKJd7pnR7McaslGYOP1QmmiBXdJH/H/yLCT+rcQ7FaPBUxRGUtrg=="],
 
+    "@discoveryjs/json-ext": ["@discoveryjs/json-ext@0.5.7", "", {}, "sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw=="],
+
     "@dnd-kit/accessibility": ["@dnd-kit/accessibility@3.1.1", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw=="],
 
     "@dnd-kit/core": ["@dnd-kit/core@6.3.1", "", { "dependencies": { "@dnd-kit/accessibility": "^3.1.1", "@dnd-kit/utilities": "^3.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ=="],
@@ -582,23 +584,25 @@
 
     "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.7", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || 2.0.0-beta.2 || 2.0.0-beta.3", "@emnapi/runtime": "^1.7.1 || 2.0.0-beta.2 || 2.0.0-beta.3" } }, "sha512-zJccwplOAbgfZju95IUHazLnx9RAPtPN2YGJXI6UbrgeaR9QfPjGrQL6ERkSAtnVCA4Q+83ApGyaX5zdpCaKkQ=="],
 
-    "@next/env": ["@next/env@16.4.5", "", {}, "sha512-JwSPwpdkZL5VMl2jA/q+JI8MZdweAL3xmw5/tb9y/TLtmS0YXZnmYDzSihwk8xTj1OL+WM53gTqaj96yuLp6Xw=="],
+    "@next/bundle-analyzer": ["@next/bundle-analyzer@16.4.6", "", { "dependencies": { "webpack-bundle-analyzer": "4.10.1" } }, "sha512-Evp2ETZoDcqpg5LZPeJNG51o1Bc5vH+LPSP+BmSkdjeykMCh1fMB/shs3bJVbTOxYp7wC3Ed3HLo0jgX1BdxNA=="],
+
+    "@next/env": ["@next/env@16.4.6", "", {}, "sha512-SunBjJ6t+oBtecS3dTjdVuMhUogP5wD/vrGL5EVuQYM1iS4O5ilL51HkiJ3sPjMzRHiCChvr4dbaSJbR7F3lxA=="],
 
-    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-W5TniBzWKASbNNwHZ/S/f1MxQUXU/LdjklVMWA0Ujbfl7SZnUzFls45hO0i/sF7Bx1jJBWp7WWmoQajXtX/O8A=="],
+    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-kJ4VVZkley17xKaJx72QN2IBqjrj7zenCQZaUF0l9ShS/1Mt2kW4+Z5KGG6vgr3L/J562xTOizVyM1iA/u5nlg=="],
 
-    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.4.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-uWq4qkHapBDS1oFltWS4YxTb9pLHAtLNcpbuK6SmRsebLYZqpBML/j/C0op+50JYGTpZgVL/DWNt/6oWlamrrw=="],
+    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.4.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-eIPGZIqC+8JKaeZmvnCANJQF4xWkkHqSnAAajtFxgwDMAOnCgxNvP52SeWZ41PyVwoe+Le/NQuZSaQ8j7YshSA=="],
 
-    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-FdRcyOx5u5P51mlAqLB9EXdd8jZO5fsdHtk4BAQSkqOywCsbTNN/rmw+jO7pnmjNdAtu2AG46NzbCL2FPDrrgw=="],
+    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.4.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-9nI6O8vvczH2D9ZNdMGqb/3NuT15T9ksOZnAmx9/gjF2cOi74+xxyf1Hk96uIMfm14c9y6wHeBq6SH8g6udvcA=="],
 
-    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-cyvmmgtRXR8aGVT86wi9Py53IlfyCx7P2fZxuAXAoTummDnhKtUyjrMeXfapqp4qgD+gT5RqyGD/VfA16jEK7Q=="],
+    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.4.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-7/qPhTxDp2ScluOJOhLuhWmlA17o1yZ0SIgpISBCpBxXgtnK4+KGywBpFkfLPiU1rnSM1faFGzYkH6i7JdTrqA=="],
 
-    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-hPc+Fl+N22DAvqZHq559NmamXboOX5Lu8I5Wl0DezfrhTk1Zz21NQeYoZDmNI/NjTcrdsVxM72Fzn2lI+Q+vAw=="],
+    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.4.6", "", { "os": "linux", "cpu": "x64" }, "sha512-oOpbNa8XOW1qCGd9VvzC4fbkkRxEls7/WI6tz+YHC0xRA7KpV1U7DrAnCPjzVyOk/karzWEepCOcTIDmwK8FwQ=="],
 
-    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-gbACYE8IP/jlprNTpiWXHb8N9CofOzpnEwH2SrIz1dUbiJf1FbDssDupCAPeP1Taxe8mgG20sGZamJI7KFOdZw=="],
+    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.4.6", "", { "os": "linux", "cpu": "x64" }, "sha512-aM8CZ+OR2EwXaAYw7KGkW2GDmNDsLBIRe1MMRZCJPTdw/xhTD0IMUVO4sf3KqrzuRouGzwwLZn34+gFeVXiUQA=="],
 
-    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.4.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-+8gj++ZMo8H20Xh2ijjNqyFk5LPLw0AC4Fs4Tq/G94rjjQXhOjN4jgSWsWKPFsyY26hfIeemJIwKtMxOsp5GBA=="],
+    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.4.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-U0p7/tEtqvHX2crhd841CDwKtp5CFkKXVjOhmfccR3Pvp64sj8KBwRqsvltqLOwVBbj0NtkxwXSDpEHYGbxeXQ=="],
 
-    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.4.5", "", { "os": "win32", "cpu": "x64" }, "sha512-qNZj66pYXnaWLiF9R9GUbfBdrCv7kC6TaZfIwB2KH5WPc/8pEM3nVOj8hpQhWJU8S94rlH5MPDcX15+RrgUhiw=="],
+    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.4.6", "", { "os": "win32", "cpu": "x64" }, "sha512-3ZG15/5WIdlTQsIEvc9sPTTSL5XFrlLklIKmfF4fwsDnoAhu6NcBDXsk3mbGxNyo6aVLEGex+fHCv2MahY7a9g=="],
 
     "@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
 
@@ -706,43 +710,43 @@
 
     "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.21.2", "", { "os": "win32", "cpu": "x64" }, "sha512-VPoCAhKvCQTlG7vxqaBXcmuvbh77BfnGXj8g0pbvVXpm1F/R8rDVwqIWcEbMzrI1JvJlm8v7T9uMVQb6UctMRg=="],
 
-    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.76.0", "", { "os": "android", "cpu": "arm" }, "sha512-z8x4kittQLPsrJWmfoIJyYqs2gNwceGShoUqAJdFRPw3K4kkkKCFHh3Cr4NFRvZb7DPfDS3+JfBjSm3OIyQaJQ=="],
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.78.0", "", { "os": "android", "cpu": "arm" }, "sha512-1x9NPGQG5WMOOT8spRP4hPbeqwB/P9ayxFo4EUDSle6mLmtYRqE6suXgHr93/S2nnszy77LlIa8klkKdWtHbMw=="],
 
-    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.76.0", "", { "os": "android", "cpu": "arm64" }, "sha512-Zj9fEQhQSKGj8ZTB+X4q4ho4545xWf7qsvJpwREWnBz5BATEFYtStKRgiwYOZvxQ7ORlBEgSj7pmDzuljfV1mQ=="],
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.78.0", "", { "os": "android", "cpu": "arm64" }, "sha512-1muYaW9SiPEq8NIPGX0B20oUwCx6HWiCsZem/2jU7UsOzoXLT4YxWq6ybdhwKSKl0PyAfvyMyPF7FsI1To7AdA=="],
 
-    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.76.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jZy8GpUXaWpic5JPMAvLmaBz95Sx0naZl6hptBPLOMiYmZYiME7jAt6pv8o/tjQqPNWKb+7jKzZhrYx6UqM5MQ=="],
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.78.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jl4KJdo8HrVpLmcSYS/7oDXPH8Hzd6VrzgUFRAbY0j6cSRjcDkUnpuAStuNLoqvMtZEi7Rdy68BBriCgWJcy2g=="],
 
-    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.76.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U59+a9lVpoRp9enRhTE9GssL3qB1k09CYagRzTfs3dfknopMYV0x0xHZv7Pls3SNMqHlyHR+ufmY76CYafQoLw=="],
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.78.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-RwOhQgAQi1qV3TeuTfrgGkCWEL3eDFIql/lo4rt2xpGHqyolKa+W5cFbb+M9IvwMwQbplii5Gbv1ZQQPTJlNug=="],
 
-    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.76.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-J1R3YJHPdQJ2RQvzMdTVDWyizhihGiRGGAeEZxtGp629j5pcT5ypSLSiBflopD7o7tmiMD+xlNfhIVmjcHKMVQ=="],
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.78.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-MAXydj01mLjMUlnmo7sYVm+7kdBdU9Nwaux2Q1f9oLNqt3CCdego1oMoZ30qDyZQGQXfVJZEU1yRV7mSzwKDVA=="],
 
-    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.76.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x9qTg6zHoqeyzmFVlIjSb9WlhZdoXaayMTeQeDeUEfKA484AgPJz7f9chLjDMONA6wUUX0FJxnVHsYgX5Zv0+g=="],
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-rz6FVZRiWsq3O2YQgCoqZRwaQQaPQ70NBks4+KINjjPJOjBTd8g/iq6ynS97ode+qKGlhXtpc/xCl8LHzfOjyQ=="],
 
-    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.76.0", "", { "os": "linux", "cpu": "arm" }, "sha512-303gbamm7NDllTtkeaX+8F5Da+KcSBr64mqELQEFg9XgnjfLX3YBCHUcOfgIlVTSybesy43eoeKai8oGr0P6UA=="],
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-lIK0XJi4JP1FnhuLjR/JWhQHGghZc+ghFNnbZTQC8kxsmrkW3ex8CeF7fp0FT+rEP0Nm6voCYkasL8poVWA9sQ=="],
 
-    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.76.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j3UAXzCJoWX9bZLaICj6DfwkI/2fzja9RpiCIbIN+2CQAcKoY+5SH5pQUcECvn32mQm17NSPE9YqTAwYx1seZg=="],
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-o2LJIHfW3ZADOjDVk5c7MM1M8CiAG43GTc4mlJAK23fOHgru4CvnqWedCoCXpIsKokoRdEa7XdQywPGZv1BAiA=="],
 
-    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.76.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-qFZqWVkEzuxWMtUkCtHxsnohXHnUMBQr/ZIxF0KmlCSt8de/bc1lbpVgpqjb3QxCADQHG/O1s3JcowcBF2sqdw=="],
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-G+lUaQk94Vo+4byyd8X2+pPXtd7wObpdbvBC8xyozZD0ROSVBI3XpNNR6HECkJq4Q51AwLuJG81f4x+4eqvSrw=="],
 
-    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.76.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-ROiAid0UH2GN5lMMX2JTgKlOKx1rN+6a1WxIuBsU3j5A3MuB9U5XkREMW76XBbAImnH45mfOCFcSIwb+drcVYg=="],
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.78.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-r76PAZf9/ZgF/iDRaIf8nLsr4x6ZHe/j2QLmWUjoQ46Sa11qMO68a5u5iux3y8vLzqYTS/xtKO9PjjMfyk5png=="],
 
-    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.76.0", "", { "os": "linux", "cpu": "none" }, "sha512-Oyd/9ObdM2RYkZ7yzF/GyvVdbNgJcRG8BFVwnAVo3ooqzaem4E2p5eTIGB09FecQD+Q5HQEANOTEnIZTO6rBAQ=="],
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQiXTt/c4aVoRXkJvhf4Y/sA1XYe3XjSMDbdX5PiAssBuHERoGtncQXz0KKWkXPejWTKlAL4mZSQZdHOCiw7TA=="],
 
-    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.76.0", "", { "os": "linux", "cpu": "none" }, "sha512-86DOpmPDR5UzHSOB8y5HlOpYAIBtMx+6L72IyousNx54q1Kz61aykB4ScovFYivZUak+7Ww6tPBUjarluzYKLw=="],
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-VNB3wFUx/rAqwVNW+uyXxb+c0HUrmcS51UPkFMDWJY95c6Tck6u6HOyVLsqiYoC8kh2mGlwanYmjb/R2McvN0A=="],
 
-    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.76.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-u6omjjFooKfnHLBI+3UtBVInAeuEhoM/RAIw/OiFop2QQgOan5zDfqPR6guMaylt68L60kV+by07Ibp87KDjrw=="],
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.78.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-1nbI0Y7SXwx2f4mJmKt58MaDdjAcoaYM90pBMGdcZCsTW2taFW1/MUi3uQGRPAN2n+3PldCdO9m+D6x+gU/heg=="],
 
-    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.76.0", "", { "os": "linux", "cpu": "x64" }, "sha512-L0/hW1MdMrgsvuLGp9YEQOYOGj5xPHa8wVRtybdd5av03PV4qSpAq3pyfC7sn7UCA8ynRhMRTAa9Kr9nV4LGZg=="],
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-I2z2ISPjrl3CSRF5fmQkNnoh46UVU1GjM1V0+COJyNZcj0SDNM4DrPP2/gXCX38YJ1P2BL6sF2VdsJ+pEYEbJQ=="],
 
-    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.76.0", "", { "os": "linux", "cpu": "x64" }, "sha512-JNk/7HaPDJjy5kih3vq6b71Qif3tHx1ZFACGBzeHeNzyKaIpar4eFGya89GR398K2rwX0eEVmEq1npBPlEkkmg=="],
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-YHt5nKKFxT4SruI57FHnEhGRSDuoFqNoAM3moYCClg70mjjS39gBBbdzaZv+N0otdzvQVuHTPu3jFu5tpqC3XQ=="],
 
-    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.76.0", "", { "os": "none", "cpu": "arm64" }, "sha512-MDLrOQPXDuPKvPUCvpP3hC6kO72dsYxfpYiR08Nf5DiM75M0d8+D26JwT4uHDf0bcflvlGHcd58Hn2HpxkHUUQ=="],
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.78.0", "", { "os": "none", "cpu": "arm64" }, "sha512-WH21lBMU+LYzF7aMeozTZlyc44oa2F+I5OtQ7RwuidCDoAxgTyN1s34rx0PBYrio56+2G88U9VOnYJsyV7VMHQ=="],
 
-    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.76.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-2CcICDrQKqMAOFuzmts/8Ov5iKb+DW/QrW4MFsl2bnRg86uoiUvtqUkHqNSY19Shegc8pBHiXMSEHDjIg94o0A=="],
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.78.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-uNQqHJrtHIiSl8pMbhDktmGpA1hqwldWNO8kbNpNFhVt+BYk4C3Ge8nlJgkRtGjtMam0+542G5UQJJG6lLePbg=="],
 
-    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.76.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-NjZLJg+tQpMWVSyeWBBKCpib7H/uLq84ZzxCvY5eqHzSaItuzCECGA9MBiZwmW8fnkBIfppg49Ib//LSCGAp8Q=="],
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.78.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-W6omURRT39EHBPH4Z8sUPIOzWVjMbhCCCWcfT0sa6aeC+vOXNyBAJmpQRh5//KfPDX96jJlNith9i4N65wxB+Q=="],
 
-    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.76.0", "", { "os": "win32", "cpu": "x64" }, "sha512-0vCMaX/qloc7uaKBDRh+62SBW8EqmhS7c8/al+PxD594ao4lyEWdcoEmVoBgnCNVW07GDpg+9uPV7x6ta9mljw=="],
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.78.0", "", { "os": "win32", "cpu": "x64" }, "sha512-r9rWKeDVc7lIrj0Us9kP08W7FudYAoWyEdO40qnKk20bHiTbW/z2v4LoIxxUENQyFfApbeV2Gl9XsEgY/tY1dA=="],
 
     "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@7.0.2006", "", { "os": "darwin", "cpu": "arm64" }, "sha512-uc0MEHXZUDW23Zmo5X28eSNeSnP17jKnh9GiehpVZqhfy99ks8spyXT5Llar3tjDN7ppnQN0Qd9FK6WNkdD+fQ=="],
 
@@ -756,45 +760,45 @@
 
     "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@7.0.2006", "", { "os": "win32", "cpu": "x64" }, "sha512-VZsGowXcp3vQNkjoGeVCOTf4aGrRpRk6bBJWhefnJVPr6z+dX+LKqqHfwaqnFvg66Q2iJpXqklRW38YO21ee+Q=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.91.0", "", { "os": "android", "cpu": "arm" }, "sha512-eOqJUUS1MCqIoUUxMIkuwaqIdKaHr1SXYA0CQI95UUrF8jwQylQH33bBmnqhZfvWXKlRB2Ylx/+Sbk/ctEqzZQ=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.93.0", "", { "os": "android", "cpu": "arm" }, "sha512-KKw70pbD5Pvq3G2lJ+WQ71XPMjCmg37rkSe2+mDqCRP3PoTSdDMuEi4UOnE8JBtyNM7bek61EC2s0Jt7S7u+Sg=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.91.0", "", { "os": "android", "cpu": "arm64" }, "sha512-vIJU4lRxK0EhbBt+iR3rkq3pio4I+V5Gshwjei3plNjN+CIq0WxWHzYVI06J9KN8Ar3hyNSFtzJAjVRLZOYpjg=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.93.0", "", { "os": "android", "cpu": "arm64" }, "sha512-fvr1fTUZGelwRxKDt64pf28aL1WaWgviwz3X+E/FcRYvrlEahH0NECRz/c1SY+K+KWmZk5uAf6h1kQnyBkp/2A=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.91.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tLy76MurwAOpQt5QVMkJUgexBSWhB7qdvAYb14bc0xntZS6f55aKicbZoxZ/QlmAbnrdlXeD5+IjwY8EZ9RWTg=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.93.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-VdvSN9JRf4Es6ZzoAdvEeh8tgKdw8L4H82WmA8MMPVfPdZGCwE/nI27Z1HrRHYQhPxOh4kmnxQEioSUFrOvDaw=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.91.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-zPeMmjAqm5vXxbTp/JqYuc9gGSbUuEaeCAkFHB4TCRLTlfJGD//Fkx03YvZHCHZJ7ideLiiLcae+3f2I27qnaA=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.93.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-QR1V890Ml0YGRG0F/iV0K9igG+pOhe+VWd+aZnxY849rRHZf3F2gEoQks5+GVHf105X9Mh/6HdShTP5juekG2g=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.91.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-psOR9+xGMXn0hj4KY5M2kjSQ1n0TCMdYbPOraoV0iQyl7mw2oBBYGUM2+ma40m1YLVrktTBOta4FjrmcOHDhrg=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.93.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jDfIbi30zZaKi+rTvig3sge+Xhi8pFFSgHxb0jzovc4qh8ETm/irKV9c7N/JsuwnYc5sbvf4IC8w1vQQ0IL+BA=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.91.0", "", { "os": "linux", "cpu": "arm" }, "sha512-1PNA1j4ETxawvxfz6ueDxWgQgWkXPbv44DWZmC7LR07GqojGFDOwWbosOT6/AYiJr7zMXEhn2dPWMkyFFOFpUQ=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.93.0", "", { "os": "linux", "cpu": "arm" }, "sha512-qtxZ714ND/koFgVH00QgxlzZiIbRPmguaPhnHRU5DFFtrtEdOrSnZD4U/H2AzXrXkZ59eQbMBnJwbum5XohrIQ=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.91.0", "", { "os": "linux", "cpu": "arm" }, "sha512-jcNePVpca37lTbHmiPMnVbPAAW0rH9kAoDjsDv6vESEX9pzazIR1q5SyYuc1rQzdjHtc2VVCDN9jDh6tHcOHyA=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.93.0", "", { "os": "linux", "cpu": "arm" }, "sha512-5pJ9NjMvH7WMUqXB6bTTOSemBm39w2cod27Hu3+Yom/GhbTeNXlYcpDx1o4CgBP6fhp0YHG66TNdVaUm6sHjsA=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.91.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-TJi78UX6R+9qZ23ZKtzN6adfW83bjY0NXsCRMBRH6H7IizaMXmZbdRAtjedMkx77bT46YQH0csawsY9lwha8MA=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.93.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-pRf+7jtbt2fHE23SX7qBxRgnBZicUgsoCK1PVIjnOk+t3a6UBkpt/GrKI99WlxsKUxftz/5nv/kfKvScmYywkw=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.91.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-OowlLroUTzKq5OBvbu6iegch8SJ2DivXFCukzPWURwvcJhMj7/P0CUGH5qrDlxT1Kh48dcxqYqrvE8qK6xTLKQ=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.93.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zM8Fd/K8sqGvsBcJBZ3oVZ3ctGWbszA08IaGt5gFFF5RcunppAI/ZnAXbouABvnWeJ//S44KKlfPZnDDbeiphg=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.91.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-QF/5Ge8yGpWg5s4awMNHfVKh1WOmk591Qg082i6CHenXYBa+W1E5RwWZXaKUOw4Ko7CCjqg3TfBc0AzhnqblYg=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.93.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-7qKCnvhZKDXJG2pdbLazd2hw4FxjJHbZOFrrbzyy5PdHfPLH9vnNUa1le01A8uItZuYKPBPncH+HCoEiFT4SgA=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.91.0", "", { "os": "linux", "cpu": "none" }, "sha512-dXlsKlNhzJQX1nageGKnvWe1D7uTng249hQM80CG/YPZ8F/VZHbxVLhImgurdWBOmu86XOemValLjrW6QIOM/Q=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.93.0", "", { "os": "linux", "cpu": "none" }, "sha512-2pgulxC6G8V5wE750NJE/fRkf9aO6i6yoj10wyaR2EdiNtan4OemsOtsQ0ZTXGdY8Q3IoTmlND3GYvjJsvikYg=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.91.0", "", { "os": "linux", "cpu": "none" }, "sha512-tznkj5VrWNRUfymkaLcJetgMLbP9suL5ob/m7j0Fdbnm5u3Li/Ezo/YcBixiuwdL1sg0oGpyTe86It0J6T+Lxg=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.93.0", "", { "os": "linux", "cpu": "none" }, "sha512-yWsn6Gg2PnGG5jlyDz5+pHGiMTMiy4adaa4WRMzDgzB8efaShk1JMmTHIBSVLQMh0tYXRs4CN5uJCO79r4Mi4g=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.91.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-sNvfLiUYQkVsLNUgIW24AEYTHSd2zZ1vAxXssPdjuQHTtCpRvQihYri6d5z5FY7w/QrcnB5+g9E+/sqmZq8tfA=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.93.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-WCn5plwp/ezS2RDPQKp0/EXEVRr9/dDexUdRKmsMFqzNM5xBSZ1wbsi3PuMk1VfkMRnI5BuazCsziCWMXRDOlw=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.91.0", "", { "os": "linux", "cpu": "x64" }, "sha512-eA25ETvimhUZ89y5BcunNY7yv7qwG2I7V7dFQAU+mIEqZ57gBCXdIERl0yXOEt43zjsw0yK2gRKTc+twF706wQ=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.93.0", "", { "os": "linux", "cpu": "x64" }, "sha512-F2CGjb9LAkzH+IYTZSzd1klQ1vk5z6Utjax64WeLByCkYXbVDbsun+Oy2hLfW2MDSKCvW+jwy/9ld0EPgdeu+A=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.91.0", "", { "os": "linux", "cpu": "x64" }, "sha512-4hZ4Z9K+OkcTpAHDoUTMg/8MModbM0aocrl9KnGzp9h5iKqjrXraEUZorYoVCT7xoK93CAHXgTndxRBrOjH/fA=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.93.0", "", { "os": "linux", "cpu": "x64" }, "sha512-plf5DE2objcG8Tf7mXRuRa8tT8rzDkpjqXQtKoGsKHWkpgsialbON1+cCtoSEUTVbQUjXvuAm8vV9+3rR0yCBw=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.91.0", "", { "os": "none", "cpu": "arm64" }, "sha512-gtqn4b0kLpGe46Qh7NHiR86wZpd+TLaesO106s7V3RG33r63VB94LW5qPKEDJX64osh3xfjnPFn1M0484bC7wQ=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.93.0", "", { "os": "none", "cpu": "arm64" }, "sha512-Kp2yJrKvoTe9FfKdO/xwLNUbs2bYTMKx0+aoQD1s0h/Tx0kSgtHSdGmrk8tTKdluosjFbo88qYRIaNIX43AfFw=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.91.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-KQItBdsyHN28U3z/bEek6h9pvG3Uqv564QYO8K1bE/V7YRZgpHlRnfNKVPHkk4sfYKyPzEjCgW80QkImOLvJog=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.93.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-vigjcHCFsR6KjnWTEVfaCxcMYapEuaK9FZa1MpewwQ1S+Xud3v0okfkj1RySsD6RF1NRHIjSlQSalTnKIaj3nA=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.91.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-XFKqbbsQVmTgw+CyBKuzSZtAa45viom1naFfulKmkTFdDyDaBQaBqEz5J61TI8iwBynU+F8q7qPD+9mplZRhEg=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.93.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-0Ot3BEe/AAr2/uQhe55r8CmPlperYk2mQmxdutOru7oU0kir6IiEVHb1TG3GORRlfra97lPHVDLhgmihiKzLrg=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.91.0", "", { "os": "win32", "cpu": "x64" }, "sha512-DmpK0PthG66Bcz5Y4JqNbzXltzyLQtg3ofYpd25+ejm7kQYUM78VL1uIP/ZFct2781mwUyBX37LatFPCTVp35A=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.93.0", "", { "os": "win32", "cpu": "x64" }, "sha512-ZzzIIVs/Qkm8trUWYKF0OYub5ALlv50/3gsEZbKAvWgz+yNJX6uRmQ8ySPXU2Q0/Y9m4JCOjhpmC8XUYbPHX5Q=="],
 
-    "@oxlint/plugins": ["@oxlint/plugins@1.91.0", "", {}, "sha512-Fh+SOBxMu7/pbSk84WG4BN6npcxxlF4jWNQJ+S4IUNyvSVeQwOVTFQMD/Dx2EqBQ1lVeCADcJ+0rzT1BKQ9cUA=="],
+    "@oxlint/plugins": ["@oxlint/plugins@1.93.0", "", {}, "sha512-bKWQI1g9jn8bWUZsvhbOLfgva576Fbp1KwoTNSUCMdT9tlTAvQS2JkifX1UrhPPdyN4GHvM20HhvIMqqU1yotQ=="],
 
     "@payloadcms/db-mongodb": ["@payloadcms/db-mongodb@3.93.0", "", { "dependencies": { "mongoose": "8.24.1", "mongoose-paginate-v2": "1.9.4", "prompts": "2.4.2", "uuid": "13.0.2" }, "peerDependencies": { "payload": "3.93.0" } }, "sha512-cXcDSraT+1Spyl7JoIgBp6rnuuvdHGCkDKVBh+gwEWcUdQskU8FETMzezSCYQobRpSUNZ4AgRcq5Q+usPRnpNw=="],
 
@@ -822,7 +826,7 @@
 
     "@pinojs/redact": ["@pinojs/redact@0.4.0", "", {}, "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg=="],
 
-    "@playwright/test": ["@playwright/test@1.63.0", "", { "dependencies": { "playwright": "1.63.0" }, "bin": { "playwright": "cli.js" } }, "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ=="],
+    "@playwright/test": ["@playwright/test@1.65.0", "", { "dependencies": { "playwright": "1.65.0" }, "bin": { "playwright": "cli.js" } }, "sha512-iGURLGuKDLakSEl7Pgfv8h7f+XLT+V861Wfhz0zlEl5nyFuKUopdkFBPKqTllTUp06aOwPuH8iuUEb3yp3MpbQ=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
@@ -830,6 +834,8 @@
 
     "@pnpm/npm-conf": ["@pnpm/npm-conf@3.0.3", "", { "dependencies": { "@pnpm/config.env-replace": "^1.1.0", "@pnpm/network.ca-file": "^1.0.1", "config-chain": "^1.1.11" } }, "sha512-//0sR/cow/s4ICQaYoAobOl4aU8cjU6x/V24V7XkKotb9+O+3zySIYp146vpaobYHnxa4pZX8NkV54Z5AwbDKA=="],
 
+    "@polka/url": ["@polka/url@1.0.0-next.29", "", {}, "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww=="],
+
     "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
 
     "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="],
@@ -1100,27 +1106,27 @@
 
     "@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.4", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.4", "@tailwindcss/oxide": "4.3.4", "postcss": "^8.5.25", "tailwindcss": "4.3.4" } }, "sha512-6O0QLY+1CseO8ivlYK2Y7IxNPaQ8D5ypxrV+ws34mbxknWH824J+gEWtJ0gyFiYAudmdEeXdF8kqwgXIaZRyHw=="],
 
-    "@takumi-rs/core": ["@takumi-rs/core@2.19.0", "", { "dependencies": { "@takumi-rs/helpers": "2.19.0" }, "optionalDependencies": { "@takumi-rs/core-darwin-arm64": "2.19.0", "@takumi-rs/core-darwin-x64": "2.19.0", "@takumi-rs/core-linux-arm64-gnu": "2.19.0", "@takumi-rs/core-linux-arm64-musl": "2.19.0", "@takumi-rs/core-linux-x64-gnu": "2.19.0", "@takumi-rs/core-linux-x64-musl": "2.19.0", "@takumi-rs/core-win32-arm64-msvc": "2.19.0", "@takumi-rs/core-win32-x64-msvc": "2.19.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-cYxOTb4pOu25Y8GBm3JTyIwenHNAZF11pxEmTxA3Q7VabC0pqeWDo/nOjTc2slTHORaglkvwK4SMmnpzab5BjQ=="],
+    "@takumi-rs/core": ["@takumi-rs/core@2.20.0", "", { "dependencies": { "@takumi-rs/helpers": "2.20.0" }, "optionalDependencies": { "@takumi-rs/core-darwin-arm64": "2.20.0", "@takumi-rs/core-darwin-x64": "2.20.0", "@takumi-rs/core-linux-arm64-gnu": "2.20.0", "@takumi-rs/core-linux-arm64-musl": "2.20.0", "@takumi-rs/core-linux-x64-gnu": "2.20.0", "@takumi-rs/core-linux-x64-musl": "2.20.0", "@takumi-rs/core-win32-arm64-msvc": "2.20.0", "@takumi-rs/core-win32-x64-msvc": "2.20.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-28uryNYSyuXZWv5uBfJiWDrRXVdAunkU0sZiB7KG2WgLej64pUNL6jZSTQa+gBXfVu+3DdCz58OnpONBO6EUqQ=="],
 
-    "@takumi-rs/core-darwin-arm64": ["@takumi-rs/core-darwin-arm64@2.19.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-W/SI7Zrxo70dIaKNo+/kOLVr97S3ezkqsi7OM0RWz2CtP+cFgdBTPHXNsrB561gJFPHsuWN/LZ0u8oZxeAYtGw=="],
+    "@takumi-rs/core-darwin-arm64": ["@takumi-rs/core-darwin-arm64@2.20.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-wescbJ8pm0fBN8uXxjiZUDqN7JkdDDmxt8Gq1pSrpRCuGxvAnoj3agMMhHtJ5Ty+BufkIwSvV2cBXRLM4wyYZw=="],
 
-    "@takumi-rs/core-darwin-x64": ["@takumi-rs/core-darwin-x64@2.19.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-xO/eTwPLrfUZRybMnG4lb6fDa7BjFryFi1TSkRF5KjPhkv21Lr5ovFEYz1y2P5k/4psrk66FJbU2EJDOEjdXiw=="],
+    "@takumi-rs/core-darwin-x64": ["@takumi-rs/core-darwin-x64@2.20.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-idCQC8PLuuDFQ4c2YEx142Q1WM+GbrR3RqNxuJay5MxfCXcZ42dv+96xGcgs0U2AWOk1GkY/vTY4y/Om7O/QHA=="],
 
-    "@takumi-rs/core-linux-arm64-gnu": ["@takumi-rs/core-linux-arm64-gnu@2.19.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0PvL5bNTZTkLExjKveI3pOz3mtfjJtECqK49f/KGnp7J0bBmdoi2muszCh/dQQEEFKXcWNe27yfK1tzsO5fm0g=="],
+    "@takumi-rs/core-linux-arm64-gnu": ["@takumi-rs/core-linux-arm64-gnu@2.20.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-TeqwOXlVdjAoSoOVQVoJOER4upQnh7nX6QJnYqVDlbByiSkMhqYULXc7I83NqzkL3U/fbT7/oASNeGWAI2axBA=="],
 
-    "@takumi-rs/core-linux-arm64-musl": ["@takumi-rs/core-linux-arm64-musl@2.19.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-nwKZMGcNVdmCP+U7+uINtXpgOeyk5m7g5D9EAtttpWc6ImjJm7MaqNK4Q2YBkOFeAIbRkY5dDL8Xcu19ATSj0w=="],
+    "@takumi-rs/core-linux-arm64-musl": ["@takumi-rs/core-linux-arm64-musl@2.20.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gOcZxdGq7ebhqRN1Ue3FYJV7jKFG8yG99Opiky13viXXH8hkOde+OKUMe2kqWRH42j7p5EhBPj2qmdUBXXQBCQ=="],
 
-    "@takumi-rs/core-linux-x64-gnu": ["@takumi-rs/core-linux-x64-gnu@2.19.0", "", { "os": "linux", "cpu": "x64" }, "sha512-gf/U6qxWZk6uX5MFnl5/PTOzxBbISj89UQwbliHa1sflcq2d+SeITDqnGtkUueF/4TlgPVV7JvrPuhAbINy2Gg=="],
+    "@takumi-rs/core-linux-x64-gnu": ["@takumi-rs/core-linux-x64-gnu@2.20.0", "", { "os": "linux", "cpu": "x64" }, "sha512-MwIdLqyMUUz+6wuxkGJZyEO9alZODuDqe826HAG2+RErwpSUwfqtD2pHPWG9bnWkr7qpVeziFut6Ng68lYzcvQ=="],
 
-    "@takumi-rs/core-linux-x64-musl": ["@takumi-rs/core-linux-x64-musl@2.19.0", "", { "os": "linux", "cpu": "x64" }, "sha512-zHD0EdIA2ZMCnKV/KtMgEerUcdvjYU4hGiru9I/x96u+BJXaQGMtHCxXt9Srhj+dlqhPyWdQTMAE3wpflN+0nw=="],
+    "@takumi-rs/core-linux-x64-musl": ["@takumi-rs/core-linux-x64-musl@2.20.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bM9QEwOuKg0+im1M+XjownCCdN+zHKQXGblDttpKuoa2QEd4F9t0JJcQMBSjLFucC2sf+rGicAmayMsQRxwgfg=="],
 
-    "@takumi-rs/core-win32-arm64-msvc": ["@takumi-rs/core-win32-arm64-msvc@2.19.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-v1CrPsmzhIe0+v+kIAdaSwrNMqiOpUXgMxHLUo0xDQdPMNML0EefDsL9ADtKDpT1pjhY/r9tvwVl3RhKsdottw=="],
+    "@takumi-rs/core-win32-arm64-msvc": ["@takumi-rs/core-win32-arm64-msvc@2.20.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-VwGj5dsODmHYV09P3AFhvcHL3hk8cS3Y0PYYHxFQtopwcWTsDN522+siotYL1lXZaEag9FoMJOuqiuZsVGgR3w=="],
 
-    "@takumi-rs/core-win32-x64-msvc": ["@takumi-rs/core-win32-x64-msvc@2.19.0", "", { "os": "win32", "cpu": "x64" }, "sha512-9HJb2LTDSlehFrGfPw+uKgxM3XCnpy/PYnwtyzcgAiSFJVjwv0zCLl3IvJREakj5Y9rJCg0mMtPje9hlPbJL/A=="],
+    "@takumi-rs/core-win32-x64-msvc": ["@takumi-rs/core-win32-x64-msvc@2.20.0", "", { "os": "win32", "cpu": "x64" }, "sha512-3am5JIowXAETxUHwQh8MONCagATpN4jFiXISKT2djvceJxrriPZKwWNjB7zTUzZmVLYTbslMrG7x2+U1wPndYg=="],
 
-    "@takumi-rs/helpers": ["@takumi-rs/helpers@2.19.0", "", { "peerDependencies": { "preact": "^10.0.0 || ^11.0.0", "react": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["preact", "react"] }, "sha512-3ycCjYCP31HACXBvlpv4fMLw9vneCVGuttFBfZr4jpL0nHNCt2wlXvt0XFt05FscLMUY2s+5PGKPE6EatXI/mg=="],
+    "@takumi-rs/helpers": ["@takumi-rs/helpers@2.20.0", "", { "peerDependencies": { "preact": "^10.0.0 || ^11.0.0", "react": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["preact", "react"] }, "sha512-efdeG4Ujsw0IEYXhq3lUN1UiKhK6f3tak7VSMrCEWSvumFs0q5moBHSLdsR6aJhPNsYei21Ea6Rjtv94/qdyjg=="],
 
-    "@takumi-rs/wasm": ["@takumi-rs/wasm@2.19.0", "", { "dependencies": { "@takumi-rs/helpers": "2.19.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-V9LKPOFVHKZ7lANVQ94WmOkGvgW0EqXUeLEpsWB2Wnnx7WpOWHnbAI9Yb0VnAYeyRicp7nAfG3vF/M7vsw0s2w=="],
+    "@takumi-rs/wasm": ["@takumi-rs/wasm@2.20.0", "", { "dependencies": { "@takumi-rs/helpers": "2.20.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-2Xfu55Ye8gmJMXQEDun/5zl/78LyCXKUjP503alH1tG0OyotkkWpZbgW8iWGuxxf4IJvp9kIaO+NLGbq4B6J8A=="],
 
     "@testing-library/dom": ["@testing-library/dom@10.4.2", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-yzr2S9HyAIdhz2/6qHgbs665Q7PKVcDF05vsOlHPxG1mo36gKVesdYVeDLnXgfjJ03CrKRk08knc6+E/9m8v2Q=="],
 
@@ -1278,6 +1284,8 @@
 
     "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
 
+    "acorn-walk": ["acorn-walk@8.3.5", "", { "dependencies": { "acorn": "^8.11.0" } }, "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw=="],
+
     "agent-base": ["agent-base@9.0.0", "", {}, "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA=="],
 
     "aggregate-error": ["aggregate-error@5.1.0", "", { "dependencies": { "clean-stack": "^5.2.0", "indent-string": "^5.0.0" } }, "sha512-1m4/ydbOGBbHTtBYa4/ISQcqfPdZAxQLzj71wM71T8lP4ktez8lcsVolvscrujQW4CJr/LJSzoZ6mcfnqzYQ3A=="],
@@ -1300,8 +1308,6 @@
 
     "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
 
-    "arch": ["arch@2.2.0", "", {}, "sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ=="],
-
     "arg": ["arg@5.0.2", "", {}, "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg=="],
 
     "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
@@ -1424,8 +1430,6 @@
 
     "client-only": ["client-only@0.0.1", "", {}, "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA=="],
 
-    "clipboardy": ["clipboardy@3.0.0", "", { "dependencies": { "arch": "^2.2.0", "execa": "^5.1.1", "is-wsl": "^2.2.0" } }, "sha512-Su+uU5sr1jkUy1sGRpLKjKrvEOVXgSgiSInwa/qeID6aJ07yh+5NWc3h2QfjHjBnfX4LhtFcuAWKUsJ3r+fjbg=="],
-
     "cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
 
     "clone": ["clone@2.1.2", "", {}, "sha512-3Pe/CF1Nn94hyhIYpjtiLhdCoEoz0DqQ+988E9gmeEdQZlojxnOb74wctFyuwWQHzqyf9X7C7MG8juUpqBJT8w=="],
@@ -1604,6 +1608,8 @@
 
     "dot-prop": ["dot-prop@10.2.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw=="],
 
+    "duplexer": ["duplexer@0.1.2", "", {}, "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg=="],
+
     "duplexer2": ["duplexer2@0.1.4", "", { "dependencies": { "readable-stream": "^2.0.2" } }, "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA=="],
 
     "eastasianwidth": ["eastasianwidth@0.2.0", "", {}, "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="],
@@ -1766,6 +1772,8 @@
 
     "graphql-scalars": ["graphql-scalars@1.22.2", "", { "dependencies": { "tslib": "^2.5.0" }, "peerDependencies": { "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0" } }, "sha512-my9FB4GtghqXqi/lWSVAOPiTzTnnEzdOXCsAC2bb5V7EFNQjVjwy3cSSbUvgYOtDuDibd+ZsCDhz+4eykYOlhQ=="],
 
+    "gzip-size": ["gzip-size@6.0.0", "", { "dependencies": { "duplexer": "^0.1.2" } }, "sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q=="],
+
     "handlebars": ["handlebars@4.7.10", "", { "dependencies": { "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0" }, "optionalDependencies": { "uglify-js": "^3.1.4" }, "bin": { "handlebars": "bin/handlebars" } }, "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg=="],
 
     "happy-dom": ["happy-dom@20.14.6", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q=="],
@@ -1862,7 +1870,7 @@
 
     "is-decimal": ["is-decimal@2.0.1", "", {}, "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A=="],
 
-    "is-docker": ["is-docker@2.2.1", "", { "bin": { "is-docker": "cli.js" } }, "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ=="],
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
 
     "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
 
@@ -1880,6 +1888,8 @@
 
     "is-plain-obj": ["is-plain-obj@4.1.0", "", {}, "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg=="],
 
+    "is-plain-object": ["is-plain-object@5.1.0", "", {}, "sha512-bUi/yjmtKYcRVUtWRGr0UA6xEFh2I6zWUwMrUXB3s7bmYCaZ8a+0ZsTRkrawh/mzlSD1Y0Ph8bp/U+TvBpWDNw=="],
+
     "is-port-reachable": ["is-port-reachable@4.0.0", "", {}, "sha512-9UoipoxYmSk6Xy7QFgRv2HDyaysmgSG75TFQs6S+3pDM7ZhKTF/bskZV+0UlABHzKjNVhPjYCLfeZUEg1wXxig=="],
 
     "is-potential-custom-element-name": ["is-potential-custom-element-name@1.0.1", "", {}, "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ=="],
@@ -1892,7 +1902,7 @@
 
     "is-windows": ["is-windows@1.0.2", "", {}, "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA=="],
 
-    "is-wsl": ["is-wsl@2.2.0", "", { "dependencies": { "is-docker": "^2.0.0" } }, "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww=="],
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
 
     "isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
 
@@ -2182,6 +2192,8 @@
 
     "mquery": ["mquery@5.0.0", "", { "dependencies": { "debug": "4.x" } }, "sha512-iQMncpmEK8R8ncT8HJGsGc9Dsp8xcgYMVSbs5jgnm1lFHTZqMJTUWTDx1LBO8+mK3tPNZWFLBghQEIOULSTHZg=="],
 
+    "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],
+
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
     "mz": ["mz@2.7.0", "", { "dependencies": { "any-promise": "^1.0.0", "object-assign": "^4.0.1", "thenify-all": "^1.0.0" } }, "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q=="],
@@ -2198,7 +2210,7 @@
 
     "nerf-dart": ["nerf-dart@1.0.0", "", {}, "sha512-EZSPZB70jiVsivaBLYDCyntd5eH8NTSMOn3rB+HxwdmKThGELLdYv8qVIMWvZEFy9w8ZZpW9h9OB32l1rGtj7g=="],
 
-    "next": ["next@16.4.5", "", { "dependencies": { "@next/env": "16.4.5", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.4.5", "@next/swc-darwin-x64": "16.4.5", "@next/swc-linux-arm64-gnu": "16.4.5", "@next/swc-linux-arm64-musl": "16.4.5", "@next/swc-linux-x64-gnu": "16.4.5", "@next/swc-linux-x64-musl": "16.4.5", "@next/swc-win32-arm64-msvc": "16.4.5", "@next/swc-win32-x64-msvc": "16.4.5", "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-rmdfsWosjTUO+6R0S3KokoIk6Kj0sWDRTe86tZHdqaWH/oXq/udX3/4xb+YQi7aWbyEFoglDU54kaifLCdXbBw=="],
+    "next": ["next@16.4.6", "", { "dependencies": { "@next/env": "16.4.6", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.4.6", "@next/swc-darwin-x64": "16.4.6", "@next/swc-linux-arm64-gnu": "16.4.6", "@next/swc-linux-arm64-musl": "16.4.6", "@next/swc-linux-x64-gnu": "16.4.6", "@next/swc-linux-x64-musl": "16.4.6", "@next/swc-win32-arm64-msvc": "16.4.6", "@next/swc-win32-x64-msvc": "16.4.6", "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-QZJiYhaZLJMo2KpkQGQIwvmd79WVsAWeYIU554a8d7zArS3si/IRy3lBNV/rtYhE70oLwdLYhPAXLPx8HwcwtA=="],
 
     "next-themes": ["next-themes@0.4.6", "", { "peerDependencies": { "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc", "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc" } }, "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA=="],
 
@@ -2248,13 +2260,15 @@
 
     "open": ["open@10.2.0", "", { "dependencies": { "default-browser": "^5.2.1", "define-lazy-prop": "^3.0.0", "is-inside-container": "^1.0.0", "wsl-utils": "^0.1.0" } }, "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA=="],
 
+    "opener": ["opener@1.5.2", "", { "bin": { "opener": "bin/opener-bin.js" } }, "sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A=="],
+
     "oxc-parser": ["oxc-parser@0.127.0", "", { "dependencies": { "@oxc-project/types": "^0.127.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.127.0", "@oxc-parser/binding-android-arm64": "0.127.0", "@oxc-parser/binding-darwin-arm64": "0.127.0", "@oxc-parser/binding-darwin-x64": "0.127.0", "@oxc-parser/binding-freebsd-x64": "0.127.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.127.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.127.0", "@oxc-parser/binding-linux-arm64-gnu": "0.127.0", "@oxc-parser/binding-linux-arm64-musl": "0.127.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.127.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.127.0", "@oxc-parser/binding-linux-riscv64-musl": "0.127.0", "@oxc-parser/binding-linux-s390x-gnu": "0.127.0", "@oxc-parser/binding-linux-x64-gnu": "0.127.0", "@oxc-parser/binding-linux-x64-musl": "0.127.0", "@oxc-parser/binding-openharmony-arm64": "0.127.0", "@oxc-parser/binding-wasm32-wasi": "0.127.0", "@oxc-parser/binding-win32-arm64-msvc": "0.127.0", "@oxc-parser/binding-win32-ia32-msvc": "0.127.0", "@oxc-parser/binding-win32-x64-msvc": "0.127.0" } }, "sha512-bkgD4qHlN7WxLdX8bLXdaU54TtQtAIg/ZBAfm0aje/mo3MRDo3P0hZSgr4U7O3xfX+fQmR5AP04JS/TGcZLcFA=="],
 
     "oxc-resolver": ["oxc-resolver@11.21.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.21.2", "@oxc-resolver/binding-android-arm64": "11.21.2", "@oxc-resolver/binding-darwin-arm64": "11.21.2", "@oxc-resolver/binding-darwin-x64": "11.21.2", "@oxc-resolver/binding-freebsd-x64": "11.21.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.21.2", "@oxc-resolver/binding-linux-arm64-musl": "11.21.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.21.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-musl": "11.21.2", "@oxc-resolver/binding-openharmony-arm64": "11.21.2", "@oxc-resolver/binding-wasm32-wasi": "11.21.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.21.2", "@oxc-resolver/binding-win32-x64-msvc": "11.21.2" } }, "sha512-w5tLwYN3Zo24w5EeWJjJWZOwhYqTtC8PS2B1tIt7BZUuqTIcU07sQValbDw+rq7+AuAGzOHklgK+ifsy4lpXfw=="],
 
-    "oxfmt": ["oxfmt@0.76.0", "", { "dependencies": { "tinypool": "2.2.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.76.0", "@oxfmt/binding-android-arm64": "0.76.0", "@oxfmt/binding-darwin-arm64": "0.76.0", "@oxfmt/binding-darwin-x64": "0.76.0", "@oxfmt/binding-freebsd-x64": "0.76.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.76.0", "@oxfmt/binding-linux-arm-musleabihf": "0.76.0", "@oxfmt/binding-linux-arm64-gnu": "0.76.0", "@oxfmt/binding-linux-arm64-musl": "0.76.0", "@oxfmt/binding-linux-ppc64-gnu": "0.76.0", "@oxfmt/binding-linux-riscv64-gnu": "0.76.0", "@oxfmt/binding-linux-riscv64-musl": "0.76.0", "@oxfmt/binding-linux-s390x-gnu": "0.76.0", "@oxfmt/binding-linux-x64-gnu": "0.76.0", "@oxfmt/binding-linux-x64-musl": "0.76.0", "@oxfmt/binding-openharmony-arm64": "0.76.0", "@oxfmt/binding-win32-arm64-msvc": "0.76.0", "@oxfmt/binding-win32-ia32-msvc": "0.76.0", "@oxfmt/binding-win32-x64-msvc": "0.76.0" }, "peerDependencies": { "@astrojs/compiler-rs": "^0.5.0", "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["@astrojs/compiler-rs", "svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-Yo9RIn9lRWTm/U8obHbXUWc39lCpEFXlEggFoPx01zS18OCFi7mAwMmL05+p1AunuJgSkONffWyBHJzpMMCRuQ=="],
+    "oxfmt": ["oxfmt@0.78.0", "", { "dependencies": { "tinypool": "2.2.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.78.0", "@oxfmt/binding-android-arm64": "0.78.0", "@oxfmt/binding-darwin-arm64": "0.78.0", "@oxfmt/binding-darwin-x64": "0.78.0", "@oxfmt/binding-freebsd-x64": "0.78.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.78.0", "@oxfmt/binding-linux-arm-musleabihf": "0.78.0", "@oxfmt/binding-linux-arm64-gnu": "0.78.0", "@oxfmt/binding-linux-arm64-musl": "0.78.0", "@oxfmt/binding-linux-ppc64-gnu": "0.78.0", "@oxfmt/binding-linux-riscv64-gnu": "0.78.0", "@oxfmt/binding-linux-riscv64-musl": "0.78.0", "@oxfmt/binding-linux-s390x-gnu": "0.78.0", "@oxfmt/binding-linux-x64-gnu": "0.78.0", "@oxfmt/binding-linux-x64-musl": "0.78.0", "@oxfmt/binding-openharmony-arm64": "0.78.0", "@oxfmt/binding-win32-arm64-msvc": "0.78.0", "@oxfmt/binding-win32-ia32-msvc": "0.78.0", "@oxfmt/binding-win32-x64-msvc": "0.78.0" }, "peerDependencies": { "@astrojs/compiler-rs": "^0.5.0", "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["@astrojs/compiler-rs", "svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-uagX+70mKqh/YqxB6ON/lkxVPH6E1Z7pfP2x6XVRPPyiDCZtX6o1xIEeXAIXJ/2wA5ViX4RFuW+IAQn85yJdWg=="],
 
-    "oxlint": ["oxlint@1.91.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.91.0", "@oxlint/binding-android-arm64": "1.91.0", "@oxlint/binding-darwin-arm64": "1.91.0", "@oxlint/binding-darwin-x64": "1.91.0", "@oxlint/binding-freebsd-x64": "1.91.0", "@oxlint/binding-linux-arm-gnueabihf": "1.91.0", "@oxlint/binding-linux-arm-musleabihf": "1.91.0", "@oxlint/binding-linux-arm64-gnu": "1.91.0", "@oxlint/binding-linux-arm64-musl": "1.91.0", "@oxlint/binding-linux-ppc64-gnu": "1.91.0", "@oxlint/binding-linux-riscv64-gnu": "1.91.0", "@oxlint/binding-linux-riscv64-musl": "1.91.0", "@oxlint/binding-linux-s390x-gnu": "1.91.0", "@oxlint/binding-linux-x64-gnu": "1.91.0", "@oxlint/binding-linux-x64-musl": "1.91.0", "@oxlint/binding-openharmony-arm64": "1.91.0", "@oxlint/binding-win32-arm64-msvc": "1.91.0", "@oxlint/binding-win32-ia32-msvc": "1.91.0", "@oxlint/binding-win32-x64-msvc": "1.91.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2005", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-vjy/cBZcEFcYh3dbxUoQK+bjc+QaY3ZWo86aJkZ5YAwp/HyiqP7dTdNgbvcIVJafhAH5sZbTqBp4sZcicEZngA=="],
+    "oxlint": ["oxlint@1.93.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.93.0", "@oxlint/binding-android-arm64": "1.93.0", "@oxlint/binding-darwin-arm64": "1.93.0", "@oxlint/binding-darwin-x64": "1.93.0", "@oxlint/binding-freebsd-x64": "1.93.0", "@oxlint/binding-linux-arm-gnueabihf": "1.93.0", "@oxlint/binding-linux-arm-musleabihf": "1.93.0", "@oxlint/binding-linux-arm64-gnu": "1.93.0", "@oxlint/binding-linux-arm64-musl": "1.93.0", "@oxlint/binding-linux-ppc64-gnu": "1.93.0", "@oxlint/binding-linux-riscv64-gnu": "1.93.0", "@oxlint/binding-linux-riscv64-musl": "1.93.0", "@oxlint/binding-linux-s390x-gnu": "1.93.0", "@oxlint/binding-linux-x64-gnu": "1.93.0", "@oxlint/binding-linux-x64-musl": "1.93.0", "@oxlint/binding-openharmony-arm64": "1.93.0", "@oxlint/binding-win32-arm64-msvc": "1.93.0", "@oxlint/binding-win32-ia32-msvc": "1.93.0", "@oxlint/binding-win32-x64-msvc": "1.93.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2005", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-19JMsQFX+YvEbcUTFQxjTwhvs0Ibg0D6CFneSLgpwnACWcY/6LjhpGpkPodh0T5aIT1pjMTLlYaeBFzaVgugTA=="],
 
     "oxlint-tailwindcss": ["oxlint-tailwindcss@1.17.1", "", { "dependencies": { "@tailwindcss/node": "^4.3.3", "tailwindcss": "^4.3.3" } }, "sha512-fIsTVO97ruLU7GK8mNfQiE0TsjcnOccVz/w+C/lvbo54Hb/0ZZvT4cw3a0TCxM/buREd09enI+h7zfm6cG8OzA=="],
 
@@ -2344,9 +2358,9 @@
 
     "pkg-conf": ["pkg-conf@2.1.0", "", { "dependencies": { "find-up": "^2.0.0", "load-json-file": "^4.0.0" } }, "sha512-C+VUP+8jis7EsQZIhDYmS5qlNtjv2yP4SNtjXK9AP1ZcTRlnSfuumaTnRfYZnYgUUYVIKqL0fRvmUGDV2fmp6g=="],
 
-    "playwright": ["playwright@1.64.1", "", { "dependencies": { "playwright-core": "1.64.1" }, "bin": { "playwright": "cli.js" } }, "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA=="],
+    "playwright": ["playwright@1.65.0", "", { "dependencies": { "playwright-core": "1.65.0" }, "bin": { "playwright": "cli.js" } }, "sha512-F3AMWcR44qMBt4kq+6Kb6mX7bjGXshktKFOPULd7reED6ZJWevjbNRqysP7q+AATE9kdPEZBibex1BYsvpVoeA=="],
 
-    "playwright-core": ["playwright-core@1.64.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ=="],
+    "playwright-core": ["playwright-core@1.65.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-vNSKgH6YqtN7cdT/L334zo0a+YwkrpicyrHJlWWPIm/Q+Nn2SWInil01oT0mbu96U4GgoRtCYQD9CzJQgju+lA=="],
 
     "pluralize": ["pluralize@8.0.0", "", {}, "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="],
 
@@ -2508,7 +2522,7 @@
 
     "semver-regex": ["semver-regex@4.0.5", "", {}, "sha512-hunMQrEy1T6Jr2uEVjrAIqjwWcQTgOAcIM52C8MY1EZSD3DDNft04XzvYKPqjED65bNVVko0YI38nYeEHCX3yw=="],
 
-    "serve": ["serve@14.2.6", "", { "dependencies": { "@zeit/schemas": "2.36.0", "ajv": "8.18.0", "arg": "5.0.2", "boxen": "7.0.0", "chalk": "5.0.1", "chalk-template": "0.4.0", "clipboardy": "3.0.0", "compression": "1.8.1", "is-port-reachable": "4.0.0", "serve-handler": "6.1.7", "update-check": "1.5.4" }, "bin": { "serve": "build/main.js" } }, "sha512-QEjUSA+sD4Rotm1znR8s50YqA3kYpRGPmtd5GlFxbaL9n/FdUNbqMhxClqdditSk0LlZyA/dhud6XNRTOC9x2Q=="],
+    "serve": ["serve@14.2.7", "", { "dependencies": { "@zeit/schemas": "2.36.0", "ajv": "8.18.0", "arg": "5.0.2", "boxen": "7.0.0", "chalk": "5.0.1", "chalk-template": "0.4.0", "compression": "1.8.1", "is-port-reachable": "4.0.0", "serve-handler": "6.1.7", "tinyclip": "^0.1.12", "update-check": "1.5.4" }, "bin": { "serve": "build/main.js" } }, "sha512-mTJ9LAyBwHhO2T/PNaI0oWxmKl7FFuJ+ZEHKL1rRO69fWV1Y4qcsFB3gpuD2HfHvJCwvJq5ChibjjAGe0wc0vw=="],
 
     "serve-handler": ["serve-handler@6.1.7", "", { "dependencies": { "bytes": "3.0.0", "content-disposition": "0.5.2", "mime-types": "2.1.18", "minimatch": "3.1.5", "path-is-inside": "1.0.2", "path-to-regexp": "3.3.0", "range-parser": "1.2.0" } }, "sha512-CinAq1xWb0vR3twAv9evEU8cNWkXCb9kd5ePAHUKJBkOsUpR1wt/CvGdeca7vqumL1U5cSaeVQ6zZMxiJ3yWsg=="],
 
@@ -2530,6 +2544,8 @@
 
     "simple-wcswidth": ["simple-wcswidth@1.1.2", "", {}, "sha512-j7piyCjAeTDSjzTSQ7DokZtMNwNlEAyxqSZeCS+CXH7fJ4jx3FuJ/mTW3mE+6JLs4VJBbcll0Kjn+KXI5t21Iw=="],
 
+    "sirv": ["sirv@2.0.4", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-94Bdh3cC2PKrbgSOUqTiGPWVZeSiXfKOVZNJniWoqrWrRkB1CJzBU3NEbiTsPcYy1lDsANA/THzS+9WBiy5nfQ=="],
+
     "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
     "skin-tone": ["skin-tone@2.0.0", "", { "dependencies": { "unicode-emoji-modifier-base": "^1.0.0" } }, "sha512-kUMbT1oBJCpgrnKoSr0o6wPtvRWT9W9UKvGLwfJYO2WuahZRHOpEyL1ckyMGgMWh0UdpmaoFqKKD29WTomNEGA=="],
@@ -2642,13 +2658,11 @@
 
     "tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
 
-    "tailwind-merge": ["tailwind-merge@3.7.0", "", {}, "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA=="],
+    "tailwind-variants": ["tailwind-variants@4.0.2", "", {}, "sha512-sZvOFkfe5LlYG/crRX5IvP3oUHmJPu+7WmrLQFvF0kCRq51C+lurlzFMm/jURG/5keT7VOJ/it0N3jkzYux85w=="],
 
-    "tailwind-variants": ["tailwind-variants@3.3.1", "", { "peerDependencies": { "tailwind-merge": ">=3.0.0", "tailwindcss": "*" }, "optionalPeers": ["tailwind-merge", "tailwindcss"] }, "sha512-4pAvwUtM4HKBiRZftncAbpn6V9Hhwoa5Fl7O2u5zbp7Z5Cvu+/o/6+176WY3WCEES209543quG8zFIcXCsc5Jw=="],
+    "tailwindcss": ["tailwindcss@4.3.5", "", {}, "sha512-FcQk9BuffmEHJP2G0XmB2SplU1aLTI7j07Kunk+U74Ny+XiWOtzXz9aujFZ/avntw1e2cOv/3PkgzflQ7gX2vQ=="],
 
-    "tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
-
-    "takumi-js": ["takumi-js@2.19.0", "", { "dependencies": { "@takumi-rs/core": "2.19.0", "@takumi-rs/helpers": "2.19.0", "@takumi-rs/wasm": "2.19.0" } }, "sha512-WUgzukIpAtoDUeFkdKvT0o4pterWoyM9qcXpIRUQIqUZHriIBdPdPZV42UyzEbNyXvg/1aUaVhBGEyivraT8NQ=="],
+    "takumi-js": ["takumi-js@2.20.0", "", { "dependencies": { "@takumi-rs/core": "2.20.0", "@takumi-rs/helpers": "2.20.0", "@takumi-rs/wasm": "2.20.0" } }, "sha512-WnqocRxTlQcDeA6Q0Awcz3+diSF3UGA2hmIL3pLsqiGXZHpeeRVpVad97EO33sYiMT6+L2kMya28EVGJbjCyfg=="],
 
     "tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
 
@@ -2674,6 +2688,8 @@
 
     "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
 
+    "tinyclip": ["tinyclip@0.1.15", "", {}, "sha512-uo33abH+Ays0xYaDysoBt494Hb3hsEczMpcC0MwFl773pazORx4fmvKhclhR1wonUbB6vvpRsvVMwnhfqeMc+A=="],
+
     "tinyexec": ["tinyexec@1.3.1", "", {}, "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA=="],
 
     "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
@@ -2694,6 +2710,8 @@
 
     "token-types": ["token-types@6.2.0", "", { "dependencies": { "@borewit/text-codec": "^0.2.3", "@tokenizer/token": "^0.3.0", "ieee754": "^1.2.1" } }, "sha512-s9euYHM//T3loJtbNUYdbAzsMlvKBeRS+XCLFy+UGosMQH19Hwjap5k19i4PPAEJJBsVIpMpVTxl4fIqCuNfUg=="],
 
+    "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="],
+
     "tough-cookie": ["tough-cookie@6.0.2", "", { "dependencies": { "tldts": "^7.0.5" } }, "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA=="],
 
     "tr46": ["tr46@7.0.0", "", { "dependencies": { "punycode": "^2.3.1" } }, "sha512-BcDSDW+SIGWVOns1Zm6Yg91q9AEj7eaID0QDY9oIqJD1A8dscNwMcl9Sms2DeuWCNov1X0/oXanHGYQBSLwZsg=="],
@@ -2816,6 +2834,8 @@
 
     "webidl-conversions": ["webidl-conversions@8.0.1", "", {}, "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ=="],
 
+    "webpack-bundle-analyzer": ["webpack-bundle-analyzer@4.10.1", "", { "dependencies": { "@discoveryjs/json-ext": "0.5.7", "acorn": "^8.0.4", "acorn-walk": "^8.0.0", "commander": "^7.2.0", "debounce": "^1.2.1", "escape-string-regexp": "^4.0.0", "gzip-size": "^6.0.0", "html-escaper": "^2.0.2", "is-plain-object": "^5.0.0", "opener": "^1.5.2", "picocolors": "^1.0.0", "sirv": "^2.0.3", "ws": "^7.3.1" }, "bin": { "webpack-bundle-analyzer": "lib/bin/analyzer.js" } }, "sha512-s3P7pgexgT/HTUSYgxJyn28A+99mmLq4HsJepMPzu0R8ImJc52QNqaFYW1Z2z2uIb1/J3eYgaAWVpaC+v/1aAQ=="],
+
     "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="],
 
     "whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
@@ -2938,8 +2958,6 @@
 
     "@payloadcms/ui/date-fns": ["date-fns@4.1.0", "", {}, "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg=="],
 
-    "@playwright/test/playwright": ["playwright@1.63.0", "", { "dependencies": { "playwright-core": "1.63.0" }, "bin": { "playwright": "cli.js" } }, "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg=="],
-
     "@pnpm/network.ca-file/graceful-fs": ["graceful-fs@4.2.10", "", {}, "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA=="],
 
     "@poppinss/colors/kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
@@ -2968,6 +2986,8 @@
 
     "@tailwindcss/node/magic-string": ["magic-string@1.4.5", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.6.0" } }, "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w=="],
 
+    "@tailwindcss/node/tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
+
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.3", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.3", "tslib": "^2.4.0" }, "bundled": true }, "sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
@@ -2980,6 +3000,8 @@
 
     "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.9.1", "", { "bundled": true }, "sha512-a4Ux9VKuIMHsOS7ENbEq6hK2ZGYIT27Rtl0E4eD9KqwxhKiQeMZE/9xb3IdYwWaSOyIBQLExhQgXDTYoiCxnWA=="],
 
+    "@tailwindcss/postcss/tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
+
     "@testing-library/jest-dom/aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
 
     "@testing-library/jest-dom/dom-accessibility-api": ["dom-accessibility-api@0.6.3", "", {}, "sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w=="],
@@ -3026,8 +3048,6 @@
 
     "cli-table3/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
-    "clipboardy/execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
-
     "cliui/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
 
     "cliui/wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
@@ -3074,8 +3094,6 @@
 
     "import-fresh/resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
 
-    "is-inside-container/is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
-
     "istanbul-lib-report/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
     "jsdom/undici": ["undici@8.12.3", "", {}, "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw=="],
@@ -3476,20 +3494,28 @@
 
     "update-check/registry-auth-token": ["registry-auth-token@3.3.2", "", { "dependencies": { "rc": "^1.1.6", "safe-buffer": "^5.0.1" } }, "sha512-JL39c60XlzCVgNrO+qq68FoNb56w/m7JYvGR2jT5iR1xBrUA3Mfx5Twk5rqTThPmQKMWydGmq8oFtDlxfrmxnQ=="],
 
+    "vite-plugin-storybook-nextjs/@next/env": ["@next/env@16.4.5", "", {}, "sha512-JwSPwpdkZL5VMl2jA/q+JI8MZdweAL3xmw5/tb9y/TLtmS0YXZnmYDzSihwk8xTj1OL+WM53gTqaj96yuLp6Xw=="],
+
     "vite-plugin-storybook-nextjs/vite-tsconfig-paths": ["vite-tsconfig-paths@5.1.4", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" }, "optionalPeers": ["vite"] }, "sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w=="],
 
     "vitest/@vitest/expect": ["@vitest/expect@4.1.12", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.12", "@vitest/utils": "4.1.12", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ=="],
 
     "vitest/@vitest/spy": ["@vitest/spy@4.1.12", "", {}, "sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg=="],
 
+    "webpack-bundle-analyzer/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
+
+    "webpack-bundle-analyzer/debounce": ["debounce@1.2.1", "", {}, "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug=="],
+
+    "webpack-bundle-analyzer/escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
+
+    "webpack-bundle-analyzer/ws": ["ws@7.5.13", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": "^5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA=="],
+
     "widest-line/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
 
     "wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
     "wrap-ansi/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
 
-    "wsl-utils/is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
-
     "xss/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
 
     "@babel/helper-module-imports/@babel/traverse/@babel/parser": ["@babel/parser@7.29.12", "", { "dependencies": { "@babel/types": "^7.29.11" }, "bin": "./bin/babel-parser.js" }, "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg=="],
@@ -3508,8 +3534,6 @@
 
     "@oxc-resolver/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
-    "@playwright/test/playwright/playwright-core": ["playwright-core@1.63.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg=="],
-
     "@react-email/ui/next/@next/env": ["@next/env@16.4.3", "", {}, "sha512-a7tz1QCcWWkwC/rPJcPMJk/UNRu9CFhDd3OHYE5hddbJrs8BqRTalxI6GlKCWEGzRLHN+S/B7a4PAHCtm25aBQ=="],
 
     "@react-email/ui/next/@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4yq5EXBt+VDtAZwTyfijaFp5D2C5oz3Ikw5a2kiX2K9nw72vrZX2q5UuAlkPtUMO1tQz6JTKpaKWjS7OOefTDQ=="],
@@ -3566,18 +3590,6 @@
 
     "cli-table3/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "clipboardy/execa/human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
-
-    "clipboardy/execa/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
-
-    "clipboardy/execa/npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
-
-    "clipboardy/execa/onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
-
-    "clipboardy/execa/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
-    "clipboardy/execa/strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
-
     "cliui/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
     "cliui/wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
@@ -3686,10 +3698,6 @@
 
     "cli-highlight/yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "clipboardy/execa/npm-run-path/path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
-
-    "clipboardy/execa/onetime/mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
-
     "glob/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
     "npm/minipass-flush/minipass/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
diff --git a/global.d.ts b/global.d.ts
index aecea15a..098d144d 100644
--- a/global.d.ts
+++ b/global.d.ts
@@ -1,45 +1,9 @@
+// No top-level import: it would turn this file into a module and the
+// declarations below would stop being global.
 namespace NodeJS {
-  interface ProcessEnv {
-    NODE_ENV: string
+  type SchemaEnv = import('@/types/environment').Env
 
-    SERVER_HOST: string
-    SERVER_URL: string
-    NEXT_PUBLIC_SERVER_URL: string
-
-    PAYLOAD_SECRET: string
-    PREVIEW_SECRET: string
-    CRON_SECRET: string
-
-    DATABASE_URL: string
-    REDIS_URL: string
-
-    S3_BUCKET: string
-    S3_ACCESS_KEY: string
-    S3_SECRET_KEY: string
-    S3_REGION: string
-    S3_ENDPOINT: string
-
-    UMAMI_USERNAME: string
-    UMAMI_PASSWORD: string
-    NEXT_PUBLIC_UMAMI_URL: string
-    NEXT_PUBLIC_UMAMI_SITE_ID: string
-
-    USESEND_URL: string
-    USESEND_API_KEY: string
-    USESEND_DEFAULT_FROM_ADDRESS: string
-    USESEND_DEFAULT_FROM_NAME: string
-
-    OPENAI_API_KEY: string
-    ANTHROPIC_API_KEY: string
-    MAPBOX_API_KEY: string
-
-    NEXT_PUBLIC_STATUS_PAGE_URL: string
-    STATUS_PAGE_HEARTBEAT_URL: string
-
-    CLOUDFLARE_TUNNEL_HOST?: string
-    CLOUDFLARE_TUNNEL_URL?: string
-    CLOUDFLARE_TUNNEL_TOKEN?: string
-  }
+  interface ProcessEnv extends SchemaEnv {}
 
   type ReadableStream = import('typescript').ReadableStream
 }
diff --git a/lefthook.yml b/lefthook.yml
index 660bfde4..ac1ee23d 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -11,13 +11,12 @@ pre-commit:
       glob: '*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}'
       run: bun x oxfmt --no-error-on-unmatched-pattern {staged_files} && bun x oxlint --fix --no-error-on-unmatched-pattern {staged_files}
       stage_fixed: true
-    # Keeps dependency versions within their syncpack groups and the lockfile
-    # in step with package.json. stage_fixed only re-stages files the glob
-    # matched, so the lockfile `bun install` rewrites is added explicitly;
-    # otherwise CI's `bun install --frozen-lockfile` fails on the commit.
     package-json:
-      glob: 'package.json'
-      run: bun x syncpack format --source package.json && bun x syncpack fix --dependency-types prod,dev,peer --source package.json && bun install && git add bun.lock
+      glob: [ 'package.json', 'bun.lock' ]
+      run: |
+        bun x syncpack format --source package.json
+        bun x syncpack fix --dependency-types prod,dev,peer --source package.json
+        bun install
       stage_fixed: true
 
 commit-msg:
diff --git a/llms.txt b/llms.txt
index bf4a0a49..3fbcce87 100644
--- a/llms.txt
+++ b/llms.txt
@@ -8,50 +8,104 @@ This is a code repository, not a documentation site — the files below are the
 AI coding agent should read before making changes, not end-user docs. `AGENTS.md` is the most
 important file: read it first, every time.
 
+This file describes the repository. The website's own public `/llms.txt` is a separate thing,
+generated from published content by `app/llms.txt/route.ts`.
+
 ## Start Here
 
-- [AGENTS.md](AGENTS.md): Required reading before any change — stack, code style, architecture
-  notes, and known security guardrails (public SSE channels remain unauthenticated by design,
-  unsanitized raw SVG rendering, unenforced `CRON_SECRET`).
+- [AGENTS.md](AGENTS.md): Required reading before any change — stack, commands, code style,
+  architecture notes, security guardrails (session checks on server actions, authenticated SSE
+  channels, server-side SVG sanitizing, production detection via `PRODUCTION_HOST`) and known
+  issues.
 - [README.md](README.md): Setup and local development — Doppler-based env config, Docker
-  services, available scripts, project structure, testing, CI/deployment.
+  services, available scripts, environment variables, project structure, testing, CI/deployment.
 
 ## Configuration
 
 - [payload.config.ts](payload.config.ts): Payload CMS configuration (collections, globals,
-  plugins, S3 storage, KV cache) — repo root, not under `src/`.
-- [next.config.ts](next.config.ts): Next.js configuration, including the `env:` block that
-  inlines `SERVER_URL`, `STATUS_PAGE_URL`, and `SENTRY_DSN` at build time.
+  plugins, jobs queue, S3 storage, KV store, dashboard widgets) — repo root, not under `src/`.
+- [next.config.ts](next.config.ts): Next.js configuration; validates the environment against
+  the Zod schema at startup and owns the opt-in dev tunnel. There is no `env:` block: browser
+  values are plain `NEXT_PUBLIC_*` variables.
+- [proxy.ts](proxy.ts): Next.js 16 request proxy (the former `middleware.ts`); canonicalizes blog
+  listing URLs and marks non-default sorts `noindex`.
 - [src/types/environment.ts](src/types/environment.ts): Zod schema and source of truth for all
-  environment variables; validated at process start.
+  environment variables.
+- [.env.test](.env.test): The one committed env file — dummy, format-valid values for E2E runs
+  and CI checks.
 - [docker-compose.yml](docker-compose.yml): Local infrastructure (MongoDB, Redis, S3-compatible
   storage) — the app itself runs via `bun run dev`, not as a compose service.
-- [oxlint.config.ts](oxlint.config.ts), [oxfmt.config.ts](oxfmt.config.ts): Linting/formatting rules (Oxc toolchain, not ESLint/Prettier).
-- [vitest.config.ts](vitest.config.ts) / [vitest.setup.ts](vitest.setup.ts): Unit test config
-  and shared mocks (`payload`, `next/cache`, `redis`).
-- [playwright.config.ts](playwright.config.ts): E2E test config (Chromium).
-- [commitlint.config.mjs](commitlint.config.mjs): Conventional Commits enforcement.
+- [package.json](package.json): Scripts and dependencies; Bun is the package manager, Node.js
+  runs Next, Payload, the scripts and the tests.
+- [oxlint.config.ts](oxlint.config.ts): Lint rules (Oxc toolchain, not ESLint), including the
+  Tailwind plugin and the vendored `anti-slop` plugin.
+- [oxfmt.config.ts](oxfmt.config.ts): Formatting and import order (not Prettier).
+- [syncpack.config.mjs](syncpack.config.mjs): Dependency version rules, including the pinned
+  Playwright version.
+- [lefthook.yml](lefthook.yml): Git hooks — format and lint staged files, sync `package.json`,
+  check the commit message.
+- [commitlint.config.mjs](commitlint.config.mjs): Conventional Commits rules.
+- [vitest.config.ts](vitest.config.ts): Unit test configuration.
+- [vitest.setup.ts](vitest.setup.ts): Shared mocks (`payload`, `next/cache`, `server-only`,
+  `redis`) and the forced `TZ=UTC`.
+- [playwright.config.ts](playwright.config.ts): E2E test configuration (Chromium).
 
 ## Source Layout
 
-- [app/](app): Next.js App Router — `(frontend)` for the public site and its API routes
-  (preview, sse, heartbeat), `(payload)` for the admin panel.
-- [src/collections/](src/collections): Payload Collections (Media, Pages, BlogPosts, Resume*,
-  Users, etc.).
-- [src/globals/](src/globals): Payload Globals (SiteSettings, PDFGeneratorSettings, etc.).
+- [app/](app): Next.js App Router — `(frontend)` for the public site, its route handlers
+  (preview, sse, health, icons/collection, the blog RSS feed, the resume download) and
+  `sitemap.ts`; `(payload)` for the admin panel and Payload's REST API; `llms.txt/` for the
+  site's public `/llms.txt`; `robots.ts`, `manifest.ts` and `global-error.tsx`, which have to
+  stay at the root of `app/`.
+- [src/collections/](src/collections): Payload Collections (Media*, Pages, BlogPosts,
+  BlogTopics, Resume*, Redirects, References, Users).
+- [src/globals/](src/globals): Payload Globals (SiteSettings, SettingsGlobalUser,
+  PDFGeneratorSettings).
 - [src/blocks/](src/blocks): Reusable Payload Blocks (resume sections, content blocks).
-- [src/fields/](src/fields): Custom/reusable Payload field factories.
-- [src/access/](src/access): Access control functions — no role system; any authenticated
-  Payload user is fully trusted.
+- [src/fields/](src/fields): Reusable Payload field factories (`SlugField`, `TitleField`, ...).
 - [src/components/](src/components): React components.
-- [src/lib/](src/lib): Framework-agnostic utilities, including `RedisHandler.ts` (cache +
-  pub/sub for SSE) and `lib/seed/` (shared seed/clean logic for fixture data, used by both
-  CLI scripts and the admin panel).
-- [src/emails/](src/emails): React Email templates and rendering (contact form notifications).
-- [src/pdf/](src/pdf): PDF generation (resume export).
-- [src/jobs-queue/](src/jobs-queue): Payload Jobs Queue tasks/workflows.
-- [src/widgets/](src/widgets): Custom Payload dashboard widgets (async server components registered
-  in `payload.config.ts`; client parts call server actions from `src/lib/actions/`).
-- [src/lib/actions/](src/lib/actions): Server actions (`'use server'`) for admin mutations (job
-  rescheduling, cancellation, etc.).
+- [src/lib/](src/lib): Utilities grouped by domain, including `RedisHandler.ts` (cache and
+  pub/sub for SSE), `isProductionHost.ts` (the only way to tell production apart) and `seed/`
+  (fixture seed/clean logic shared by the CLI scripts and the admin panel).
+- [src/lib/access/](src/lib/access): Access control functions — no role system; any
+  authenticated Payload user is fully trusted.
+- [src/lib/actions/](src/lib/actions): Server actions (`'use server'`) for admin mutations, and
+  `requireSession.ts`, the session check every such action runs first.
+- [src/lib/anthropic/](src/lib/anthropic): Claude calls (alt text, meta descriptions, blog
+  excerpts, resume translation); all go through `generateAnthropicText.ts`, which owns the model
+  IDs, effort, timeout and output limit.
+- [src/lib/sse/](src/lib/sse): Allowlist of Server-Sent Events channels, public and
+  authenticated.
+- [src/jobs-queue/](src/jobs-queue): Payload Jobs Queue task/workflow configs plus their
+  handlers (`handlers/`), which only the standalone worker runs.
+- [src/plugins/](src/plugins): Local Payload plugins (redirects, references).
+- [src/widgets/](src/widgets): Payload dashboard widgets (async server components registered in
+  `payload.config.ts`; client parts call server actions from `src/lib/actions/`).
+- [src/emails/](src/emails): React Email templates (contact form notifications).
+- [src/pdf/](src/pdf): PDF generation for the resume export.
+- [src/migrations/](src/migrations): Payload database migrations.
+- [scripts/](scripts): Dev runner, worker entrypoint, env loader, seeders, image assembly.
 - [e2e/](e2e): Playwright E2E specs — structural smoke tests, not content assertions.
+
+## Build and Deployment
+
+- [.github/workflows/lint-and-test.yml](.github/workflows/lint-and-test.yml): Pull-request gate —
+  lint, Semgrep, unit tests (the E2E job is currently commented out).
+- [.github/workflows/build-and-deploy.yml](.github/workflows/build-and-deploy.yml): Push
+  pipeline for `main` and `develop` — version bump, migrate, build, image boot checks, push,
+  Dokploy redeploy.
+- [Dockerfile](Dockerfile): COPY-only images for the app, the worker and Storybook; everything
+  is built in CI.
+- [release.config.mjs](release.config.mjs): semantic-release — releases from `main`, release
+  candidates from `develop`.
+- [scripts/start-worker.mjs](scripts/start-worker.mjs): Worker container entrypoint; runs the
+  job queue and its health endpoint.
+
+## Optional
+
+- [CHANGELOG.md](CHANGELOG.md): Release history, written by semantic-release.
+- [.storybook/](.storybook): Storybook configuration, component stories, and the
+  design-foundation and shader documentation (MDX).
+- [tools/oxlint/anti-slop/](tools/oxlint/anti-slop): Vendored Oxlint rule plugin.
+- [patches/](patches): Dependency patches applied by Bun (`pdfjs-dist`).
+- [LICENSE](LICENSE): MIT license.
diff --git a/next.config.ts b/next.config.ts
index fd28a039..fb21ca65 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -2,110 +2,23 @@ import { ChildProcess, spawn } from 'node:child_process'
 import process from 'node:process'
 
 import { NextConfig } from 'next'
-import { PHASE_DEVELOPMENT_SERVER } from 'next/constants'
+import { PHASE_DEVELOPMENT_SERVER, type PHASE_TYPE } from 'next/constants'
 import { withPayload } from '@payloadcms/next/withPayload'
 
+import bundleAnalyzer from '@next/bundle-analyzer'
 import z from 'zod'
 
 import { envSchema } from '@/types/environment'
 
 let server: ChildProcess | null = null
 
-const createTunnel = (token: string) =>
-  new Promise<ChildProcess | null>((resolve) => {
-    // No `shell: true`: the token is passed as its own argv entry rather than
-    // concatenated into a command string, which also silences DEP0190.
-    const childProcess = spawn('npx', ['wrangler', 'tunnel', 'run', '--token', token], {
-      stdio: 'ignore',
-    })
-
-    /**
-     *    Reap the tunnel with the dev server. Without this every `next dev`
-     *    leaves a live `wrangler tunnel run` behind, and they accumulate
-     *    silently across restarts.
-     *
-     *    Only `exit` is hooked: scripts/dev.mjs already forwards SIGINT/SIGTERM
-     *    to this process and re-raises them, so adding handlers here would
-     *    replace Node's default signal behaviour and let the wrapper's own
-     *    exit-code handling be pre-empted by a hardcoded `process.exit(0)`.
-     */
-    process.once('exit', () => {
-      if (!childProcess.killed) {
-        childProcess.kill('SIGTERM')
-      }
-    })
-
-    /**
-     *    `spawn` fires for npx itself, so it only proves the launcher started —
-     *    wrangler may still fail afterwards (missing binary, rejected token).
-     *    An early exit is therefore treated as a failed tunnel, and whichever
-     *    of the two settles first wins.
-     */
-    childProcess.once('spawn', () => {
-      resolve(childProcess)
-    })
-    childProcess.once('error', () => {
-      resolve(null)
-    })
-    childProcess.once('exit', (code) => {
-      if (code !== 0) resolve(null)
-    })
-  })
+export default async function buildConfig(phase: PHASE_TYPE): Promise<NextConfig> {
+  /* parse environment variables and normalize values */
+  parseEnvironment()
 
-export default async (phase, { defaultConfig: _defaultConfig }) => {
-  /**
-   *    The tunnel is opt-in via `bun run dev --tunnel`, which scripts/dev.mjs
-   *    translates into DEV_TUNNEL=1. Having the credentials in .env.local is
-   *    no longer enough to start it — otherwise every `next dev` opens a
-   *    public tunnel as a side effect of the file being present.
-   *
-   *    This runs before validation so the addresses it swaps in are the ones
-   *    the schema checks.
-   */
-  const tunnelRequested = phase === PHASE_DEVELOPMENT_SERVER && process.env.DEV_TUNNEL === '1'
-
-  if (tunnelRequested) {
-    const { CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST, CLOUDFLARE_TUNNEL_TOKEN } = process.env
-
-    if (!CLOUDFLARE_TUNNEL_URL || !CLOUDFLARE_TUNNEL_HOST || !CLOUDFLARE_TUNNEL_TOKEN) {
-      console.error(
-        '\n[tunnel] --tunnel needs CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST and CLOUDFLARE_TUNNEL_TOKEN\n',
-      )
-      process.exit(1)
-    }
-
-    process.env.SERVER_HOST = CLOUDFLARE_TUNNEL_HOST
-    process.env.SERVER_URL = CLOUDFLARE_TUNNEL_URL
-  }
-
-  /* Environment validation */
-  const parsedEnv = envSchema.safeParse(process.env)
-
-  if (!parsedEnv.success) {
-    console.error(`\n${z.prettifyError(parsedEnv.error)}\n`)
-    process.exit(1)
-  }
-
-  if (tunnelRequested) {
-    // Next reloads this config on edit; the tunnel outlives those reloads.
-    if (!server) {
-      server = await createTunnel(process.env.CLOUDFLARE_TUNNEL_TOKEN)
-
-      if (!server) {
-        console.error('\n[tunnel] failed to start `wrangler tunnel run` — is wrangler installed?\n')
-        process.exit(1)
-      }
-    }
-
-    /**
-     *    Only this process has the tunnel URL — .env.local is loaded by Next,
-     *    not by scripts/dev.mjs. Hand it to the wrapper, which splices it into
-     *    Next's address block and swallows this marker.
-     *
-     *    stderr, not stdout: Next captures stdout while the config loads, so a
-     *    marker written there never reaches the parent.
-     */
-    process.stderr.write(`__DEV_TUNNEL_URL__${process.env.SERVER_URL}\n`)
+  /* when next is called with DEV_TUNNEL=1, we need to set the server host and url */
+  if (phase === PHASE_DEVELOPMENT_SERVER && process.env.DEV_TUNNEL === '1') {
+    await initializeTunnel()
   }
 
   const nextConfig: NextConfig = {
@@ -272,7 +185,117 @@ export default async (phase, { defaultConfig: _defaultConfig }) => {
     }),
   }
 
-  return withPayload(nextConfig, {
+  const withBundleAnalyzer = bundleAnalyzer({
+    enabled: process.env.ANALYZE === 'true',
+    openAnalyzer: process.env.CI !== 'true',
+  })
+
+  return withPayload(withBundleAnalyzer(nextConfig), {
     devBundleServerPackages: false,
   })
 }
+
+/**
+ * Parses environment variables and normalizes them.
+ */
+function parseEnvironment(): void {
+  const parsedEnv = envSchema.safeParse(process.env)
+
+  /* fail early when necessary env vars are missing */
+  if (!parsedEnv.success) {
+    console.error(`\n${z.prettifyError(parsedEnv.error)}\n`)
+    process.exit(1)
+  }
+
+  /* overwrite process.env with parsedEnv.data to enable normalized values */
+  Object.entries(parsedEnv.data).forEach(([key, value]) => {
+    // Assigning undefined would store the string 'undefined'.
+    if (value === undefined) {
+      delete process.env[key]
+
+      return
+    }
+
+    process.env[key] = value
+  })
+}
+
+/**
+ * Spawns a wrangler tunnel process and returns a promise that resolves to the
+ * spawned process or null if the process fails to start.
+ */
+function createTunnel(token: string) {
+  return new Promise<ChildProcess | null>((resolve) => {
+    // No `shell: true`: the token is passed as its own argv entry rather than
+    // concatenated into a command string, which also silences DEP0190.
+    const childProcess = spawn('npx', ['wrangler', 'tunnel', 'run', '--token', token], {
+      stdio: 'ignore',
+    })
+
+    /**
+     *    Reap the tunnel with the dev server. Without this every `next dev`
+     *    leaves a live `wrangler tunnel run` behind, and they accumulate
+     *    silently across restarts.
+     *
+     *    Only `exit` is hooked: scripts/dev.mjs already forwards SIGINT/SIGTERM
+     *    to this process and re-raises them, so adding handlers here would
+     *    replace Node's default signal behaviour and let the wrapper's own
+     *    exit-code handling be pre-empted by a hardcoded `process.exit(0)`.
+     */
+    process.once('exit', () => {
+      if (!childProcess.killed) {
+        childProcess.kill('SIGTERM')
+      }
+    })
+
+    /**
+     *    `spawn` fires for npx itself, so it only proves the launcher started —
+     *    wrangler may still fail afterwards (missing binary, rejected token).
+     *    An early exit is therefore treated as a failed tunnel, and whichever
+     *    of the two settles first wins.
+     */
+    childProcess.once('spawn', () => {
+      resolve(childProcess)
+    })
+    childProcess.once('error', () => {
+      resolve(null)
+    })
+    childProcess.once('exit', (code) => {
+      if (code !== 0) resolve(null)
+    })
+  })
+}
+
+async function initializeTunnel() {
+  const tunnelVarsAvailable =
+    !!process.env.CLOUDFLARE_TUNNEL_URL &&
+    !!process.env.CLOUDFLARE_TUNNEL_HOST &&
+    !!process.env.CLOUDFLARE_TUNNEL_TOKEN
+
+  if (!tunnelVarsAvailable) {
+    console.error(
+      '\n[tunnel] --tunnel needs CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST and CLOUDFLARE_TUNNEL_TOKEN\n',
+    )
+    process.exit(1)
+  }
+
+  if (tunnelVarsAvailable) {
+    process.env.SERVER_HOST = process.env.CLOUDFLARE_TUNNEL_HOST
+    process.env.SERVER_URL = process.env.CLOUDFLARE_TUNNEL_URL
+
+    if (!server && !!process.env.CLOUDFLARE_TUNNEL_TOKEN) {
+      server = await createTunnel(process.env.CLOUDFLARE_TUNNEL_TOKEN)
+
+      if (!server) {
+        console.error('\n[tunnel] failed to start `wrangler tunnel run` — is wrangler installed?\n')
+        process.exit(1)
+      }
+
+      /**
+       *    stderr, not stdout: Next captures stdout while the config loads, so a
+       *    marker written there never reaches the parent.
+       */
+      process.stderr.write(`__DEV_TUNNEL_URL__${process.env.SERVER_URL}\n`)
+    }
+  }
+}
diff --git a/oxfmt.config.ts b/oxfmt.config.ts
index 7f31e632..bb42b763 100644
--- a/oxfmt.config.ts
+++ b/oxfmt.config.ts
@@ -84,7 +84,7 @@ export default defineConfig({
     // Generated by `bun run generate`.
     'src/types/payload.ts',
     'app/(payload)/admin/importMap.js',
-    // Biome never formatted these; keeping them out avoids an unrelated rewrite.
+    // Never formatted so far; keeping them out avoids an unrelated rewrite.
     '**/*.md',
     '**/*.mdx',
     '**/*.yml',
diff --git a/oxlint.config.ts b/oxlint.config.ts
index 049e1f00..d10cefe9 100644
--- a/oxlint.config.ts
+++ b/oxlint.config.ts
@@ -12,6 +12,10 @@ import tailwindcss from 'oxlint-tailwindcss/config'
  * types domains, with the same rules switched off or down to warnings.
  */
 export default defineConfig({
+  // Off until the strict-mode typing refactor: it adds 66 errors today.
+  options: {
+    typeAware: false,
+  },
   extends: [tailwindcss()],
   settings: {
     tailwindcss: {
@@ -25,9 +29,9 @@ export default defineConfig({
     'oxc',
     'react',
     'react-perf',
-    'jsx-a11y',
     'nextjs',
     'import',
+    'jsx-a11y',
   ],
   categories: {
     correctness: 'error',
@@ -82,7 +86,7 @@ export default defineConfig({
     'anti-slop/no-module-mocking': 'warn',
     'anti-slop/no-object-parameters': 'warn',
     'anti-slop/no-reflect-get': 'warn',
-    'anti-slop/no-runtime-typeof': 'warn',
+    'anti-slop/no-runtime-typeof': ['warn', { allowInTypeGuards: true }],
     'anti-slop/no-shape-in-symbol-names': 'warn',
     'anti-slop/no-unknown-parameters': 'warn',
     'anti-slop/no-unknown-returns': 'warn',
@@ -100,6 +104,7 @@ export default defineConfig({
     'typescript/no-explicit-any': 'warn',
     'typescript/no-unsafe-assignment': 'warn',
     'typescript/no-useless-default-assignment': 'warn',
+    'typescript/no-redundant-type-constituents': 'warn',
 
     'react/rules-of-hooks': 'error',
     'react/exhaustive-deps': 'warn',
diff --git a/package.json b/package.json
index a1f6bcfd..0264e706 100644
--- a/package.json
+++ b/package.json
@@ -16,31 +16,32 @@
     "#frontend.css": "./src/styles/frontend.css"
   },
   "scripts": {
+    "_email": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" email",
+    "_next": "NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" next",
+    "_payload": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" payload --disable-transpile",
+    "_storybook": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" storybook",
+    "analyze": "ANALYZE=true bun run build",
     "build": "bun run _next build --webpack",
     "build:storybook": "bun run _storybook build --output-dir dist",
     "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
-    "chore:format": "syncpack format",
     "ci": "bun run migrate && bun run build",
-    "deps:fix": "syncpack fix --dependency-types prod,dev,peer",
-    "deps:lint": "syncpack lint --dependency-types prod,dev,peer",
-    "deps:update": "syncpack update",
     "dev": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" node scripts/dev.mjs",
     "dev:app": "bun run _next dev",
-    "dev:storybook": "bun run _storybook dev -p 6006",
     "dev:email": "bun run _email dev --dir src/emails --port 3005",
-    "format": "oxfmt",
+    "dev:storybook": "bun run _storybook dev -p 6006",
     "generate": "bun run generate:next-types && bun run generate:payload-types && bun run generate:importmap",
     "generate:importmap": "bun run _payload generate:importmap",
-    "generate:payload-types": "bun run _payload generate:types",
     "generate:next-types": "bun run _next typegen",
+    "generate:payload-types": "bun run _payload generate:types",
     "links:migrate": "bun run _payload run scripts/migrate-link-field-naming.ts",
     "lint": "oxlint && oxfmt --check",
+    "lint:fix": "oxlint --fix && oxfmt",
     "load-env": "node scripts/load-env.mjs",
     "migrate": "bun run _payload migrate",
-    "_next": "NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" next",
-    "_payload": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" payload --disable-transpile",
-    "_email": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" email",
-    "_storybook": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" storybook",
+    "packages:fix": "syncpack fix --dependency-types prod,dev,peer",
+    "packages:format": "syncpack format",
+    "packages:lint": "syncpack lint --dependency-types prod,dev,peer",
+    "packages:update": "syncpack update",
     "prepare": "lefthook install",
     "refs:backfill": "bun run _payload run scripts/backfill-references.ts",
     "release": "semantic-release",
@@ -53,8 +54,8 @@
     "seed:resume-documents:clean": "bun run _payload run scripts/seed-resume-documents.ts -- --clean",
     "seed:topics": "bun run _payload run scripts/seed-topics.ts",
     "seed:topics:clean": "bun run _payload run scripts/seed-topics.ts -- --clean",
-    "start:storybook": "npx serve dist -l 3020",
     "start:app": "bun run _next start",
+    "start:storybook": "npx serve dist -l 3020",
     "start:worker": "node scripts/start-worker.mjs",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
@@ -62,8 +63,7 @@
     "test:e2e:docker": "./scripts/e2e-docker.sh",
     "test:e2e:ui": "node --env-file=.env.test node_modules/@playwright/test/cli.js test --ui",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "lint:fix": "oxlint --fix && oxfmt"
+    "typecheck": "tsc --noEmit"
   },
   "overrides": {
     "pdfjs-dist": "5.4.296"
@@ -107,15 +107,15 @@
     "mediabunny": "^1.65.2",
     "nanoid": "^6.0.1",
     "neotraverse": "^1.0.1",
-    "next": "^16.3.6",
+    "next": "^16.4.6",
     "next-themes": "^0.4.6",
     "ogl": "^1.0.11",
     "payload": "^3.93.0",
     "pdf-parse": "^2.4.5",
     "pretty-ms": "^9.3.1",
     "pupa": "^3.3.0",
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "react-email": "^6.11.0",
     "recharts": "^3.10.1",
     "redis": "^6.3.1",
@@ -123,10 +123,9 @@
     "sharp": "^0.35.4",
     "shiki": "^4.4.3",
     "svgo": "^4.1.0",
-    "tailwind-merge": "^3.7.0",
-    "tailwind-variants": "^3.3.1",
-    "tailwindcss": "^4.3.3",
-    "takumi-js": "^2.14.0",
+    "tailwind-variants": "^4.0.2",
+    "tailwindcss": "^4.3.5",
+    "takumi-js": "^2.20.0",
     "timestring": "^7.0.0",
     "tw-easing-gradients": "^1.2.0",
     "type-fest": "^5.10.0",
@@ -136,8 +135,9 @@
   "devDependencies": {
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
-    "@oxlint/plugins": "^1.86.0",
-    "@playwright/test": "~1.63.0",
+    "@next/bundle-analyzer": "^16.4.6",
+    "@oxlint/plugins": "^1.93.0",
+    "@playwright/test": "~1.65.0",
     "@react-email/ui": "^6.11.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/commit-analyzer": "^13.0.1",
@@ -166,15 +166,15 @@
     "autoprefixer": "^10.6.1",
     "cssnano": "^9.0.5",
     "lefthook": "^2.1.14",
-    "oxfmt": "^0.76.0",
-    "oxlint": "^1.86.0",
+    "oxfmt": "^0.78.0",
+    "oxlint": "^1.93.0",
     "oxlint-tailwindcss": "^1.16.0",
     "oxlint-tsgolint": "^7.0.2006",
-    "playwright": "~1.64.1",
+    "playwright": "~1.65.0",
     "postcss": "^8.5.28",
     "react-docgen-typescript": "^2.4.0",
     "semantic-release": "^25.0.9",
-    "serve": "^14.2.6",
+    "serve": "^14.2.7",
     "storybook": "^10.6.0",
     "styled-jsx": "^5.1.7",
     "syncpack": "^15.3.3",
diff --git a/payload.config.ts b/payload.config.ts
index 2fd4f4bd..7dd1af35 100644
--- a/payload.config.ts
+++ b/payload.config.ts
@@ -13,6 +13,7 @@ import sharp from 'sharp'
 
 import { BLOCKS } from '@/blocks'
 import { COLLECTIONS } from '@/collections'
+import { GENERATOR_FLAGS } from '@/fields/GeneratorFlags'
 import { GLOBALS } from '@/globals'
 import { scopeJobsList } from '@/jobs-queue/lib/jobsListFilter'
 import { TASKS } from '@/jobs-queue/tasks'
@@ -306,6 +307,19 @@ export const config = buildConfig({
         ...jsonSchema,
         definitions: {
           ...jsonSchema.definitions,
+          GeneratorFlag: {
+            title: 'GeneratorFlag',
+            type: 'string',
+            enum: [...GENERATOR_FLAGS],
+          },
+          GeneratorFlags: {
+            title: 'GeneratorFlags',
+            type: 'array',
+            items: {
+              $ref: '#/definitions/GeneratorFlag',
+            },
+            additionalItems: false,
+          },
           SkillType: {
             title: 'SkillType',
             type: 'string',
diff --git a/scripts/e2e-docker.sh b/scripts/e2e-docker.sh
index d7d37481..8a8f67da 100755
--- a/scripts/e2e-docker.sh
+++ b/scripts/e2e-docker.sh
@@ -8,10 +8,12 @@ set -euo pipefail
 #      docker compose up -d      (Mongo/Redis/S3)
 #      bun run dev:app          (Next.js on the host, port 3000)
 #
-#    The image tag MUST match the @playwright/test version in package.json —
-#    bump them together, otherwise browser revisions mismatch.
+#    The image tag must match the installed @playwright/test, otherwise the
+#    browser revisions mismatch, so it is read from the package rather than
+#    written here.
 
-IMAGE="mcr.microsoft.com/playwright:v1.62.1-noble"
+PLAYWRIGHT_VERSION="$(node -p "require('./node_modules/@playwright/test/package.json').version")"
+IMAGE="mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"
 
 #    Host networking lets the container reach the dev server as
 #    http://localhost:3000 — required because the Payload admin UI talks to
diff --git a/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx b/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
index e39fbf03..1907c6b7 100644
--- a/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { resolveRelations } from '@/lib/resolveRelation'
 import { ResumeAboutMeBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx b/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
index 6867c59c..5a2c051a 100644
--- a/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { ResumeContactBlock } from '@/types/payload'
 
 import { ResumeContactBlockClientRenderer } from './Renderer.client'
diff --git a/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx b/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
index b8c9b3cb..5cf5c0eb 100644
--- a/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeCustomersCached } from '@/lib/fetchers/fetchResumeCustomers'
 import type { ResumeCustomersBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
index e3be2003..2fd3863b 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
@@ -49,7 +49,7 @@ export const ResumeDownloadsBlockClientRenderer = ({
             data-reveal-item
             className="text-background-foreground flex flex-col justify-center gap-8 md:flex-row"
           >
-            {document_en && (
+            {document_en?.url && (
               <ResumeDownloadButton
                 locale="en"
                 url={document_en.url}
@@ -58,7 +58,7 @@ export const ResumeDownloadsBlockClientRenderer = ({
                 subline="English Version"
               />
             )}
-            {document_de && (
+            {document_de?.url && (
               <ResumeDownloadButton
                 locale="de"
                 url={document_de.url}
diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
index 946373f3..5d2625a3 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchLatestResumeDocument } from '@/lib/fetchers/fetchLatestResumeDocument'
 import { ResumeDownloadsBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
index 2c04c1e2..bc5b7431 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
@@ -1,7 +1,5 @@
 'use client'
 
-import Link from 'next/link'
-
 import { cn } from 'tailwind-variants'
 
 import { Button } from '@/components/Button'
@@ -34,9 +32,11 @@ export const ResumeDownloadButton = ({
       )}
       asChild
     >
-      <Link
+      {/* A file download, not a route: next/link would prefetch it and throws without an href. */}
+      <a
         href={url}
         download={fileName}
+        aria-label={`${label}: ${subline}`}
         onClick={() =>
           track(`resume-download-${locale}`, {
             slug,
@@ -75,7 +75,7 @@ export const ResumeDownloadButton = ({
             <span className="text-xs leading-none opacity-80">{subline}</span>
           </div>
         </div>
-      </Link>
+      </a>
     </Button>
   )
 }
diff --git a/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx b/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
index e8e0a3bc..fbdc4634 100644
--- a/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { Suspense } from 'react'
 
 import { fetchResumeJobsCached } from '@/lib/fetchers/fetchResumeJobs'
diff --git a/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx b/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
index b0f77b06..3188fce8 100644
--- a/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeProjectsCached } from '@/lib/fetchers/fetchResumeProjects'
 import { reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { resolveRelations } from '@/lib/resolveRelation'
diff --git a/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx b/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
index 47ea6f40..2de81cc8 100644
--- a/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import Link from 'next/link'
 
 import { Headline } from '@/components/Headline'
diff --git a/src/collections/BlogTopics/index.ts b/src/collections/BlogTopics/index.ts
index af555188..d0ce2605 100644
--- a/src/collections/BlogTopics/index.ts
+++ b/src/collections/BlogTopics/index.ts
@@ -17,6 +17,7 @@ import { generatePreviewPath } from '@/lib/generatePreviewPath'
 import { AdminGroup } from '@/types/admin-panel'
 import { RESERVED_TOPIC_SLUGS } from '@/types/blog'
 import { CollectionData, CollectionSlug } from '@/types/collections'
+import { Topic } from '@/types/payload'
 
 import { revalidateBlogTopic } from './hooks/revalidateBlogTopic'
 
@@ -76,27 +77,35 @@ export const BlogTopics: CollectionConfig<CollectionSlug['BlogTopics']> = {
     delete: async ({
       req: { user, payload },
       id,
-    }: AccessArgs<CollectionData<CollectionSlug['BlogTopics']>>) => {
+      collectionConfig: { slug },
+    }: AccessArgs<Topic>) => {
       if (!user) return false
-      let references = 0
 
       try {
-        const { totalDocs } = await payload.find({
-          collection: CollectionSlug.BlogPosts,
+        const { totalDocs } = await payload.count({
+          collection: CollectionSlug.DocumentReferences,
           where: {
-            topics: {
-              contains: id,
-            },
+            and: [
+              {
+                targetCollection: {
+                  equals: slug,
+                },
+              },
+              {
+                targetId: {
+                  equals: id,
+                },
+              },
+            ],
           },
-          pagination: false,
         })
 
-        references += totalDocs
-      } catch (_) {
-        /* no references found */
-      }
+        return totalDocs === 0
+      } catch (error) {
+        payload.logger.error(error)
 
-      return references === 0
+        return false
+      }
     },
     read: authenticatedOrPublished,
     update: authenticated,
diff --git a/src/collections/MediaImages/components/AltField.tsx b/src/collections/MediaImages/components/AltField.tsx
index ccd6d3d1..daa8d589 100644
--- a/src/collections/MediaImages/components/AltField.tsx
+++ b/src/collections/MediaImages/components/AltField.tsx
@@ -1,22 +1,24 @@
 import type { TextFieldServerComponent } from 'payload'
 
 import { TextFieldWithLockAndGenerate } from '@/components/AdminPanel/TextFieldWithLockAndGenerate'
+import { requireSession } from '@/lib/actions/requireSession'
 import { fetchAnthropicImageAltText } from '@/lib/anthropic/fetchImageAltText'
+import { resolveOwnMediaUrl } from '@/lib/resolveOwnMediaUrl'
 
 export const AltField: TextFieldServerComponent = ({ data: { url }, path, clientField }) => {
   const generateFunction = async () => {
     'use server'
 
     try {
-      const imageUrl = new URL(url, process.env.SERVER_URL)
+      await requireSession()
 
-      const imageData = await fetch(imageUrl)
+      const imageData = await fetch(resolveOwnMediaUrl(url))
         .then((res) => res.arrayBuffer())
         .then((arrayBuffer) => Buffer.from(arrayBuffer))
 
       return await fetchAnthropicImageAltText(imageData)
     } catch (error) {
-      console.error('Error fetching image:', error)
+      console.error('Error generating alt text:', error)
 
       return ''
     }
diff --git a/src/collections/MediaImages/hooks/generateAlt.ts b/src/collections/MediaImages/hooks/generateAlt.ts
index a59b2fd6..5d749390 100644
--- a/src/collections/MediaImages/hooks/generateAlt.ts
+++ b/src/collections/MediaImages/hooks/generateAlt.ts
@@ -7,16 +7,31 @@ import { fetchAnthropicImageAltText } from '@/lib/anthropic/fetchImageAltText'
  * This function is used as a beforeChange hook for the MediaImage collection.
  * It generates alternative text for images based on their content.
  */
-export const generateAlt: CollectionBeforeChangeHook = async ({ data, req: { file }, context }) => {
+export const generateAlt: CollectionBeforeChangeHook = async ({
+  data,
+  req: { file, payload },
+  context,
+}) => {
   if (context.skipGenerateAlt) return data
 
   /* req.file is only set when uploading a file */
   if (!file || !file?.mimetype?.includes('image')) return data
 
-  const alt = await fetchAnthropicImageAltText(file.data)
+  try {
+    const alt = await fetchAnthropicImageAltText(file.data)
 
-  return {
-    ...data,
-    alt,
+    return {
+      ...data,
+      alt,
+    }
+  } catch (error) {
+    // The upload must not depend on Claude being reachable; the alt text can
+    // still be generated from the field's button afterwards.
+    payload.logger.error({
+      err: error,
+      msg: 'Could not generate alt text for the uploaded image',
+    })
+
+    return data
   }
 }
diff --git a/src/collections/References/index.ts b/src/collections/References/index.ts
index 3c96f782..31383caa 100644
--- a/src/collections/References/index.ts
+++ b/src/collections/References/index.ts
@@ -25,7 +25,7 @@ import { CollectionSlug } from '@/types/collections'
  * Being `hidden` it has no nav entry; reach it directly at
  * `/admin/collections/document-references`.
  */
-export const References: CollectionConfig = {
+export const References: CollectionConfig<CollectionSlug['DocumentReferences']> = {
   slug: CollectionSlug.DocumentReferences,
   access: {
     create: forbidden,
diff --git a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts b/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts
deleted file mode 100644
index 1804ab5d..00000000
--- a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { normalizeIncomingFlags } from './normalizeIncomingFlags'
-
-const run = (value?: unknown) =>
-  normalizeIncomingFlags({
-    value,
-  } as never) as Promise<string[]>
-
-describe('normalizeIncomingFlags', () => {
-  it('keeps plain flags as given', async () => {
-    expect(await run(['resume-asset', 'thumbnail'])).toEqual(['resume-asset', 'thumbnail'])
-  })
-
-  it('strips legacy +/- operator prefixes', async () => {
-    expect(await run(['+resume-asset', '-thumbnail'])).toEqual(['resume-asset', 'thumbnail'])
-  })
-
-  it('collapses a prefixed and plain spelling of the same flag', async () => {
-    expect(await run(['+thumbnail', 'thumbnail'])).toEqual(['thumbnail'])
-  })
-
-  it('deduplicates', async () => {
-    expect(await run(['a', 'a', 'b'])).toEqual(['a', 'b'])
-  })
-
-  it('drops empty entries', async () => {
-    expect(await run(['', '+', '  ', 'a'])).toEqual(['a'])
-  })
-
-  it('returns an empty array for a missing or non-array value', async () => {
-    expect(await run(undefined)).toEqual([])
-    expect(await run('nope')).toEqual([])
-  })
-})
diff --git a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts b/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts
deleted file mode 100644
index c6c081cc..00000000
--- a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { FieldHook } from 'payload'
-
-import { isArray, isString } from 'lodash-es'
-
-/**
- * Normalizes the flag list to unique, plain flag names.
- *
- * Leading `+`/`-` are stripped rather than rejected: the field previously used
- * them as add/remove operators, so documents and callers written against that
- * shape still supply them. Stripping keeps those writes working and converging
- * on the stored form instead of creating a second spelling of every flag.
- */
-export const normalizeIncomingFlags: FieldHook = async ({
-  value,
-}: {
-  value?: string[]
-}): Promise<string[]> => {
-  if (!isArray(value)) return []
-
-  return value
-    .filter(isString)
-    .map((flag) => flag.replace(/^[+-]/, '').trim())
-    .filter((flag) => flag !== '')
-    .filter((flag, index, array) => array.indexOf(flag) === index)
-}
diff --git a/src/fields/GeneratorFlags/index.ts b/src/fields/GeneratorFlags/index.ts
index 74a094b4..93beec52 100644
--- a/src/fields/GeneratorFlags/index.ts
+++ b/src/fields/GeneratorFlags/index.ts
@@ -1,7 +1,5 @@
 import { TextField } from 'payload'
 
-import { normalizeIncomingFlags } from './hooks/normalizeIncomingFlags'
-
 /**
  * Markers describing how an asset came to exist — set by the jobs queue when it
  * generates thumbnails and resume documents, and used to filter those out of
@@ -27,6 +25,7 @@ import { normalizeIncomingFlags } from './hooks/normalizeIncomingFlags'
  * back as `thumbnail` cannot be described accurately. Callers that genuinely
  * need to merge can spread the existing array.
  */
+
 export const GENERATOR_FLAGS = [
   'resume-asset',
   'thumbnail',
@@ -54,20 +53,18 @@ export const GeneratorFlagsField = (): TextField => ({
   admin: {
     hidden: true,
   },
-
+  hooks: {
+    afterRead: [({ value }) => value ?? []],
+  },
+  defaultValue: [],
   typescriptSchema: [
     () => ({
       type: 'array',
       items: {
-        type: 'string',
-        enum: [...GENERATOR_FLAGS],
+        $ref: '#/definitions/GeneratorFlag',
       },
       additionalItems: false,
-      required: false,
       default: [],
     }),
   ],
-  hooks: {
-    beforeChange: [normalizeIncomingFlags],
-  },
 })
diff --git a/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx b/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
index 4ea496d4..79c16369 100644
--- a/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
+++ b/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
@@ -1,32 +1,34 @@
-import type { TextFieldServerComponent, TextFieldServerProps } from 'payload'
-
-import { get } from 'lodash-es'
+import type { TextFieldServerComponent } from 'payload'
 
+import { requireSession } from '@/lib/actions/requireSession'
 import { fetchAnthropicMetaDescription } from '@/lib/anthropic/fetchMetaDescription'
-import { generateContentURL } from '@/lib/generateContentURL'
 
 import { FieldComponentClient } from './FieldComponent.client'
 
-type DescriptionFieldProps = {
-  slugPath: string
-} & TextFieldServerProps
-
 export const FieldComponent: TextFieldServerComponent = async ({
   collectionSlug,
   data,
   path,
   clientField,
-  slugPath,
-}: DescriptionFieldProps) => {
+}) => {
   const generateFunction = async () => {
     'use server'
 
-    const pageUrl = generateContentURL({
-      collection: collectionSlug,
-      slug: get(data, slugPath),
-    })
-
-    return await fetchAnthropicMetaDescription(pageUrl)
+    try {
+      await requireSession()
+
+      // An empty result leaves the field as it is.
+      return (
+        (await fetchAnthropicMetaDescription({
+          collection: collectionSlug,
+          data,
+        })) ?? ''
+      )
+    } catch (error) {
+      console.error('Error generating meta description:', error)
+
+      return ''
+    }
   }
 
   return (
diff --git a/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts b/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts
deleted file mode 100644
index 884c9f80..00000000
--- a/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { FieldHook } from 'payload'
-
-import { fetchAnthropicMetaDescription } from '@/lib/anthropic/fetchMetaDescription'
-import { generateContentURL } from '@/lib/generateContentURL'
-
-export const generateMetaDescriptionHook =
-  (slugPath: string): FieldHook =>
-  async ({ data, operation, value, collection }) => {
-    if (operation === 'create' || typeof value !== 'string' || value === '') {
-      const slugValue = data?.[slugPath]
-
-      if (typeof slugValue === 'string' && slugValue.length > 0) {
-        const url = generateContentURL({
-          collection: collection.slug,
-          slug: slugValue,
-        })
-
-        return await fetchAnthropicMetaDescription(url)
-      }
-    }
-
-    return value
-  }
diff --git a/src/fields/Meta/MetaDescriptionField/index.ts b/src/fields/Meta/MetaDescriptionField/index.ts
index 11befc21..d101d242 100644
--- a/src/fields/Meta/MetaDescriptionField/index.ts
+++ b/src/fields/Meta/MetaDescriptionField/index.ts
@@ -1,10 +1,6 @@
 import type { TextField } from 'payload'
 
-interface MetaDescriptionFieldProps {
-  slugPath: string
-}
-
-export const MetaDescriptionField = ({ slugPath }: MetaDescriptionFieldProps): TextField => ({
+export const MetaDescriptionField = (): TextField => ({
   name: 'description',
   label: 'Description',
   type: 'text',
@@ -15,12 +11,7 @@ export const MetaDescriptionField = ({ slugPath }: MetaDescriptionFieldProps): T
     disableListFilter: true,
     disableGroupBy: true,
     components: {
-      Field: {
-        path: '@/fields/Meta/MetaDescriptionField/FieldComponent',
-        serverProps: {
-          slugPath,
-        },
-      },
+      Field: '@/fields/Meta/MetaDescriptionField/FieldComponent',
     },
   },
 })
diff --git a/src/fields/Meta/index.ts b/src/fields/Meta/index.ts
index 0fe12676..88a3697b 100644
--- a/src/fields/Meta/index.ts
+++ b/src/fields/Meta/index.ts
@@ -70,9 +70,7 @@ export const MetaField = ({
         }),
       ]),
       MetaSerpProgressGroupField([
-        MetaDescriptionField({
-          slugPath,
-        }),
+        MetaDescriptionField(),
         MetaSerpProgressField({
           watchPath: 'meta.description',
           serpConfig: DESCRIPTION_SERP_CONFIG,
diff --git a/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts b/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
index a55c4de1..97e4f807 100644
--- a/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
+++ b/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { FieldHook } from 'payload'
 import { convertLexicalToPlaintext } from '@payloadcms/richtext-lexical/plaintext'
 
diff --git a/src/globals/PDFGeneratorSettings/index.ts b/src/globals/PDFGeneratorSettings/index.ts
index df7f03dc..89888b97 100644
--- a/src/globals/PDFGeneratorSettings/index.ts
+++ b/src/globals/PDFGeneratorSettings/index.ts
@@ -158,6 +158,7 @@ export const PDFGeneratorSettings: GlobalConfig<GlobalSlug['PDFGeneratorSettings
 
           label: false,
           type: 'json',
+          required: true,
 
           typescriptSchema: [
             () => ({
diff --git a/src/globals/SiteSettings/index.ts b/src/globals/SiteSettings/index.ts
index f0765ff5..93b46386 100644
--- a/src/globals/SiteSettings/index.ts
+++ b/src/globals/SiteSettings/index.ts
@@ -24,7 +24,7 @@ const NavEntries = (): ArrayField => ({
     },
   },
   hooks: {
-    afterRead: [async ({ value = [] }) => value],
+    afterRead: [({ value = [] }) => value],
   },
   interfaceName: 'NavEntries',
   fields: [...LinkField().fields],
diff --git a/src/jobs-queue/handlers/createResumeDocument.ts b/src/jobs-queue/handlers/createResumeDocument.ts
index 711441f4..6b99069f 100644
--- a/src/jobs-queue/handlers/createResumeDocument.ts
+++ b/src/jobs-queue/handlers/createResumeDocument.ts
@@ -28,6 +28,7 @@ const run: TaskHandler<TaskSlug['CreateResumeDocument']> = async ({ input, req:
     data: {
       title: documentTitle,
       slug: documentSlug,
+      generatorFlags: [],
       createdAt,
       jobId,
       document_en: {
diff --git a/src/lib/RedisHandler.ts b/src/lib/RedisHandler.ts
index aabac8d9..1bd15203 100644
--- a/src/lib/RedisHandler.ts
+++ b/src/lib/RedisHandler.ts
@@ -2,6 +2,8 @@ import { EventEmitter } from 'node:events'
 
 import { createClient } from 'redis'
 
+import { isCachedRedisValue } from '@/lib/typeGuards'
+
 export type RedisListener = (message: string) => void
 
 const createRedisClient = () =>
@@ -59,7 +61,7 @@ export const get = async <T extends object | string>(key: string): Promise<T | n
   const redis = await getClient()
   const data = await redis.get(key)
 
-  if (!data || typeof data !== 'string') return null
+  if (!isCachedRedisValue(data)) return null
 
   try {
     return JSON.parse(data) as T
@@ -82,9 +84,7 @@ export const set = async <T extends object | string>(
   const stringifiedValue = JSON.stringify(value)
 
   if (ttlSeconds) {
-    await redis.set(key, stringifiedValue, {
-      EX: ttlSeconds,
-    })
+    await redis.set(key, stringifiedValue, { expiration: { type: 'EX', value: ttlSeconds } })
   } else {
     await redis.set(key, stringifiedValue)
   }
diff --git a/src/lib/actions/enqueueBilingualTranslation.ts b/src/lib/actions/enqueueBilingualTranslation.ts
index a297986a..b91fd11a 100644
--- a/src/lib/actions/enqueueBilingualTranslation.ts
+++ b/src/lib/actions/enqueueBilingualTranslation.ts
@@ -35,7 +35,7 @@ export const enqueueBilingualTranslation = async (
   // `TranslateControls` only renders inside the Payload admin panel, but a
   // Server Action is its own reachable endpoint regardless of which page
   // renders the button that calls it — without this, anyone who discovers
-  // the action's reference could trigger paid OpenAI/Anthropic translation
+  // the action's reference could trigger paid Anthropic translation
   // calls with no session at all.
   const { user } = await payload.auth({
     headers: await headers(),
diff --git a/src/lib/actions/requireSession.ts b/src/lib/actions/requireSession.ts
new file mode 100644
index 00000000..39ac289f
--- /dev/null
+++ b/src/lib/actions/requireSession.ts
@@ -0,0 +1,24 @@
+import { headers } from 'next/headers'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+/**
+ * Rejects a Server Action call that carries no signed-in Payload session.
+ *
+ * A Server Action is its own reachable endpoint, whichever page renders the
+ * control that calls it, so every action that costs money or changes data
+ * checks the session itself instead of relying on the admin panel's routing.
+ */
+export const requireSession = async (): Promise<void> => {
+  const payload = await getPayload({
+    config,
+  })
+
+  const { user } = await payload.auth({
+    headers: await headers(),
+  })
+
+  if (!user) {
+    throw new Error('You must be signed in to do this.')
+  }
+}
diff --git a/src/lib/anthropic/fetchExcerpt.test.ts b/src/lib/anthropic/fetchExcerpt.test.ts
index 4cc34f86..0a1a475e 100644
--- a/src/lib/anthropic/fetchExcerpt.test.ts
+++ b/src/lib/anthropic/fetchExcerpt.test.ts
@@ -57,6 +57,7 @@ describe('fetchAnthropicExcerpt', () => {
   it('sends the source HTML to the model and parses the excerpt result back into Lexical', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>A short summary of the post.</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(
@@ -92,6 +93,7 @@ describe('fetchAnthropicExcerpt', () => {
   it("strips a leading '```html' + trailing '```' fence from the model output before parsing", async () => {
     generateTextMock.mockResolvedValue({
       text: '```html\n<p>A short summary.</p>\n```',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(paragraphDocument('Some content here.') as never)
@@ -111,6 +113,7 @@ describe('fetchAnthropicExcerpt', () => {
   it('unwraps links, which the excerpt editor cannot hold, keeping their text', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>Read the <a href="https://example.com">full guide</a> first.</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(paragraphDocument('Some content here.') as never)
diff --git a/src/lib/anthropic/fetchExcerpt.ts b/src/lib/anthropic/fetchExcerpt.ts
index 7f4745b1..499309ba 100644
--- a/src/lib/anthropic/fetchExcerpt.ts
+++ b/src/lib/anthropic/fetchExcerpt.ts
@@ -1,12 +1,9 @@
-'use server'
-
 import { convertLexicalToHTML } from '@payloadcms/richtext-lexical/html'
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
 import { parseHtmlToLexical } from '@/lib/lexical/parseHtmlToLexical'
 
 /**
@@ -25,37 +22,26 @@ export const fetchAnthropicExcerpt = async (
 
   if (!html.trim()) return null
 
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
+  const excerptHtml = await generateAnthropicText({
+    functionId: 'fetchAnthropicExcerpt',
+    maxOutputTokens: 2048,
+    system: dedent`
+      You write the excerpt shown on a blog post's preview card.
 
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+      The post is in the <post> tags as HTML. Tell the reader what they will
+      get from it in 2-3 sentences, in the same language as the post and in the
+      author's own voice: state the point directly rather than describing the
+      post ("This post explains ...").
 
-  const { text: excerptHtml } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicExcerpt',
-    },
-    system: dedent`
-      Write a concise, engaging excerpt (2-3 sentences) summarizing the
-      following blog post HTML, suitable for a preview card and meta
-      description. Return only the excerpt as a single HTML <p> tag, no
-      explanation, no code fences, no surrounding <html>/<body> tags. Use no
-      links; <strong> and <em> are the only tags allowed inside the <p>.
+      Return a single HTML <p> element and nothing else. Inside it, <strong>
+      and <em> are the only tags allowed; the excerpt has no link support.
     `,
-    prompt: html,
+    prompt: `<post>\n${html}\n</post>`,
   })
 
-  const stripped = excerptHtml
-    .replace(/^\s*```(?:html)?\s*\n?/i, '')
-    .replace(/\n?\s*```\s*$/, '')
-    // The excerpt editor has no link feature, so a link would fail validation
-    // on save; keep its text only.
-    .replace(/<\/?a\b[^>]*>/gi, '')
-    .trim()
+  // The excerpt editor has no link feature, so a link would fail validation
+  // on save; keep its text only.
+  const withoutLinks = excerptHtml.replace(/<\/?a\b[^>]*>/gi, '').trim()
 
-  return parseHtmlToLexical(stripped)
+  return parseHtmlToLexical(withoutLinks)
 }
diff --git a/src/lib/anthropic/fetchImageAltText.ts b/src/lib/anthropic/fetchImageAltText.ts
index c6360d51..9f0b0707 100644
--- a/src/lib/anthropic/fetchImageAltText.ts
+++ b/src/lib/anthropic/fetchImageAltText.ts
@@ -1,52 +1,45 @@
-'use server'
-
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 import sharp, { type SharpInput } from 'sharp'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
+
+// Large enough for text in the image to stay legible to the model.
+const MAX_EDGE_PX = 1024
+
 /**
  * Generates an image alternative text based on the image
  * @param input
  */
 export const fetchAnthropicImageAltText = async (input: SharpInput): Promise<string> => {
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
-
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
-
   const resizedImageBuffer = await sharp(input)
     .autoOrient()
     .resize({
-      width: 512,
-      height: 512,
+      width: MAX_EDGE_PX,
+      height: MAX_EDGE_PX,
       fit: 'inside',
+      withoutEnlargement: true,
     })
     .jpeg({
-      quality: 75,
+      quality: 80,
     })
     .toBuffer()
 
-  const { text } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicImageAltText',
-    },
+  return generateAnthropicText({
+    functionId: 'fetchAnthropicImageAltText',
+    maxOutputTokens: 1024,
     system: dedent`
-      Write a short but meaningful sentence that explains the attached image and helps improve its accessibility by describing the content of the image, adapted for visually impaired people or users of screen readers.
+      You write alt text for images on a personal website and blog, read aloud
+      by screen readers to people who cannot see the image.
+
+      Describe what the image shows in one English sentence, under 125
+      characters where possible:
+        - Lead with the most important content and be specific and factual
+        - Describe it directly, without openers such as "Image of" or "Picture of"
+        - Include text shown in the image when it matters for understanding it
+        - Mention mood or style only when that is the point of the image
+        - For an abstract or decorative image, name its visual character briefly
 
-      Your alt text should follow these guidelines:
-        - Keep it concise (typically one sentence, under 125 characters when possible)
-        - Describe the most important or relevant content in the image
-        - Be specific and factual about what is shown
-        - Avoid starting with phrases like "Image of..." or "Picture of..." - just describe what's there
-        - Focus on information that would be useful to someone who cannot see the image
-        - If there is text in the image that is important to understanding it, include that text in your description
-        - Avoid subjective interpretations unless the mood/tone is clearly the main point of the image
+      Return only the alt text, without quotation marks.
     `,
     messages: [
       {
@@ -56,10 +49,12 @@ export const fetchAnthropicImageAltText = async (input: SharpInput): Promise<str
             type: 'image',
             image: resizedImageBuffer,
           },
+          {
+            type: 'text',
+            text: 'Write the alt text for this image.',
+          },
         ],
       },
     ],
   })
-
-  return text
 }
diff --git a/src/lib/anthropic/fetchMetaDescription.test.ts b/src/lib/anthropic/fetchMetaDescription.test.ts
new file mode 100644
index 00000000..b106f120
--- /dev/null
+++ b/src/lib/anthropic/fetchMetaDescription.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const generateTextMock = vi.fn()
+
+vi.mock('ai', () => ({
+  generateText: (...args: unknown[]) => generateTextMock(...args),
+}))
+
+vi.mock('@ai-sdk/anthropic', () => ({
+  createAnthropic: () => (model: string) => ({
+    modelId: model,
+  }),
+}))
+
+const { clampMetaDescription, fetchAnthropicMetaDescription, META_DESCRIPTION_MAX_LENGTH } =
+  await import('./fetchMetaDescription')
+
+const post = {
+  title: 'Caching in Next.js',
+  slug: 'caching-in-next-js',
+  content: {
+    root: {
+      type: 'root',
+      children: [
+        {
+          type: 'paragraph',
+          children: [
+            {
+              type: 'text',
+              text: 'How cache tags and revalidation fit together.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+}
+
+describe('fetchAnthropicMetaDescription', () => {
+  beforeEach(() => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-test')
+    generateTextMock.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it("sends the document's own title and text, not a URL", async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'How cache tags and revalidation work together in Next.js.',
+      finishReason: 'stop',
+    })
+
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'posts',
+      data: post,
+    })
+
+    expect(result).toBe('How cache tags and revalidation work together in Next.js.')
+
+    const [options] = generateTextMock.mock.calls[0]
+
+    expect(options.prompt).toContain('<type>blog post</type>')
+    expect(options.prompt).toContain('Caching in Next.js')
+    expect(options.prompt).toContain('How cache tags and revalidation fit together.')
+    expect(options.prompt).not.toMatch(/https?:\/\//)
+    expect(options.prompt).not.toContain('caching-in-next-js')
+  })
+
+  it('returns null without calling the model when the document has no text', async () => {
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'pages',
+      data: {
+        slug: 'empty',
+      },
+    })
+
+    expect(result).toBeNull()
+    expect(generateTextMock).not.toHaveBeenCalled()
+  })
+
+  it('shortens an over-long answer to the limit', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'word '.repeat(60),
+      finishReason: 'stop',
+    })
+
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'pages',
+      data: post,
+    })
+
+    expect(result?.length).toBeLessThanOrEqual(META_DESCRIPTION_MAX_LENGTH)
+  })
+})
+
+describe('clampMetaDescription', () => {
+  it('leaves a description within the limit alone, collapsing whitespace', () => {
+    expect(clampMetaDescription('  Short   and\nsweet. ')).toBe('Short and sweet.')
+  })
+
+  it('cuts at the last complete sentence when one ends late enough', () => {
+    const first = `${'A'.repeat(100)}.`
+    const result = clampMetaDescription(`${first} ${'B'.repeat(100)}.`)
+
+    expect(result).toBe(first)
+  })
+
+  it('otherwise cuts at a word boundary and adds an ellipsis', () => {
+    const result = clampMetaDescription('word '.repeat(60))
+
+    expect(result.length).toBeLessThanOrEqual(META_DESCRIPTION_MAX_LENGTH)
+    expect(result.endsWith('word…')).toBe(true)
+  })
+
+  it('still respects the limit for one unbroken string', () => {
+    expect(clampMetaDescription('x'.repeat(300)).length).toBe(META_DESCRIPTION_MAX_LENGTH)
+  })
+})
diff --git a/src/lib/anthropic/fetchMetaDescription.ts b/src/lib/anthropic/fetchMetaDescription.ts
index de6f2e3f..b78f3e9e 100644
--- a/src/lib/anthropic/fetchMetaDescription.ts
+++ b/src/lib/anthropic/fetchMetaDescription.ts
@@ -1,63 +1,104 @@
-'use server'
-
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
+import { extractDocumentText } from '@/lib/extractDocumentText'
+import { CollectionSlug } from '@/types/collections'
+
+// Search engines cut descriptions off around here.
+export const META_DESCRIPTION_MAX_LENGTH = 160
+
 /**
- * Generates a meta-description based on the URL
- * @param url
+ * A description only needs the gist of the page, which the opening carries;
+ * sending a whole long article would cost more without changing the result.
  */
-export const fetchAnthropicMetaDescription = async (url: string): Promise<string> => {
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
+const MAX_CONTENT_LENGTH = 8000
 
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+const pageTypeFor = (collection: string): string => {
+  if (collection === CollectionSlug.BlogPosts) return 'blog post'
+
+  if (collection === CollectionSlug.BlogTopics) return 'blog topic overview'
+
+  return 'page'
+}
+
+/**
+ * Shortens an over-long description to the limit: at the last complete
+ * sentence when one ends late enough to be worth keeping, otherwise at a word
+ * boundary with an ellipsis. Models cannot count characters reliably.
+ */
+export const clampMetaDescription = (
+  text: string,
+  maxLength: number = META_DESCRIPTION_MAX_LENGTH,
+): string => {
+  const normalized = text.replace(/\s+/g, ' ').trim()
+
+  if (normalized.length <= maxLength) return normalized
+
+  const head = normalized.slice(0, maxLength)
+
+  const sentenceEnd = Math.max(
+    head.lastIndexOf('. '),
+    head.lastIndexOf('! '),
+    head.lastIndexOf('? '),
+  )
 
-  const { text } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicMetaDescription',
-    },
+  if (sentenceEnd >= maxLength / 2) return head.slice(0, sentenceEnd + 1)
+
+  const room = normalized.slice(0, maxLength - 1)
+  const wordEnd = room.lastIndexOf(' ')
+
+  return `${(wordEnd > 0 ? room.slice(0, wordEnd) : room).replace(/[\s,;:–-]+$/, '')}…`
+}
+
+type FetchAnthropicMetaDescriptionArgs = {
+  collection: string
+  /** The document as it is being edited; its title and text are what gets described. */
+  data: unknown
+}
+
+/**
+ * Generates a meta description from a document's own title and text.
+ * Returns `null` when the document has no text to describe yet.
+ */
+export const fetchAnthropicMetaDescription = async ({
+  collection,
+  data,
+}: FetchAnthropicMetaDescriptionArgs): Promise<string | null> => {
+  const content = extractDocumentText(data).slice(0, MAX_CONTENT_LENGTH)
+
+  if (!content) return null
+
+  const description = await generateAnthropicText({
+    functionId: 'fetchAnthropicMetaDescription',
+    maxOutputTokens: 1024,
     system: dedent`
-      Create a meta-description text for the following URL, focusing on optimization for Google and other major search engines. A meta-description is a short text that appears in search engine results below the page title.
-      If you are looking for an in-depth context, such as the website operator's full name, information about their job, a categorization of the website and its intended purpose, as well as many other details, check out the JSON-LD objects embedded in the source code.
-      The provided JSON-LD objects are also designed to define the section of the website, e.g. "homepage", "resume", "blog", "blog post".
-
-      The meta-description should follow these requirements:
-
-      CHARACTER COUNT:
-      - Keep the meta-description between 150-160 characters (including spaces)
-      - This is the optimal length to avoid being cut off in search results
-
-      SEO OPTIMIZATION:
-      - Include relevant keywords naturally
-      - Make it compelling and informative
-      - Accurately describe what users will find on the page
-
-      TONE AND CALL-TO-ACTION:
-      - Use an action-oriented tone that encourages users to visit the website
-      - Include clear calls-to-action
-      - Mention key offerings
-      - Create urgency or value proposition to encourage clicks
-      - Use first person tone
-
-      OUTPUT FORMAT:
-      - Respond with the meta-description text ONLY - your entire response must be that one sentence or two, nothing else
-      - Do not add a title, headings, bullet points, or a "why this works" style explanation
-      - Do not offer multiple alternatives or label anything "Option 1" / "Recommended" - return exactly one meta-description, no picking between variants
-      - No markdown formatting of any kind (no **bold**, no #headings, no code fences, no checkmarks)
-      - No surrounding quotation marks
+      You write the meta description for a page of a personal website: the
+      short text search engines show below the page title.
+
+      The <page> tags hold the page's type and the text it contains, starting
+      with its title. Write one description based only on that text, in the
+      same language, and in the first person where the page speaks about its
+      author.
+
+      Aim for 140 to 155 characters including spaces, because search engines
+      cut off longer text. Lead with what the page offers, use the terms a
+      reader would search for where they fit naturally, and prefer a concrete
+      statement over a generic call to action.
+
+      Return the description as plain text and nothing else: no quotation
+      marks, no markdown, no alternatives.
     `,
-    prompt: url,
+    // Joined rather than a dedent template: the multi-line content has no
+    // indentation of its own, which would stop dedent from stripping any.
+    prompt: [
+      '<page>',
+      `<type>${pageTypeFor(collection)}</type>`,
+      '<content>',
+      content,
+      '</content>',
+      '</page>',
+    ].join('\n'),
   })
 
-  return text
-    .replace(/^\s*```(?:\w+)?\s*\n?/, '')
-    .replace(/\n?\s*```\s*$/, '')
-    .trim()
+  return clampMetaDescription(description)
 }
diff --git a/src/lib/anthropic/fetchTranslation.test.ts b/src/lib/anthropic/fetchTranslation.test.ts
index a42eb9f8..8177a3ad 100644
--- a/src/lib/anthropic/fetchTranslation.test.ts
+++ b/src/lib/anthropic/fetchTranslation.test.ts
@@ -61,6 +61,7 @@ describe('fetchAnthropicTranslation', () => {
   it('sends the source HTML to the model and parses the translated result back into Lexical', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>Hallo Welt</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicTranslation({
@@ -74,6 +75,7 @@ describe('fetchAnthropicTranslation', () => {
     expect(call[0].prompt).toContain('Hello world')
     expect(call[0].system).toContain('English')
     expect(call[0].system).toContain('German')
+    expect(call[0].model.modelId).toBe('claude-sonnet-5-5')
 
     const root = result?.root as unknown as {
       children: Array<{
@@ -103,6 +105,7 @@ describe('fetchAnthropicTranslation', () => {
   it("strips a leading '```html' + trailing '```' fence from the model output before parsing", async () => {
     generateTextMock.mockResolvedValue({
       text: '```html\n<p>Hallo Welt</p>\n```',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicTranslation({
diff --git a/src/lib/anthropic/fetchTranslation.ts b/src/lib/anthropic/fetchTranslation.ts
index 96d191fb..33d17274 100644
--- a/src/lib/anthropic/fetchTranslation.ts
+++ b/src/lib/anthropic/fetchTranslation.ts
@@ -1,12 +1,12 @@
-'use server'
-
 import { convertLexicalToHTML } from '@payloadcms/richtext-lexical/html'
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import {
+  ANTHROPIC_TRANSLATION_MODEL,
+  generateAnthropicText,
+} from '@/lib/anthropic/generateAnthropicText'
 import { parseHtmlToLexical } from '@/lib/lexical/parseHtmlToLexical'
 import { BilingualLanguageLabel, BilingualLanguageValue } from '@/types/bilingualLanguage'
 
@@ -33,35 +33,29 @@ export const fetchAnthropicTranslation = async ({
 
   if (!html.trim()) return null
 
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
-
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+  const source = BilingualLanguageLabel[sourceLanguage]
+  const target = BilingualLanguageLabel[targetLanguage]
 
-  const { text: translatedHtml } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicTranslation',
-    },
+  const translatedHtml = await generateAnthropicText({
+    functionId: 'fetchAnthropicTranslation',
+    model: ANTHROPIC_TRANSLATION_MODEL,
+    maxOutputTokens: 16_000,
     system: dedent`
-      Translate the following ${BilingualLanguageLabel[sourceLanguage]} HTML fragment
-      into ${BilingualLanguageLabel[targetLanguage]}. Preserve the HTML tags and
-      structure exactly - translate only the text content. Keep the tone
-      concise and professional, appropriate for a CV/résumé bullet point.
-      Return only the translated HTML fragment, no explanation, no code
-      fences, no surrounding <html>/<body> tags.
+      You translate résumé content from ${source} into ${target}.
+
+      The source is an HTML fragment in the <source> tags. Translate its text
+      and keep the HTML tags, attributes and structure exactly as they are.
+      Leave link targets, company names, product names, technologies and other
+      proper nouns untranslated.
+
+      Keep the tone concise and professional, as in a CV bullet point, and
+      phrase it the way a native ${target} reader expects a résumé to read
+      rather than word for word.
+
+      Return only the translated HTML fragment.
     `,
-    prompt: html,
+    prompt: `<source>\n${html}\n</source>`,
   })
 
-  const stripped = translatedHtml
-    .replace(/^\s*```(?:html)?\s*\n?/i, '')
-    .replace(/\n?\s*```\s*$/, '')
-    .trim()
-
-  return parseHtmlToLexical(stripped)
+  return parseHtmlToLexical(translatedHtml)
 }
diff --git a/src/lib/anthropic/generateAnthropicText.test.ts b/src/lib/anthropic/generateAnthropicText.test.ts
new file mode 100644
index 00000000..73c62c45
--- /dev/null
+++ b/src/lib/anthropic/generateAnthropicText.test.ts
@@ -0,0 +1,100 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const generateTextMock = vi.fn()
+
+vi.mock('ai', () => ({
+  generateText: (...args: unknown[]) => generateTextMock(...args),
+}))
+
+vi.mock('@ai-sdk/anthropic', () => ({
+  createAnthropic: () => (model: string) => ({
+    modelId: model,
+  }),
+}))
+
+const { ANTHROPIC_MODEL, ANTHROPIC_TRANSLATION_MODEL, generateAnthropicText, stripCodeFence } =
+  await import('./generateAnthropicText')
+
+const call = () =>
+  generateAnthropicText({
+    functionId: 'test',
+    system: 'Be brief.',
+    maxOutputTokens: 512,
+    prompt: 'Hello',
+  })
+
+describe('generateAnthropicText', () => {
+  beforeEach(() => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-test')
+    generateTextMock.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('calls the current Haiku at low effort with an output limit and a timeout', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'Hi',
+      finishReason: 'stop',
+    })
+
+    await expect(call()).resolves.toBe('Hi')
+
+    const [options] = generateTextMock.mock.calls[0]
+
+    expect(options.model.modelId).toBe(ANTHROPIC_MODEL)
+    expect(ANTHROPIC_MODEL).toBe('claude-haiku-5-5')
+    expect(options.providerOptions.anthropic.effort).toBe('low')
+    expect(options.maxOutputTokens).toBe(512)
+    expect(options.timeout).toBeGreaterThan(0)
+    expect(options.system).toBe('Be brief.')
+    expect(options.prompt).toBe('Hello')
+  })
+
+  it('uses the model a caller names instead of the default', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'Hi',
+      finishReason: 'stop',
+    })
+
+    await generateAnthropicText({
+      functionId: 'test',
+      system: 'Be brief.',
+      maxOutputTokens: 512,
+      model: ANTHROPIC_TRANSLATION_MODEL,
+      prompt: 'Hello',
+    })
+
+    expect(generateTextMock.mock.calls[0][0].model.modelId).toBe('claude-sonnet-5-5')
+  })
+
+  it.each(['length', 'content-filter', 'error', 'other'])(
+    'throws instead of returning a partial answer when the model stops with %s',
+    async (finishReason) => {
+      generateTextMock.mockResolvedValue({
+        text: 'Half an ans',
+        finishReason,
+      })
+
+      await expect(call()).rejects.toThrow(finishReason)
+    },
+  )
+
+  it('throws before calling the model when ANTHROPIC_API_KEY is not configured', async () => {
+    vi.stubEnv('ANTHROPIC_API_KEY', '')
+
+    await expect(call()).rejects.toThrow(/ANTHROPIC_API_KEY/)
+    expect(generateTextMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('stripCodeFence', () => {
+  it.each([
+    ['```html\n<p>Hi</p>\n```', '<p>Hi</p>'],
+    ['```\nplain\n```', 'plain'],
+    ['  no fence  ', 'no fence'],
+  ])('turns %j into %j', (input, expected) => {
+    expect(stripCodeFence(input)).toBe(expected)
+  })
+})
diff --git a/src/lib/anthropic/generateAnthropicText.ts b/src/lib/anthropic/generateAnthropicText.ts
new file mode 100644
index 00000000..98c0ffa7
--- /dev/null
+++ b/src/lib/anthropic/generateAnthropicText.ts
@@ -0,0 +1,85 @@
+import { createAnthropic } from '@ai-sdk/anthropic'
+import { generateText, type ModelMessage } from 'ai'
+
+export const ANTHROPIC_MODEL = 'claude-haiku-5-5'
+
+/**
+ * Résumé wording is read closely and translated rarely, so the translation
+ * uses the stronger model; everything else stays on the cheap one.
+ */
+export const ANTHROPIC_TRANSLATION_MODEL = 'claude-sonnet-5-5'
+
+type AnthropicModel = typeof ANTHROPIC_MODEL | typeof ANTHROPIC_TRANSLATION_MODEL
+
+// One model call; none of the tasks here should take longer.
+const TIMEOUT_MS = 60_000
+
+type GenerateAnthropicTextArgs = {
+  /** Telemetry identifier, the name of the calling fetcher. */
+  functionId: string
+  system: string
+  /** Thinking counts toward this, so leave room beyond the expected answer. */
+  maxOutputTokens: number
+  /** Defaults to `ANTHROPIC_MODEL`. */
+  model?: AnthropicModel
+} & (
+  | {
+      prompt: string
+    }
+  | {
+      messages: ModelMessage[]
+    }
+)
+
+/** Models sometimes wrap HTML or plain text in a markdown fence despite being told not to. */
+export const stripCodeFence = (text: string): string =>
+  text
+    .replace(/^\s*```(?:\w+)?\s*\n?/, '')
+    .replace(/\n?\s*```\s*$/, '')
+    .trim()
+
+/**
+ * Shared Claude call for the short generation tasks in this folder.
+ *
+ * Throws instead of returning a partial answer: a response cut off by the
+ * token limit or declined by a safety filter must not be stored as content.
+ */
+export const generateAnthropicText = async ({
+  functionId,
+  system,
+  maxOutputTokens,
+  model = ANTHROPIC_MODEL,
+  ...input
+}: GenerateAnthropicTextArgs): Promise<string> => {
+  if (!process.env.ANTHROPIC_API_KEY) {
+    throw new Error('ANTHROPIC_API_KEY is not configured.')
+  }
+
+  const anthropic = createAnthropic({
+    apiKey: process.env.ANTHROPIC_API_KEY,
+  })
+
+  const { text, finishReason } = await generateText({
+    model: anthropic(model),
+    telemetry: {
+      isEnabled: true,
+      functionId,
+    },
+    maxOutputTokens,
+    timeout: TIMEOUT_MS,
+    providerOptions: {
+      anthropic: {
+        // Both models think more than these short tasks need by default.
+        effort: 'low',
+      },
+    },
+    system,
+    ...input,
+  })
+
+  if (finishReason !== 'stop') {
+    throw new Error(`Claude did not finish its answer (${finishReason}).`)
+  }
+
+  return stripCodeFence(text)
+}
diff --git a/src/lib/extractDocumentText.test.ts b/src/lib/extractDocumentText.test.ts
new file mode 100644
index 00000000..af8c419b
--- /dev/null
+++ b/src/lib/extractDocumentText.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest'
+
+import { extractDocumentText } from './extractDocumentText'
+
+const richText = (...texts: string[]) => ({
+  root: {
+    type: 'root',
+    children: texts.map((text) => ({
+      type: 'paragraph',
+      children: [
+        {
+          type: 'text',
+          text,
+        },
+      ],
+    })),
+  },
+})
+
+describe('extractDocumentText', () => {
+  it('collects titles and rich text in document order', () => {
+    const text = extractDocumentText({
+      title: 'Caching in Next.js',
+      slug: 'caching-in-next-js',
+      content: richText('First paragraph.', 'Second paragraph.'),
+    })
+
+    expect(text).toBe('Caching in Next.js\nFirst paragraph.\nSecond paragraph.')
+  })
+
+  it('reaches text nested in hero slides and layout blocks', () => {
+    const text = extractDocumentText({
+      layout: {
+        hero: {
+          slides: [
+            {
+              content: richText('Hero line.'),
+            },
+          ],
+        },
+        content: [
+          {
+            blockType: 'feature-cards',
+            title: 'What I do',
+            cards: [
+              {
+                title: 'Frontend',
+                description: richText('React and TypeScript.'),
+              },
+            ],
+          },
+        ],
+      },
+    })
+
+    expect(text).toBe('Hero line.\nWhat I do\nFrontend\nReact and TypeScript.')
+  })
+
+  it('leaves out the search-preview fields and non-text values', () => {
+    const text = extractDocumentText({
+      title: 'About',
+      slug: 'about',
+      updatedAt: '2026-01-01',
+      relatedPost: '64b7f0c2a1',
+      meta: {
+        title: 'Old meta title',
+        description: 'Old meta description',
+      },
+    })
+
+    expect(text).toBe('About')
+  })
+
+  it('keeps a repeated string once and collapses whitespace', () => {
+    const text = extractDocumentText({
+      title: 'Same',
+      content: richText('Same', '  spaced \n out  '),
+    })
+
+    expect(text).toBe('Same\nspaced out')
+  })
+
+  it('returns an empty string for values without text', () => {
+    expect(extractDocumentText(null)).toBe('')
+    expect(extractDocumentText({})).toBe('')
+    expect(extractDocumentText('title')).toBe('')
+  })
+})
diff --git a/src/lib/extractDocumentText.ts b/src/lib/extractDocumentText.ts
new file mode 100644
index 00000000..90c3287e
--- /dev/null
+++ b/src/lib/extractDocumentText.ts
@@ -0,0 +1,60 @@
+/* oxlint-disable anti-slop/no-runtime-typeof, anti-slop/no-unknown-parameters, anti-slop/no-unsafe-dictionary-type -- walks arbitrary document JSON of any collection; there is no single schema to parse it against */
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+// The search-preview fields describe the document; they are not its content.
+const SKIPPED_KEYS = new Set(['meta'])
+
+/**
+ * Collects the readable text of a Payload document: every `title` and every
+ * Lexical text node, in document order, wherever they are nested (hero
+ * slides, layout blocks, rich-text fields).
+ *
+ * Relationship fields only contribute when they are populated; a bare ID has
+ * no text. Repeated strings are kept once.
+ */
+export const extractDocumentText = (document: unknown): string => {
+  const parts: string[] = []
+  const seen = new Set<string>()
+
+  const add = (text: string) => {
+    const trimmed = text.replace(/\s+/g, ' ').trim()
+
+    if (trimmed === '' || seen.has(trimmed)) return
+
+    seen.add(trimmed)
+    parts.push(trimmed)
+  }
+
+  const visit = (node: unknown) => {
+    if (Array.isArray(node)) {
+      for (const item of node) visit(item)
+
+      return
+    }
+
+    if (!isRecord(node)) return
+
+    // A Lexical text node; its siblings and children hold no further text.
+    if (node.type === 'text' && typeof node.text === 'string') {
+      add(node.text)
+
+      return
+    }
+
+    for (const [key, value] of Object.entries(node)) {
+      if (SKIPPED_KEYS.has(key)) continue
+
+      if (key === 'title' && typeof value === 'string') {
+        add(value)
+      } else {
+        visit(value)
+      }
+    }
+  }
+
+  visit(document)
+
+  return parts.join('\n')
+}
diff --git a/src/lib/fetchers/_fetchGlobalData.ts b/src/lib/fetchers/_fetchGlobalData.ts
index 37d4b473..a72dad58 100644
--- a/src/lib/fetchers/_fetchGlobalData.ts
+++ b/src/lib/fetchers/_fetchGlobalData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/lib/fetchers/fetchDocumentBySlug.ts b/src/lib/fetchers/fetchDocumentBySlug.ts
new file mode 100644
index 00000000..aac0d7d9
--- /dev/null
+++ b/src/lib/fetchers/fetchDocumentBySlug.ts
@@ -0,0 +1,116 @@
+import { cacheLife, cacheTag } from 'next/cache'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
+import { resolveRelations } from '@/lib/resolveRelation'
+import { CollectionData, CollectionSlug } from '@/types/collections'
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+async function fetchDocumentBySlugRaw(
+  slug: string,
+  draft: boolean,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  const payload = await getPayload({
+    config,
+  })
+
+  let realSlug: string = slug
+
+  if (slug === 'latest') {
+    try {
+      const {
+        docs: [latestDoc],
+      } = await payload.find({
+        collection: CollectionSlug.ResumeDocuments,
+        overrideAccess: true,
+        draft,
+        limit: 1,
+        sort: '-createdAt',
+      })
+
+      if (latestDoc && latestDoc.slug) {
+        realSlug = latestDoc.slug
+      }
+    } catch (error) {
+      console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+    }
+  }
+
+  try {
+    const {
+      docs: [doc],
+    } = await payload.find({
+      collection: CollectionSlug.ResumeDocuments,
+      overrideAccess: true,
+      draft,
+      limit: 1,
+      // No `_status` filter: the collection has no drafts, and Payload rejects the path.
+      where: {
+        slug: {
+          equals: realSlug,
+        },
+      },
+    })
+
+    if (!doc) return null
+
+    return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
+  } catch (error) {
+    console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+
+    return null
+  }
+}
+
+/**
+ * Fetches a cached resume document by its slug and locale.
+ *
+ * @param slug - The unique slug identifying the resume document.
+ * @param locale - The bilingual language used to reduce localized document data.
+ */
+async function fetchDocumentBySlugCached(
+  slug: string,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  'use cache'
+  cacheLife('max')
+  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
+
+  return fetchDocumentBySlugRaw(slug, false, locale)
+}
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+export async function fetchDocumentBySlug({
+  slug,
+  draft = false,
+  locale = 'en',
+}: {
+  slug: string
+  draft?: boolean
+  locale?: BilingualLanguage
+}): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  if (draft) {
+    return fetchDocumentBySlugRaw(slug, true, locale)
+  }
+
+  return fetchDocumentBySlugCached(slug, locale)
+}
diff --git a/src/lib/fetchers/fetchLatestResumeDocument.ts b/src/lib/fetchers/fetchLatestResumeDocument.ts
index 324766b9..4a96179d 100644
--- a/src/lib/fetchers/fetchLatestResumeDocument.ts
+++ b/src/lib/fetchers/fetchLatestResumeDocument.ts
@@ -22,7 +22,7 @@ export type LatestResumeDocument = Pick<
  * Scoped narrower than the broad `CollectionSlug.ResumeDocuments` tag every
  * other resume-document fetcher uses, so revalidating "latest" specifically
  * (see `revalidateLatestResumeDocument`) doesn't also blow away unrelated
- * per-slug reads (`fetchResumeDocumentBySlug`) or the newer-versions count
+ * per-slug reads (`fetchDocumentBySlug`) or the newer-versions count
  * (`fetchNewerDocumentVersions`).
  */
 export const LATEST_RESUME_DOCUMENT_TAG = `${CollectionSlug.ResumeDocuments}:latest`
diff --git a/src/lib/fetchers/fetchPageBySlug.ts b/src/lib/fetchers/fetchPageBySlug.ts
index 52949652..1544c597 100644
--- a/src/lib/fetchers/fetchPageBySlug.ts
+++ b/src/lib/fetchers/fetchPageBySlug.ts
@@ -1,11 +1,20 @@
-import { cacheTag } from 'next/cache'
+import { cacheLife, cacheTag } from 'next/cache'
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
-import { reduceDataToBilingualLanguage, BilingualLanguage } from '@/lib/i18n'
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { resolveRelations } from '@/lib/resolveRelation'
 import { CollectionData, CollectionSlug } from '@/types/collections'
 
+/**
+ * Fetches a raw page document by its slug, optionally including draft content, and reduces localized data to the requested bilingual language.
+ *
+ * @param slug - The page slug to search for.
+ * @param draft - Whether to include draft content in the lookup.
+ * @param locale - The bilingual language used to reduce localized page data.
+ * @return The resolved page collection data when found, or null if no matching page exists or an error occurs.
+ */
 async function fetchPageBySlugRaw(
   slug: string,
   draft: boolean,
@@ -24,9 +33,33 @@ async function fetchPageBySlugRaw(
       draft,
       limit: 1,
       where: {
-        slug: {
-          equals: slug,
-        },
+        and: [
+          {
+            slug: {
+              equals: slug,
+            },
+          },
+          // Preview reads the newest version whatever its status: a published
+          // document without a pending draft has no 'draft' version to match.
+          ...(draft
+            ? []
+            : [
+                {
+                  or: [
+                    {
+                      _status: {
+                        equals: 'published' as const,
+                      },
+                    },
+                    {
+                      _status: {
+                        exists: false,
+                      },
+                    },
+                  ],
+                },
+              ]),
+        ],
       },
     })
 
@@ -34,26 +67,46 @@ async function fetchPageBySlugRaw(
 
     return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
   } catch (error) {
-    console.error('[fetchPageBySlugRaw]', error)
+    console.error('[fetchPageBySlugRaw]', extractErrorMessage(error))
 
     return null
   }
 }
 
+/**
+ * Fetches a page by its slug and locale using the configured cache.
+ *
+ * The cached result is tagged by the pages collection and the specific page slug,
+ * allowing cache invalidation for either the full collection or an individual page.
+ *
+ * @param slug - The unique slug of the page to fetch.
+ * @param locale - The language locale used to retrieve the localized page data.
+ * @return The matching page collection data, or null if no page is found.
+ */
 async function fetchPageBySlugCached(
   slug: string,
   locale: BilingualLanguage,
 ): Promise<CollectionData<CollectionSlug['Pages']> | null> {
   'use cache'
+  cacheLife('max')
   cacheTag(CollectionSlug.Pages, `${CollectionSlug.Pages}:${slug}`)
 
   return fetchPageBySlugRaw(slug, false, locale)
 }
 
+/**
+ * Fetches a page by its slug, optionally retrieving the draft version and using the specified locale.
+ *
+ * @param params - The parameters used to fetch the page.
+ * @param params.slug - The slug of the page to fetch.
+ * @param params.draft - Whether to fetch the draft version of the page.
+ * @param params.locale - The locale to use when fetching the page.
+ * @return A promise that resolves to the matching page data, or null if no page is found.
+ */
 export async function fetchPageBySlug({
   slug,
   draft = false,
-  locale = 'de',
+  locale = 'en',
 }: {
   slug: string
   draft?: boolean
diff --git a/src/lib/fetchers/fetchPostBySlug.ts b/src/lib/fetchers/fetchPostBySlug.ts
new file mode 100644
index 00000000..8bc459a2
--- /dev/null
+++ b/src/lib/fetchers/fetchPostBySlug.ts
@@ -0,0 +1,93 @@
+import { cacheLife, cacheTag } from 'next/cache'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
+import { resolveRelations } from '@/lib/resolveRelation'
+import { CollectionData, CollectionSlug } from '@/types/collections'
+
+async function fetchPostBySlugRaw(
+  slug: string,
+  draft: boolean,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
+  const payload = await getPayload({
+    config,
+  })
+
+  try {
+    const {
+      docs: [doc],
+    } = await payload.find({
+      collection: CollectionSlug.BlogPosts,
+      overrideAccess: true,
+      draft,
+      limit: 1,
+      where: {
+        and: [
+          {
+            slug: {
+              equals: slug,
+            },
+          },
+          // Preview reads the newest version whatever its status: a published
+          // document without a pending draft has no 'draft' version to match.
+          ...(draft
+            ? []
+            : [
+                {
+                  or: [
+                    {
+                      _status: {
+                        equals: 'published' as const,
+                      },
+                    },
+                    {
+                      _status: {
+                        exists: false,
+                      },
+                    },
+                  ],
+                },
+              ]),
+        ],
+      },
+    })
+
+    if (!doc) return null
+
+    return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
+  } catch (error) {
+    console.error('[fetchPostBySlugRaw]', extractErrorMessage(error))
+
+    return null
+  }
+}
+
+async function fetchPostBySlugCached(
+  slug: string,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
+  'use cache'
+  cacheLife('max')
+  cacheTag(CollectionSlug.BlogPosts, `${CollectionSlug.BlogPosts}:${slug}`)
+
+  return fetchPostBySlugRaw(slug, false, locale)
+}
+
+export async function fetchPostBySlug({
+  slug,
+  draft = false,
+  locale = 'en',
+}: {
+  slug: string
+  draft?: boolean
+  locale?: BilingualLanguage
+}): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
+  if (draft) {
+    return fetchPostBySlugRaw(slug, true, locale)
+  }
+
+  return fetchPostBySlugCached(slug, locale)
+}
diff --git a/src/lib/fetchers/fetchResumeDocumentBySlug.ts b/src/lib/fetchers/fetchResumeDocumentBySlug.ts
deleted file mode 100644
index ace38112..00000000
--- a/src/lib/fetchers/fetchResumeDocumentBySlug.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { cacheLife, cacheTag } from 'next/cache'
-import config from '@payload-config'
-import { getPayload } from 'payload'
-
-import { CollectionData, CollectionSlug } from '@/types/collections'
-
-export const fetchResumeDocumentBySlug = async (slug: string) => {
-  'use cache'
-  cacheLife('max')
-  // Tagged with both the broad collection tag and one scoped to this slug:
-  // documents here are create-only and immutable (update/delete are
-  // `forbidden` on the collection), so an existing slug's data never
-  // changes after creation and nothing currently revalidates the slug-scoped
-  // tag on its own — the broad tag is what actually gets used today (see
-  // fetchNewerDocumentVersions), kept here so a future create-triggered
-  // revalidation of just this slug has something to target without also
-  // reaching every other slug.
-  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
-
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug.ResumeDocuments,
-    draft: false,
-    limit: 1,
-    pagination: false,
-    // overrideAccess: false,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  return (docs[0] as CollectionData<CollectionSlug['ResumeDocuments']>) || null
-}
diff --git a/src/lib/fetchers/fetchTrendingBlogPosts.test.ts b/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
index 37c6f1eb..ccdf8756 100644
--- a/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
+++ b/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
@@ -11,7 +11,7 @@ vi.mock('@/lib/RedisHandler', () => ({
   set: (...args: unknown[]) => setMock(...args),
 }))
 
-vi.mock('@/widgets/UmamiWidget/UmamiWidget.data', () => ({
+vi.mock('@/lib/umami/getToken', () => ({
   getToken: (...args: unknown[]) => getTokenMock(...args),
 }))
 
diff --git a/src/lib/fetchers/fetchTrendingBlogPosts.ts b/src/lib/fetchers/fetchTrendingBlogPosts.ts
index bce67ff8..d39bb68a 100644
--- a/src/lib/fetchers/fetchTrendingBlogPosts.ts
+++ b/src/lib/fetchers/fetchTrendingBlogPosts.ts
@@ -1,14 +1,12 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
 import { minutesToSeconds, subDays } from 'date-fns'
 
 import { get, set } from '@/lib/RedisHandler'
+import { getToken } from '@/lib/umami/getToken'
 import { CollectionSlug } from '@/types/collections'
 import { BlogPostData } from '@/types/payload'
-import { getToken } from '@/widgets/UmamiWidget/UmamiWidget.data'
 
 const BLOG_POST_PATH_PREFIX = '/blog/post/'
 
diff --git a/src/lib/generatePreviewPath.ts b/src/lib/generatePreviewPath.ts
index 52b2d48e..add38abe 100644
--- a/src/lib/generatePreviewPath.ts
+++ b/src/lib/generatePreviewPath.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { generateContentPath } from './generateContentPath'
 
 /**
diff --git a/src/lib/generateResumeId.ts b/src/lib/generateResumeId.ts
index 2141dee9..d641e4a3 100644
--- a/src/lib/generateResumeId.ts
+++ b/src/lib/generateResumeId.ts
@@ -16,8 +16,6 @@ const nanoid = customAlphabet('ABCDEFGHIJKLMNOPQRSTUVWXYZ', 5)
  * Retries until `ResumeDocuments` has no doc with that slug.
  */
 export const generateResumeId = async () => {
-  'use server'
-
   const payload = await getPayload({
     config,
   })
diff --git a/src/lib/isProductionHost.test.ts b/src/lib/isProductionHost.test.ts
new file mode 100644
index 00000000..db8b45fe
--- /dev/null
+++ b/src/lib/isProductionHost.test.ts
@@ -0,0 +1,35 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { isProductionHost } from './isProductionHost'
+
+describe('isProductionHost', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('is true when SERVER_HOST equals PRODUCTION_HOST', () => {
+    vi.stubEnv('PRODUCTION_HOST', 'example.com')
+    vi.stubEnv('SERVER_HOST', 'example.com')
+
+    expect(isProductionHost()).toBe(true)
+  })
+
+  it('is false on any other host', () => {
+    vi.stubEnv('PRODUCTION_HOST', 'example.com')
+    vi.stubEnv('SERVER_HOST', 'dev.example.com')
+
+    expect(isProductionHost()).toBe(false)
+  })
+
+  it('is false when PRODUCTION_HOST is unset or empty, even if SERVER_HOST is too', () => {
+    vi.stubEnv('PRODUCTION_HOST', '')
+    vi.stubEnv('SERVER_HOST', '')
+
+    expect(isProductionHost()).toBe(false)
+
+    vi.stubEnv('PRODUCTION_HOST', undefined)
+    vi.stubEnv('SERVER_HOST', undefined)
+
+    expect(isProductionHost()).toBe(false)
+  })
+})
diff --git a/src/lib/isProductionHost.ts b/src/lib/isProductionHost.ts
new file mode 100644
index 00000000..447b293a
--- /dev/null
+++ b/src/lib/isProductionHost.ts
@@ -0,0 +1,9 @@
+/**
+ * Whether this process serves the production site.
+ *
+ * `NODE_ENV` cannot answer that: every deployed image runs in production mode,
+ * the development environment included. An unset `PRODUCTION_HOST` reads as
+ * "not production", so a misconfigured environment fails closed.
+ */
+export const isProductionHost = (): boolean =>
+  Boolean(process.env.PRODUCTION_HOST) && process.env.SERVER_HOST === process.env.PRODUCTION_HOST
diff --git a/src/lib/mapbox/fetchAddressData.ts b/src/lib/mapbox/fetchAddressData.ts
index 1fda6397..472d0e96 100644
--- a/src/lib/mapbox/fetchAddressData.ts
+++ b/src/lib/mapbox/fetchAddressData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { get } from 'lodash-es'
 
 import type { AddressData } from '@/types/payload'
diff --git a/src/lib/mapbox/fetchCoordinatesData.ts b/src/lib/mapbox/fetchCoordinatesData.ts
index 2adbce98..28a40669 100644
--- a/src/lib/mapbox/fetchCoordinatesData.ts
+++ b/src/lib/mapbox/fetchCoordinatesData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { get } from 'lodash-es'
 
 import type { AddressData } from '@/types/payload'
diff --git a/src/lib/resolveOwnMediaUrl.test.ts b/src/lib/resolveOwnMediaUrl.test.ts
new file mode 100644
index 00000000..2a4f7854
--- /dev/null
+++ b/src/lib/resolveOwnMediaUrl.test.ts
@@ -0,0 +1,38 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { resolveOwnMediaUrl } from './resolveOwnMediaUrl'
+
+describe('resolveOwnMediaUrl', () => {
+  beforeEach(() => {
+    vi.stubEnv('SERVER_URL', 'https://example.com')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('resolves a relative upload path against the site', () => {
+    expect(resolveOwnMediaUrl('/api/images/file/photo.jpg').href).toBe(
+      'https://example.com/api/images/file/photo.jpg',
+    )
+  })
+
+  it('accepts an absolute URL on the same origin', () => {
+    expect(resolveOwnMediaUrl('https://example.com/api/images/file/photo.jpg').pathname).toBe(
+      '/api/images/file/photo.jpg',
+    )
+  })
+
+  it.each([
+    'https://evil.example/photo.jpg',
+    'http://example.com/photo.jpg',
+    'http://169.254.169.254/latest/meta-data',
+    '//evil.example/photo.jpg',
+  ])('rejects %s', (url) => {
+    expect(() => resolveOwnMediaUrl(url)).toThrow(/another origin/)
+  })
+
+  it.each([undefined, null, ''])('rejects a missing URL (%s)', (url) => {
+    expect(() => resolveOwnMediaUrl(url)).toThrow(/no URL/)
+  })
+})
diff --git a/src/lib/resolveOwnMediaUrl.ts b/src/lib/resolveOwnMediaUrl.ts
new file mode 100644
index 00000000..10902adf
--- /dev/null
+++ b/src/lib/resolveOwnMediaUrl.ts
@@ -0,0 +1,20 @@
+/**
+ * Resolves a media URL against this site and rejects anything that points
+ * elsewhere, so a server-side fetch of "our own upload" can never be steered
+ * to another host. Uploads are served from `/api/<collection>/file/...`, so a
+ * legitimate value is always same-origin.
+ */
+export const resolveOwnMediaUrl = (url: string | null | undefined): URL => {
+  if (!url) {
+    throw new Error('The image has no URL yet.')
+  }
+
+  const origin = new URL(process.env.SERVER_URL ?? '').origin
+  const resolved = new URL(url, origin)
+
+  if (resolved.origin !== origin) {
+    throw new Error(`Refusing to fetch media from another origin: ${resolved.origin}`)
+  }
+
+  return resolved
+}
diff --git a/src/lib/resolveRelation.ts b/src/lib/resolveRelation.ts
index d869f937..695f357b 100644
--- a/src/lib/resolveRelation.ts
+++ b/src/lib/resolveRelation.ts
@@ -58,8 +58,6 @@ const isRelation = (
  * @returns The same structure with all relations resolved.
  */
 export const resolveRelations = async <T>(data: T): Promise<ResolvedRelations<T>> => {
-  'use server'
-
   const payload = await getPayload({
     config,
   })
diff --git a/src/lib/typeGuards.ts b/src/lib/typeGuards.ts
index 23bbe67b..08025607 100644
--- a/src/lib/typeGuards.ts
+++ b/src/lib/typeGuards.ts
@@ -1,3 +1,5 @@
+import * as util from 'node:util'
+
 import { CollectionSlug } from '@/types/collections'
 import type { MediaAudio, MediaDocument, MediaImage, MediaVideo } from '@/types/payload'
 
@@ -90,4 +92,7 @@ export const isMediaVideoReference = (
   isMediaVideo(object.value)
 
 export const isArrayBuffer = (data: unknown): data is ArrayBuffer =>
-  typeof data === 'object' && data !== null && data.toString() === '[object ArrayBuffer]'
+  typeof data === 'object' && data !== null && util.types.isArrayBuffer(data)
+
+export const isCachedRedisValue = (value: unknown): value is string =>
+  typeof value === 'string' && value !== ''
diff --git a/src/lib/umami/getToken.ts b/src/lib/umami/getToken.ts
new file mode 100644
index 00000000..06b8d4f7
--- /dev/null
+++ b/src/lib/umami/getToken.ts
@@ -0,0 +1,69 @@
+// Deliberately not a 'use server' module: an export here would be a client-callable
+// endpoint, and getToken hands out the Umami bearer token.
+
+let token: string | null = null
+let tokenPromise: Promise<string | null> | null = null
+
+const login = async (): Promise<string | null> => {
+  try {
+    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/login`, {
+      method: 'POST',
+      body: JSON.stringify({
+        username: process.env.UMAMI_USERNAME,
+        password: process.env.UMAMI_PASSWORD,
+      }),
+    })
+
+    const data = await response.json()
+    token = (data.token as string) ?? null
+  } catch {
+    token = null
+  }
+
+  return token
+}
+
+const verify = async (): Promise<boolean> => {
+  if (!token) return false
+
+  try {
+    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/verify`, {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+      },
+    })
+
+    return response.ok
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Returns a valid bearer token, verifying the current one first and logging
+ * in again if it's missing/invalid. The in-flight promise is shared while
+ * pending, so concurrent callers dedupe into a single verify/login flow, but
+ * it's cleared once settled so the next call re-checks instead of being
+ * stuck on the first result forever.
+ */
+export const getToken = async (): Promise<string | null> => {
+  if (tokenPromise) return tokenPromise
+
+  tokenPromise = (async () => {
+    const verified = await verify()
+
+    if (!verified) {
+      await login()
+    }
+
+    return token
+  })()
+
+  try {
+    return await tokenPromise
+  } finally {
+    tokenPromise = null
+  }
+}
diff --git a/src/lib/umami/isTrackingSuppressed.server.ts b/src/lib/umami/isTrackingSuppressed.server.ts
index 5b10a3dc..11fa3783 100644
--- a/src/lib/umami/isTrackingSuppressed.server.ts
+++ b/src/lib/umami/isTrackingSuppressed.server.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { cookies } from 'next/headers'
 
 import { jwtVerify } from 'jose'
diff --git a/src/lib/umami/track.server.ts b/src/lib/umami/track.server.ts
index 07926567..906c481d 100644
--- a/src/lib/umami/track.server.ts
+++ b/src/lib/umami/track.server.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { isTrackingSuppressed } from './isTrackingSuppressed.server'
 import { sendUmamiPayload } from './sendUmamiPayload'
 import type { UmamiSendPayload, UmamiSendPayloadPayload } from './Umami.types'
diff --git a/src/lib/uploadHeroSlideMedia.ts b/src/lib/uploadHeroSlideMedia.ts
index c0fbdc2c..ad2f5ab9 100644
--- a/src/lib/uploadHeroSlideMedia.ts
+++ b/src/lib/uploadHeroSlideMedia.ts
@@ -50,7 +50,9 @@ export const uploadHeroSlideMedia = async (
 
   const doc = await payload.create({
     collection,
-    data: {},
+    data: {
+      generatorFlags: [],
+    },
     file: {
       data,
       name: file.name,
diff --git a/src/migrations/00000001_initialize_basic_site.ts b/src/migrations/00000001_initialize_basic_site.ts
index 93916707..7fd103c1 100644
--- a/src/migrations/00000001_initialize_basic_site.ts
+++ b/src/migrations/00000001_initialize_basic_site.ts
@@ -3,86 +3,42 @@ import { MigrateDownArgs, MigrateUpArgs } from '@payloadcms/db-mongodb'
 import { SiteSettingsDefaults } from '@/globals/SiteSettings'
 import { CollectionSlug } from '@/types/collections'
 import { GlobalSlug } from '@/types/globals'
+import { Page } from '@/types/payload'
 
-export async function up({ payload, req: _req, session: _session }: MigrateUpArgs): Promise<void> {
-  const homePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'home',
-      },
-    },
-    data: {
-      title: 'Home',
-      slug: 'home',
-      protected: true,
-      layout: 'home',
-      _status: 'published',
-    },
+export async function up({ payload, req, session: _session }: MigrateUpArgs): Promise<void> {
+  const migration = {
+    payload,
+    req,
+  }
+
+  const homePage = await createOrUpdatePage(migration, {
+    slug: 'home',
+    title: 'Home',
+    layout: 'home',
   })
 
-  const aboutMePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'about-me',
-      },
-    },
-    data: {
-      title: 'About Me',
-      slug: 'about-me',
-      protected: true,
-      layout: 'default',
-      _status: 'published',
-    },
+  const aboutMePage = await createOrUpdatePage(migration, {
+    slug: 'about-me',
+    title: 'About Me',
+    layout: 'default',
   })
 
-  const resumePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'resume',
-      },
-    },
-    data: {
-      title: 'Resume',
-      slug: 'resume',
-      protected: true,
-      layout: 'resume',
-      _status: 'published',
-    },
+  const resumePage = await createOrUpdatePage(migration, {
+    slug: 'resume',
+    title: 'Resume',
+    layout: 'resume',
   })
 
-  const legalNoticePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'legal-notice',
-      },
-    },
-    data: {
-      title: 'Legal Notice',
-      slug: 'legal-notice',
-      protected: true,
-      layout: 'legal',
-      _status: 'published',
-    },
+  const legalNoticePage = await createOrUpdatePage(migration, {
+    slug: 'legal-notice',
+    title: 'Legal Notice',
+    layout: 'legal',
   })
 
-  const privacyPolicyPage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'privacy-policy',
-      },
-    },
-    data: {
-      title: 'Privacy Policy',
-      slug: 'privacy-policy',
-      protected: true,
-      layout: 'resume',
-      _status: 'published',
-    },
+  const privacyPolicyPage = await createOrUpdatePage(migration, {
+    slug: 'privacy-policy',
+    title: 'Privacy Policy',
+    layout: 'resume',
   })
 
   await payload.db.updateGlobal({
@@ -203,3 +159,54 @@ export async function down({
 }: MigrateDownArgs): Promise<void> {
   // Migration code
 }
+
+async function createOrUpdatePage(
+  { payload, req }: Pick<MigrateUpArgs, 'payload' | 'req'>,
+  page: Pick<Page, 'slug' | 'title' | 'layout'>,
+): Promise<Page> {
+  const where = {
+    slug: {
+      equals: page.slug,
+    },
+  }
+
+  const data = {
+    ...page,
+    protected: true,
+    _status: 'published' as const,
+  }
+
+  // No Next context in the migrate CLI to revalidate from.
+  const context = {
+    skipRevalidate: true,
+  }
+
+  const { totalDocs } = await payload.count({
+    collection: CollectionSlug.Pages,
+    req,
+    where,
+  })
+
+  if (!totalDocs) {
+    return payload.create({
+      collection: CollectionSlug.Pages,
+      context,
+      data,
+      draft: false,
+      req,
+    })
+  }
+
+  const {
+    docs: [updated],
+  } = await payload.update({
+    collection: CollectionSlug.Pages,
+    context,
+    data,
+    draft: false,
+    req,
+    where,
+  })
+
+  return updated
+}
diff --git a/src/pdf/index.tsx b/src/pdf/index.tsx
index 41b15dda..da4c0deb 100644
--- a/src/pdf/index.tsx
+++ b/src/pdf/index.tsx
@@ -5,6 +5,7 @@ import dePattern from 'hyphen/patterns/de-1996'
 import enPattern from 'hyphen/patterns/en-us'
 
 import type { BilingualLanguage } from '@/lib/i18n'
+import { isProductionHost } from '@/lib/isProductionHost'
 import { BulletPoint } from '@/pdf/components/BulletPoint'
 import { Footer } from '@/pdf/components/Footer'
 import { Header } from '@/pdf/components/Header'
@@ -98,7 +99,7 @@ export const ResumeDocument = ({
         orientation="portrait"
         bookmark={document.title}
       >
-        {process.env.SERVER_HOST !== 'daniel.heene.io' && (
+        {!isProductionHost() && (
           <View style={styles.debug} fixed>
             <Text style={textStyles.debugText}>DRAFT</Text>
           </View>
diff --git a/src/pdf/lib/buildDocumentHeader.ts b/src/pdf/lib/buildDocumentHeader.ts
index 67c2febe..606dc8d3 100644
--- a/src/pdf/lib/buildDocumentHeader.ts
+++ b/src/pdf/lib/buildDocumentHeader.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import parsePhoneNumber from 'libphonenumber-js'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildIntroductionSection.ts b/src/pdf/lib/buildIntroductionSection.ts
index 0fe73ee8..2fb8f5db 100644
--- a/src/pdf/lib/buildIntroductionSection.ts
+++ b/src/pdf/lib/buildIntroductionSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
 import { BilingualLanguage } from '@/lib/i18n'
 import { DocumentSectionType, IntroductionSection } from '@/pdf/types'
diff --git a/src/pdf/lib/buildLanguageSection.ts b/src/pdf/lib/buildLanguageSection.ts
index 5c33ebac..95d36532 100644
--- a/src/pdf/lib/buildLanguageSection.ts
+++ b/src/pdf/lib/buildLanguageSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildResumeDocumentData.ts b/src/pdf/lib/buildResumeDocumentData.ts
index 65cd4b06..055d13bc 100644
--- a/src/pdf/lib/buildResumeDocumentData.ts
+++ b/src/pdf/lib/buildResumeDocumentData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { ZodSafeParseResult } from 'zod'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildSkillSections.ts b/src/pdf/lib/buildSkillSections.ts
index 951bb823..e8ee4b26 100644
--- a/src/pdf/lib/buildSkillSections.ts
+++ b/src/pdf/lib/buildSkillSections.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchPDFGeneratorSettings, fetchResumeSkills } from '@/lib/fetchers'
 import { type BilingualLanguage, translate } from '@/lib/i18n'
 import { DocumentSectionType, SkillSection } from '@/pdf/types'
diff --git a/src/pdf/lib/buildWorkExperienceSection.ts b/src/pdf/lib/buildWorkExperienceSection.ts
index d5d6c7cb..66896f32 100644
--- a/src/pdf/lib/buildWorkExperienceSection.ts
+++ b/src/pdf/lib/buildWorkExperienceSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeJobs } from '@/lib/fetchers'
 import {
   type BilingualLanguage,
diff --git a/src/types/environment.ts b/src/types/environment.ts
index ad68fb22..bf71fd31 100644
--- a/src/types/environment.ts
+++ b/src/types/environment.ts
@@ -15,6 +15,12 @@ export const envSchema = z.object({
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
 
   SERVER_HOST: z.string().trim().min(1),
+
+  /**
+   * Host of the production site. An environment is production when its
+   * `SERVER_HOST` equals this (see `src/lib/isProductionHost.ts`).
+   */
+  PRODUCTION_HOST: z.string().trim().min(1),
   SERVER_URL: z.url(),
 
   /**
@@ -27,6 +33,12 @@ export const envSchema = z.object({
   NEXT_PUBLIC_STATUS_PAGE_URL: z.url(),
   STATUS_PAGE_HEARTBEAT_URL: z.url(),
 
+  /**
+   * Push monitor the worker's `heartbeatPing` job reports to every minute.
+   * Optional: without it the job only logs.
+   */
+  STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL: emptyAsUndefined(z.url()),
+
   /**
    * Base URL used by generateResumeDocumentRedirectURL to build the
    * redirect target for /download/resume.pdf and localized resume jobs.
@@ -67,7 +79,6 @@ export const envSchema = z.object({
   USESEND_DEFAULT_FROM_ADDRESS: z.email(),
   USESEND_DEFAULT_FROM_NAME: z.string().trim().min(1),
 
-  OPENAI_API_KEY: z.string(),
   ANTHROPIC_API_KEY: z.string(),
   MAPBOX_API_KEY: z.string(),
   UNSPLASH_ACCESS_KEY: emptyAsUndefined(z.string()),
diff --git a/src/types/payload.ts b/src/types/payload.ts
index e881ecbb..426fc48b 100644
--- a/src/types/payload.ts
+++ b/src/types/payload.ts
@@ -6,6 +6,19 @@
  * and re-run `payload generate:types` to regenerate this file.
  */
 
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "GeneratorFlag".
+ */
+export type GeneratorFlag =
+  | 'resume-asset'
+  | 'thumbnail'
+  | 'document'
+  | 'audio-thumbnail'
+  | 'video-thumbnail'
+  | 'document-thumbnail'
+  | 'unsplash-import'
+  | 'seeded-dummy';
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "PageLayout".
@@ -105,6 +118,11 @@ export type LanguageProficiency = ('a1' | 'a2' | 'b1' | 'b2' | 'c1' | 'c2' | 'na
  * via the `definition` "supportedTimezones".
  */
 export type SupportedTimezones = 'Europe/Berlin';
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "GeneratorFlags".
+ */
+export type GeneratorFlags = GeneratorFlag[];
 
 export interface Config {
   auth: {
@@ -380,16 +398,7 @@ export interface MediaImage {
     [k: string]: unknown;
   } | null;
   blurDataURL?: string | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -524,16 +533,7 @@ export interface Page {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -567,16 +567,7 @@ export interface MediaVideo {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -949,16 +940,7 @@ export interface BlogPostData {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1034,16 +1016,7 @@ export interface Topic {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1153,16 +1126,7 @@ export interface MediaDocument {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1199,16 +1163,7 @@ export interface MediaAudio {
     };
     [k: string]: unknown;
   } | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1233,16 +1188,7 @@ export interface ResumeCustomerData {
   title: string;
   slug: string;
   svg?: string | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1297,16 +1243,7 @@ export interface ResumeDocumentData {
     | number
     | boolean
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
 }
 /**
  * This interface was referenced by `Config`'s JSON-Schema
@@ -1511,16 +1448,7 @@ export interface ResumeJobData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1548,16 +1476,7 @@ export interface ResumeSkillTagData {
     hasNextPage?: boolean;
     totalDocs?: number;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1608,16 +1527,7 @@ export interface ResumeSkillData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   createdAt: string;
   updatedAt: string;
   deletedAt?: string | null;
@@ -1656,16 +1566,7 @@ export interface ResumeProjectData {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -2615,7 +2516,7 @@ export interface PDFGeneratorSettings {
   generateThrottle?: number | null;
   timeoutBetweenJobs?: number | null;
   maximumRetries: number;
-  skillSorting?: SkillSorting;
+  skillSorting: SkillSorting;
   updatedAt?: string | null;
   createdAt?: string | null;
 }
diff --git a/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts b/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
index 08b7e088..564c4d3d 100644
--- a/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
+++ b/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts b/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
index cc085f7f..c943b729 100644
--- a/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
+++ b/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
index b799f861..68b26d02 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
@@ -5,7 +5,14 @@ vi.mock('@/lib/RedisHandler', () => ({
   set: vi.fn(async () => undefined),
 }))
 
-const { fetchWebsite, getToken } = await import('./UmamiWidget.data')
+const requireSessionMock = vi.fn(async () => undefined)
+
+vi.mock('@/lib/actions/requireSession', () => ({
+  requireSession: () => requireSessionMock(),
+}))
+
+const { getToken } = await import('@/lib/umami/getToken')
+const { fetchWebsite } = await import('./UmamiWidget.data')
 
 describe('UmamiWidget data', () => {
   beforeEach(() => {
@@ -19,6 +26,16 @@ describe('UmamiWidget data', () => {
     vi.restoreAllMocks()
   })
 
+  it('rejects without a session and never calls Umami', async () => {
+    const fetchMock = vi.fn()
+
+    vi.stubGlobal('fetch', fetchMock)
+    requireSessionMock.mockRejectedValueOnce(new Error('You must be signed in to do this.'))
+
+    await expect(fetchWebsite()).rejects.toThrow('You must be signed in to do this.')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it('returns null instead of throwing when Umami is unreachable', async () => {
     vi.spyOn(console, 'error').mockImplementation(() => {})
     vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('fetch failed')))
diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.ts b/src/widgets/UmamiWidget/UmamiWidget.data.ts
index e3fe9069..d4d9529d 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.ts
@@ -2,74 +2,9 @@
 
 import { hoursToSeconds } from 'date-fns'
 
+import { requireSession } from '@/lib/actions/requireSession'
 import { get, set } from '@/lib/RedisHandler'
-
-let token: string | null = null
-let tokenPromise: Promise<string | null> | null = null
-
-const login = async (): Promise<string | null> => {
-  try {
-    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/login`, {
-      method: 'POST',
-      body: JSON.stringify({
-        username: process.env.UMAMI_USERNAME,
-        password: process.env.UMAMI_PASSWORD,
-      }),
-    })
-
-    const data = await response.json()
-    token = (data.token as string) ?? null
-  } catch {
-    token = null
-  }
-
-  return token
-}
-
-const verify = async (): Promise<boolean> => {
-  if (!token) return false
-
-  try {
-    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/verify`, {
-      method: 'POST',
-      headers: {
-        Accept: 'application/json',
-        Authorization: `Bearer ${token}`,
-      },
-    })
-
-    return response.ok
-  } catch {
-    return false
-  }
-}
-
-/**
- * Returns a valid bearer token, verifying the current one first and logging
- * in again if it's missing/invalid. The in-flight promise is shared while
- * pending, so concurrent callers dedupe into a single verify/login flow, but
- * it's cleared once settled so the next call re-checks instead of being
- * stuck on the first result forever.
- */
-export const getToken = async (): Promise<string | null> => {
-  if (tokenPromise) return tokenPromise
-
-  tokenPromise = (async () => {
-    const verified = await verify()
-
-    if (!verified) {
-      await login()
-    }
-
-    return token
-  })()
-
-  try {
-    return await tokenPromise
-  } finally {
-    tokenPromise = null
-  }
-}
+import { getToken } from '@/lib/umami/getToken'
 
 const CACHE_TTL_SECONDS = hoursToSeconds(2)
 
@@ -182,7 +117,13 @@ export type UmamiPageViews = {
   sessions: Metric[]
 }
 
+/**
+ * Every export of this module is a server action, a callable endpoint whichever
+ * page renders the widget, so each one checks the session itself.
+ */
 export const fetchWebsite = async () => {
+  await requireSession()
+
   const url = buildApiUrl('')
 
   return await fetcher<UmamiWebsite>(url)
@@ -193,6 +134,8 @@ export const fetchStats = async ({
   endAt,
   unit,
 }: UmamiStatsParams): Promise<UmamiStats | null> => {
+  await requireSession()
+
   const url = buildApiUrl('stats', {
     startAt,
     endAt,
@@ -206,6 +149,8 @@ export const fetchEvents = async ({
   startAt,
   endAt,
 }: UmamiEventsParams): Promise<UmamiEvent[] | null> => {
+  await requireSession()
+
   const url = buildApiUrl('metrics', {
     startAt,
     endAt,
@@ -219,6 +164,8 @@ export const fetchPaths = async ({
   startAt,
   endAt,
 }: UmamiPathsParams): Promise<UmamiPath[] | null> => {
+  await requireSession()
+
   const url = buildApiUrl('metrics', {
     startAt,
     endAt,
@@ -234,6 +181,8 @@ export const fetchPageViews = async ({
   timezone,
   unit,
 }: UmamiPageViewsParams): Promise<UmamiPageViews | null> => {
+  await requireSession()
+
   const url = buildApiUrl('pageviews', {
     startAt,
     endAt,
diff --git a/syncpack.config.mjs b/syncpack.config.mjs
index 1c8dfd57..5081a3e7 100644
--- a/syncpack.config.mjs
+++ b/syncpack.config.mjs
@@ -2,47 +2,31 @@
 
 /**
  * Keeps families of packages that are released together on the same version.
- *
- * Payload, Storybook and the others each publish a dozen packages from
- * one repo on a shared release train — mixing versions within a family causes
- * subtle runtime breakage rather than an install error, so it is worth
- * enforcing. Each family is held to a single range with `sameRange`: `snapTo` targets a
- * local workspace package, which this single-package repo does not have, so
- * matching ranges is the equivalent guarantee.
- *
- * Run `bun run deps:lint` to check, `bun run deps:fix` to apply.
+ * Run `bun run packages:lint` to check, `bun run packages:fix` to apply.
  *
  * @type {import('syncpack').RcFile}
  */
 export default {
   sortPackages: true,
-  // Mirrors sort-package-json's own default `sortOrder`/alphabetized-content
-  // list exactly (node_modules/sort-package-json's `fields` array — the
-  // fields there marked `over: sortObject`/`sortDependencies`), so a
-  // `syncpack fix` run and a `sort-package-json` run agree on both key
-  // order (sortFirst below) and content order for these fields, instead of
-  // re-shuffling each other's output on alternating commits.
   sortAz: [
-    'maintainers',
+    'bundledDependencies',
+    'bundleDependencies',
     'contributors',
-    'resolutions',
-    'overrides',
     'dependencies',
     'devDependencies',
-    'peerDependencies',
-    'optionalDependencies',
-    'bundledDependencies',
-    'bundleDependencies',
-    'extensionPack',
-    'extensionDependencies',
     'engines',
     'engineStrict',
+    'extensionDependencies',
+    'extensionPack',
+    'maintainers',
+    'optionalDependencies',
+    'overrides',
+    'peerDependencies',
     'preferGlobal',
     'publishConfig',
+    'resolutions',
+    'scripts',
   ],
-  // Full sort-package-json default field order (see that package's `fields`
-  // array) — kept complete rather than trimmed to this repo's current
-  // fields, so it stays correct as fields are added later.
   sortFirst: [
     '$schema',
     'name',
@@ -156,69 +140,54 @@ export default {
     'markdown',
   ],
   source: ['package.json', 'apps/*/package.json', 'packages/*/package.json'],
-
+  /**
+   * Families are pinned, not `sameRange`: every syncpack policy compares one
+   * dependency across several package.json files, so in this single-package
+   * repo only `pinVersion` holds two different dependencies to one version.
+   * To upgrade a family, change its pin and run `bun run packages:fix`.
+   */
   versionGroups: [
-    /**
-     * Packages that live in a family's namespace but are versioned
-     * independently. Listing them first means the family rules below never
-     * see them.
-     */
     {
       label: 'Independently versioned, despite the shared namespace',
       dependencies: [
-        // Storybook's compiler addons track the bundler, not Storybook
         '@storybook/addon-webpack5-compiler-swc',
-        // each Radix primitive ships on its own release line
         '@radix-ui/**',
-        // changelog-github is 0.x while the CLI is 2.x
         '@changesets/changelog-github',
       ],
       packages: ['**'],
       isIgnored: true,
     },
-
     {
       label: 'Payload CMS packages share a release train',
       dependencies: ['payload', '@payloadcms/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^3.93.0',
     },
-
     {
       label: 'Storybook packages share a release train',
       dependencies: ['storybook', '@storybook/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^10.6.0',
     },
-
     {
       label: 'Vitest packages share a release train',
       dependencies: ['vitest', '@vitest/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^4.1.11',
     },
-
-    /**
-     * `playwright` and `@playwright/test` must match exactly: the Docker image
-     * tag in scripts/e2e-docker.sh is pinned to this version, and a mismatch
-     * means the bundled browser revisions disagree.
-     */
     {
-      label: 'Playwright must match the pinned browser image',
+      label: 'Playwright packages are pinned to one version',
       dependencies: ['playwright', '@playwright/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '~1.65.0',
     },
-
     {
-      label: 'React and its DOM/type packages move together',
+      label: 'react and react-dom packages move together',
       dependencies: ['react', 'react-dom'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^19.3.1',
     },
   ],
-
-  /** Range styles, so a family bump does not silently change pinning strategy. */
   semverGroups: [
     {
       label: 'Playwright is pinned to a patch range to match the Docker image',
diff --git a/tsconfig.json b/tsconfig.json
index 149e8817..11b6cd8c 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,11 +7,7 @@
     "incremental": true,
     "isolatedModules": true,
     "jsx": "react-jsx",
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
+    "lib": ["dom", "dom.iterable", "esnext"],
     "module": "esnext",
     "moduleResolution": "bundler",
     "noEmit": true,
@@ -27,22 +23,13 @@
     "strict": false,
     "target": "esnext",
     "paths": {
-      "@/*": [
-        "./src/*"
-      ],
-      "@payload-config": [
-        "./payload.config.ts"
-      ],
-      "react": [
-        "./node_modules/@types/react"
-      ]
+      "@/*": ["./src/*"],
+      "@payload-config": ["./payload.config.ts"],
+      "react": ["./node_modules/@types/react"],
+      "react-dom": ["./node_modules/@types/react-dom"]
     }
   },
-  "exclude": [
-    "node_modules",
-    "out",
-    "tools/oxlint/anti-slop"
-  ],
+  "exclude": ["node_modules", "out", "tools/oxlint/anti-slop"],
   "include": [
     "next-env.d.ts",
     "**/*.ts",
@@ -54,6 +41,6 @@
     ".storybook/**/*.ts",
     ".storybook/**/*.tsx",
     ".storybook/**/*.mdx",
-    "node_modules/storybook/dist/manager/runtime.js",
+    "node_modules/storybook/dist/manager/runtime.js"
   ]
 }