From 7ff96eb0eb0eb1816be6e5a020b5f3cc87840b7c Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:38:00 +0100
Subject: [PATCH 01/30] docs: bring README, AGENTS and llms.txt back in line
 with the code

README: CI section described a ci.yml that no longer exists; rewritten for lint-and-test.yml (incl. Semgrep, disabled E2E) and build-and-deploy.yml (boot checks, single build). Fixed dev/generate/build/seed scripts, env variable table (NEXT_PUBLIC_SERVER_URL, NEXT_PUBLIC_STATUS_PAGE_URL, RESUME_REDIRECT_URL_BASE), API routes and the project structure tree.

AGENTS: dev no longer starts Storybook, all four authenticated SSE channel prefixes, Semgrep convention, plugins/stories/llms.txt notes, and a refreshed Known Issues list (pdfjs-dist pin replaces the removed postcss-merge-rules one).

llms.txt: removed references to src/access, the heartbeat route and the next.config env block.
---
 AGENTS.md |  63 +++++++++++++------
 README.md | 178 +++++++++++++++++++++++++++++++-----------------------
 llms.txt  |  26 +++++---
 3 files changed, 164 insertions(+), 103 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index e59ace98..8e05b086 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,10 +30,12 @@ See `README.md` for setup/run instructions; this file focuses on conventions and
 
 ```bash
 bun install              # install deps (Bun only — see packageManager in package.json)
-bun run dev              # runs Next.js dev server + Storybook in parallel
-bun run dev:app          # Next.js dev server only
-bun run generate         # regenerate Payload types + import map (run after changing collections/fields)
-bun run build            # production build
+bun run dev              # Next.js dev server via scripts/dev.mjs (--tunnel opens the Cloudflare Tunnel)
+bun run dev:app          # plain `next dev`, without the tunnel wrapper
+bun run dev:storybook    # Storybook on :6006 (not started by `bun run dev`)
+bun run generate         # regenerate Next route types, Payload types + import map
+bun run build            # production build (`next build --webpack`)
+bun run typecheck        # tsc --noEmit
 bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
 bun run format           # oxfmt (formatting and import order only)
@@ -59,7 +61,8 @@ Always spell scripts `bun run <script>`: bare `bun test` and `bun build` run Bun
 and bundler, not the package scripts.
 
 Commits go through Lefthook (`lefthook.yml`): `pre-commit` runs `oxfmt` then `oxlint --fix` on
-staged files (re-staging the fixes), `commit-msg` enforces Conventional
+staged files (re-staging the fixes) and, when `package.json` is staged, `syncpack format` + `fix`
+followed by `bun install` (re-staging `bun.lock`); `commit-msg` enforces Conventional
 Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
 `test`, `build`, `ci`, `perf`, `style`, `revert`); scopes are unrestricted.
 
@@ -94,7 +97,8 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   the two hook flavors stay visually distinct — React hooks in `src/lib/hooks/` are camelCase named
   after the hook (`useIsMobile.ts`), Payload lifecycle hooks in `src/lib/payloadHooks/` are
   camelCase named after what they do (`generateChecksum.ts`). Plain utils use camelCase
-  (`generateSlug.ts`).
+  (`generateSlug.ts`). `src/components/hooks/` is an older second home for React hooks (one of
+  them kebab-case, `use-server-sent-events.ts`); put new hooks in `src/lib/hooks/`.
 - **Fields**: folder name has no suffix (`src/fields/Slug/`), but the exported factory function
   has an `XField` suffix (`SlugField`, `TitleField`). Keep this pattern for new fields.
 - **Globals**: naming is currently inconsistent (`SiteSettings`, `SettingsGlobalUser`,
@@ -125,9 +129,9 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   functions), `hooks/` (React hooks), `payloadHooks/` (Payload collection/global lifecycle hooks —
   distinct from `hooks/`, don't conflate the two), `anthropic/` and `mapbox/` (external API
   clients, same shape as `unsplash/`), plus `actions/`, `fetchers/`, `date/`, `i18n/`, `jsonLd/`,
-  `redirects/`, `references/`, `seed/`, `shiki/`, `sse/`, `umami/`, `unsplash/`. A new
-  external API client or hook goes in the matching subfolder; a handful of genuinely standalone
-  utilities stay flat at the top of `src/lib/`.
+  `blog/`, `lexical/`, `migrations/`, `redirects/`, `references/`, `seed/`, `shiki/`, `sse/`,
+  `umami/`, `unsplash/`. A new external API client or hook goes in the matching subfolder; a
+  handful of genuinely standalone utilities stay flat at the top of `src/lib/`.
 - **Collections/Blocks/Fields/Globals** are factory-function based — most fields (e.g.
   `TitleField()`, `SlugField()`) accept an `overrides` object rather than being edited in place.
   Reuse existing field factories instead of inlining raw Payload field configs when one exists.
@@ -150,6 +154,14 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   `*.client.tsx` files and call server actions from `src/lib/actions/` for mutations.
 - **Server actions** (`src/lib/actions/`): `'use server'` functions for admin mutations (job
   rescheduling, cancellation, etc.). Use `useTransition` on the client side when calling them.
+- **Plugins** (`src/plugins/`): `redirects` and `references` are local Payload plugins that add the
+  `Redirects` and `References` collections; `bun run refs:backfill` rebuilds the reference index.
+- **Stories** live in `.storybook/components/*.stories.tsx`, not next to the components; the
+  design-foundation and shader docs are MDX under `.storybook/foundations/` and
+  `.storybook/shaders/`.
+- **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
+  maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
+  content.
 
 ## Environment-specific values
 
@@ -167,13 +179,15 @@ the Next.js bundle; their **handlers** are not. Each handler lives in `handlers/
 config points at it with `handler: handlerPath('<name>.ts')` (Payload loads string handlers at run
 time). A handler module must use `req.payload` instead of `getPayload({ config })`. The web process
 only enqueues jobs (never `runByID`); the worker
-(`scripts/start-worker.mjs`, polling every 5 seconds) runs them.
+(`scripts/start-worker.mjs`, polling every 5 seconds) runs them. The app process runs jobs itself
+only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
 
 ## Security Guardrails (found during review — respect these when touching related code)
 
 - **SSE / Redis channels** (`app/(frontend)/api/sse/route.ts`): the `channel` query param is
   matched against an allowlist (`src/lib/sse/channels.ts`) before `subscribe()` ever sees it, and
-  per-job channels (`bilingual-translate:`, `seed-task:`) additionally require a signed-in
+  per-job channels (`bilingual-translate:`, `seed-task:`, `scheduled-job:`, `resume-generate:`)
+  additionally require a signed-in
   `payload.auth()` session. The public channels in `SSE_CHANNELS` (e.g. `service-status`) stay
   unauthenticated by design. If you add a new channel that carries non-public data, add it to the
   authenticated branch rather than `SSE_CHANNELS` — see the route's own comments for the exact
@@ -193,20 +207,31 @@ only enqueues jobs (never `runByID`); the worker
   `src/types/environment.ts` declares the schema and is the only place the full set of
   variables is enumerated. The one committed env file is `.env.test`, which holds dummy,
   format-valid values for E2E runs.
+- **Semgrep** runs on every PR (`lint-and-test.yml`, rulesets `nodejs`, `typescript`, `react`,
+  `secrets`) and fails the check on any finding. A reviewed, accepted finding is marked on its own
+  line with `// nosemgrep: <rule> -- <reason>` (see `src/components/LogoCarousel/LogoCarousel.tsx`).
 - New authenticated API routes should mirror `app/(frontend)/api/preview/route.ts`'s pattern of
   pairing a shared-secret check with a real `payload.auth()` session check where feasible.
 
 ## Known Issues / Tech Debt (baseline, not blocking, but don't add more)
 
 - `bun run lint` passes but reports pre-existing warnings, mostly `no-explicit-any`, `no-unused-vars`,
-  `no-img-element` and the React Compiler rules (`set-state-in-effect`, `purity`, `refs`), which
+  `no-img-element`, the React Compiler rules (`set-state-in-effect`, `purity`, `refs`), and the
+  backlog of the `tailwindcss/*` and vendored `anti-slop/*` rules (`tools/oxlint/anti-slop/`), which
   `oxlint.config.ts` keeps at `warn` until they are cleaned up.
-- Leftover debug `console.log`s (e.g. `src/collections/ResumeJobs/index.ts`,
-  `src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx`) and commented-out dead code (e.g.
-  `src/collections/ResumeSkillTags/index.ts`) exist and should be cleaned up opportunistically.
-- `package.json` `overrides` pins `postcss-merge-rules` to `9.0.4`: `9.0.6` throws
-  `RangeError: Invalid string length` while cssnano minifies Payload's admin CSS in the
-  production build. Lift the pin once a newer release builds cleanly (`bun run build`).
+- A leftover debug `console.log` (`src/components/VideoMedia/VideoMedia.tsx`) and commented-out dead
+  code (e.g. `src/collections/ResumeSkills/index.ts`,
+  `src/components/ResumeRenderer/sections/Hero/Hero.tsx`) exist and should be cleaned up
+  opportunistically.
+- `package.json` `overrides` pins `pdfjs-dist` to `5.4.296` because `patches/pdfjs-dist@5.4.296.patch`
+  targets that exact version (it gives the fake-worker import a default `workerSrc`, see
+  vercel/next.js#65406). Bumping `pdfjs-dist` means regenerating the patch.
+- The E2E job in `lint-and-test.yml` is commented out, so Playwright only runs locally.
+- `scripts/e2e-docker.sh` pins the Playwright image to `v1.62.1`, behind `@playwright/test`
+  (`~1.63.0`); the script's own comment requires the two to match.
+- `OPENAI_API_KEY` is required by the env schema but read nowhere (all AI calls go through
+  `src/lib/anthropic/`), and `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` is read by the `heartbeatPing`
+  handler but missing from the schema.
 - No app-level rate limiting exists on public API routes.
 - No shared logging abstraction — error logging is ad hoc `console.error` calls.
 
@@ -217,7 +242,7 @@ only enqueues jobs (never `runByID`); the worker
   test; E2E specs live in `e2e/*.spec.ts` (never `*.spec.ts` under `src/`).
 - Shared mocks live in `vitest.setup.ts`: `payload` (`getPayload` stubbed via `importOriginal`
   spread — never replace the whole module, value imports from it are used at runtime),
-  `next/cache` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and `neotraverse` are
+  `next/cache`, `server-only` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and `neotraverse` are
   intentionally NOT mocked — their real behavior is the contract under test.
 - `TZ=UTC` is forced in `vitest.setup.ts` and date tests depend on it. Anything touching
   `Interval.setToX()` or `getLocalISOString` needs `vi.useFakeTimers()` + `vi.setSystemTime()`.
diff --git a/README.md b/README.md
index 9614ad65..94d98e46 100644
--- a/README.md
+++ b/README.md
@@ -12,21 +12,21 @@ This repository contains the source code for the personal website, blog, and res
 - **Framework**: [Next.js 16](https://nextjs.org/) (App Router, React 19)
 - **CMS**: [Payload CMS 3.x](https://payloadcms.com/)
 - **Database**: [MongoDB 8](https://www.mongodb.com/) (via `@payloadcms/db-mongodb`)
-- **Cache & Pub/Sub**: [Redis 8](https://redis.io/) (`@payloadcms/kv-redis`, `@trieb.work/nextjs-turbo-redis-cache`, and custom SSE pub/sub handler)
+- **Cache & Pub/Sub**: [Redis 8](https://redis.io/) (`@payloadcms/kv-redis` for Payload's KV store, plus `src/lib/RedisHandler.ts` for app-level caching and the SSE pub/sub layer)
 - **Storage**: S3-compatible storage ([RustFS](https://rustfs.com) in local dev via Docker, AWS S3 / Cloudflare R2 in production via `@payloadcms/storage-s3`)
 - **Styling**: [Tailwind CSS 4](https://tailwindcss.com/), PostCSS, Tailwind Variants
 - **Component Development**: [Storybook 10](https://storybook.js.org/)
-- **Linting & Formatting**: [Oxlint](https://oxc.rs/docs/guide/usage/linter) and [Oxfmt](https://oxc.rs/docs/guide/usage/formatter) (no ESLint/Prettier)
+- **Linting & Formatting**: [Oxlint](https://oxc.rs/docs/guide/usage/linter) and [Oxfmt](https://oxc.rs/docs/guide/usage/formatter) (no ESLint/Prettier), with `oxlint-tailwindcss` and a vendored `anti-slop` rule plugin (`tools/oxlint/anti-slop/`)
 - **Package Manager**: [Bun](https://bun.sh/) (`^1.4.0`, pinned `bun@1.4.2`); Node.js still runs Next, Payload and the scripts
 - **Testing**: [Vitest](https://vitest.dev/) (Unit), [Playwright](https://playwright.dev/) (E2E)
 - **Integrations & Services**:
   - **Analytics**: [Umami](https://umami.is/) (Optional)
-  - **Transactional Email**: [UseSend](https://usesend.com/) / [React Email](https://react.email/) (Optional)
-  - **AI Metadata & Alt-Text**: OpenAI / Anthropic (Optional)
-  - **Address & Geocoding**: Mapbox (Optional)
+  - **Transactional Email**: [UseSend](https://usesend.com/) / [React Email](https://react.email/)
+  - **AI Metadata, Alt-Text, Excerpts & Translation**: Anthropic Claude via the [AI SDK](https://ai-sdk.dev/) (`src/lib/anthropic/`)
+  - **Address & Geocoding**: Mapbox
   - **Stock Photos**: Unsplash API (Optional)
   - **Icons**: Self-hosted Iconify API (`https://icons.heene.io`)
-  - **Dev Tunnel**: Cloudflare Tunnel (Optional)
+  - **Dev Tunnel**: Cloudflare Tunnel (Optional, `bun run dev --tunnel`)
 
 ---
 
@@ -77,7 +77,7 @@ bun install
 
 ### 4. Generate Payload Types & Import Map
 
-Payload requires generated TypeScript types and an import map for the admin panel:
+Payload requires generated TypeScript types and an import map for the admin panel (this also runs `next typegen` for the route types):
 
 ```bash
 bun run generate
@@ -87,17 +87,18 @@ bun run generate
 
 ### 5. Run the Application
 
-Start the development server (runs Next.js dev server and Storybook in parallel):
+Start the Next.js development server:
 
 ```bash
-bun run dev
+bun run dev              # http://localhost:3000
+bun run dev --tunnel     # same, also exposed through the Cloudflare Tunnel (needs CLOUDFLARE_TUNNEL_*)
 ```
 
-Or run services independently:
+Storybook and the email previews run as separate processes:
 
 ```bash
-bun run dev:app          # Next.js dev server only (http://localhost:3000)
-bun run dev:storybook    # Storybook only (http://localhost:6006)
+bun run dev:app          # Plain `next dev`, without the --tunnel wrapper
+bun run dev:storybook    # Storybook (http://localhost:6006)
 bun run dev:email        # React Email preview server (http://localhost:3005)
 ```
 
@@ -113,11 +114,14 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 ## Entry Points
 
 - **Next.js App Router**:
-  - `app/(frontend)/`: Public website pages, layouts, and API routes (`/api/preview`, `/api/sse`, `/api/heartbeat`, `/api/health/*`, etc.). Dynamic pages are under `[slug]/`.
-  - `app/(payload)/`: Payload CMS admin panel routes (`/admin`).
+  - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
+  - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
+  - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
+  - `app/robots.ts`, `app/sitemap.ts`: Crawler rules and the sitemap.
+- **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
-- **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`.
-- **Dev Runner**: `scripts/dev.mjs` (handles `--tunnel` Cloudflare tunnel argument and orchestrates dev processes).
+- **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`. The web process only enqueues jobs; the worker runs them.
+- **Dev Runner**: `scripts/dev.mjs` (a `next dev` wrapper that owns the `--tunnel` flag).
 - **Environment Loader**: `scripts/load-env.mjs` (fetches active Doppler secrets into `.env.local`).
 
 ---
@@ -126,18 +130,19 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 
 | Script | Description |
 | --- | --- |
-| `bun run dev` | Starts Next.js dev server and Storybook in parallel (supports `--tunnel`). |
-| `bun run dev:app` | Starts Next.js development server only (`localhost:3000`). |
+| `bun run dev` | Starts the Next.js dev server through `scripts/dev.mjs` (`localhost:3000`, supports `--tunnel`). |
+| `bun run dev:app` | Starts the Next.js dev server directly, without the tunnel wrapper. |
 | `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
-| `bun run build` | Production build (compiles the Next.js bundle). |
+| `bun run build` | Production build (`next build --webpack`). |
 | `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
 | `bun run start:storybook` | Serves the static Storybook build on port 3020. |
 | `bun run start:app` | Starts the production Next.js application server. |
 | `bun run start:worker` | Runs standalone background jobs worker and health monitoring server. |
 | `bun run load-env` | Writes `.env.local` from active Doppler config (`--check` validates drift). |
-| `bun run generate` | Runs `generate:types` and `generate:importmap` in parallel. |
-| `bun run generate:types` | Generates TypeScript types for Payload collections and globals (`src/types/payload.ts`). |
-| `bun run generate:importmap` | Regenerates Payload admin component import map. |
+| `bun run generate` | Runs `generate:next-types`, `generate:payload-types` and `generate:importmap` in sequence. |
+| `bun run generate:next-types` | Generates Next.js route types (`next typegen`). |
+| `bun run generate:payload-types` | Generates TypeScript types for Payload collections and globals (`src/types/payload.ts`). |
+| `bun run generate:importmap` | Regenerates Payload admin component import map (`app/(payload)/admin/importMap.js`). |
 | `bun run _payload` | Wrapper to execute Payload CLI commands (used by `migrate`, `generate` and the other scripts). |
 | `bun run migrate` | Runs database migrations via Payload CLI. |
 | `bun run ci` | Local convenience: runs database migrations and a full production build (CI itself runs the steps separately). |
@@ -151,10 +156,10 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 | `bun run chore:format` | Formats `package.json` field order using Syncpack. |
 | `bun run chore:reinstall` | Cleans `node_modules` and `bun.lock`, then runs fresh `bun install`. |
 | `bun run dev:email` | Starts React Email development server on port 3005 (`src/emails`). |
-| `bun run seed:topics` | Seeds fixture blog topics (`--clean` to remove). |
-| `bun run seed:posts` | Seeds fixture blog posts and media (`--clean` to remove, `--count <n>` to set quantity). |
-| `bun run seed:pages` | Seeds fixture pages (`--clean` to remove, `--count <n>` to set quantity). |
-| `bun run seed:resume-documents` | Seeds an older and a newer fixture resume document without PDFs (`--clean` to remove). |
+| `bun run seed:topics` | Seeds fixture blog topics (`-- --count <n>`, default 6; `seed:topics:clean` removes them). |
+| `bun run seed:posts` | Seeds fixture blog posts and media (`-- --count <n>`, default 10; `seed:posts:clean` removes them). |
+| `bun run seed:pages` | Seeds fixture pages (`-- --count <n>`, default 10; `seed:pages:clean` removes them). |
+| `bun run seed:resume-documents` | Seeds an older and a newer fixture resume document without PDFs (`seed:resume-documents:clean` removes them). |
 | `bun run links:migrate` | Runs database migration for link field naming. |
 | `bun run refs:backfill` | Rebuilds content reference index table. |
 | `bun run test` | Runs unit tests once via Vitest. |
@@ -162,7 +167,7 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 | `bun run test:coverage` | Runs Vitest with v8 code coverage reporting. |
 | `bun run test:e2e` | Runs Playwright E2E tests against `.env.test`. |
 | `bun run test:e2e:ui` | Runs Playwright E2E tests with interactive UI. |
-| `bun run test:e2e:docker` | Runs Playwright E2E tests inside Docker Chromium container. |
+| `bun run test:e2e:docker` | Runs Playwright E2E tests inside Docker Chromium container, against a dev server on the host. |
 | `bun run release` | Runs semantic-release to calculate version, tag, and publish changelog. |
 | `bun run release:dry-run` | Runs semantic-release in dry-run mode. |
 
@@ -178,10 +183,12 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | --- | --- | --- |
 | `NODE_ENV` | Optional (`development` \| `production` \| `test`) | Runtime environment (defaults to `development`). |
 | `SERVER_HOST` | **Required** | Host/port used for server-side URL construction. |
-| `SERVER_URL` | **Required** (URL) | Public URL of the server (inlined into client bundle at build time). |
+| `SERVER_URL` | **Required** (URL) | Public URL of the site, read server-side. |
+| `NEXT_PUBLIC_SERVER_URL` | **Required** (URL) | Same value as `SERVER_URL`, exposed to the browser for the live-preview listener. |
+| `RESUME_REDIRECT_URL_BASE` | **Required** (URL) | Base URL for the redirect target of `/download/resume.pdf` and localized resume jobs. |
 | `PAYLOAD_SECRET` | **Required** | Secret key used to encrypt Payload JWT tokens. |
 | `PREVIEW_SECRET` | **Required** | Shared secret for draft/preview authentication. |
-| `CRON_SECRET` | **Required** | Secret token reserved for securing cron/scheduled tasks. |
+| `CRON_SECRET` | **Required** | Reserved for securing cron/scheduled routes; declared but not read anywhere yet. |
 
 ### Database & Cache
 
@@ -204,16 +211,17 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
-| `PAYLOAD_JOBS_ENABLE_APP_WORKERS` | Optional (`true` \| `false`) | Enables embedded job workers in the main Next.js app process (defaults to `false`). |
+| `PAYLOAD_JOBS_ENABLE_APP_WORKERS` | Optional (`true` \| `false`) | Enables embedded job workers in the main Next.js app process (defaults to `false`; the standalone worker normally runs the jobs). |
 
 ### Status Page
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
-| `STATUS_PAGE_URL` | **Required** (URL) | Public status page URL (inlined into client bundle). |
-| `STATUS_PAGE_HEARTBEAT_URL` | **Required** (URL) | Heartbeat monitoring URL pinged server-side. |
+| `NEXT_PUBLIC_STATUS_PAGE_URL` | **Required** (URL) | Public status page URL, read in the browser. |
+| `STATUS_PAGE_HEARTBEAT_URL` | **Required** (URL) | Status page heartbeat endpoint the server fetches (Redis-cached) for the service-status indicator. |
+| `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` | Optional (URL), not in the schema | Push monitor URL the worker's `heartbeatPing` job calls every minute; without it the job only logs. |
 
-### Analytics & Email (Optional)
+### Analytics & Email
 
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
@@ -231,8 +239,8 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
 | `NEXT_PUBLIC_ICONIFY_API` | Optional (URL) | Self-hosted Iconify API (defaults to `https://icons.heene.io`). |
-| `OPENAI_API_KEY` | **Required** | API key for OpenAI (used for automated alt-text and meta descriptions). |
-| `ANTHROPIC_API_KEY` | **Required** | API key for Anthropic Claude (alternative AI generation provider). |
+| `OPENAI_API_KEY` | **Required** | Still required by the schema, but no code reads it; any non-empty value passes. |
+| `ANTHROPIC_API_KEY` | **Required** | API key for Anthropic Claude (alt-text, meta descriptions, blog excerpts, resume translation). |
 | `MAPBOX_API_KEY` | **Required** | Mapbox access token for address and coordinate lookups. |
 | `UNSPLASH_ACCESS_KEY` | Optional | Unsplash API access key for stock photo search & direct media import. |
 
@@ -244,7 +252,7 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | `CLOUDFLARE_TUNNEL_URL` | Optional (URL) | Target URL for Cloudflare tunnel. |
 | `CLOUDFLARE_TUNNEL_TOKEN` | Optional | Cloudflare tunnel authentication token. |
 
-> **Build-Time Inlining Notice**: route shells rendered at build time with `cacheComponents: true` capture server-side values. Ensure correct values are present during `bun run build`.
+> **Build-Time Inlining Notice**: `NEXT_PUBLIC_*` values are inlined into the client bundle, and route shells prerendered with `cacheComponents: true` capture server-side values. Ensure correct values are present during `bun run build`.
 
 ---
 
@@ -254,43 +262,57 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 .
 ├── app/                          # Next.js App Router
 │   ├── (frontend)/               # Public website routes, layouts, and API routes
-│   │   ├── [slug]/               # Dynamic page routes
-│   │   ├── api/                  # API endpoints (preview, sse, health, heartbeat, icons, etc.)
+│   │   ├── [slug]/               # CMS-driven pages
+│   │   ├── api/                  # Route handlers (preview, sse, health, icons/collection)
+│   │   ├── blog/                 # Blog listing, topics, posts, and the RSS feed (feed.xml)
+│   │   ├── download/             # /download/resume.pdf redirect
+│   │   ├── resume/               # Resume documents by slug
 │   │   └── layout.tsx            # Frontend root layout
-│   └── (payload)/                # Payload CMS admin routes
-│       ├── admin/                # Payload admin UI routes
-│       ├── api/                  # Payload REST & GraphQL API endpoints
-│       └── layout.tsx            # Payload admin layout
+│   ├── (payload)/                # Payload CMS admin routes
+│   │   ├── admin/                # Payload admin UI routes (and the generated import map)
+│   │   ├── api/                  # Payload REST API endpoints
+│   │   └── layout.tsx            # Payload admin layout
+│   ├── llms.txt/                 # Public /llms.txt route
+│   ├── robots.ts                 # Crawler rules
+│   └── sitemap.ts                # Sitemap
 ├── src/                          # Application source code
-│   ├── access/                   # Payload access control policies (anyone, authenticated, etc.)
-│   ├── blocks/                   # Reusable Payload blocks (Hero, Content, Resume, Media, etc.)
-│   ├── collections/              # Payload collections (Media, Pages, Posts, Resume*, Users, etc.)
-│   ├── components/               # React UI components & Storybook stories
-│   ├── contexts/                 # React context providers (theme, locale, etc.)
+│   ├── blocks/                   # Payload blocks (rich text, code, feature cards, resume sections, etc.)
+│   ├── collections/              # Payload collections (Media*, Pages, BlogPosts, BlogTopics, Resume*, Redirects, References, Users)
+│   ├── components/               # React UI components
 │   ├── emails/                   # React Email templates
 │   ├── fields/                   # Reusable Payload field factories (Slug, HeroSlides, Link, etc.)
 │   ├── fonts/                    # Custom font definitions
-│   ├── globals/                  # Payload globals (SiteSettings, PDFGeneratorSettings, etc.)
-│   ├── hooks/                    # Custom React hooks
-│   ├── jobs-queue/               # Payload background jobs, tasks, workflows, and health checks
-│   ├── lib/                      # Utilities (RedisHandler, SSE, image optimization, seeding, etc.)
+│   ├── globals/                  # Payload globals (SiteSettings, SettingsGlobalUser, PDFGeneratorSettings)
+│   ├── jobs-queue/               # Payload job tasks, workflows, their handlers, and health checks
+│   ├── lib/                      # Utilities, grouped by domain: access/, hooks/, payloadHooks/, actions/,
+│   │                             #   fetchers/, sse/, seed/, redirects/, references/, anthropic/, etc.
 │   ├── migrations/               # Database migration scripts
 │   ├── pdf/                      # PDF resume generator components (@react-pdf/renderer)
-│   ├── plugins/                  # Custom Payload plugins
-│   ├── stories/                  # Global Storybook configurations & documentation
+│   ├── plugins/                  # Custom Payload plugins (redirects, references)
 │   ├── styles/                   # CSS and Tailwind 4 stylesheets
 │   ├── types/                    # TypeScript declarations, environment schema, generated types
 │   └── widgets/                  # Custom Payload dashboard widgets
-├── public/                       # Static public assets (favicons, icons, robots.txt)
-├── scripts/                      # Utility scripts (dev runner, worker, seeders, environment loader)
-├── docs/                         # Specifications, architecture notes, and design plans
+├── .storybook/                   # Storybook config, component stories, and foundations/shaders docs (MDX)
+├── .github/                      # Workflows (lint-and-test, build-and-deploy), setup action, Dependabot
+├── public/                       # Static public assets (favicons, OG image, Payload admin assets)
+├── scripts/                      # Utility scripts (dev runner, worker, seeders, environment loader, image assembly)
+├── tools/oxlint/anti-slop/       # Vendored Oxlint rule plugin
+├── patches/                      # Bun dependency patches (pdfjs-dist)
 ├── e2e/                          # Playwright end-to-end test specs
+├── Dockerfile                    # COPY-only images: app, worker, storybook
 ├── docker-compose.yml            # Local development infrastructure (MongoDB, Redis, RustFS)
-├── next.config.ts                # Next.js configuration & Payload integration
+├── next.config.ts                # Next.js configuration, env validation & Payload integration
 ├── payload.config.ts             # Payload CMS master configuration
+├── proxy.ts                      # Next.js request proxy (blog URL canonicalization)
+├── instrumentation.ts            # Next.js server instrumentation hook
+├── instrumentation-client.ts     # First-pageview Umami tracking
+├── llms.txt                      # Entry points of this repository for AI coding agents
 ├── oxlint.config.ts              # Oxlint rules
 ├── oxfmt.config.ts               # Oxfmt formatting and import order
 ├── lefthook.yml                  # Git hooks
+├── commitlint.config.mjs         # Conventional Commits rules
+├── release.config.mjs            # semantic-release configuration
+├── syncpack.config.mjs           # Dependency version groups
 ├── bunfig.toml                   # Bun install settings
 ├── playwright.config.ts          # Playwright E2E configuration
 ├── vitest.config.ts              # Vitest unit test configuration
@@ -313,7 +335,7 @@ bun run test:coverage    # Generate test coverage report
 ```
 
 - Configuration: `vitest.config.ts`.
-- Mocks & environment: `vitest.setup.ts` forces `TZ=UTC` and mocks `payload`, `next/cache`, and `redis`. Real implementations of `tailwind-merge`, `date-fns`, `slugify`, `pupa`, and `neotraverse` are tested directly.
+- Mocks & environment: `vitest.setup.ts` forces `TZ=UTC` and mocks `payload`, `next/cache`, `server-only`, and `redis`. Real implementations of `tailwind-merge`, `date-fns`, `slugify`, `pupa`, and `neotraverse` are tested directly.
 
 ### End-to-End Tests (Playwright)
 
@@ -329,6 +351,9 @@ bun run test:e2e:docker  # Run tests in Playwright Docker Chromium container
 1. Run `docker compose up -d` so MongoDB, Redis, and RustFS storage are active.
 2. E2E tests execute using `.env.test` with dummy valid credentials.
 3. `bun run test:e2e` automatically starts or reuses the local dev server. For Docker tests (`bun run test:e2e:docker`), start the dev server beforehand with `bun run dev:app`.
+4. `E2E_BASE_URL`, `E2E_SERVER_COMMAND` and `E2E_NO_SERVER` override the target URL, the server command, and whether Playwright starts a server at all (see `playwright.config.ts`).
+
+> The E2E job in CI is currently disabled (commented out in `lint-and-test.yml`); run the suite locally.
 
 ---
 
@@ -338,20 +363,26 @@ Seed fixture content into local MongoDB for development and testing:
 
 ```bash
 # Seed Topics (categories)
-bun run seed:topics          # Creates fixture blog topics
+bun run seed:topics          # Creates 6 fixture blog topics
 bun run seed:topics:clean    # Removes seeded blog topics
 
 # Seed Blog Posts (with images)
-bun run seed:posts           # Creates blog topics & 30 posts with downloaded images
+bun run seed:posts           # Creates blog topics & 10 posts with downloaded images
 bun run seed:posts:clean     # Removes seeded posts and associated media
-# Pass custom count via: bun run seed:posts -- --count 10
+# Pass custom count via: bun run seed:posts -- --count 25
 
 # Seed Pages
-bun run seed:pages           # Creates standard fixture pages
+bun run seed:pages           # Creates 10 fixture pages
 bun run seed:pages:clean     # Removes seeded pages
 # Pass custom count via: bun run seed:pages -- --count 5
+
+# Seed Resume Documents
+bun run seed:resume-documents        # Creates an older and a newer resume document (no PDFs)
+bun run seed:resume-documents:clean  # Removes them
 ```
 
+The same seed/clean logic (`src/lib/seed/`) is also available from the admin panel, where it runs as a queued job.
+
 - Seeders are idempotent and match by slug.
 - Article prose and layouts are deterministic per title using a seeded pseudo-random generator.
 - Images are downloaded from `picsum.photos` and uploaded into Payload media.
@@ -360,19 +391,18 @@ bun run seed:pages:clean     # Removes seeded pages
 
 ## CI / CD & Deployment
 
-Everything is built in CI; Docker images only `COPY` finished output (no package manager, installs or builds inside an image). The checks live in `.github/workflows/ci.yml` and are reused by pull requests (`lint-and-test.yml`) and pushes (`build-and-deploy.yml`).
+Everything is built in CI; Docker images only `COPY` finished output (no package manager, installs or builds inside an image). Pull requests are gated by `lint-and-test.yml`, pushes are built and deployed by `build-and-deploy.yml`. Both use the composite action `.github/actions/setup` (Bun, Node.js 26, `bun install --frozen-lockfile`).
 
-- **`ci.yml`** (pull requests and pushes):
-  1. **Lint**: `commitlint` (PRs), `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files match `bun run generate`, and `actionlint`.
-  2. **Unit Tests**: `vitest run --coverage`.
-  3. **Compile**: `next build --experimental-build-mode=compile` with `.env.test` values. It needs no database and must not inline any environment-specific value; `scripts/check-env-leak.mjs` fails the job if a `.env.test` value ends up in `.next`.
-  4. **E2E** (environment `Testing`): resets the shared Testing services (Mongo and Redis rebuilt through Dokploy, S3 bucket emptied; `scripts/reset-test-services.mjs`), migrates, seeds, runs `next build --experimental-build-mode=generate` (prerender/PPR), assembles `out/web` and runs Playwright against `node out/web/server.js`. Forks and dependabot cannot read the Testing secrets and use local containers (`docker compose`) instead.
-- **Pushes to `develop` / `main`** (`build-and-deploy.yml`):
-  1. **Semantic Versioning**: semver bump and tag/changelog via `semantic-release`. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
-  2. **CI**: the jobs above.
-  3. **Deploy** (environment `Production` on `main`, `Development` on `develop`): downloads the tested compile, runs `bun run migrate` against the target database, runs `--experimental-build-mode=generate` with that environment's values, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks.
+- **Pull requests to `main` / `develop`** (`lint-and-test.yml`, required by branch protection):
+  1. **Lint**: `commitlint` over the PR's commits, `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files (`src/types/payload.ts`, the admin import map) match `bun run generate`, and `actionlint`.
+  2. **Semgrep**: static security analysis with the `nodejs`, `typescript`, `react` and `secrets` rulesets. Accepted findings are marked in place with `// nosemgrep: <rule>` and a reason.
+  3. **Unit Tests**: `vitest run --coverage`, with the coverage report uploaded as an artifact.
+  4. **E2E**: currently disabled (the job is commented out in the workflow).
+- **Pushes to `develop` / `main`** (`build-and-deploy.yml`, also runnable through `workflow_dispatch` on those two branches):
+  1. **Bump version**: semver bump, tag and changelog via `semantic-release` (`release.config.mjs`), committed as a GitHub App so the push passes `main`'s ruleset. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
+  2. **Deploy** (environment `Production` on `main`, `Development` on `develop`): connects to the tailnet, runs `bun run migrate` against the target database, runs one `next build --webpack` with that environment's values, builds Storybook, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, boot-checks each one as a real container (`/api/health` on 3000, `/health` on 3010, Storybook on 3020), pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks. The lint and test jobs are not re-run here; the merged commit already passed them as PR checks.
 
-Each push to `main`/`develop` builds and deploys against that environment's real secrets, so environment-specific values the browser needs (site URL, status page, Umami) are ordinary `NEXT_PUBLIC_*` environment variables read via `process.env.NEXT_PUBLIC_*`.
+Each push to `main`/`develop` builds and deploys against that environment's real secrets, so environment-specific values the browser needs (site URL, status page, Umami, the Iconify API) are ordinary `NEXT_PUBLIC_*` environment variables read via `process.env.NEXT_PUBLIC_*`.
 
 ---
 
@@ -380,7 +410,7 @@ Each push to `main`/`develop` builds and deploys against that environment's real
 
 Lefthook (`lefthook.yml`) manages Git hooks, installed automatically during `bun install`:
 
-- `pre-commit`: Runs `oxfmt` and `oxlint --fix` on staged files, and syncpack when `package.json` changes.
+- `pre-commit`: Runs `oxfmt` and `oxlint --fix` on staged files. When `package.json` is staged it also runs syncpack (`format` + `fix`) and `bun install`, re-staging `bun.lock`.
 - `commit-msg`: Enforces [Conventional Commits](https://www.conventionalcommits.org/) format using `commitlint`.
 
 Example valid commit messages:
diff --git a/llms.txt b/llms.txt
index bf4a0a49..f42913a8 100644
--- a/llms.txt
+++ b/llms.txt
@@ -12,7 +12,7 @@ important file: read it first, every time.
 
 - [AGENTS.md](AGENTS.md): Required reading before any change — stack, code style, architecture
   notes, and known security guardrails (public SSE channels remain unauthenticated by design,
-  unsanitized raw SVG rendering, unenforced `CRON_SECRET`).
+  raw SVG is sanitized server-side before rendering, `CRON_SECRET` is declared but unenforced).
 - [README.md](README.md): Setup and local development — Doppler-based env config, Docker
   services, available scripts, project structure, testing, CI/deployment.
 
@@ -20,8 +20,11 @@ important file: read it first, every time.
 
 - [payload.config.ts](payload.config.ts): Payload CMS configuration (collections, globals,
   plugins, S3 storage, KV cache) — repo root, not under `src/`.
-- [next.config.ts](next.config.ts): Next.js configuration, including the `env:` block that
-  inlines `SERVER_URL`, `STATUS_PAGE_URL`, and `SENTRY_DSN` at build time.
+- [next.config.ts](next.config.ts): Next.js configuration; validates the environment against
+  the Zod schema at startup and owns the opt-in dev tunnel. There is no `env:` block: browser
+  values are plain `NEXT_PUBLIC_*` variables.
+- [proxy.ts](proxy.ts): Next.js 16 request proxy (the former `middleware.ts`); canonicalizes blog
+  listing URLs.
 - [src/types/environment.ts](src/types/environment.ts): Zod schema and source of truth for all
   environment variables; validated at process start.
 - [docker-compose.yml](docker-compose.yml): Local infrastructure (MongoDB, Redis, S3-compatible
@@ -34,22 +37,25 @@ important file: read it first, every time.
 
 ## Source Layout
 
-- [app/](app): Next.js App Router — `(frontend)` for the public site and its API routes
-  (preview, sse, heartbeat), `(payload)` for the admin panel.
-- [src/collections/](src/collections): Payload Collections (Media, Pages, BlogPosts, Resume*,
-  Users, etc.).
+- [app/](app): Next.js App Router — `(frontend)` for the public site and its route handlers
+  (preview, sse, health, icons/collection, the blog RSS feed, the resume download), `(payload)`
+  for the admin panel and Payload's REST API, `llms.txt/` for the site's public `/llms.txt`.
+- [src/collections/](src/collections): Payload Collections (Media*, Pages, BlogPosts,
+  BlogTopics, Resume*, Redirects, References, Users).
 - [src/globals/](src/globals): Payload Globals (SiteSettings, PDFGeneratorSettings, etc.).
 - [src/blocks/](src/blocks): Reusable Payload Blocks (resume sections, content blocks).
 - [src/fields/](src/fields): Custom/reusable Payload field factories.
-- [src/access/](src/access): Access control functions — no role system; any authenticated
-  Payload user is fully trusted.
+- [src/lib/access/](src/lib/access): Access control functions — no role system; any
+  authenticated Payload user is fully trusted.
 - [src/components/](src/components): React components.
 - [src/lib/](src/lib): Framework-agnostic utilities, including `RedisHandler.ts` (cache +
   pub/sub for SSE) and `lib/seed/` (shared seed/clean logic for fixture data, used by both
   CLI scripts and the admin panel).
 - [src/emails/](src/emails): React Email templates and rendering (contact form notifications).
 - [src/pdf/](src/pdf): PDF generation (resume export).
-- [src/jobs-queue/](src/jobs-queue): Payload Jobs Queue tasks/workflows.
+- [src/jobs-queue/](src/jobs-queue): Payload Jobs Queue task/workflow configs plus their
+  handlers (`handlers/`), which only the standalone worker (`scripts/start-worker.mjs`) runs.
+- [src/plugins/](src/plugins): Local Payload plugins (redirects, references).
 - [src/widgets/](src/widgets): Custom Payload dashboard widgets (async server components registered
   in `payload.config.ts`; client parts call server actions from `src/lib/actions/`).
 - [src/lib/actions/](src/lib/actions): Server actions (`'use server'`) for admin mutations (job

From 03db130300edbc48919863f08ab481f9e5060ac3 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:46:50 +0100
Subject: [PATCH 02/30] refactor(app): move robots and sitemap into the
 frontend route group

Also drops .github/actionlint.yaml, whose only entry configured the removed ci.yml, and updates README and AGENTS for the new paths.

global-error.tsx stays at the app root: Next only resolves it there.
---
 .github/actionlint.yaml             | 7 -------
 AGENTS.md                           | 2 +-
 README.md                           | 8 +++++---
 app/{ => (frontend)}/robots.test.ts | 0
 app/{ => (frontend)}/robots.ts      | 0
 app/{ => (frontend)}/sitemap.ts     | 0
 6 files changed, 6 insertions(+), 11 deletions(-)
 delete mode 100644 .github/actionlint.yaml
 rename app/{ => (frontend)}/robots.test.ts (100%)
 rename app/{ => (frontend)}/robots.ts (100%)
 rename app/{ => (frontend)}/sitemap.ts (100%)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 56d26d63..00000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-paths:
-  .github/workflows/ci.yml:
-    ignore:
-      # The E2E job reads these from the Testing environment (`environment:
-      # Testing`), which a reusable workflow gets without declaring them under
-      # `workflow_call.secrets`; declaring them there left them empty.
-      - 'property "(test_services_host|database_url|redis_url|s3_endpoint|s3_bucket|s3_region|s3_access_key|s3_secret_key|ts_oauth_client_id|ts_oauth_secret)" is not defined'
diff --git a/AGENTS.md b/AGENTS.md
index 8e05b086..69007ce1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -145,7 +145,7 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   only inside the grid's Suspense boundary so the shell still prerenders. `src/lib/blog/listing.ts`
   owns the params (sort options, parsing, href building); `proxy.ts` uses it to redirect
   non-canonical forms (legacy `/page/<n>` segments, `page=1`, unknown sorts) and to mark non-default
-  sorts `noindex`. The RSS feed (`/blog/feed.xml`) and `app/sitemap.ts` cache under the `posts` tag,
+  sorts `noindex`. The RSS feed (`/blog/feed.xml`) and `app/(frontend)/sitemap.ts` cache under the `posts` tag,
   which `revalidateBlogPost` invalidates.
 - **Dashboard widgets** (`src/widgets/`): async server components registered in `payload.config.ts`
   under `admin.dashboard.widgets`. Each widget has a `slug`, `Component` path, and optional
diff --git a/README.md b/README.md
index 94d98e46..02752b42 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,8 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
   - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
   - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
   - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
-  - `app/robots.ts`, `app/sitemap.ts`: Crawler rules and the sitemap.
+  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap.
+  - `app/global-error.tsx`: Root error boundary. It has to stay at the root of `app/`; Next.js does not look for it inside a route group.
 - **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
 - **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`. The web process only enqueues jobs; the worker runs them.
@@ -267,14 +268,15 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 │   │   ├── blog/                 # Blog listing, topics, posts, and the RSS feed (feed.xml)
 │   │   ├── download/             # /download/resume.pdf redirect
 │   │   ├── resume/               # Resume documents by slug
+│   │   ├── robots.ts             # Crawler rules
+│   │   ├── sitemap.ts            # Sitemap
 │   │   └── layout.tsx            # Frontend root layout
 │   ├── (payload)/                # Payload CMS admin routes
 │   │   ├── admin/                # Payload admin UI routes (and the generated import map)
 │   │   ├── api/                  # Payload REST API endpoints
 │   │   └── layout.tsx            # Payload admin layout
 │   ├── llms.txt/                 # Public /llms.txt route
-│   ├── robots.ts                 # Crawler rules
-│   └── sitemap.ts                # Sitemap
+│   └── global-error.tsx          # Root error boundary (must stay at the app root)
 ├── src/                          # Application source code
 │   ├── blocks/                   # Payload blocks (rich text, code, feature cards, resume sections, etc.)
 │   ├── collections/              # Payload collections (Media*, Pages, BlogPosts, BlogTopics, Resume*, Redirects, References, Users)
diff --git a/app/robots.test.ts b/app/(frontend)/robots.test.ts
similarity index 100%
rename from app/robots.test.ts
rename to app/(frontend)/robots.test.ts
diff --git a/app/robots.ts b/app/(frontend)/robots.ts
similarity index 100%
rename from app/robots.ts
rename to app/(frontend)/robots.ts
diff --git a/app/sitemap.ts b/app/(frontend)/sitemap.ts
similarity index 100%
rename from app/sitemap.ts
rename to app/(frontend)/sitemap.ts

From 3e4b70c227c01abf8e4a44de2ab4476c3d1098d5 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:52:12 +0100
Subject: [PATCH 03/30] fix(app): load stylesheet and fonts in the global error
 boundary

global-error replaces the root layout, so the frontend CSS and font variables its classes rely on were never loaded and the page rendered unstyled.
---
 app/global-error.tsx | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/global-error.tsx b/app/global-error.tsx
index b50dd94c..26a366a7 100644
--- a/app/global-error.tsx
+++ b/app/global-error.tsx
@@ -1,9 +1,15 @@
 'use client'
 
+import '#frontend.css'
+import PPSupplyMono from '@/fonts/pp-supply-mono/next'
+import PPSupplySans from '@/fonts/pp-supply-sans/next'
+
 /**
  * Root error boundary.
  *
- * It replaces the entire document, so it carries its own html/body.
+ * It replaces the entire document, root layout included, so it carries its own
+ * html/body and loads the stylesheet and fonts itself. Next only resolves this
+ * file at the root of `app/`, never inside a route group.
  */
 export default function GlobalError({
   error,
@@ -15,7 +21,11 @@ export default function GlobalError({
   reset: () => void
 }) {
   return (
-    <html lang="en">
+    <html
+      lang="en"
+      className={`${PPSupplySans.variable} ${PPSupplyMono.variable}`}
+      data-theme="system"
+    >
       <body className="flex min-h-svh flex-col items-center justify-center gap-6 bg-background p-8 text-foreground">
         <div className="flex max-w-md flex-col items-center gap-4 text-center">
           <h1 className="font-mono text-2xl font-semibold">Something went wrong</h1>

From f89942c1b2401bf6269c7c1bc199000cc4e67f99 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:52:14 +0100
Subject: [PATCH 04/30] feat(seo): serve one robots rule for every crawler

Drops the per-bot split that limited everything except search engines and link-preview bots to /llms.txt. Tests follow the single rule.
---
 app/(frontend)/robots.test.ts | 28 +++++++++++-----------------
 app/(frontend)/robots.ts      | 22 +---------------------
 2 files changed, 12 insertions(+), 38 deletions(-)

diff --git a/app/(frontend)/robots.test.ts b/app/(frontend)/robots.test.ts
index bfc43e01..443698a4 100644
--- a/app/(frontend)/robots.test.ts
+++ b/app/(frontend)/robots.test.ts
@@ -2,12 +2,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import robots from './robots'
 
-const rulesFor = async (agent: string) => {
+const allRules = async () => {
   const { rules } = await robots()
 
-  return (Array.isArray(rules) ? rules : [rules]).find(({ userAgent }) =>
-    Array.isArray(userAgent) ? userAgent.includes(agent) : userAgent === agent,
-  )
+  return Array.isArray(rules) ? rules : [rules]
 }
 
 describe('robots', () => {
@@ -15,23 +13,19 @@ describe('robots', () => {
     vi.unstubAllEnvs()
   })
 
-  it('lets search engines render pages and load uploads', async () => {
-    const rule = await rulesFor('Googlebot')
+  it('applies one rule to every crawler', async () => {
+    const rules = await allRules()
 
-    expect(rule.allow).toEqual(expect.arrayContaining(['/', '/api/*/file/']))
-    expect(rule.disallow).toEqual(expect.arrayContaining(['/admin', '/api']))
-    expect(rule.disallow).not.toContain('/_next')
-  })
-
-  it('gives link-preview bots the same access as search engines', async () => {
-    expect(await rulesFor('Twitterbot')).toEqual(await rulesFor('Googlebot'))
+    expect(rules).toHaveLength(1)
+    expect(rules[0].userAgent).toEqual(['*'])
   })
 
-  it('limits every other crawler to /llms.txt', async () => {
-    const rule = await rulesFor('*')
+  it('lets crawlers render pages and load uploads', async () => {
+    const [rule] = await allRules()
 
-    expect(rule.allow).toEqual(['/llms.txt'])
-    expect(rule.disallow).toEqual(['/'])
+    expect(rule.allow).toEqual(['/', '/api/*/file/'])
+    expect(rule.disallow).toEqual(['/admin', '/api'])
+    expect(rule.disallow).not.toContain('/_next')
   })
 
   it('points at the sitemap and sends no Host directive', async () => {
diff --git a/app/(frontend)/robots.ts b/app/(frontend)/robots.ts
index 6bae6136..df0607ea 100644
--- a/app/(frontend)/robots.ts
+++ b/app/(frontend)/robots.ts
@@ -1,30 +1,10 @@
 import type { MetadataRoute } from 'next'
 
-// Search engines index the site. Link-preview bots only fetch a shared URL to
-// render its card, so they get the same access. Everyone else, AI training
-// crawlers included, is limited to /llms.txt.
-const SEARCH_ENGINES = ['Googlebot', 'Bingbot', 'YandexBot', 'DuckDuckBot', 'Applebot']
-
-const LINK_PREVIEW_BOTS = [
-  'Twitterbot',
-  'facebookexternalhit',
-  'LinkedInBot',
-  'Slackbot',
-  'Discordbot',
-  'TelegramBot',
-  'WhatsApp',
-]
-
 export default async function robots(): Promise<MetadataRoute.Robots> {
   return {
     rules: [
       {
-        userAgent: '*',
-        allow: ['/llms.txt'],
-        disallow: ['/'],
-      },
-      {
-        userAgent: [...SEARCH_ENGINES, ...LINK_PREVIEW_BOTS],
+        userAgent: ['*'],
         // /_next stays crawlable: rendering needs its JS, CSS and /_next/image.
         // Uploads are served from /api/<collection>/file/, which must stay
         // reachable even though the rest of /api is not.

From b8af18ec1d2bb0aa0b96468b6d1ad781578351f2 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:52:15 +0100
Subject: [PATCH 05/30] build(deps): put playwright packages on one version and
 pin it in syncpack

@playwright/test was on ~1.63.0 while playwright was on ~1.64.1 and the Docker image on v1.62.1. The sameRange group never caught it: syncpack compares one dependency across packages, not two dependencies with each other. pinVersion does. e2e-docker.sh now reads the image tag from the installed @playwright/test.
---
 bun.lock              |  8 ++------
 package.json          |  2 +-
 scripts/e2e-docker.sh |  8 +++++---
 syncpack.config.mjs   | 15 ++++++++++-----
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/bun.lock b/bun.lock
index d91c9dab..6f7469e3 100644
--- a/bun.lock
+++ b/bun.lock
@@ -73,7 +73,7 @@
         "@commitlint/cli": "^21.2.3",
         "@commitlint/config-conventional": "^21.2.3",
         "@oxlint/plugins": "^1.86.0",
-        "@playwright/test": "~1.63.0",
+        "@playwright/test": "~1.64.1",
         "@react-email/ui": "^6.11.0",
         "@semantic-release/changelog": "^7.0.0",
         "@semantic-release/commit-analyzer": "^13.0.1",
@@ -822,7 +822,7 @@
 
     "@pinojs/redact": ["@pinojs/redact@0.4.0", "", {}, "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg=="],
 
-    "@playwright/test": ["@playwright/test@1.63.0", "", { "dependencies": { "playwright": "1.63.0" }, "bin": { "playwright": "cli.js" } }, "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ=="],
+    "@playwright/test": ["@playwright/test@1.64.1", "", { "dependencies": { "playwright": "1.64.1" }, "bin": { "playwright": "cli.js" } }, "sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
@@ -2938,8 +2938,6 @@
 
     "@payloadcms/ui/date-fns": ["date-fns@4.1.0", "", {}, "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg=="],
 
-    "@playwright/test/playwright": ["playwright@1.63.0", "", { "dependencies": { "playwright-core": "1.63.0" }, "bin": { "playwright": "cli.js" } }, "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg=="],
-
     "@pnpm/network.ca-file/graceful-fs": ["graceful-fs@4.2.10", "", {}, "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA=="],
 
     "@poppinss/colors/kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
@@ -3508,8 +3506,6 @@
 
     "@oxc-resolver/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
-    "@playwright/test/playwright/playwright-core": ["playwright-core@1.63.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg=="],
-
     "@react-email/ui/next/@next/env": ["@next/env@16.4.3", "", {}, "sha512-a7tz1QCcWWkwC/rPJcPMJk/UNRu9CFhDd3OHYE5hddbJrs8BqRTalxI6GlKCWEGzRLHN+S/B7a4PAHCtm25aBQ=="],
 
     "@react-email/ui/next/@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4yq5EXBt+VDtAZwTyfijaFp5D2C5oz3Ikw5a2kiX2K9nw72vrZX2q5UuAlkPtUMO1tQz6JTKpaKWjS7OOefTDQ=="],
diff --git a/package.json b/package.json
index a1f6bcfd..acf35df9 100644
--- a/package.json
+++ b/package.json
@@ -137,7 +137,7 @@
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
     "@oxlint/plugins": "^1.86.0",
-    "@playwright/test": "~1.63.0",
+    "@playwright/test": "~1.64.1",
     "@react-email/ui": "^6.11.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/commit-analyzer": "^13.0.1",
diff --git a/scripts/e2e-docker.sh b/scripts/e2e-docker.sh
index d7d37481..8a8f67da 100755
--- a/scripts/e2e-docker.sh
+++ b/scripts/e2e-docker.sh
@@ -8,10 +8,12 @@ set -euo pipefail
 #      docker compose up -d      (Mongo/Redis/S3)
 #      bun run dev:app          (Next.js on the host, port 3000)
 #
-#    The image tag MUST match the @playwright/test version in package.json —
-#    bump them together, otherwise browser revisions mismatch.
+#    The image tag must match the installed @playwright/test, otherwise the
+#    browser revisions mismatch, so it is read from the package rather than
+#    written here.
 
-IMAGE="mcr.microsoft.com/playwright:v1.62.1-noble"
+PLAYWRIGHT_VERSION="$(node -p "require('./node_modules/@playwright/test/package.json').version")"
+IMAGE="mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"
 
 #    Host networking lets the container reach the dev server as
 #    http://localhost:3000 — required because the Payload admin UI talks to
diff --git a/syncpack.config.mjs b/syncpack.config.mjs
index 1c8dfd57..2d2eb1b4 100644
--- a/syncpack.config.mjs
+++ b/syncpack.config.mjs
@@ -199,15 +199,20 @@ export default {
     },
 
     /**
-     * `playwright` and `@playwright/test` must match exactly: the Docker image
-     * tag in scripts/e2e-docker.sh is pinned to this version, and a mismatch
-     * means the bundled browser revisions disagree.
+     * `playwright` and `@playwright/test` must be on the identical version:
+     * each bundles its own browser revisions, and scripts/e2e-docker.sh picks
+     * the Docker image tag from the installed `@playwright/test`.
+     *
+     * Pinned rather than `sameRange`: syncpack only compares one dependency
+     * across packages, never two dependencies with each other, so in this
+     * single-package repo a policy group cannot catch a mismatch. To upgrade
+     * Playwright, change this one value and run `bun run deps:fix`.
      */
     {
-      label: 'Playwright must match the pinned browser image',
+      label: 'Playwright packages are pinned to one version',
       dependencies: ['playwright', '@playwright/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '~1.64.1',
     },
 
     {

From 148cb18f1b1a69e5b1b4c84a133e04dd2031ea5b Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:52:16 +0100
Subject: [PATCH 06/30] chore(env): remove the unused OPENAI_API_KEY

Nothing read it; all AI calls go through src/lib/anthropic. Removed from the env schema, global.d.ts, .env.test, the deploy workflow and the docs.
---
 .env.test                                      | 3 +--
 .github/workflows/build-and-deploy.yml         | 1 -
 AGENTS.md                                      | 7 ++-----
 README.md                                      | 1 -
 global.d.ts                                    | 1 -
 src/lib/actions/enqueueBilingualTranslation.ts | 2 +-
 src/types/environment.ts                       | 1 -
 7 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/.env.test b/.env.test
index bb2f23dc..ae840ea0 100644
--- a/.env.test
+++ b/.env.test
@@ -1,7 +1,7 @@
 # Test environment — committed on purpose.
 # Dummy but format-valid values that satisfy src/types/environment.ts so the
 # app can boot for E2E tests. Flows depending on real external services will
-# not work with these: AI generation (OpenAI/Anthropic), Mapbox geocoding,
+# not work with these: AI generation (Anthropic), Mapbox geocoding,
 # email (UseSend), Umami analytics, status-page heartbeat.
 # Prerequisite: `docker compose up -d` (Mongo, Redis, S3 must be reachable).
 
@@ -37,7 +37,6 @@ USESEND_API_KEY=test-key
 USESEND_DEFAULT_FROM_ADDRESS=test@example.com
 USESEND_DEFAULT_FROM_NAME=Test
 
-OPENAI_API_KEY=sk-test
 ANTHROPIC_API_KEY=sk-ant-test
 MAPBOX_API_KEY=pk.test
 UNSPLASH_ACCESS_KEY=
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 201aa418..d2807686 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -177,7 +177,6 @@ jobs:
       USESEND_API_KEY: ${{ secrets.USESEND_API_KEY }}
       USESEND_DEFAULT_FROM_ADDRESS: ${{ secrets.USESEND_DEFAULT_FROM_ADDRESS }}
       USESEND_DEFAULT_FROM_NAME: ${{ secrets.USESEND_DEFAULT_FROM_NAME }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       MAPBOX_API_KEY: ${{ secrets.MAPBOX_API_KEY }}
       UNSPLASH_ACCESS_KEY: ${{ secrets.UNSPLASH_ACCESS_KEY }}
diff --git a/AGENTS.md b/AGENTS.md
index 69007ce1..3795880d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -227,11 +227,8 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   targets that exact version (it gives the fake-worker import a default `workerSrc`, see
   vercel/next.js#65406). Bumping `pdfjs-dist` means regenerating the patch.
 - The E2E job in `lint-and-test.yml` is commented out, so Playwright only runs locally.
-- `scripts/e2e-docker.sh` pins the Playwright image to `v1.62.1`, behind `@playwright/test`
-  (`~1.63.0`); the script's own comment requires the two to match.
-- `OPENAI_API_KEY` is required by the env schema but read nowhere (all AI calls go through
-  `src/lib/anthropic/`), and `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` is read by the `heartbeatPing`
-  handler but missing from the schema.
+- `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` is read by the `heartbeatPing` handler but missing from
+  the env schema.
 - No app-level rate limiting exists on public API routes.
 - No shared logging abstraction — error logging is ad hoc `console.error` calls.
 
diff --git a/README.md b/README.md
index 02752b42..fad01d02 100644
--- a/README.md
+++ b/README.md
@@ -240,7 +240,6 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | Variable | Type / Requirement | Purpose |
 | --- | --- | --- |
 | `NEXT_PUBLIC_ICONIFY_API` | Optional (URL) | Self-hosted Iconify API (defaults to `https://icons.heene.io`). |
-| `OPENAI_API_KEY` | **Required** | Still required by the schema, but no code reads it; any non-empty value passes. |
 | `ANTHROPIC_API_KEY` | **Required** | API key for Anthropic Claude (alt-text, meta descriptions, blog excerpts, resume translation). |
 | `MAPBOX_API_KEY` | **Required** | Mapbox access token for address and coordinate lookups. |
 | `UNSPLASH_ACCESS_KEY` | Optional | Unsplash API access key for stock photo search & direct media import. |
diff --git a/global.d.ts b/global.d.ts
index aecea15a..dff7d251 100644
--- a/global.d.ts
+++ b/global.d.ts
@@ -29,7 +29,6 @@ namespace NodeJS {
     USESEND_DEFAULT_FROM_ADDRESS: string
     USESEND_DEFAULT_FROM_NAME: string
 
-    OPENAI_API_KEY: string
     ANTHROPIC_API_KEY: string
     MAPBOX_API_KEY: string
 
diff --git a/src/lib/actions/enqueueBilingualTranslation.ts b/src/lib/actions/enqueueBilingualTranslation.ts
index a297986a..b91fd11a 100644
--- a/src/lib/actions/enqueueBilingualTranslation.ts
+++ b/src/lib/actions/enqueueBilingualTranslation.ts
@@ -35,7 +35,7 @@ export const enqueueBilingualTranslation = async (
   // `TranslateControls` only renders inside the Payload admin panel, but a
   // Server Action is its own reachable endpoint regardless of which page
   // renders the button that calls it — without this, anyone who discovers
-  // the action's reference could trigger paid OpenAI/Anthropic translation
+  // the action's reference could trigger paid Anthropic translation
   // calls with no session at all.
   const { user } = await payload.auth({
     headers: await headers(),
diff --git a/src/types/environment.ts b/src/types/environment.ts
index ad68fb22..4f6398e2 100644
--- a/src/types/environment.ts
+++ b/src/types/environment.ts
@@ -67,7 +67,6 @@ export const envSchema = z.object({
   USESEND_DEFAULT_FROM_ADDRESS: z.email(),
   USESEND_DEFAULT_FROM_NAME: z.string().trim().min(1),
 
-  OPENAI_API_KEY: z.string(),
   ANTHROPIC_API_KEY: z.string(),
   MAPBOX_API_KEY: z.string(),
   UNSPLASH_ACCESS_KEY: emptyAsUndefined(z.string()),

From ab0e33b621f149c662ec56b9d186c2a116b060dd Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:56:47 +0100
Subject: [PATCH 07/30] chore(env): declare
 STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL in the env schema

The heartbeatPing handler already read it; it is optional, so an unset or empty value still passes validation.
---
 AGENTS.md                | 2 --
 README.md                | 2 +-
 global.d.ts              | 1 +
 src/types/environment.ts | 6 ++++++
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 3795880d..3d56507b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -227,8 +227,6 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   targets that exact version (it gives the fake-worker import a default `workerSrc`, see
   vercel/next.js#65406). Bumping `pdfjs-dist` means regenerating the patch.
 - The E2E job in `lint-and-test.yml` is commented out, so Playwright only runs locally.
-- `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` is read by the `heartbeatPing` handler but missing from
-  the env schema.
 - No app-level rate limiting exists on public API routes.
 - No shared logging abstraction — error logging is ad hoc `console.error` calls.
 
diff --git a/README.md b/README.md
index fad01d02..b2da1e8b 100644
--- a/README.md
+++ b/README.md
@@ -220,7 +220,7 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | --- | --- | --- |
 | `NEXT_PUBLIC_STATUS_PAGE_URL` | **Required** (URL) | Public status page URL, read in the browser. |
 | `STATUS_PAGE_HEARTBEAT_URL` | **Required** (URL) | Status page heartbeat endpoint the server fetches (Redis-cached) for the service-status indicator. |
-| `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` | Optional (URL), not in the schema | Push monitor URL the worker's `heartbeatPing` job calls every minute; without it the job only logs. |
+| `STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL` | Optional (URL) | Push monitor URL the worker's `heartbeatPing` job calls every minute; without it the job only logs. |
 
 ### Analytics & Email
 
diff --git a/global.d.ts b/global.d.ts
index dff7d251..a5922664 100644
--- a/global.d.ts
+++ b/global.d.ts
@@ -34,6 +34,7 @@ namespace NodeJS {
 
     NEXT_PUBLIC_STATUS_PAGE_URL: string
     STATUS_PAGE_HEARTBEAT_URL: string
+    STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL?: string
 
     CLOUDFLARE_TUNNEL_HOST?: string
     CLOUDFLARE_TUNNEL_URL?: string
diff --git a/src/types/environment.ts b/src/types/environment.ts
index 4f6398e2..849f63fb 100644
--- a/src/types/environment.ts
+++ b/src/types/environment.ts
@@ -27,6 +27,12 @@ export const envSchema = z.object({
   NEXT_PUBLIC_STATUS_PAGE_URL: z.url(),
   STATUS_PAGE_HEARTBEAT_URL: z.url(),
 
+  /**
+   * Push monitor the worker's `heartbeatPing` job reports to every minute.
+   * Optional: without it the job only logs.
+   */
+  STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL: emptyAsUndefined(z.url()),
+
   /**
    * Base URL used by generateResumeDocumentRedirectURL to build the
    * redirect target for /download/resume.pdf and localized resume jobs.

From 4ddf09a838dc6ea560e75d9e415be57f4bd0e16e Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 06:57:40 +0100
Subject: [PATCH 08/30] feat(seo): disallow all crawlers outside production

robots.txt only opens the site when SERVER_HOST is daniel.heene.io, the same signal the PDF draft watermark uses. NODE_ENV is production in every deployed image, so it cannot tell the environments apart.
---
 README.md                     |  2 +-
 app/(frontend)/robots.test.ts | 64 +++++++++++++++++++++++++++--------
 app/(frontend)/robots.ts      | 15 ++++++++
 3 files changed, 65 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index b2da1e8b..c907f10a 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
   - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
   - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
   - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
-  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap.
+  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap. `robots.txt` disallows everything unless `SERVER_HOST` is the production host (`daniel.heene.io`).
   - `app/global-error.tsx`: Root error boundary. It has to stay at the root of `app/`; Next.js does not look for it inside a route group.
 - **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
diff --git a/app/(frontend)/robots.test.ts b/app/(frontend)/robots.test.ts
index 443698a4..c100204f 100644
--- a/app/(frontend)/robots.test.ts
+++ b/app/(frontend)/robots.test.ts
@@ -13,26 +13,60 @@ describe('robots', () => {
     vi.unstubAllEnvs()
   })
 
-  it('applies one rule to every crawler', async () => {
-    const rules = await allRules()
+  describe('on production', () => {
+    const stubProduction = () => {
+      vi.stubEnv('SERVER_HOST', 'daniel.heene.io')
+      vi.stubEnv('SERVER_URL', 'https://daniel.heene.io')
+    }
 
-    expect(rules).toHaveLength(1)
-    expect(rules[0].userAgent).toEqual(['*'])
-  })
+    it('applies one rule to every crawler', async () => {
+      stubProduction()
+      const rules = await allRules()
+
+      expect(rules).toHaveLength(1)
+      expect(rules[0].userAgent).toEqual(['*'])
+    })
+
+    it('lets crawlers render pages and load uploads', async () => {
+      stubProduction()
+      const [rule] = await allRules()
 
-  it('lets crawlers render pages and load uploads', async () => {
-    const [rule] = await allRules()
+      expect(rule.allow).toEqual(['/', '/api/*/file/'])
+      expect(rule.disallow).toEqual(['/admin', '/api'])
+      expect(rule.disallow).not.toContain('/_next')
+    })
 
-    expect(rule.allow).toEqual(['/', '/api/*/file/'])
-    expect(rule.disallow).toEqual(['/admin', '/api'])
-    expect(rule.disallow).not.toContain('/_next')
+    it('points at the sitemap and sends no Host directive', async () => {
+      stubProduction()
+      const result = await robots()
+
+      expect(result.sitemap).toBe('https://daniel.heene.io/sitemap.xml')
+      expect(result.host).toBeUndefined()
+    })
   })
 
-  it('points at the sitemap and sends no Host directive', async () => {
-    vi.stubEnv('SERVER_URL', 'https://example.com')
-    const result = await robots()
+  describe('everywhere else', () => {
+    it.each(['daniel.heene.dev', 'localhost:3000', 'staging.daniel.heene.io'])(
+      'disallows everything on %s',
+      async (host) => {
+        vi.stubEnv('SERVER_HOST', host)
+        vi.stubEnv('SERVER_URL', `https://${host}`)
+        const result = await robots()
+
+        expect(await allRules()).toEqual([
+          {
+            userAgent: ['*'],
+            disallow: ['/'],
+          },
+        ])
+        expect(result.sitemap).toBeUndefined()
+      },
+    )
+
+    it('disallows everything when SERVER_HOST is unset', async () => {
+      vi.stubEnv('SERVER_HOST', undefined)
 
-    expect(result.sitemap).toBe('https://example.com/sitemap.xml')
-    expect(result.host).toBeUndefined()
+      expect((await allRules())[0].disallow).toEqual(['/'])
+    })
   })
 })
diff --git a/app/(frontend)/robots.ts b/app/(frontend)/robots.ts
index df0607ea..2e1249cb 100644
--- a/app/(frontend)/robots.ts
+++ b/app/(frontend)/robots.ts
@@ -1,6 +1,21 @@
 import type { MetadataRoute } from 'next'
 
+// Same signal as the draft watermark in src/pdf/index.tsx. NODE_ENV cannot
+// tell the environments apart: every deployed image runs in production mode.
+const PRODUCTION_HOST = 'daniel.heene.io'
+
 export default async function robots(): Promise<MetadataRoute.Robots> {
+  if (process.env.SERVER_HOST !== PRODUCTION_HOST) {
+    return {
+      rules: [
+        {
+          userAgent: ['*'],
+          disallow: ['/'],
+        },
+      ],
+    }
+  }
+
   return {
     rules: [
       {

From 84697b6cd85c20e32a75f1c67d9bac78c711cd61 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 07:18:46 +0100
Subject: [PATCH 09/30] docs(agents): correct the preview-route claim and cover
 robots, global-error and the playwright pin

---
 AGENTS.md | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 3d56507b..f5330711 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -57,6 +57,12 @@ files import generated types from `src/types/payload.ts` and `@/types/collection
 Don't let those block your task, but do not introduce new lint errors or warnings, and prefer
 fixing warnings in files you already touch.
 
+`syncpack.config.mjs` pins `playwright` and `@playwright/*` to one version with `pinVersion`; to
+upgrade Playwright, change that value and run `bun run deps:fix`. `scripts/e2e-docker.sh` derives
+its image tag from the installed `@playwright/test`. The `sameRange` groups in that file (Payload,
+Storybook, Vitest, React) do not catch mismatches between different packages in this
+single-package repo: syncpack only compares one dependency across packages.
+
 Always spell scripts `bun run <script>`: bare `bun test` and `bun build` run Bun's own test runner
 and bundler, not the package scripts.
 
@@ -159,6 +165,8 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
 - **Stories** live in `.storybook/components/*.stories.tsx`, not next to the components; the
   design-foundation and shader docs are MDX under `.storybook/foundations/` and
   `.storybook/shaders/`.
+- **`app/global-error.tsx`** has to stay at the root of `app/`: Next only resolves it there, not
+  inside a route group. It replaces the root layout, so it imports the stylesheet and fonts itself.
 - **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
   maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
   content.
@@ -187,9 +195,8 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
 - **SSE / Redis channels** (`app/(frontend)/api/sse/route.ts`): the `channel` query param is
   matched against an allowlist (`src/lib/sse/channels.ts`) before `subscribe()` ever sees it, and
   per-job channels (`bilingual-translate:`, `seed-task:`, `scheduled-job:`, `resume-generate:`)
-  additionally require a signed-in
-  `payload.auth()` session. The public channels in `SSE_CHANNELS` (e.g. `service-status`) stay
-  unauthenticated by design. If you add a new channel that carries non-public data, add it to the
+  additionally require a signed-in `payload.auth()` session. The public channels in `SSE_CHANNELS`
+  (e.g. `service-status`) stay unauthenticated by design. If you add a new channel that carries non-public data, add it to the
   authenticated branch rather than `SSE_CHANNELS` — see the route's own comments for the exact
   split.
 - **Raw SVG rendering**: `src/collections/ResumeCustomers` stores raw SVG markup rendered via
@@ -210,8 +217,15 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
 - **Semgrep** runs on every PR (`lint-and-test.yml`, rulesets `nodejs`, `typescript`, `react`,
   `secrets`) and fails the check on any finding. A reviewed, accepted finding is marked on its own
   line with `// nosemgrep: <rule> -- <reason>` (see `src/components/LogoCarousel/LogoCarousel.tsx`).
-- New authenticated API routes should mirror `app/(frontend)/api/preview/route.ts`'s pattern of
-  pairing a shared-secret check with a real `payload.auth()` session check where feasible.
+- New authenticated API routes and server actions need a real `payload.auth()` session check, as
+  in the SSE route's per-job branch and `src/lib/actions/enqueueBilingualTranslation.ts` — a Server
+  Action is its own reachable endpoint, whichever page renders the button. Compare shared secrets
+  with `crypto.timingSafeEqual` and accept only same-site relative redirect targets, as
+  `app/(frontend)/api/preview/route.ts` does (that route checks `PREVIEW_SECRET` only, no session).
+- **Crawlers**: `app/(frontend)/robots.ts` disallows everything unless `SERVER_HOST` is
+  `daniel.heene.io`. `NODE_ENV` cannot tell environments apart (every deployed image runs
+  `production`), so compare `SERVER_HOST` for production-only behaviour, as `src/pdf/index.tsx`
+  also does.
 
 ## Known Issues / Tech Debt (baseline, not blocking, but don't add more)
 
@@ -237,11 +251,11 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   test; E2E specs live in `e2e/*.spec.ts` (never `*.spec.ts` under `src/`).
 - Shared mocks live in `vitest.setup.ts`: `payload` (`getPayload` stubbed via `importOriginal`
   spread — never replace the whole module, value imports from it are used at runtime),
-  `next/cache`, `server-only` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and `neotraverse` are
-  intentionally NOT mocked — their real behavior is the contract under test.
+  `next/cache`, `server-only` and `redis`. `tailwind-merge`, `date-fns`, `slugify`, `pupa` and
+  `neotraverse` are intentionally NOT mocked — their real behavior is the contract under test.
 - `TZ=UTC` is forced in `vitest.setup.ts` and date tests depend on it. Anything touching
   `Interval.setToX()` or `getLocalISOString` needs `vi.useFakeTimers()` + `vi.setSystemTime()`.
-  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `PREVIEW_SECRET`).
+  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `SERVER_HOST`, `PREVIEW_SECRET`).
 - There is no CI-enforced coverage threshold; when fixing a bug, add a regression test near
   existing tests for that module if a suitable test file already exists.
 

From 5b066f5109f91d33e3a56e31d6d34180a30989a0 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 07:21:50 +0100
Subject: [PATCH 10/30] feat(env): read the production host from
 PRODUCTION_HOST

robots.txt and the PDF draft watermark compared SERVER_HOST with a hardcoded daniel.heene.io. Both now go through isProductionHost(), which compares it with the new required PRODUCTION_HOST variable and treats an unset value as not production.
---
 .env.test                              |  1 +
 .github/workflows/build-and-deploy.yml |  1 +
 AGENTS.md                              | 11 ++++----
 README.md                              |  3 ++-
 app/(frontend)/robots.test.ts          |  7 ++++--
 app/(frontend)/robots.ts               |  6 ++---
 global.d.ts                            |  1 +
 src/lib/isProductionHost.test.ts       | 35 ++++++++++++++++++++++++++
 src/lib/isProductionHost.ts            |  9 +++++++
 src/pdf/index.tsx                      |  3 ++-
 src/types/environment.ts               |  6 +++++
 11 files changed, 70 insertions(+), 13 deletions(-)
 create mode 100644 src/lib/isProductionHost.test.ts
 create mode 100644 src/lib/isProductionHost.ts

diff --git a/.env.test b/.env.test
index ae840ea0..d965c94a 100644
--- a/.env.test
+++ b/.env.test
@@ -8,6 +8,7 @@
 # Not the real dev-server port (3000): that literal can also appear hardcoded
 # in vendor code.
 SERVER_HOST=localhost:39217
+PRODUCTION_HOST=daniel.heene.io
 SERVER_URL=http://localhost:39217
 NEXT_PUBLIC_SERVER_URL=http://localhost:39217
 NEXT_PUBLIC_STATUS_PAGE_URL=http://localhost:3001
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index d2807686..1fbe9a27 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -154,6 +154,7 @@ jobs:
       # per-branch NODE_ENV build arg is gone with the Docker build phase.
       NODE_ENV: production
       SERVER_HOST: ${{ secrets.SERVER_HOST }}
+      PRODUCTION_HOST: ${{ secrets.PRODUCTION_HOST }}
       SERVER_URL: ${{ secrets.SERVER_URL }}
       NEXT_PUBLIC_SERVER_URL: ${{ secrets.NEXT_PUBLIC_SERVER_URL }}
       NEXT_PUBLIC_STATUS_PAGE_URL: ${{ secrets.NEXT_PUBLIC_STATUS_PAGE_URL }}
diff --git a/AGENTS.md b/AGENTS.md
index f5330711..0d498194 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -222,10 +222,11 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   Action is its own reachable endpoint, whichever page renders the button. Compare shared secrets
   with `crypto.timingSafeEqual` and accept only same-site relative redirect targets, as
   `app/(frontend)/api/preview/route.ts` does (that route checks `PREVIEW_SECRET` only, no session).
-- **Crawlers**: `app/(frontend)/robots.ts` disallows everything unless `SERVER_HOST` is
-  `daniel.heene.io`. `NODE_ENV` cannot tell environments apart (every deployed image runs
-  `production`), so compare `SERVER_HOST` for production-only behaviour, as `src/pdf/index.tsx`
-  also does.
+- **Production detection**: `NODE_ENV` cannot tell environments apart (every deployed image runs
+  `production`). Use `isProductionHost()` (`src/lib/isProductionHost.ts`), which compares
+  `SERVER_HOST` with `PRODUCTION_HOST` and reads an unset value as "not production". Outside
+  production `app/(frontend)/robots.ts` disallows all crawlers and `src/pdf/index.tsx` stamps
+  PDFs as DRAFT.
 
 ## Known Issues / Tech Debt (baseline, not blocking, but don't add more)
 
@@ -255,7 +256,7 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   `neotraverse` are intentionally NOT mocked — their real behavior is the contract under test.
 - `TZ=UTC` is forced in `vitest.setup.ts` and date tests depend on it. Anything touching
   `Interval.setToX()` or `getLocalISOString` needs `vi.useFakeTimers()` + `vi.setSystemTime()`.
-  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `SERVER_HOST`, `PREVIEW_SECRET`).
+  Use `vi.stubEnv()` for env-dependent code (`SERVER_URL`, `SERVER_HOST`, `PRODUCTION_HOST`, `PREVIEW_SECRET`).
 - There is no CI-enforced coverage threshold; when fixing a bug, add a regression test near
   existing tests for that module if a suitable test file already exists.
 
diff --git a/README.md b/README.md
index c907f10a..87816596 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
   - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
   - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
   - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
-  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap. `robots.txt` disallows everything unless `SERVER_HOST` is the production host (`daniel.heene.io`).
+  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap. `robots.txt` disallows everything unless `SERVER_HOST` equals `PRODUCTION_HOST`.
   - `app/global-error.tsx`: Root error boundary. It has to stay at the root of `app/`; Next.js does not look for it inside a route group.
 - **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
@@ -184,6 +184,7 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 | --- | --- | --- |
 | `NODE_ENV` | Optional (`development` \| `production` \| `test`) | Runtime environment (defaults to `development`). |
 | `SERVER_HOST` | **Required** | Host/port used for server-side URL construction. |
+| `PRODUCTION_HOST` | **Required** | Host of the production site. An environment counts as production when `SERVER_HOST` equals it; everywhere else `robots.txt` disallows all crawlers and generated PDFs carry a DRAFT watermark. |
 | `SERVER_URL` | **Required** (URL) | Public URL of the site, read server-side. |
 | `NEXT_PUBLIC_SERVER_URL` | **Required** (URL) | Same value as `SERVER_URL`, exposed to the browser for the live-preview listener. |
 | `RESUME_REDIRECT_URL_BASE` | **Required** (URL) | Base URL for the redirect target of `/download/resume.pdf` and localized resume jobs. |
diff --git a/app/(frontend)/robots.test.ts b/app/(frontend)/robots.test.ts
index c100204f..ded5d73e 100644
--- a/app/(frontend)/robots.test.ts
+++ b/app/(frontend)/robots.test.ts
@@ -15,6 +15,7 @@ describe('robots', () => {
 
   describe('on production', () => {
     const stubProduction = () => {
+      vi.stubEnv('PRODUCTION_HOST', 'daniel.heene.io')
       vi.stubEnv('SERVER_HOST', 'daniel.heene.io')
       vi.stubEnv('SERVER_URL', 'https://daniel.heene.io')
     }
@@ -49,6 +50,7 @@ describe('robots', () => {
     it.each(['daniel.heene.dev', 'localhost:3000', 'staging.daniel.heene.io'])(
       'disallows everything on %s',
       async (host) => {
+        vi.stubEnv('PRODUCTION_HOST', 'daniel.heene.io')
         vi.stubEnv('SERVER_HOST', host)
         vi.stubEnv('SERVER_URL', `https://${host}`)
         const result = await robots()
@@ -63,8 +65,9 @@ describe('robots', () => {
       },
     )
 
-    it('disallows everything when SERVER_HOST is unset', async () => {
-      vi.stubEnv('SERVER_HOST', undefined)
+    it('disallows everything when PRODUCTION_HOST is unset', async () => {
+      vi.stubEnv('PRODUCTION_HOST', undefined)
+      vi.stubEnv('SERVER_HOST', 'daniel.heene.io')
 
       expect((await allRules())[0].disallow).toEqual(['/'])
     })
diff --git a/app/(frontend)/robots.ts b/app/(frontend)/robots.ts
index 2e1249cb..31cd6ef6 100644
--- a/app/(frontend)/robots.ts
+++ b/app/(frontend)/robots.ts
@@ -1,11 +1,9 @@
 import type { MetadataRoute } from 'next'
 
-// Same signal as the draft watermark in src/pdf/index.tsx. NODE_ENV cannot
-// tell the environments apart: every deployed image runs in production mode.
-const PRODUCTION_HOST = 'daniel.heene.io'
+import { isProductionHost } from '@/lib/isProductionHost'
 
 export default async function robots(): Promise<MetadataRoute.Robots> {
-  if (process.env.SERVER_HOST !== PRODUCTION_HOST) {
+  if (!isProductionHost()) {
     return {
       rules: [
         {
diff --git a/global.d.ts b/global.d.ts
index a5922664..4949d386 100644
--- a/global.d.ts
+++ b/global.d.ts
@@ -3,6 +3,7 @@ namespace NodeJS {
     NODE_ENV: string
 
     SERVER_HOST: string
+    PRODUCTION_HOST: string
     SERVER_URL: string
     NEXT_PUBLIC_SERVER_URL: string
 
diff --git a/src/lib/isProductionHost.test.ts b/src/lib/isProductionHost.test.ts
new file mode 100644
index 00000000..db8b45fe
--- /dev/null
+++ b/src/lib/isProductionHost.test.ts
@@ -0,0 +1,35 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { isProductionHost } from './isProductionHost'
+
+describe('isProductionHost', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('is true when SERVER_HOST equals PRODUCTION_HOST', () => {
+    vi.stubEnv('PRODUCTION_HOST', 'example.com')
+    vi.stubEnv('SERVER_HOST', 'example.com')
+
+    expect(isProductionHost()).toBe(true)
+  })
+
+  it('is false on any other host', () => {
+    vi.stubEnv('PRODUCTION_HOST', 'example.com')
+    vi.stubEnv('SERVER_HOST', 'dev.example.com')
+
+    expect(isProductionHost()).toBe(false)
+  })
+
+  it('is false when PRODUCTION_HOST is unset or empty, even if SERVER_HOST is too', () => {
+    vi.stubEnv('PRODUCTION_HOST', '')
+    vi.stubEnv('SERVER_HOST', '')
+
+    expect(isProductionHost()).toBe(false)
+
+    vi.stubEnv('PRODUCTION_HOST', undefined)
+    vi.stubEnv('SERVER_HOST', undefined)
+
+    expect(isProductionHost()).toBe(false)
+  })
+})
diff --git a/src/lib/isProductionHost.ts b/src/lib/isProductionHost.ts
new file mode 100644
index 00000000..447b293a
--- /dev/null
+++ b/src/lib/isProductionHost.ts
@@ -0,0 +1,9 @@
+/**
+ * Whether this process serves the production site.
+ *
+ * `NODE_ENV` cannot answer that: every deployed image runs in production mode,
+ * the development environment included. An unset `PRODUCTION_HOST` reads as
+ * "not production", so a misconfigured environment fails closed.
+ */
+export const isProductionHost = (): boolean =>
+  Boolean(process.env.PRODUCTION_HOST) && process.env.SERVER_HOST === process.env.PRODUCTION_HOST
diff --git a/src/pdf/index.tsx b/src/pdf/index.tsx
index 41b15dda..da4c0deb 100644
--- a/src/pdf/index.tsx
+++ b/src/pdf/index.tsx
@@ -5,6 +5,7 @@ import dePattern from 'hyphen/patterns/de-1996'
 import enPattern from 'hyphen/patterns/en-us'
 
 import type { BilingualLanguage } from '@/lib/i18n'
+import { isProductionHost } from '@/lib/isProductionHost'
 import { BulletPoint } from '@/pdf/components/BulletPoint'
 import { Footer } from '@/pdf/components/Footer'
 import { Header } from '@/pdf/components/Header'
@@ -98,7 +99,7 @@ export const ResumeDocument = ({
         orientation="portrait"
         bookmark={document.title}
       >
-        {process.env.SERVER_HOST !== 'daniel.heene.io' && (
+        {!isProductionHost() && (
           <View style={styles.debug} fixed>
             <Text style={textStyles.debugText}>DRAFT</Text>
           </View>
diff --git a/src/types/environment.ts b/src/types/environment.ts
index 849f63fb..bf71fd31 100644
--- a/src/types/environment.ts
+++ b/src/types/environment.ts
@@ -15,6 +15,12 @@ export const envSchema = z.object({
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
 
   SERVER_HOST: z.string().trim().min(1),
+
+  /**
+   * Host of the production site. An environment is production when its
+   * `SERVER_HOST` equals this (see `src/lib/isProductionHost.ts`).
+   */
+  PRODUCTION_HOST: z.string().trim().min(1),
   SERVER_URL: z.url(),
 
   /**

From 5988c39d7eff76a8fbf9e2cd07e24ff20893ca4d Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 07:39:11 +0100
Subject: [PATCH 11/30] fix(ai): describe pages from their content, guard the
 generate actions, move to Haiku 5.5

The meta description fetcher sent only the page URL to a model that cannot fetch, so the text was invented from the slug. It now sends the document's own title and text and clamps the result to 160 characters.

All four fetchers share generateAnthropicText(): claude-haiku-5-5 at low effort, an output limit, a timeout, and an error instead of a truncated or declined answer. Prompts wrap their input in tags and state language, voice and what to leave untranslated; alt text sees a 1024px image instead of 512px.

The inline generate actions check the session, the alt action only fetches same-origin media, and a failed alt generation no longer fails the image upload. The fetcher modules drop 'use server'. Removes the never-wired meta description hook.
---
 AGENTS.md                                     |  12 +-
 .../MediaImages/components/AltField.tsx       |   8 +-
 .../MediaImages/hooks/generateAlt.ts          |  25 ++-
 .../MetaDescriptionField/FieldComponent.tsx   |  34 ++--
 .../hooks/generateMetaTitleHook.ts            |  23 ---
 src/fields/Meta/MetaDescriptionField/index.ts |  13 +-
 src/fields/Meta/index.ts                      |   4 +-
 src/lib/actions/requireSession.ts             |  24 +++
 src/lib/anthropic/fetchExcerpt.test.ts        |   3 +
 src/lib/anthropic/fetchExcerpt.ts             |  48 ++----
 src/lib/anthropic/fetchImageAltText.ts        |  59 ++++---
 .../anthropic/fetchMetaDescription.test.ts    | 120 +++++++++++++++
 src/lib/anthropic/fetchMetaDescription.ts     | 145 +++++++++++-------
 src/lib/anthropic/fetchTranslation.test.ts    |   2 +
 src/lib/anthropic/fetchTranslation.ts         |  50 +++---
 .../anthropic/generateAnthropicText.test.ts   |  83 ++++++++++
 src/lib/anthropic/generateAnthropicText.ts    |  74 +++++++++
 src/lib/extractDocumentText.test.ts           |  88 +++++++++++
 src/lib/extractDocumentText.ts                |  60 ++++++++
 src/lib/resolveOwnMediaUrl.test.ts            |  38 +++++
 src/lib/resolveOwnMediaUrl.ts                 |  20 +++
 21 files changed, 726 insertions(+), 207 deletions(-)
 delete mode 100644 src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts
 create mode 100644 src/lib/actions/requireSession.ts
 create mode 100644 src/lib/anthropic/fetchMetaDescription.test.ts
 create mode 100644 src/lib/anthropic/generateAnthropicText.test.ts
 create mode 100644 src/lib/anthropic/generateAnthropicText.ts
 create mode 100644 src/lib/extractDocumentText.test.ts
 create mode 100644 src/lib/extractDocumentText.ts
 create mode 100644 src/lib/resolveOwnMediaUrl.test.ts
 create mode 100644 src/lib/resolveOwnMediaUrl.ts

diff --git a/AGENTS.md b/AGENTS.md
index 0d498194..627a3905 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -160,6 +160,13 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   `*.client.tsx` files and call server actions from `src/lib/actions/` for mutations.
 - **Server actions** (`src/lib/actions/`): `'use server'` functions for admin mutations (job
   rescheduling, cancellation, etc.). Use `useTransition` on the client side when calling them.
+- **Claude calls** (`src/lib/anthropic/`): every fetcher goes through `generateAnthropicText()`,
+  which owns the model ID (`ANTHROPIC_MODEL`), effort, timeout and output limit, and throws when
+  the answer was cut off or declined rather than returning partial text. Give the model the
+  content itself (wrapped in tags), never a URL: it cannot fetch. These modules are plain server
+  modules, not `'use server'` files, and the worker imports them too, so `server-only` (which
+  throws outside Next) is not an option. Callers that run inside a save (`generateAlt`) catch the
+  error so a Claude outage never blocks the write.
 - **Plugins** (`src/plugins/`): `redirects` and `references` are local Payload plugins that add the
   `Redirects` and `References` collections; `bun run refs:backfill` rebuilds the reference index.
 - **Stories** live in `.storybook/components/*.stories.tsx`, not next to the components; the
@@ -219,7 +226,10 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
   line with `// nosemgrep: <rule> -- <reason>` (see `src/components/LogoCarousel/LogoCarousel.tsx`).
 - New authenticated API routes and server actions need a real `payload.auth()` session check, as
   in the SSE route's per-job branch and `src/lib/actions/enqueueBilingualTranslation.ts` — a Server
-  Action is its own reachable endpoint, whichever page renders the button. Compare shared secrets
+  Action is its own reachable endpoint, whichever page renders the button. Inline `'use server'`
+  functions in admin field components call `requireSession()` (`src/lib/actions/requireSession.ts`)
+  first. A server-side fetch of an uploaded file goes through `resolveOwnMediaUrl()`
+  (`src/lib/resolveOwnMediaUrl.ts`), which rejects any other origin. Compare shared secrets
   with `crypto.timingSafeEqual` and accept only same-site relative redirect targets, as
   `app/(frontend)/api/preview/route.ts` does (that route checks `PREVIEW_SECRET` only, no session).
 - **Production detection**: `NODE_ENV` cannot tell environments apart (every deployed image runs
diff --git a/src/collections/MediaImages/components/AltField.tsx b/src/collections/MediaImages/components/AltField.tsx
index ccd6d3d1..daa8d589 100644
--- a/src/collections/MediaImages/components/AltField.tsx
+++ b/src/collections/MediaImages/components/AltField.tsx
@@ -1,22 +1,24 @@
 import type { TextFieldServerComponent } from 'payload'
 
 import { TextFieldWithLockAndGenerate } from '@/components/AdminPanel/TextFieldWithLockAndGenerate'
+import { requireSession } from '@/lib/actions/requireSession'
 import { fetchAnthropicImageAltText } from '@/lib/anthropic/fetchImageAltText'
+import { resolveOwnMediaUrl } from '@/lib/resolveOwnMediaUrl'
 
 export const AltField: TextFieldServerComponent = ({ data: { url }, path, clientField }) => {
   const generateFunction = async () => {
     'use server'
 
     try {
-      const imageUrl = new URL(url, process.env.SERVER_URL)
+      await requireSession()
 
-      const imageData = await fetch(imageUrl)
+      const imageData = await fetch(resolveOwnMediaUrl(url))
         .then((res) => res.arrayBuffer())
         .then((arrayBuffer) => Buffer.from(arrayBuffer))
 
       return await fetchAnthropicImageAltText(imageData)
     } catch (error) {
-      console.error('Error fetching image:', error)
+      console.error('Error generating alt text:', error)
 
       return ''
     }
diff --git a/src/collections/MediaImages/hooks/generateAlt.ts b/src/collections/MediaImages/hooks/generateAlt.ts
index a59b2fd6..5d749390 100644
--- a/src/collections/MediaImages/hooks/generateAlt.ts
+++ b/src/collections/MediaImages/hooks/generateAlt.ts
@@ -7,16 +7,31 @@ import { fetchAnthropicImageAltText } from '@/lib/anthropic/fetchImageAltText'
  * This function is used as a beforeChange hook for the MediaImage collection.
  * It generates alternative text for images based on their content.
  */
-export const generateAlt: CollectionBeforeChangeHook = async ({ data, req: { file }, context }) => {
+export const generateAlt: CollectionBeforeChangeHook = async ({
+  data,
+  req: { file, payload },
+  context,
+}) => {
   if (context.skipGenerateAlt) return data
 
   /* req.file is only set when uploading a file */
   if (!file || !file?.mimetype?.includes('image')) return data
 
-  const alt = await fetchAnthropicImageAltText(file.data)
+  try {
+    const alt = await fetchAnthropicImageAltText(file.data)
 
-  return {
-    ...data,
-    alt,
+    return {
+      ...data,
+      alt,
+    }
+  } catch (error) {
+    // The upload must not depend on Claude being reachable; the alt text can
+    // still be generated from the field's button afterwards.
+    payload.logger.error({
+      err: error,
+      msg: 'Could not generate alt text for the uploaded image',
+    })
+
+    return data
   }
 }
diff --git a/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx b/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
index 4ea496d4..79c16369 100644
--- a/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
+++ b/src/fields/Meta/MetaDescriptionField/FieldComponent.tsx
@@ -1,32 +1,34 @@
-import type { TextFieldServerComponent, TextFieldServerProps } from 'payload'
-
-import { get } from 'lodash-es'
+import type { TextFieldServerComponent } from 'payload'
 
+import { requireSession } from '@/lib/actions/requireSession'
 import { fetchAnthropicMetaDescription } from '@/lib/anthropic/fetchMetaDescription'
-import { generateContentURL } from '@/lib/generateContentURL'
 
 import { FieldComponentClient } from './FieldComponent.client'
 
-type DescriptionFieldProps = {
-  slugPath: string
-} & TextFieldServerProps
-
 export const FieldComponent: TextFieldServerComponent = async ({
   collectionSlug,
   data,
   path,
   clientField,
-  slugPath,
-}: DescriptionFieldProps) => {
+}) => {
   const generateFunction = async () => {
     'use server'
 
-    const pageUrl = generateContentURL({
-      collection: collectionSlug,
-      slug: get(data, slugPath),
-    })
-
-    return await fetchAnthropicMetaDescription(pageUrl)
+    try {
+      await requireSession()
+
+      // An empty result leaves the field as it is.
+      return (
+        (await fetchAnthropicMetaDescription({
+          collection: collectionSlug,
+          data,
+        })) ?? ''
+      )
+    } catch (error) {
+      console.error('Error generating meta description:', error)
+
+      return ''
+    }
   }
 
   return (
diff --git a/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts b/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts
deleted file mode 100644
index 884c9f80..00000000
--- a/src/fields/Meta/MetaDescriptionField/hooks/generateMetaTitleHook.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { FieldHook } from 'payload'
-
-import { fetchAnthropicMetaDescription } from '@/lib/anthropic/fetchMetaDescription'
-import { generateContentURL } from '@/lib/generateContentURL'
-
-export const generateMetaDescriptionHook =
-  (slugPath: string): FieldHook =>
-  async ({ data, operation, value, collection }) => {
-    if (operation === 'create' || typeof value !== 'string' || value === '') {
-      const slugValue = data?.[slugPath]
-
-      if (typeof slugValue === 'string' && slugValue.length > 0) {
-        const url = generateContentURL({
-          collection: collection.slug,
-          slug: slugValue,
-        })
-
-        return await fetchAnthropicMetaDescription(url)
-      }
-    }
-
-    return value
-  }
diff --git a/src/fields/Meta/MetaDescriptionField/index.ts b/src/fields/Meta/MetaDescriptionField/index.ts
index 11befc21..d101d242 100644
--- a/src/fields/Meta/MetaDescriptionField/index.ts
+++ b/src/fields/Meta/MetaDescriptionField/index.ts
@@ -1,10 +1,6 @@
 import type { TextField } from 'payload'
 
-interface MetaDescriptionFieldProps {
-  slugPath: string
-}
-
-export const MetaDescriptionField = ({ slugPath }: MetaDescriptionFieldProps): TextField => ({
+export const MetaDescriptionField = (): TextField => ({
   name: 'description',
   label: 'Description',
   type: 'text',
@@ -15,12 +11,7 @@ export const MetaDescriptionField = ({ slugPath }: MetaDescriptionFieldProps): T
     disableListFilter: true,
     disableGroupBy: true,
     components: {
-      Field: {
-        path: '@/fields/Meta/MetaDescriptionField/FieldComponent',
-        serverProps: {
-          slugPath,
-        },
-      },
+      Field: '@/fields/Meta/MetaDescriptionField/FieldComponent',
     },
   },
 })
diff --git a/src/fields/Meta/index.ts b/src/fields/Meta/index.ts
index 0fe12676..88a3697b 100644
--- a/src/fields/Meta/index.ts
+++ b/src/fields/Meta/index.ts
@@ -70,9 +70,7 @@ export const MetaField = ({
         }),
       ]),
       MetaSerpProgressGroupField([
-        MetaDescriptionField({
-          slugPath,
-        }),
+        MetaDescriptionField(),
         MetaSerpProgressField({
           watchPath: 'meta.description',
           serpConfig: DESCRIPTION_SERP_CONFIG,
diff --git a/src/lib/actions/requireSession.ts b/src/lib/actions/requireSession.ts
new file mode 100644
index 00000000..39ac289f
--- /dev/null
+++ b/src/lib/actions/requireSession.ts
@@ -0,0 +1,24 @@
+import { headers } from 'next/headers'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+/**
+ * Rejects a Server Action call that carries no signed-in Payload session.
+ *
+ * A Server Action is its own reachable endpoint, whichever page renders the
+ * control that calls it, so every action that costs money or changes data
+ * checks the session itself instead of relying on the admin panel's routing.
+ */
+export const requireSession = async (): Promise<void> => {
+  const payload = await getPayload({
+    config,
+  })
+
+  const { user } = await payload.auth({
+    headers: await headers(),
+  })
+
+  if (!user) {
+    throw new Error('You must be signed in to do this.')
+  }
+}
diff --git a/src/lib/anthropic/fetchExcerpt.test.ts b/src/lib/anthropic/fetchExcerpt.test.ts
index 4cc34f86..0a1a475e 100644
--- a/src/lib/anthropic/fetchExcerpt.test.ts
+++ b/src/lib/anthropic/fetchExcerpt.test.ts
@@ -57,6 +57,7 @@ describe('fetchAnthropicExcerpt', () => {
   it('sends the source HTML to the model and parses the excerpt result back into Lexical', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>A short summary of the post.</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(
@@ -92,6 +93,7 @@ describe('fetchAnthropicExcerpt', () => {
   it("strips a leading '```html' + trailing '```' fence from the model output before parsing", async () => {
     generateTextMock.mockResolvedValue({
       text: '```html\n<p>A short summary.</p>\n```',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(paragraphDocument('Some content here.') as never)
@@ -111,6 +113,7 @@ describe('fetchAnthropicExcerpt', () => {
   it('unwraps links, which the excerpt editor cannot hold, keeping their text', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>Read the <a href="https://example.com">full guide</a> first.</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicExcerpt(paragraphDocument('Some content here.') as never)
diff --git a/src/lib/anthropic/fetchExcerpt.ts b/src/lib/anthropic/fetchExcerpt.ts
index 7f4745b1..499309ba 100644
--- a/src/lib/anthropic/fetchExcerpt.ts
+++ b/src/lib/anthropic/fetchExcerpt.ts
@@ -1,12 +1,9 @@
-'use server'
-
 import { convertLexicalToHTML } from '@payloadcms/richtext-lexical/html'
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
 import { parseHtmlToLexical } from '@/lib/lexical/parseHtmlToLexical'
 
 /**
@@ -25,37 +22,26 @@ export const fetchAnthropicExcerpt = async (
 
   if (!html.trim()) return null
 
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
+  const excerptHtml = await generateAnthropicText({
+    functionId: 'fetchAnthropicExcerpt',
+    maxOutputTokens: 2048,
+    system: dedent`
+      You write the excerpt shown on a blog post's preview card.
 
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+      The post is in the <post> tags as HTML. Tell the reader what they will
+      get from it in 2-3 sentences, in the same language as the post and in the
+      author's own voice: state the point directly rather than describing the
+      post ("This post explains ...").
 
-  const { text: excerptHtml } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicExcerpt',
-    },
-    system: dedent`
-      Write a concise, engaging excerpt (2-3 sentences) summarizing the
-      following blog post HTML, suitable for a preview card and meta
-      description. Return only the excerpt as a single HTML <p> tag, no
-      explanation, no code fences, no surrounding <html>/<body> tags. Use no
-      links; <strong> and <em> are the only tags allowed inside the <p>.
+      Return a single HTML <p> element and nothing else. Inside it, <strong>
+      and <em> are the only tags allowed; the excerpt has no link support.
     `,
-    prompt: html,
+    prompt: `<post>\n${html}\n</post>`,
   })
 
-  const stripped = excerptHtml
-    .replace(/^\s*```(?:html)?\s*\n?/i, '')
-    .replace(/\n?\s*```\s*$/, '')
-    // The excerpt editor has no link feature, so a link would fail validation
-    // on save; keep its text only.
-    .replace(/<\/?a\b[^>]*>/gi, '')
-    .trim()
+  // The excerpt editor has no link feature, so a link would fail validation
+  // on save; keep its text only.
+  const withoutLinks = excerptHtml.replace(/<\/?a\b[^>]*>/gi, '').trim()
 
-  return parseHtmlToLexical(stripped)
+  return parseHtmlToLexical(withoutLinks)
 }
diff --git a/src/lib/anthropic/fetchImageAltText.ts b/src/lib/anthropic/fetchImageAltText.ts
index c6360d51..9f0b0707 100644
--- a/src/lib/anthropic/fetchImageAltText.ts
+++ b/src/lib/anthropic/fetchImageAltText.ts
@@ -1,52 +1,45 @@
-'use server'
-
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 import sharp, { type SharpInput } from 'sharp'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
+
+// Large enough for text in the image to stay legible to the model.
+const MAX_EDGE_PX = 1024
+
 /**
  * Generates an image alternative text based on the image
  * @param input
  */
 export const fetchAnthropicImageAltText = async (input: SharpInput): Promise<string> => {
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
-
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
-
   const resizedImageBuffer = await sharp(input)
     .autoOrient()
     .resize({
-      width: 512,
-      height: 512,
+      width: MAX_EDGE_PX,
+      height: MAX_EDGE_PX,
       fit: 'inside',
+      withoutEnlargement: true,
     })
     .jpeg({
-      quality: 75,
+      quality: 80,
     })
     .toBuffer()
 
-  const { text } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicImageAltText',
-    },
+  return generateAnthropicText({
+    functionId: 'fetchAnthropicImageAltText',
+    maxOutputTokens: 1024,
     system: dedent`
-      Write a short but meaningful sentence that explains the attached image and helps improve its accessibility by describing the content of the image, adapted for visually impaired people or users of screen readers.
+      You write alt text for images on a personal website and blog, read aloud
+      by screen readers to people who cannot see the image.
+
+      Describe what the image shows in one English sentence, under 125
+      characters where possible:
+        - Lead with the most important content and be specific and factual
+        - Describe it directly, without openers such as "Image of" or "Picture of"
+        - Include text shown in the image when it matters for understanding it
+        - Mention mood or style only when that is the point of the image
+        - For an abstract or decorative image, name its visual character briefly
 
-      Your alt text should follow these guidelines:
-        - Keep it concise (typically one sentence, under 125 characters when possible)
-        - Describe the most important or relevant content in the image
-        - Be specific and factual about what is shown
-        - Avoid starting with phrases like "Image of..." or "Picture of..." - just describe what's there
-        - Focus on information that would be useful to someone who cannot see the image
-        - If there is text in the image that is important to understanding it, include that text in your description
-        - Avoid subjective interpretations unless the mood/tone is clearly the main point of the image
+      Return only the alt text, without quotation marks.
     `,
     messages: [
       {
@@ -56,10 +49,12 @@ export const fetchAnthropicImageAltText = async (input: SharpInput): Promise<str
             type: 'image',
             image: resizedImageBuffer,
           },
+          {
+            type: 'text',
+            text: 'Write the alt text for this image.',
+          },
         ],
       },
     ],
   })
-
-  return text
 }
diff --git a/src/lib/anthropic/fetchMetaDescription.test.ts b/src/lib/anthropic/fetchMetaDescription.test.ts
new file mode 100644
index 00000000..b106f120
--- /dev/null
+++ b/src/lib/anthropic/fetchMetaDescription.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const generateTextMock = vi.fn()
+
+vi.mock('ai', () => ({
+  generateText: (...args: unknown[]) => generateTextMock(...args),
+}))
+
+vi.mock('@ai-sdk/anthropic', () => ({
+  createAnthropic: () => (model: string) => ({
+    modelId: model,
+  }),
+}))
+
+const { clampMetaDescription, fetchAnthropicMetaDescription, META_DESCRIPTION_MAX_LENGTH } =
+  await import('./fetchMetaDescription')
+
+const post = {
+  title: 'Caching in Next.js',
+  slug: 'caching-in-next-js',
+  content: {
+    root: {
+      type: 'root',
+      children: [
+        {
+          type: 'paragraph',
+          children: [
+            {
+              type: 'text',
+              text: 'How cache tags and revalidation fit together.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+}
+
+describe('fetchAnthropicMetaDescription', () => {
+  beforeEach(() => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-test')
+    generateTextMock.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it("sends the document's own title and text, not a URL", async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'How cache tags and revalidation work together in Next.js.',
+      finishReason: 'stop',
+    })
+
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'posts',
+      data: post,
+    })
+
+    expect(result).toBe('How cache tags and revalidation work together in Next.js.')
+
+    const [options] = generateTextMock.mock.calls[0]
+
+    expect(options.prompt).toContain('<type>blog post</type>')
+    expect(options.prompt).toContain('Caching in Next.js')
+    expect(options.prompt).toContain('How cache tags and revalidation fit together.')
+    expect(options.prompt).not.toMatch(/https?:\/\//)
+    expect(options.prompt).not.toContain('caching-in-next-js')
+  })
+
+  it('returns null without calling the model when the document has no text', async () => {
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'pages',
+      data: {
+        slug: 'empty',
+      },
+    })
+
+    expect(result).toBeNull()
+    expect(generateTextMock).not.toHaveBeenCalled()
+  })
+
+  it('shortens an over-long answer to the limit', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'word '.repeat(60),
+      finishReason: 'stop',
+    })
+
+    const result = await fetchAnthropicMetaDescription({
+      collection: 'pages',
+      data: post,
+    })
+
+    expect(result?.length).toBeLessThanOrEqual(META_DESCRIPTION_MAX_LENGTH)
+  })
+})
+
+describe('clampMetaDescription', () => {
+  it('leaves a description within the limit alone, collapsing whitespace', () => {
+    expect(clampMetaDescription('  Short   and\nsweet. ')).toBe('Short and sweet.')
+  })
+
+  it('cuts at the last complete sentence when one ends late enough', () => {
+    const first = `${'A'.repeat(100)}.`
+    const result = clampMetaDescription(`${first} ${'B'.repeat(100)}.`)
+
+    expect(result).toBe(first)
+  })
+
+  it('otherwise cuts at a word boundary and adds an ellipsis', () => {
+    const result = clampMetaDescription('word '.repeat(60))
+
+    expect(result.length).toBeLessThanOrEqual(META_DESCRIPTION_MAX_LENGTH)
+    expect(result.endsWith('word…')).toBe(true)
+  })
+
+  it('still respects the limit for one unbroken string', () => {
+    expect(clampMetaDescription('x'.repeat(300)).length).toBe(META_DESCRIPTION_MAX_LENGTH)
+  })
+})
diff --git a/src/lib/anthropic/fetchMetaDescription.ts b/src/lib/anthropic/fetchMetaDescription.ts
index de6f2e3f..b78f3e9e 100644
--- a/src/lib/anthropic/fetchMetaDescription.ts
+++ b/src/lib/anthropic/fetchMetaDescription.ts
@@ -1,63 +1,104 @@
-'use server'
-
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
+import { extractDocumentText } from '@/lib/extractDocumentText'
+import { CollectionSlug } from '@/types/collections'
+
+// Search engines cut descriptions off around here.
+export const META_DESCRIPTION_MAX_LENGTH = 160
+
 /**
- * Generates a meta-description based on the URL
- * @param url
+ * A description only needs the gist of the page, which the opening carries;
+ * sending a whole long article would cost more without changing the result.
  */
-export const fetchAnthropicMetaDescription = async (url: string): Promise<string> => {
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
+const MAX_CONTENT_LENGTH = 8000
 
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+const pageTypeFor = (collection: string): string => {
+  if (collection === CollectionSlug.BlogPosts) return 'blog post'
+
+  if (collection === CollectionSlug.BlogTopics) return 'blog topic overview'
+
+  return 'page'
+}
+
+/**
+ * Shortens an over-long description to the limit: at the last complete
+ * sentence when one ends late enough to be worth keeping, otherwise at a word
+ * boundary with an ellipsis. Models cannot count characters reliably.
+ */
+export const clampMetaDescription = (
+  text: string,
+  maxLength: number = META_DESCRIPTION_MAX_LENGTH,
+): string => {
+  const normalized = text.replace(/\s+/g, ' ').trim()
+
+  if (normalized.length <= maxLength) return normalized
+
+  const head = normalized.slice(0, maxLength)
+
+  const sentenceEnd = Math.max(
+    head.lastIndexOf('. '),
+    head.lastIndexOf('! '),
+    head.lastIndexOf('? '),
+  )
 
-  const { text } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicMetaDescription',
-    },
+  if (sentenceEnd >= maxLength / 2) return head.slice(0, sentenceEnd + 1)
+
+  const room = normalized.slice(0, maxLength - 1)
+  const wordEnd = room.lastIndexOf(' ')
+
+  return `${(wordEnd > 0 ? room.slice(0, wordEnd) : room).replace(/[\s,;:–-]+$/, '')}…`
+}
+
+type FetchAnthropicMetaDescriptionArgs = {
+  collection: string
+  /** The document as it is being edited; its title and text are what gets described. */
+  data: unknown
+}
+
+/**
+ * Generates a meta description from a document's own title and text.
+ * Returns `null` when the document has no text to describe yet.
+ */
+export const fetchAnthropicMetaDescription = async ({
+  collection,
+  data,
+}: FetchAnthropicMetaDescriptionArgs): Promise<string | null> => {
+  const content = extractDocumentText(data).slice(0, MAX_CONTENT_LENGTH)
+
+  if (!content) return null
+
+  const description = await generateAnthropicText({
+    functionId: 'fetchAnthropicMetaDescription',
+    maxOutputTokens: 1024,
     system: dedent`
-      Create a meta-description text for the following URL, focusing on optimization for Google and other major search engines. A meta-description is a short text that appears in search engine results below the page title.
-      If you are looking for an in-depth context, such as the website operator's full name, information about their job, a categorization of the website and its intended purpose, as well as many other details, check out the JSON-LD objects embedded in the source code.
-      The provided JSON-LD objects are also designed to define the section of the website, e.g. "homepage", "resume", "blog", "blog post".
-
-      The meta-description should follow these requirements:
-
-      CHARACTER COUNT:
-      - Keep the meta-description between 150-160 characters (including spaces)
-      - This is the optimal length to avoid being cut off in search results
-
-      SEO OPTIMIZATION:
-      - Include relevant keywords naturally
-      - Make it compelling and informative
-      - Accurately describe what users will find on the page
-
-      TONE AND CALL-TO-ACTION:
-      - Use an action-oriented tone that encourages users to visit the website
-      - Include clear calls-to-action
-      - Mention key offerings
-      - Create urgency or value proposition to encourage clicks
-      - Use first person tone
-
-      OUTPUT FORMAT:
-      - Respond with the meta-description text ONLY - your entire response must be that one sentence or two, nothing else
-      - Do not add a title, headings, bullet points, or a "why this works" style explanation
-      - Do not offer multiple alternatives or label anything "Option 1" / "Recommended" - return exactly one meta-description, no picking between variants
-      - No markdown formatting of any kind (no **bold**, no #headings, no code fences, no checkmarks)
-      - No surrounding quotation marks
+      You write the meta description for a page of a personal website: the
+      short text search engines show below the page title.
+
+      The <page> tags hold the page's type and the text it contains, starting
+      with its title. Write one description based only on that text, in the
+      same language, and in the first person where the page speaks about its
+      author.
+
+      Aim for 140 to 155 characters including spaces, because search engines
+      cut off longer text. Lead with what the page offers, use the terms a
+      reader would search for where they fit naturally, and prefer a concrete
+      statement over a generic call to action.
+
+      Return the description as plain text and nothing else: no quotation
+      marks, no markdown, no alternatives.
     `,
-    prompt: url,
+    // Joined rather than a dedent template: the multi-line content has no
+    // indentation of its own, which would stop dedent from stripping any.
+    prompt: [
+      '<page>',
+      `<type>${pageTypeFor(collection)}</type>`,
+      '<content>',
+      content,
+      '</content>',
+      '</page>',
+    ].join('\n'),
   })
 
-  return text
-    .replace(/^\s*```(?:\w+)?\s*\n?/, '')
-    .replace(/\n?\s*```\s*$/, '')
-    .trim()
+  return clampMetaDescription(description)
 }
diff --git a/src/lib/anthropic/fetchTranslation.test.ts b/src/lib/anthropic/fetchTranslation.test.ts
index a42eb9f8..d20e474c 100644
--- a/src/lib/anthropic/fetchTranslation.test.ts
+++ b/src/lib/anthropic/fetchTranslation.test.ts
@@ -61,6 +61,7 @@ describe('fetchAnthropicTranslation', () => {
   it('sends the source HTML to the model and parses the translated result back into Lexical', async () => {
     generateTextMock.mockResolvedValue({
       text: '<p>Hallo Welt</p>',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicTranslation({
@@ -103,6 +104,7 @@ describe('fetchAnthropicTranslation', () => {
   it("strips a leading '```html' + trailing '```' fence from the model output before parsing", async () => {
     generateTextMock.mockResolvedValue({
       text: '```html\n<p>Hallo Welt</p>\n```',
+      finishReason: 'stop',
     })
 
     const result = await fetchAnthropicTranslation({
diff --git a/src/lib/anthropic/fetchTranslation.ts b/src/lib/anthropic/fetchTranslation.ts
index 96d191fb..446e06e4 100644
--- a/src/lib/anthropic/fetchTranslation.ts
+++ b/src/lib/anthropic/fetchTranslation.ts
@@ -1,12 +1,9 @@
-'use server'
-
 import { convertLexicalToHTML } from '@payloadcms/richtext-lexical/html'
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
-import { createAnthropic } from '@ai-sdk/anthropic'
-import { generateText } from 'ai'
 import dedent from 'dedent'
 
+import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
 import { parseHtmlToLexical } from '@/lib/lexical/parseHtmlToLexical'
 import { BilingualLanguageLabel, BilingualLanguageValue } from '@/types/bilingualLanguage'
 
@@ -33,35 +30,28 @@ export const fetchAnthropicTranslation = async ({
 
   if (!html.trim()) return null
 
-  if (!process.env.ANTHROPIC_API_KEY) {
-    throw new Error('ANTHROPIC_API_KEY is not configured.')
-  }
-
-  const anthropic = createAnthropic({
-    apiKey: process.env.ANTHROPIC_API_KEY,
-  })
+  const source = BilingualLanguageLabel[sourceLanguage]
+  const target = BilingualLanguageLabel[targetLanguage]
 
-  const { text: translatedHtml } = await generateText({
-    model: anthropic('claude-haiku-4-5'),
-    telemetry: {
-      isEnabled: true,
-      functionId: 'fetchAnthropicTranslation',
-    },
+  const translatedHtml = await generateAnthropicText({
+    functionId: 'fetchAnthropicTranslation',
+    maxOutputTokens: 16_000,
     system: dedent`
-      Translate the following ${BilingualLanguageLabel[sourceLanguage]} HTML fragment
-      into ${BilingualLanguageLabel[targetLanguage]}. Preserve the HTML tags and
-      structure exactly - translate only the text content. Keep the tone
-      concise and professional, appropriate for a CV/résumé bullet point.
-      Return only the translated HTML fragment, no explanation, no code
-      fences, no surrounding <html>/<body> tags.
+      You translate résumé content from ${source} into ${target}.
+
+      The source is an HTML fragment in the <source> tags. Translate its text
+      and keep the HTML tags, attributes and structure exactly as they are.
+      Leave link targets, company names, product names, technologies and other
+      proper nouns untranslated.
+
+      Keep the tone concise and professional, as in a CV bullet point, and
+      phrase it the way a native ${target} reader expects a résumé to read
+      rather than word for word.
+
+      Return only the translated HTML fragment.
     `,
-    prompt: html,
+    prompt: `<source>\n${html}\n</source>`,
   })
 
-  const stripped = translatedHtml
-    .replace(/^\s*```(?:html)?\s*\n?/i, '')
-    .replace(/\n?\s*```\s*$/, '')
-    .trim()
-
-  return parseHtmlToLexical(stripped)
+  return parseHtmlToLexical(translatedHtml)
 }
diff --git a/src/lib/anthropic/generateAnthropicText.test.ts b/src/lib/anthropic/generateAnthropicText.test.ts
new file mode 100644
index 00000000..71b4ddc0
--- /dev/null
+++ b/src/lib/anthropic/generateAnthropicText.test.ts
@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const generateTextMock = vi.fn()
+
+vi.mock('ai', () => ({
+  generateText: (...args: unknown[]) => generateTextMock(...args),
+}))
+
+vi.mock('@ai-sdk/anthropic', () => ({
+  createAnthropic: () => (model: string) => ({
+    modelId: model,
+  }),
+}))
+
+const { ANTHROPIC_MODEL, generateAnthropicText, stripCodeFence } =
+  await import('./generateAnthropicText')
+
+const call = () =>
+  generateAnthropicText({
+    functionId: 'test',
+    system: 'Be brief.',
+    maxOutputTokens: 512,
+    prompt: 'Hello',
+  })
+
+describe('generateAnthropicText', () => {
+  beforeEach(() => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-test')
+    generateTextMock.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('calls the current Haiku at low effort with an output limit and a timeout', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'Hi',
+      finishReason: 'stop',
+    })
+
+    await expect(call()).resolves.toBe('Hi')
+
+    const [options] = generateTextMock.mock.calls[0]
+
+    expect(options.model.modelId).toBe(ANTHROPIC_MODEL)
+    expect(ANTHROPIC_MODEL).toBe('claude-haiku-5-5')
+    expect(options.providerOptions.anthropic.effort).toBe('low')
+    expect(options.maxOutputTokens).toBe(512)
+    expect(options.timeout).toBeGreaterThan(0)
+    expect(options.system).toBe('Be brief.')
+    expect(options.prompt).toBe('Hello')
+  })
+
+  it.each(['length', 'content-filter', 'error', 'other'])(
+    'throws instead of returning a partial answer when the model stops with %s',
+    async (finishReason) => {
+      generateTextMock.mockResolvedValue({
+        text: 'Half an ans',
+        finishReason,
+      })
+
+      await expect(call()).rejects.toThrow(finishReason)
+    },
+  )
+
+  it('throws before calling the model when ANTHROPIC_API_KEY is not configured', async () => {
+    vi.stubEnv('ANTHROPIC_API_KEY', '')
+
+    await expect(call()).rejects.toThrow(/ANTHROPIC_API_KEY/)
+    expect(generateTextMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('stripCodeFence', () => {
+  it.each([
+    ['```html\n<p>Hi</p>\n```', '<p>Hi</p>'],
+    ['```\nplain\n```', 'plain'],
+    ['  no fence  ', 'no fence'],
+  ])('turns %j into %j', (input, expected) => {
+    expect(stripCodeFence(input)).toBe(expected)
+  })
+})
diff --git a/src/lib/anthropic/generateAnthropicText.ts b/src/lib/anthropic/generateAnthropicText.ts
new file mode 100644
index 00000000..4d01335a
--- /dev/null
+++ b/src/lib/anthropic/generateAnthropicText.ts
@@ -0,0 +1,74 @@
+import { createAnthropic } from '@ai-sdk/anthropic'
+import { generateText, type ModelMessage } from 'ai'
+
+export const ANTHROPIC_MODEL = 'claude-haiku-5-5'
+
+// One model call; none of the tasks here should take longer.
+const TIMEOUT_MS = 60_000
+
+type GenerateAnthropicTextArgs = {
+  /** Telemetry identifier, the name of the calling fetcher. */
+  functionId: string
+  system: string
+  /** Thinking counts toward this, so leave room beyond the expected answer. */
+  maxOutputTokens: number
+} & (
+  | {
+      prompt: string
+    }
+  | {
+      messages: ModelMessage[]
+    }
+)
+
+/** Models sometimes wrap HTML or plain text in a markdown fence despite being told not to. */
+export const stripCodeFence = (text: string): string =>
+  text
+    .replace(/^\s*```(?:\w+)?\s*\n?/, '')
+    .replace(/\n?\s*```\s*$/, '')
+    .trim()
+
+/**
+ * Shared Claude call for the short generation tasks in this folder.
+ *
+ * Throws instead of returning a partial answer: a response cut off by the
+ * token limit or declined by a safety filter must not be stored as content.
+ */
+export const generateAnthropicText = async ({
+  functionId,
+  system,
+  maxOutputTokens,
+  ...input
+}: GenerateAnthropicTextArgs): Promise<string> => {
+  if (!process.env.ANTHROPIC_API_KEY) {
+    throw new Error('ANTHROPIC_API_KEY is not configured.')
+  }
+
+  const anthropic = createAnthropic({
+    apiKey: process.env.ANTHROPIC_API_KEY,
+  })
+
+  const { text, finishReason } = await generateText({
+    model: anthropic(ANTHROPIC_MODEL),
+    telemetry: {
+      isEnabled: true,
+      functionId,
+    },
+    maxOutputTokens,
+    timeout: TIMEOUT_MS,
+    providerOptions: {
+      anthropic: {
+        // The model thinks by default at `medium`; these tasks need less.
+        effort: 'low',
+      },
+    },
+    system,
+    ...input,
+  })
+
+  if (finishReason !== 'stop') {
+    throw new Error(`Claude did not finish its answer (${finishReason}).`)
+  }
+
+  return stripCodeFence(text)
+}
diff --git a/src/lib/extractDocumentText.test.ts b/src/lib/extractDocumentText.test.ts
new file mode 100644
index 00000000..af8c419b
--- /dev/null
+++ b/src/lib/extractDocumentText.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest'
+
+import { extractDocumentText } from './extractDocumentText'
+
+const richText = (...texts: string[]) => ({
+  root: {
+    type: 'root',
+    children: texts.map((text) => ({
+      type: 'paragraph',
+      children: [
+        {
+          type: 'text',
+          text,
+        },
+      ],
+    })),
+  },
+})
+
+describe('extractDocumentText', () => {
+  it('collects titles and rich text in document order', () => {
+    const text = extractDocumentText({
+      title: 'Caching in Next.js',
+      slug: 'caching-in-next-js',
+      content: richText('First paragraph.', 'Second paragraph.'),
+    })
+
+    expect(text).toBe('Caching in Next.js\nFirst paragraph.\nSecond paragraph.')
+  })
+
+  it('reaches text nested in hero slides and layout blocks', () => {
+    const text = extractDocumentText({
+      layout: {
+        hero: {
+          slides: [
+            {
+              content: richText('Hero line.'),
+            },
+          ],
+        },
+        content: [
+          {
+            blockType: 'feature-cards',
+            title: 'What I do',
+            cards: [
+              {
+                title: 'Frontend',
+                description: richText('React and TypeScript.'),
+              },
+            ],
+          },
+        ],
+      },
+    })
+
+    expect(text).toBe('Hero line.\nWhat I do\nFrontend\nReact and TypeScript.')
+  })
+
+  it('leaves out the search-preview fields and non-text values', () => {
+    const text = extractDocumentText({
+      title: 'About',
+      slug: 'about',
+      updatedAt: '2026-01-01',
+      relatedPost: '64b7f0c2a1',
+      meta: {
+        title: 'Old meta title',
+        description: 'Old meta description',
+      },
+    })
+
+    expect(text).toBe('About')
+  })
+
+  it('keeps a repeated string once and collapses whitespace', () => {
+    const text = extractDocumentText({
+      title: 'Same',
+      content: richText('Same', '  spaced \n out  '),
+    })
+
+    expect(text).toBe('Same\nspaced out')
+  })
+
+  it('returns an empty string for values without text', () => {
+    expect(extractDocumentText(null)).toBe('')
+    expect(extractDocumentText({})).toBe('')
+    expect(extractDocumentText('title')).toBe('')
+  })
+})
diff --git a/src/lib/extractDocumentText.ts b/src/lib/extractDocumentText.ts
new file mode 100644
index 00000000..90c3287e
--- /dev/null
+++ b/src/lib/extractDocumentText.ts
@@ -0,0 +1,60 @@
+/* oxlint-disable anti-slop/no-runtime-typeof, anti-slop/no-unknown-parameters, anti-slop/no-unsafe-dictionary-type -- walks arbitrary document JSON of any collection; there is no single schema to parse it against */
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+// The search-preview fields describe the document; they are not its content.
+const SKIPPED_KEYS = new Set(['meta'])
+
+/**
+ * Collects the readable text of a Payload document: every `title` and every
+ * Lexical text node, in document order, wherever they are nested (hero
+ * slides, layout blocks, rich-text fields).
+ *
+ * Relationship fields only contribute when they are populated; a bare ID has
+ * no text. Repeated strings are kept once.
+ */
+export const extractDocumentText = (document: unknown): string => {
+  const parts: string[] = []
+  const seen = new Set<string>()
+
+  const add = (text: string) => {
+    const trimmed = text.replace(/\s+/g, ' ').trim()
+
+    if (trimmed === '' || seen.has(trimmed)) return
+
+    seen.add(trimmed)
+    parts.push(trimmed)
+  }
+
+  const visit = (node: unknown) => {
+    if (Array.isArray(node)) {
+      for (const item of node) visit(item)
+
+      return
+    }
+
+    if (!isRecord(node)) return
+
+    // A Lexical text node; its siblings and children hold no further text.
+    if (node.type === 'text' && typeof node.text === 'string') {
+      add(node.text)
+
+      return
+    }
+
+    for (const [key, value] of Object.entries(node)) {
+      if (SKIPPED_KEYS.has(key)) continue
+
+      if (key === 'title' && typeof value === 'string') {
+        add(value)
+      } else {
+        visit(value)
+      }
+    }
+  }
+
+  visit(document)
+
+  return parts.join('\n')
+}
diff --git a/src/lib/resolveOwnMediaUrl.test.ts b/src/lib/resolveOwnMediaUrl.test.ts
new file mode 100644
index 00000000..2a4f7854
--- /dev/null
+++ b/src/lib/resolveOwnMediaUrl.test.ts
@@ -0,0 +1,38 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { resolveOwnMediaUrl } from './resolveOwnMediaUrl'
+
+describe('resolveOwnMediaUrl', () => {
+  beforeEach(() => {
+    vi.stubEnv('SERVER_URL', 'https://example.com')
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('resolves a relative upload path against the site', () => {
+    expect(resolveOwnMediaUrl('/api/images/file/photo.jpg').href).toBe(
+      'https://example.com/api/images/file/photo.jpg',
+    )
+  })
+
+  it('accepts an absolute URL on the same origin', () => {
+    expect(resolveOwnMediaUrl('https://example.com/api/images/file/photo.jpg').pathname).toBe(
+      '/api/images/file/photo.jpg',
+    )
+  })
+
+  it.each([
+    'https://evil.example/photo.jpg',
+    'http://example.com/photo.jpg',
+    'http://169.254.169.254/latest/meta-data',
+    '//evil.example/photo.jpg',
+  ])('rejects %s', (url) => {
+    expect(() => resolveOwnMediaUrl(url)).toThrow(/another origin/)
+  })
+
+  it.each([undefined, null, ''])('rejects a missing URL (%s)', (url) => {
+    expect(() => resolveOwnMediaUrl(url)).toThrow(/no URL/)
+  })
+})
diff --git a/src/lib/resolveOwnMediaUrl.ts b/src/lib/resolveOwnMediaUrl.ts
new file mode 100644
index 00000000..10902adf
--- /dev/null
+++ b/src/lib/resolveOwnMediaUrl.ts
@@ -0,0 +1,20 @@
+/**
+ * Resolves a media URL against this site and rejects anything that points
+ * elsewhere, so a server-side fetch of "our own upload" can never be steered
+ * to another host. Uploads are served from `/api/<collection>/file/...`, so a
+ * legitimate value is always same-origin.
+ */
+export const resolveOwnMediaUrl = (url: string | null | undefined): URL => {
+  if (!url) {
+    throw new Error('The image has no URL yet.')
+  }
+
+  const origin = new URL(process.env.SERVER_URL ?? '').origin
+  const resolved = new URL(url, origin)
+
+  if (resolved.origin !== origin) {
+    throw new Error(`Refusing to fetch media from another origin: ${resolved.origin}`)
+  }
+
+  return resolved
+}

From 5717bcc88e3588d91542acde5ede4629556194f6 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 08:30:08 +0100
Subject: [PATCH 12/30] feat(ai): translate resume content with Sonnet 5.5

Translation is read closely and runs rarely, so it gets the stronger model; alt text, excerpts and meta descriptions stay on Haiku 5.5.
---
 AGENTS.md                                     |  3 ++-
 src/lib/anthropic/fetchTranslation.test.ts    |  1 +
 src/lib/anthropic/fetchTranslation.ts         |  6 +++++-
 .../anthropic/generateAnthropicText.test.ts   | 19 ++++++++++++++++++-
 src/lib/anthropic/generateAnthropicText.ts    | 15 +++++++++++++--
 5 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 627a3905..572a6e90 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -161,7 +161,8 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
 - **Server actions** (`src/lib/actions/`): `'use server'` functions for admin mutations (job
   rescheduling, cancellation, etc.). Use `useTransition` on the client side when calling them.
 - **Claude calls** (`src/lib/anthropic/`): every fetcher goes through `generateAnthropicText()`,
-  which owns the model ID (`ANTHROPIC_MODEL`), effort, timeout and output limit, and throws when
+  which owns the model IDs (`ANTHROPIC_MODEL`, Haiku 5.5; `ANTHROPIC_TRANSLATION_MODEL`, Sonnet
+  5.5, for résumé translation only), effort, timeout and output limit, and throws when
   the answer was cut off or declined rather than returning partial text. Give the model the
   content itself (wrapped in tags), never a URL: it cannot fetch. These modules are plain server
   modules, not `'use server'` files, and the worker imports them too, so `server-only` (which
diff --git a/src/lib/anthropic/fetchTranslation.test.ts b/src/lib/anthropic/fetchTranslation.test.ts
index d20e474c..8177a3ad 100644
--- a/src/lib/anthropic/fetchTranslation.test.ts
+++ b/src/lib/anthropic/fetchTranslation.test.ts
@@ -75,6 +75,7 @@ describe('fetchAnthropicTranslation', () => {
     expect(call[0].prompt).toContain('Hello world')
     expect(call[0].system).toContain('English')
     expect(call[0].system).toContain('German')
+    expect(call[0].model.modelId).toBe('claude-sonnet-5-5')
 
     const root = result?.root as unknown as {
       children: Array<{
diff --git a/src/lib/anthropic/fetchTranslation.ts b/src/lib/anthropic/fetchTranslation.ts
index 446e06e4..33d17274 100644
--- a/src/lib/anthropic/fetchTranslation.ts
+++ b/src/lib/anthropic/fetchTranslation.ts
@@ -3,7 +3,10 @@ import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical
 
 import dedent from 'dedent'
 
-import { generateAnthropicText } from '@/lib/anthropic/generateAnthropicText'
+import {
+  ANTHROPIC_TRANSLATION_MODEL,
+  generateAnthropicText,
+} from '@/lib/anthropic/generateAnthropicText'
 import { parseHtmlToLexical } from '@/lib/lexical/parseHtmlToLexical'
 import { BilingualLanguageLabel, BilingualLanguageValue } from '@/types/bilingualLanguage'
 
@@ -35,6 +38,7 @@ export const fetchAnthropicTranslation = async ({
 
   const translatedHtml = await generateAnthropicText({
     functionId: 'fetchAnthropicTranslation',
+    model: ANTHROPIC_TRANSLATION_MODEL,
     maxOutputTokens: 16_000,
     system: dedent`
       You translate résumé content from ${source} into ${target}.
diff --git a/src/lib/anthropic/generateAnthropicText.test.ts b/src/lib/anthropic/generateAnthropicText.test.ts
index 71b4ddc0..73c62c45 100644
--- a/src/lib/anthropic/generateAnthropicText.test.ts
+++ b/src/lib/anthropic/generateAnthropicText.test.ts
@@ -12,7 +12,7 @@ vi.mock('@ai-sdk/anthropic', () => ({
   }),
 }))
 
-const { ANTHROPIC_MODEL, generateAnthropicText, stripCodeFence } =
+const { ANTHROPIC_MODEL, ANTHROPIC_TRANSLATION_MODEL, generateAnthropicText, stripCodeFence } =
   await import('./generateAnthropicText')
 
 const call = () =>
@@ -52,6 +52,23 @@ describe('generateAnthropicText', () => {
     expect(options.prompt).toBe('Hello')
   })
 
+  it('uses the model a caller names instead of the default', async () => {
+    generateTextMock.mockResolvedValue({
+      text: 'Hi',
+      finishReason: 'stop',
+    })
+
+    await generateAnthropicText({
+      functionId: 'test',
+      system: 'Be brief.',
+      maxOutputTokens: 512,
+      model: ANTHROPIC_TRANSLATION_MODEL,
+      prompt: 'Hello',
+    })
+
+    expect(generateTextMock.mock.calls[0][0].model.modelId).toBe('claude-sonnet-5-5')
+  })
+
   it.each(['length', 'content-filter', 'error', 'other'])(
     'throws instead of returning a partial answer when the model stops with %s',
     async (finishReason) => {
diff --git a/src/lib/anthropic/generateAnthropicText.ts b/src/lib/anthropic/generateAnthropicText.ts
index 4d01335a..98c0ffa7 100644
--- a/src/lib/anthropic/generateAnthropicText.ts
+++ b/src/lib/anthropic/generateAnthropicText.ts
@@ -3,6 +3,14 @@ import { generateText, type ModelMessage } from 'ai'
 
 export const ANTHROPIC_MODEL = 'claude-haiku-5-5'
 
+/**
+ * Résumé wording is read closely and translated rarely, so the translation
+ * uses the stronger model; everything else stays on the cheap one.
+ */
+export const ANTHROPIC_TRANSLATION_MODEL = 'claude-sonnet-5-5'
+
+type AnthropicModel = typeof ANTHROPIC_MODEL | typeof ANTHROPIC_TRANSLATION_MODEL
+
 // One model call; none of the tasks here should take longer.
 const TIMEOUT_MS = 60_000
 
@@ -12,6 +20,8 @@ type GenerateAnthropicTextArgs = {
   system: string
   /** Thinking counts toward this, so leave room beyond the expected answer. */
   maxOutputTokens: number
+  /** Defaults to `ANTHROPIC_MODEL`. */
+  model?: AnthropicModel
 } & (
   | {
       prompt: string
@@ -38,6 +48,7 @@ export const generateAnthropicText = async ({
   functionId,
   system,
   maxOutputTokens,
+  model = ANTHROPIC_MODEL,
   ...input
 }: GenerateAnthropicTextArgs): Promise<string> => {
   if (!process.env.ANTHROPIC_API_KEY) {
@@ -49,7 +60,7 @@ export const generateAnthropicText = async ({
   })
 
   const { text, finishReason } = await generateText({
-    model: anthropic(ANTHROPIC_MODEL),
+    model: anthropic(model),
     telemetry: {
       isEnabled: true,
       functionId,
@@ -58,7 +69,7 @@ export const generateAnthropicText = async ({
     timeout: TIMEOUT_MS,
     providerOptions: {
       anthropic: {
-        // The model thinks by default at `medium`; these tasks need less.
+        // Both models think more than these short tasks need by default.
         effort: 'low',
       },
     },

From d82fe09b6df5efec56ceb2c9fcd5ef05ce14640a Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 11:44:50 +0100
Subject: [PATCH 13/30] docs(llms): bring llms.txt up to date with the branch

Adds the Claude helpers, session check, production detection, CI workflows, Dockerfile and release config; gives every list item a single link; moves secondary material into the Optional section.
---
 llms.txt | 103 ++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 75 insertions(+), 28 deletions(-)

diff --git a/llms.txt b/llms.txt
index f42913a8..278c6717 100644
--- a/llms.txt
+++ b/llms.txt
@@ -8,56 +8,103 @@ This is a code repository, not a documentation site — the files below are the
 AI coding agent should read before making changes, not end-user docs. `AGENTS.md` is the most
 important file: read it first, every time.
 
+This file describes the repository. The website's own public `/llms.txt` is a separate thing,
+generated from published content by `app/llms.txt/route.ts`.
+
 ## Start Here
 
-- [AGENTS.md](AGENTS.md): Required reading before any change — stack, code style, architecture
-  notes, and known security guardrails (public SSE channels remain unauthenticated by design,
-  raw SVG is sanitized server-side before rendering, `CRON_SECRET` is declared but unenforced).
+- [AGENTS.md](AGENTS.md): Required reading before any change — stack, commands, code style,
+  architecture notes, security guardrails (session checks on server actions, authenticated SSE
+  channels, server-side SVG sanitizing, production detection via `PRODUCTION_HOST`) and known
+  issues.
 - [README.md](README.md): Setup and local development — Doppler-based env config, Docker
-  services, available scripts, project structure, testing, CI/deployment.
+  services, available scripts, environment variables, project structure, testing, CI/deployment.
 
 ## Configuration
 
 - [payload.config.ts](payload.config.ts): Payload CMS configuration (collections, globals,
-  plugins, S3 storage, KV cache) — repo root, not under `src/`.
+  plugins, jobs queue, S3 storage, KV store, dashboard widgets) — repo root, not under `src/`.
 - [next.config.ts](next.config.ts): Next.js configuration; validates the environment against
   the Zod schema at startup and owns the opt-in dev tunnel. There is no `env:` block: browser
   values are plain `NEXT_PUBLIC_*` variables.
 - [proxy.ts](proxy.ts): Next.js 16 request proxy (the former `middleware.ts`); canonicalizes blog
-  listing URLs.
+  listing URLs and marks non-default sorts `noindex`.
 - [src/types/environment.ts](src/types/environment.ts): Zod schema and source of truth for all
-  environment variables; validated at process start.
+  environment variables.
+- [.env.test](.env.test): The one committed env file — dummy, format-valid values for E2E runs
+  and CI checks.
 - [docker-compose.yml](docker-compose.yml): Local infrastructure (MongoDB, Redis, S3-compatible
   storage) — the app itself runs via `bun run dev`, not as a compose service.
-- [oxlint.config.ts](oxlint.config.ts), [oxfmt.config.ts](oxfmt.config.ts): Linting/formatting rules (Oxc toolchain, not ESLint/Prettier).
-- [vitest.config.ts](vitest.config.ts) / [vitest.setup.ts](vitest.setup.ts): Unit test config
-  and shared mocks (`payload`, `next/cache`, `redis`).
-- [playwright.config.ts](playwright.config.ts): E2E test config (Chromium).
-- [commitlint.config.mjs](commitlint.config.mjs): Conventional Commits enforcement.
+- [package.json](package.json): Scripts and dependencies; Bun is the package manager, Node.js
+  runs Next, Payload, the scripts and the tests.
+- [oxlint.config.ts](oxlint.config.ts): Lint rules (Oxc toolchain, not ESLint), including the
+  Tailwind plugin and the vendored `anti-slop` plugin.
+- [oxfmt.config.ts](oxfmt.config.ts): Formatting and import order (not Prettier).
+- [syncpack.config.mjs](syncpack.config.mjs): Dependency version rules, including the pinned
+  Playwright version.
+- [lefthook.yml](lefthook.yml): Git hooks — format and lint staged files, sync `package.json`,
+  check the commit message.
+- [commitlint.config.mjs](commitlint.config.mjs): Conventional Commits rules.
+- [vitest.config.ts](vitest.config.ts): Unit test configuration.
+- [vitest.setup.ts](vitest.setup.ts): Shared mocks (`payload`, `next/cache`, `server-only`,
+  `redis`) and the forced `TZ=UTC`.
+- [playwright.config.ts](playwright.config.ts): E2E test configuration (Chromium).
 
 ## Source Layout
 
-- [app/](app): Next.js App Router — `(frontend)` for the public site and its route handlers
-  (preview, sse, health, icons/collection, the blog RSS feed, the resume download), `(payload)`
-  for the admin panel and Payload's REST API, `llms.txt/` for the site's public `/llms.txt`.
+- [app/](app): Next.js App Router — `(frontend)` for the public site, its route handlers
+  (preview, sse, health, icons/collection, the blog RSS feed, the resume download), `robots.ts`
+  and `sitemap.ts`; `(payload)` for the admin panel and Payload's REST API; `llms.txt/` for the
+  site's public `/llms.txt`; `global-error.tsx`, which has to stay at the root of `app/`.
 - [src/collections/](src/collections): Payload Collections (Media*, Pages, BlogPosts,
   BlogTopics, Resume*, Redirects, References, Users).
-- [src/globals/](src/globals): Payload Globals (SiteSettings, PDFGeneratorSettings, etc.).
+- [src/globals/](src/globals): Payload Globals (SiteSettings, SettingsGlobalUser,
+  PDFGeneratorSettings).
 - [src/blocks/](src/blocks): Reusable Payload Blocks (resume sections, content blocks).
-- [src/fields/](src/fields): Custom/reusable Payload field factories.
+- [src/fields/](src/fields): Reusable Payload field factories (`SlugField`, `TitleField`, ...).
+- [src/components/](src/components): React components.
+- [src/lib/](src/lib): Utilities grouped by domain, including `RedisHandler.ts` (cache and
+  pub/sub for SSE), `isProductionHost.ts` (the only way to tell production apart) and `seed/`
+  (fixture seed/clean logic shared by the CLI scripts and the admin panel).
 - [src/lib/access/](src/lib/access): Access control functions — no role system; any
   authenticated Payload user is fully trusted.
-- [src/components/](src/components): React components.
-- [src/lib/](src/lib): Framework-agnostic utilities, including `RedisHandler.ts` (cache +
-  pub/sub for SSE) and `lib/seed/` (shared seed/clean logic for fixture data, used by both
-  CLI scripts and the admin panel).
-- [src/emails/](src/emails): React Email templates and rendering (contact form notifications).
-- [src/pdf/](src/pdf): PDF generation (resume export).
+- [src/lib/actions/](src/lib/actions): Server actions (`'use server'`) for admin mutations, and
+  `requireSession.ts`, the session check every such action runs first.
+- [src/lib/anthropic/](src/lib/anthropic): Claude calls (alt text, meta descriptions, blog
+  excerpts, resume translation); all go through `generateAnthropicText.ts`, which owns the model
+  IDs, effort, timeout and output limit.
+- [src/lib/sse/](src/lib/sse): Allowlist of Server-Sent Events channels, public and
+  authenticated.
 - [src/jobs-queue/](src/jobs-queue): Payload Jobs Queue task/workflow configs plus their
-  handlers (`handlers/`), which only the standalone worker (`scripts/start-worker.mjs`) runs.
+  handlers (`handlers/`), which only the standalone worker runs.
 - [src/plugins/](src/plugins): Local Payload plugins (redirects, references).
-- [src/widgets/](src/widgets): Custom Payload dashboard widgets (async server components registered
-  in `payload.config.ts`; client parts call server actions from `src/lib/actions/`).
-- [src/lib/actions/](src/lib/actions): Server actions (`'use server'`) for admin mutations (job
-  rescheduling, cancellation, etc.).
+- [src/widgets/](src/widgets): Payload dashboard widgets (async server components registered in
+  `payload.config.ts`; client parts call server actions from `src/lib/actions/`).
+- [src/emails/](src/emails): React Email templates (contact form notifications).
+- [src/pdf/](src/pdf): PDF generation for the resume export.
+- [src/migrations/](src/migrations): Payload database migrations.
+- [scripts/](scripts): Dev runner, worker entrypoint, env loader, seeders, image assembly.
 - [e2e/](e2e): Playwright E2E specs — structural smoke tests, not content assertions.
+
+## Build and Deployment
+
+- [.github/workflows/lint-and-test.yml](.github/workflows/lint-and-test.yml): Pull-request gate —
+  lint, Semgrep, unit tests (the E2E job is currently commented out).
+- [.github/workflows/build-and-deploy.yml](.github/workflows/build-and-deploy.yml): Push
+  pipeline for `main` and `develop` — version bump, migrate, build, image boot checks, push,
+  Dokploy redeploy.
+- [Dockerfile](Dockerfile): COPY-only images for the app, the worker and Storybook; everything
+  is built in CI.
+- [release.config.mjs](release.config.mjs): semantic-release — releases from `main`, release
+  candidates from `develop`.
+- [scripts/start-worker.mjs](scripts/start-worker.mjs): Worker container entrypoint; runs the
+  job queue and its health endpoint.
+
+## Optional
+
+- [CHANGELOG.md](CHANGELOG.md): Release history, written by semantic-release.
+- [.storybook/](.storybook): Storybook configuration, component stories, and the
+  design-foundation and shader documentation (MDX).
+- [tools/oxlint/anti-slop/](tools/oxlint/anti-slop): Vendored Oxlint rule plugin.
+- [patches/](patches): Dependency patches applied by Bun (`pdfjs-dist`).
+- [LICENSE](LICENSE): MIT license.

From 9b88543c692f06f13a61614f69376022ebcf32f6 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 11:59:05 +0100
Subject: [PATCH 14/30] fix(app): keep robots and manifest at the app root

Next ignores robots.ts and manifest.ts inside a route group: neither route was compiled, so /robots.txt would have 404ed after the earlier move, and /manifest.webmanifest already does on production. sitemap.ts is unaffected and stays in app/(frontend).
---
 app/{(frontend) => }/manifest.ts    | 0
 app/{(frontend) => }/robots.test.ts | 0
 app/{(frontend) => }/robots.ts      | 0
 3 files changed, 0 insertions(+), 0 deletions(-)
 rename app/{(frontend) => }/manifest.ts (100%)
 rename app/{(frontend) => }/robots.test.ts (100%)
 rename app/{(frontend) => }/robots.ts (100%)

diff --git a/app/(frontend)/manifest.ts b/app/manifest.ts
similarity index 100%
rename from app/(frontend)/manifest.ts
rename to app/manifest.ts
diff --git a/app/(frontend)/robots.test.ts b/app/robots.test.ts
similarity index 100%
rename from app/(frontend)/robots.test.ts
rename to app/robots.test.ts
diff --git a/app/(frontend)/robots.ts b/app/robots.ts
similarity index 100%
rename from app/(frontend)/robots.ts
rename to app/robots.ts

From 8ccfb809e536d3589bba2e382a8fbf5332ab6e0e Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 11:59:06 +0100
Subject: [PATCH 15/30] ci: add bundle analyzer and a per-route bundle size
 budget

bun run analyze builds in compile mode with @next/bundle-analyzer and runs scripts/check-bundle-size.mjs, which reports the gzipped first-load JavaScript of every public route.

The new PR job "Build & Bundle Size" runs the same build with .env.test, publishes the table to the job summary, uploads the analyzer reports and fails above 265 kB. 170 kB, the usual recommendation, is reported as a warning: the framework chunks alone are 189 kB, so no route can meet it today (largest route: 251 kB).
---
 .github/workflows/lint-and-test.yml |  51 +++++++
 AGENTS.md                           |  14 +-
 README.md                           |  14 +-
 bun.lock                            |  33 ++++
 llms.txt                            |  12 +-
 next.config.ts                      |  12 +-
 package.json                        |   3 +
 scripts/check-bundle-size.mjs       | 225 ++++++++++++++++++++++++++++
 8 files changed, 351 insertions(+), 13 deletions(-)
 create mode 100644 scripts/check-bundle-size.mjs

diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index b14a0a22..d486aa1d 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -101,6 +101,57 @@ jobs:
           retention-days: 7
           if-no-files-found: ignore
 
+  # Compiles the app and holds the public routes to their JavaScript budget
+  # (scripts/check-bundle-size.mjs). Compile mode only: it needs no database,
+  # prerenders nothing, and is never deployed; build-and-deploy.yml builds the
+  # real thing against each environment's own values.
+  build:
+    name: Build & Bundle Size
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      # Webpack's persistent cache; the only part of .next Next documents as
+      # worth restoring between builds.
+      - name: Restore Next.js build cache
+        uses: actions/cache@v4 # TODO: pin to a commit SHA like the other actions
+        with:
+          path: .next/cache
+          key: next-cache-bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ github.sha }}
+          restore-keys: |
+            next-cache-bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-
+            next-cache-bun-${{ runner.os }}-
+
+      # next.config.ts validates the environment when it loads.
+      - name: Load .env.test into job environment
+        run: grep -v '^#' .env.test | grep -v '^$' >> "$GITHUB_ENV"
+
+      # ANALYZE writes the @next/bundle-analyzer reports to .next/analyze.
+      - name: Build
+        run: bun run build --experimental-build-mode=compile
+        env:
+          NODE_ENV: production
+          ANALYZE: 'true'
+
+      # Prints the per-route table into the job summary and fails the job when
+      # a route is over its limit.
+      - name: Check bundle size
+        run: bun run bundle:check
+
+      - name: Upload bundle analysis
+        if: always()
+        uses: actions/upload-artifact@v4 # TODO: pin to a commit SHA like the other actions
+        with:
+          name: bundle-analysis
+          path: .next/analyze/
+          retention-days: 7
+          if-no-files-found: ignore
+
   # E2E tests temporarily disabled
   # e2e:
   #   name: E2E Tests
diff --git a/AGENTS.md b/AGENTS.md
index 572a6e90..58c76a35 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,6 +36,7 @@ bun run dev:storybook    # Storybook on :6006 (not started by `bun run dev`)
 bun run generate         # regenerate Next route types, Payload types + import map
 bun run build            # production build (`next build --webpack`)
 bun run typecheck        # tsc --noEmit
+bun run analyze          # compile-only build + bundle analyzer reports + bundle budget check
 bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
 bun run format           # oxfmt (formatting and import order only)
@@ -173,8 +174,15 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
 - **Stories** live in `.storybook/components/*.stories.tsx`, not next to the components; the
   design-foundation and shader docs are MDX under `.storybook/foundations/` and
   `.storybook/shaders/`.
-- **`app/global-error.tsx`** has to stay at the root of `app/`: Next only resolves it there, not
-  inside a route group. It replaces the root layout, so it imports the stylesheet and fonts itself.
+- **`app/global-error.tsx`, `app/robots.ts` and `app/manifest.ts`** have to stay at the root of
+  `app/`: inside a route group Next silently ignores all three (no error, the URL just 404s).
+  `sitemap.ts` is the exception and works from `app/(frontend)/`. `global-error.tsx` replaces the
+  root layout, so it imports the stylesheet and fonts itself.
+- **Bundle budget**: `scripts/check-bundle-size.mjs` reports the gzipped first-load JavaScript of
+  every public route and fails above the limit set in its `BUDGETS` (CI job "Build & Bundle
+  Size"). `bun run analyze` produces the same check locally plus the `@next/bundle-analyzer`
+  reports in `.next/analyze/`. The 170 kB target is a warning; lower the enforced limit when
+  routes shrink, and give a reason in the commit when raising it.
 - **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
   maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
   content.
@@ -236,7 +244,7 @@ only when `PAYLOAD_JOBS_ENABLE_APP_WORKERS=true` (default `false`).
 - **Production detection**: `NODE_ENV` cannot tell environments apart (every deployed image runs
   `production`). Use `isProductionHost()` (`src/lib/isProductionHost.ts`), which compares
   `SERVER_HOST` with `PRODUCTION_HOST` and reads an unset value as "not production". Outside
-  production `app/(frontend)/robots.ts` disallows all crawlers and `src/pdf/index.tsx` stamps
+  production `app/robots.ts` disallows all crawlers and `src/pdf/index.tsx` stamps
   PDFs as DRAFT.
 
 ## Known Issues / Tech Debt (baseline, not blocking, but don't add more)
diff --git a/README.md b/README.md
index 87816596..3ac38183 100644
--- a/README.md
+++ b/README.md
@@ -117,8 +117,8 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
   - `app/(frontend)/`: Public website pages, layouts, and route handlers: `/api/preview`, `/api/sse`, `/api/health`, `/api/icons/collection`, `/blog/feed.xml` and `/download/resume.pdf`. CMS pages are under `[slug]/`, the blog under `blog/`, resume documents under `resume/[slug]/`.
   - `app/(payload)/`: Payload CMS admin panel (`/admin`) and Payload's REST API (`/api/*`; GraphQL is disabled).
   - `app/llms.txt/`: The site's public `/llms.txt`, generated from published pages, posts and topics (unrelated to the repository's own `llms.txt` in the project root).
-  - `app/(frontend)/robots.ts`, `app/(frontend)/sitemap.ts`: Crawler rules and the sitemap. `robots.txt` disallows everything unless `SERVER_HOST` equals `PRODUCTION_HOST`.
-  - `app/global-error.tsx`: Root error boundary. It has to stay at the root of `app/`; Next.js does not look for it inside a route group.
+  - `app/robots.ts`, `app/manifest.ts`, `app/global-error.tsx`: Crawler rules, the web app manifest and the root error boundary. These three have to stay at the root of `app/`; Next.js does not pick them up inside a route group. `robots.txt` disallows everything unless `SERVER_HOST` equals `PRODUCTION_HOST`.
+  - `app/(frontend)/sitemap.ts`: The sitemap.
 - **Request Proxy**: `proxy.ts` (Next.js 16's replacement for `middleware.ts`) canonicalizes blog listing URLs and marks non-default sorts `noindex`.
 - **Payload Configuration**: `payload.config.ts` in the project root, integrated into Next.js via `withPayload` in `next.config.ts`.
 - **Jobs Queue & Worker**: `src/jobs-queue/` and standalone background worker entrypoint `scripts/start-worker.mjs` with `scripts/health-server.ts`. The web process only enqueues jobs; the worker runs them.
@@ -135,6 +135,8 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 | `bun run dev:app` | Starts the Next.js dev server directly, without the tunnel wrapper. |
 | `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
 | `bun run build` | Production build (`next build --webpack`). |
+| `bun run analyze` | Compile-only build with `@next/bundle-analyzer` reports in `.next/analyze/`, followed by `bundle:check`. |
+| `bun run bundle:check` | Checks the first-load JavaScript of each public route in an existing build against its budget (`scripts/check-bundle-size.mjs`). |
 | `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
 | `bun run start:storybook` | Serves the static Storybook build on port 3020. |
 | `bun run start:app` | Starts the production Next.js application server. |
@@ -268,7 +270,6 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 │   │   ├── blog/                 # Blog listing, topics, posts, and the RSS feed (feed.xml)
 │   │   ├── download/             # /download/resume.pdf redirect
 │   │   ├── resume/               # Resume documents by slug
-│   │   ├── robots.ts             # Crawler rules
 │   │   ├── sitemap.ts            # Sitemap
 │   │   └── layout.tsx            # Frontend root layout
 │   ├── (payload)/                # Payload CMS admin routes
@@ -276,7 +277,9 @@ The source of truth is declared as a Zod schema in `src/types/environment.ts`. I
 │   │   ├── api/                  # Payload REST API endpoints
 │   │   └── layout.tsx            # Payload admin layout
 │   ├── llms.txt/                 # Public /llms.txt route
-│   └── global-error.tsx          # Root error boundary (must stay at the app root)
+│   ├── robots.ts                 # Crawler rules           ┐
+│   ├── manifest.ts               # Web app manifest        ├ must stay at the app root
+│   └── global-error.tsx          # Root error boundary     ┘
 ├── src/                          # Application source code
 │   ├── blocks/                   # Payload blocks (rich text, code, feature cards, resume sections, etc.)
 │   ├── collections/              # Payload collections (Media*, Pages, BlogPosts, BlogTopics, Resume*, Redirects, References, Users)
@@ -399,7 +402,8 @@ Everything is built in CI; Docker images only `COPY` finished output (no package
   1. **Lint**: `commitlint` over the PR's commits, `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files (`src/types/payload.ts`, the admin import map) match `bun run generate`, and `actionlint`.
   2. **Semgrep**: static security analysis with the `nodejs`, `typescript`, `react` and `secrets` rulesets. Accepted findings are marked in place with `// nosemgrep: <rule>` and a reason.
   3. **Unit Tests**: `vitest run --coverage`, with the coverage report uploaded as an artifact.
-  4. **E2E**: currently disabled (the job is commented out in the workflow).
+  4. **Build & Bundle Size**: `next build --webpack --experimental-build-mode=compile` with `.env.test` (no database needed), then `bun run bundle:check`. The per-route table goes into the job summary and the `@next/bundle-analyzer` reports are uploaded as the `bundle-analysis` artifact.
+  5. **E2E**: currently disabled (the job is commented out in the workflow).
 - **Pushes to `develop` / `main`** (`build-and-deploy.yml`, also runnable through `workflow_dispatch` on those two branches):
   1. **Bump version**: semver bump, tag and changelog via `semantic-release` (`release.config.mjs`), committed as a GitHub App so the push passes `main`'s ruleset. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
   2. **Deploy** (environment `Production` on `main`, `Development` on `develop`): connects to the tailnet, runs `bun run migrate` against the target database, runs one `next build --webpack` with that environment's values, builds Storybook, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, boot-checks each one as a real container (`/api/health` on 3000, `/health` on 3010, Storybook on 3020), pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks. The lint and test jobs are not re-run here; the merged commit already passed them as PR checks.
diff --git a/bun.lock b/bun.lock
index 6f7469e3..6b37de1c 100644
--- a/bun.lock
+++ b/bun.lock
@@ -72,6 +72,7 @@
       "devDependencies": {
         "@commitlint/cli": "^21.2.3",
         "@commitlint/config-conventional": "^21.2.3",
+        "@next/bundle-analyzer": "^16.4.6",
         "@oxlint/plugins": "^1.86.0",
         "@playwright/test": "~1.64.1",
         "@react-email/ui": "^6.11.0",
@@ -314,6 +315,8 @@
 
     "@date-fns/tz": ["@date-fns/tz@1.2.0", "", {}, "sha512-LBrd7MiJZ9McsOgxqWX7AaxrDjcFVjWH/tIKJd7pnR7McaslGYOP1QmmiBXdJH/H/yLCT+rcQ7FaPBUxRGUtrg=="],
 
+    "@discoveryjs/json-ext": ["@discoveryjs/json-ext@0.5.7", "", {}, "sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw=="],
+
     "@dnd-kit/accessibility": ["@dnd-kit/accessibility@3.1.1", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw=="],
 
     "@dnd-kit/core": ["@dnd-kit/core@6.3.1", "", { "dependencies": { "@dnd-kit/accessibility": "^3.1.1", "@dnd-kit/utilities": "^3.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ=="],
@@ -582,6 +585,8 @@
 
     "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.7", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || 2.0.0-beta.2 || 2.0.0-beta.3", "@emnapi/runtime": "^1.7.1 || 2.0.0-beta.2 || 2.0.0-beta.3" } }, "sha512-zJccwplOAbgfZju95IUHazLnx9RAPtPN2YGJXI6UbrgeaR9QfPjGrQL6ERkSAtnVCA4Q+83ApGyaX5zdpCaKkQ=="],
 
+    "@next/bundle-analyzer": ["@next/bundle-analyzer@16.4.6", "", { "dependencies": { "webpack-bundle-analyzer": "4.10.1" } }, "sha512-Evp2ETZoDcqpg5LZPeJNG51o1Bc5vH+LPSP+BmSkdjeykMCh1fMB/shs3bJVbTOxYp7wC3Ed3HLo0jgX1BdxNA=="],
+
     "@next/env": ["@next/env@16.4.5", "", {}, "sha512-JwSPwpdkZL5VMl2jA/q+JI8MZdweAL3xmw5/tb9y/TLtmS0YXZnmYDzSihwk8xTj1OL+WM53gTqaj96yuLp6Xw=="],
 
     "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-W5TniBzWKASbNNwHZ/S/f1MxQUXU/LdjklVMWA0Ujbfl7SZnUzFls45hO0i/sF7Bx1jJBWp7WWmoQajXtX/O8A=="],
@@ -830,6 +835,8 @@
 
     "@pnpm/npm-conf": ["@pnpm/npm-conf@3.0.3", "", { "dependencies": { "@pnpm/config.env-replace": "^1.1.0", "@pnpm/network.ca-file": "^1.0.1", "config-chain": "^1.1.11" } }, "sha512-//0sR/cow/s4ICQaYoAobOl4aU8cjU6x/V24V7XkKotb9+O+3zySIYp146vpaobYHnxa4pZX8NkV54Z5AwbDKA=="],
 
+    "@polka/url": ["@polka/url@1.0.0-next.29", "", {}, "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww=="],
+
     "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
 
     "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="],
@@ -1278,6 +1285,8 @@
 
     "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
 
+    "acorn-walk": ["acorn-walk@8.3.5", "", { "dependencies": { "acorn": "^8.11.0" } }, "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw=="],
+
     "agent-base": ["agent-base@9.0.0", "", {}, "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA=="],
 
     "aggregate-error": ["aggregate-error@5.1.0", "", { "dependencies": { "clean-stack": "^5.2.0", "indent-string": "^5.0.0" } }, "sha512-1m4/ydbOGBbHTtBYa4/ISQcqfPdZAxQLzj71wM71T8lP4ktez8lcsVolvscrujQW4CJr/LJSzoZ6mcfnqzYQ3A=="],
@@ -1604,6 +1613,8 @@
 
     "dot-prop": ["dot-prop@10.2.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw=="],
 
+    "duplexer": ["duplexer@0.1.2", "", {}, "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg=="],
+
     "duplexer2": ["duplexer2@0.1.4", "", { "dependencies": { "readable-stream": "^2.0.2" } }, "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA=="],
 
     "eastasianwidth": ["eastasianwidth@0.2.0", "", {}, "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="],
@@ -1766,6 +1777,8 @@
 
     "graphql-scalars": ["graphql-scalars@1.22.2", "", { "dependencies": { "tslib": "^2.5.0" }, "peerDependencies": { "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0" } }, "sha512-my9FB4GtghqXqi/lWSVAOPiTzTnnEzdOXCsAC2bb5V7EFNQjVjwy3cSSbUvgYOtDuDibd+ZsCDhz+4eykYOlhQ=="],
 
+    "gzip-size": ["gzip-size@6.0.0", "", { "dependencies": { "duplexer": "^0.1.2" } }, "sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q=="],
+
     "handlebars": ["handlebars@4.7.10", "", { "dependencies": { "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0" }, "optionalDependencies": { "uglify-js": "^3.1.4" }, "bin": { "handlebars": "bin/handlebars" } }, "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg=="],
 
     "happy-dom": ["happy-dom@20.14.6", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q=="],
@@ -1880,6 +1893,8 @@
 
     "is-plain-obj": ["is-plain-obj@4.1.0", "", {}, "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg=="],
 
+    "is-plain-object": ["is-plain-object@5.1.0", "", {}, "sha512-bUi/yjmtKYcRVUtWRGr0UA6xEFh2I6zWUwMrUXB3s7bmYCaZ8a+0ZsTRkrawh/mzlSD1Y0Ph8bp/U+TvBpWDNw=="],
+
     "is-port-reachable": ["is-port-reachable@4.0.0", "", {}, "sha512-9UoipoxYmSk6Xy7QFgRv2HDyaysmgSG75TFQs6S+3pDM7ZhKTF/bskZV+0UlABHzKjNVhPjYCLfeZUEg1wXxig=="],
 
     "is-potential-custom-element-name": ["is-potential-custom-element-name@1.0.1", "", {}, "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ=="],
@@ -2182,6 +2197,8 @@
 
     "mquery": ["mquery@5.0.0", "", { "dependencies": { "debug": "4.x" } }, "sha512-iQMncpmEK8R8ncT8HJGsGc9Dsp8xcgYMVSbs5jgnm1lFHTZqMJTUWTDx1LBO8+mK3tPNZWFLBghQEIOULSTHZg=="],
 
+    "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],
+
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
     "mz": ["mz@2.7.0", "", { "dependencies": { "any-promise": "^1.0.0", "object-assign": "^4.0.1", "thenify-all": "^1.0.0" } }, "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q=="],
@@ -2248,6 +2265,8 @@
 
     "open": ["open@10.2.0", "", { "dependencies": { "default-browser": "^5.2.1", "define-lazy-prop": "^3.0.0", "is-inside-container": "^1.0.0", "wsl-utils": "^0.1.0" } }, "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA=="],
 
+    "opener": ["opener@1.5.2", "", { "bin": { "opener": "bin/opener-bin.js" } }, "sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A=="],
+
     "oxc-parser": ["oxc-parser@0.127.0", "", { "dependencies": { "@oxc-project/types": "^0.127.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.127.0", "@oxc-parser/binding-android-arm64": "0.127.0", "@oxc-parser/binding-darwin-arm64": "0.127.0", "@oxc-parser/binding-darwin-x64": "0.127.0", "@oxc-parser/binding-freebsd-x64": "0.127.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.127.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.127.0", "@oxc-parser/binding-linux-arm64-gnu": "0.127.0", "@oxc-parser/binding-linux-arm64-musl": "0.127.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.127.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.127.0", "@oxc-parser/binding-linux-riscv64-musl": "0.127.0", "@oxc-parser/binding-linux-s390x-gnu": "0.127.0", "@oxc-parser/binding-linux-x64-gnu": "0.127.0", "@oxc-parser/binding-linux-x64-musl": "0.127.0", "@oxc-parser/binding-openharmony-arm64": "0.127.0", "@oxc-parser/binding-wasm32-wasi": "0.127.0", "@oxc-parser/binding-win32-arm64-msvc": "0.127.0", "@oxc-parser/binding-win32-ia32-msvc": "0.127.0", "@oxc-parser/binding-win32-x64-msvc": "0.127.0" } }, "sha512-bkgD4qHlN7WxLdX8bLXdaU54TtQtAIg/ZBAfm0aje/mo3MRDo3P0hZSgr4U7O3xfX+fQmR5AP04JS/TGcZLcFA=="],
 
     "oxc-resolver": ["oxc-resolver@11.21.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.21.2", "@oxc-resolver/binding-android-arm64": "11.21.2", "@oxc-resolver/binding-darwin-arm64": "11.21.2", "@oxc-resolver/binding-darwin-x64": "11.21.2", "@oxc-resolver/binding-freebsd-x64": "11.21.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.21.2", "@oxc-resolver/binding-linux-arm64-musl": "11.21.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.21.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-musl": "11.21.2", "@oxc-resolver/binding-openharmony-arm64": "11.21.2", "@oxc-resolver/binding-wasm32-wasi": "11.21.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.21.2", "@oxc-resolver/binding-win32-x64-msvc": "11.21.2" } }, "sha512-w5tLwYN3Zo24w5EeWJjJWZOwhYqTtC8PS2B1tIt7BZUuqTIcU07sQValbDw+rq7+AuAGzOHklgK+ifsy4lpXfw=="],
@@ -2530,6 +2549,8 @@
 
     "simple-wcswidth": ["simple-wcswidth@1.1.2", "", {}, "sha512-j7piyCjAeTDSjzTSQ7DokZtMNwNlEAyxqSZeCS+CXH7fJ4jx3FuJ/mTW3mE+6JLs4VJBbcll0Kjn+KXI5t21Iw=="],
 
+    "sirv": ["sirv@2.0.4", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-94Bdh3cC2PKrbgSOUqTiGPWVZeSiXfKOVZNJniWoqrWrRkB1CJzBU3NEbiTsPcYy1lDsANA/THzS+9WBiy5nfQ=="],
+
     "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
     "skin-tone": ["skin-tone@2.0.0", "", { "dependencies": { "unicode-emoji-modifier-base": "^1.0.0" } }, "sha512-kUMbT1oBJCpgrnKoSr0o6wPtvRWT9W9UKvGLwfJYO2WuahZRHOpEyL1ckyMGgMWh0UdpmaoFqKKD29WTomNEGA=="],
@@ -2694,6 +2715,8 @@
 
     "token-types": ["token-types@6.2.0", "", { "dependencies": { "@borewit/text-codec": "^0.2.3", "@tokenizer/token": "^0.3.0", "ieee754": "^1.2.1" } }, "sha512-s9euYHM//T3loJtbNUYdbAzsMlvKBeRS+XCLFy+UGosMQH19Hwjap5k19i4PPAEJJBsVIpMpVTxl4fIqCuNfUg=="],
 
+    "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="],
+
     "tough-cookie": ["tough-cookie@6.0.2", "", { "dependencies": { "tldts": "^7.0.5" } }, "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA=="],
 
     "tr46": ["tr46@7.0.0", "", { "dependencies": { "punycode": "^2.3.1" } }, "sha512-BcDSDW+SIGWVOns1Zm6Yg91q9AEj7eaID0QDY9oIqJD1A8dscNwMcl9Sms2DeuWCNov1X0/oXanHGYQBSLwZsg=="],
@@ -2816,6 +2839,8 @@
 
     "webidl-conversions": ["webidl-conversions@8.0.1", "", {}, "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ=="],
 
+    "webpack-bundle-analyzer": ["webpack-bundle-analyzer@4.10.1", "", { "dependencies": { "@discoveryjs/json-ext": "0.5.7", "acorn": "^8.0.4", "acorn-walk": "^8.0.0", "commander": "^7.2.0", "debounce": "^1.2.1", "escape-string-regexp": "^4.0.0", "gzip-size": "^6.0.0", "html-escaper": "^2.0.2", "is-plain-object": "^5.0.0", "opener": "^1.5.2", "picocolors": "^1.0.0", "sirv": "^2.0.3", "ws": "^7.3.1" }, "bin": { "webpack-bundle-analyzer": "lib/bin/analyzer.js" } }, "sha512-s3P7pgexgT/HTUSYgxJyn28A+99mmLq4HsJepMPzu0R8ImJc52QNqaFYW1Z2z2uIb1/J3eYgaAWVpaC+v/1aAQ=="],
+
     "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="],
 
     "whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
@@ -3480,6 +3505,14 @@
 
     "vitest/@vitest/spy": ["@vitest/spy@4.1.12", "", {}, "sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg=="],
 
+    "webpack-bundle-analyzer/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
+
+    "webpack-bundle-analyzer/debounce": ["debounce@1.2.1", "", {}, "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug=="],
+
+    "webpack-bundle-analyzer/escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
+
+    "webpack-bundle-analyzer/ws": ["ws@7.5.13", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": "^5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA=="],
+
     "widest-line/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
 
     "wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
diff --git a/llms.txt b/llms.txt
index 278c6717..a9bb79cc 100644
--- a/llms.txt
+++ b/llms.txt
@@ -53,9 +53,10 @@ generated from published content by `app/llms.txt/route.ts`.
 ## Source Layout
 
 - [app/](app): Next.js App Router — `(frontend)` for the public site, its route handlers
-  (preview, sse, health, icons/collection, the blog RSS feed, the resume download), `robots.ts`
-  and `sitemap.ts`; `(payload)` for the admin panel and Payload's REST API; `llms.txt/` for the
-  site's public `/llms.txt`; `global-error.tsx`, which has to stay at the root of `app/`.
+  (preview, sse, health, icons/collection, the blog RSS feed, the resume download) and
+  `sitemap.ts`; `(payload)` for the admin panel and Payload's REST API; `llms.txt/` for the
+  site's public `/llms.txt`; `robots.ts`, `manifest.ts` and `global-error.tsx`, which have to
+  stay at the root of `app/`.
 - [src/collections/](src/collections): Payload Collections (Media*, Pages, BlogPosts,
   BlogTopics, Resume*, Redirects, References, Users).
 - [src/globals/](src/globals): Payload Globals (SiteSettings, SettingsGlobalUser,
@@ -89,7 +90,10 @@ generated from published content by `app/llms.txt/route.ts`.
 ## Build and Deployment
 
 - [.github/workflows/lint-and-test.yml](.github/workflows/lint-and-test.yml): Pull-request gate —
-  lint, Semgrep, unit tests (the E2E job is currently commented out).
+  lint, Semgrep, unit tests, a compile-only build with the bundle-size budget (the E2E job is
+  currently commented out).
+- [scripts/check-bundle-size.mjs](scripts/check-bundle-size.mjs): Per-route first-load
+  JavaScript report and budget.
 - [.github/workflows/build-and-deploy.yml](.github/workflows/build-and-deploy.yml): Push
   pipeline for `main` and `develop` — version bump, migrate, build, image boot checks, push,
   Dokploy redeploy.
diff --git a/next.config.ts b/next.config.ts
index fd28a039..96473dac 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -5,6 +5,7 @@ import { NextConfig } from 'next'
 import { PHASE_DEVELOPMENT_SERVER } from 'next/constants'
 import { withPayload } from '@payloadcms/next/withPayload'
 
+import bundleAnalyzer from '@next/bundle-analyzer'
 import z from 'zod'
 
 import { envSchema } from '@/types/environment'
@@ -272,7 +273,16 @@ export default async (phase, { defaultConfig: _defaultConfig }) => {
     }),
   }
 
-  return withPayload(nextConfig, {
+  /**
+   *    `bun run analyze` sets ANALYZE. The reports land in .next/analyze as
+   *    static HTML; nothing is opened, so the same command works in CI.
+   */
+  const withBundleAnalyzer = bundleAnalyzer({
+    enabled: process.env.ANALYZE === 'true',
+    openAnalyzer: false,
+  })
+
+  return withPayload(withBundleAnalyzer(nextConfig), {
     devBundleServerPackages: false,
   })
 }
diff --git a/package.json b/package.json
index acf35df9..e8c47c5b 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,8 @@
   },
   "scripts": {
     "build": "bun run _next build --webpack",
+    "analyze": "ANALYZE=true bun run build --experimental-build-mode=compile && bun run bundle:check",
+    "bundle:check": "node scripts/check-bundle-size.mjs",
     "build:storybook": "bun run _storybook build --output-dir dist",
     "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
     "chore:format": "syncpack format",
@@ -136,6 +138,7 @@
   "devDependencies": {
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
+    "@next/bundle-analyzer": "^16.4.6",
     "@oxlint/plugins": "^1.86.0",
     "@playwright/test": "~1.64.1",
     "@react-email/ui": "^6.11.0",
diff --git a/scripts/check-bundle-size.mjs b/scripts/check-bundle-size.mjs
new file mode 100644
index 00000000..34217b8d
--- /dev/null
+++ b/scripts/check-bundle-size.mjs
@@ -0,0 +1,225 @@
+/**
+ *    Bundle-size budget for the public site.
+ *
+ *    Reads a finished `next build --webpack` output (`.next`) and reports, per
+ *    page route, the gzipped JavaScript a first visit can download: the chunks
+ *    every route shares plus the chunks of the client components that route's
+ *    layouts and page import. It is an upper bound, since a component a page
+ *    imports but does not render is never fetched. Fails when a budgeted route
+ *    is over its limit.
+ *
+ *    Next 16 no longer prints route sizes after a build, so this replaces the
+ *    "First Load JS" column.
+ *
+ *    Usage:
+ *      node scripts/check-bundle-size.mjs            # check, exit 1 when over budget
+ *      node scripts/check-bundle-size.mjs --json     # machine-readable report
+ */
+import { existsSync, readdirSync, readFileSync, statSync, appendFileSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import vm from 'node:vm'
+import { gzipSync } from 'node:zlib'
+
+const KB = 1024
+
+/**
+ *    Limits in gzipped kB of first-load JavaScript.
+ *
+ *    `targetKb` is the recommended size: 170 kB is the long-standing budget for
+ *    critical-path JavaScript on a mid-range phone over a slow connection, and
+ *    the size above which Next's own build output used to mark a route red.
+ *    Missing it is reported as a warning, not a failure: React and the Next
+ *    runtime alone are about 190 kB here, so no route can meet it today.
+ *
+ *    `maxKb` is the enforced limit. It sits a little above the largest route at
+ *    the time it was set (251 kB), so it catches a regression rather than
+ *    describing a goal. Lower it whenever the routes get smaller; raising it
+ *    should come with a reason in the commit.
+ *
+ *    The Payload admin panel is not budgeted: its bundle is Payload's, and it
+ *    is a signed-in tool rather than a page a visitor waits for.
+ */
+const BUDGETS = [
+  {
+    name: 'Public pages',
+    match: (route) => !route.startsWith('/admin'),
+    targetKb: 170,
+    maxKb: 265,
+  },
+]
+
+const distDir = path.resolve(
+  process.argv.find((arg) => arg.startsWith('--dir='))?.slice(6) ?? '.next',
+)
+
+const asJson = process.argv.includes('--json')
+
+if (!existsSync(path.join(distDir, 'build-manifest.json'))) {
+  console.error(`No build found in ${distDir}. Run \`bun run build\` first.`)
+  process.exit(2)
+}
+
+const gzipSizes = new Map()
+
+const gzipSize = (file) => {
+  if (!gzipSizes.has(file)) {
+    // Manifests hold URL paths: `[slug]` appears as `%5Bslug%5D`.
+    const onDisk = path.join(distDir, decodeURIComponent(file))
+
+    gzipSizes.set(file, gzipSync(readFileSync(onDisk)).length)
+  }
+
+  return gzipSizes.get(file)
+}
+
+const { rootMainFiles } = JSON.parse(
+  readFileSync(path.join(distDir, 'build-manifest.json'), 'utf8'),
+)
+
+const sharedFiles = rootMainFiles.filter((file) => file.endsWith('.js'))
+
+const findPageManifests = (dir) =>
+  readdirSync(dir).flatMap((entry) => {
+    const full = path.join(dir, entry)
+
+    if (statSync(full).isDirectory()) return findPageManifests(full)
+
+    // Route handlers have a manifest too, but send no JavaScript to a browser.
+    return entry === 'page_client-reference-manifest.js' ? [full] : []
+  })
+
+/**
+ *    Each manifest is a script that assigns to `globalThis.__RSC_MANIFEST`,
+ *    keyed by the entry (`/(frontend)/blog/page`). `clientModules` lists every
+ *    client module with the chunks that carry it for this entry; modules the
+ *    entry does not use have an empty list. `chunks` alternates id and file.
+ */
+const readManifest = (file) => {
+  const sandbox = {
+    globalThis: {},
+  }
+
+  vm.runInNewContext(readFileSync(file, 'utf8'), sandbox)
+
+  return Object.entries(sandbox.globalThis.__RSC_MANIFEST ?? {})
+}
+
+/**
+ *    The manifest is not filtered per route: it lists the client modules of
+ *    the whole app. What ties a module to a route is the last file in its
+ *    chunk list, the client entry of the layout, template, loading state or
+ *    page that imports it (`static/chunks/app/(frontend)/blog/page-<hash>.js`).
+ *    A route loads the entries of its own page and of every segment above it.
+ */
+const ENTRY_CHUNK = /^static\/chunks\/app\/(?:(.*)\/)?(layout|template|loading|page)-[0-9a-f]+\.js$/
+
+const isEntryOf = (entry, chunk) => {
+  const match = ENTRY_CHUNK.exec(decodeURIComponent(chunk))
+
+  if (!match) return false
+
+  const [, dir = '', kind] = match
+  const pageDir = entry.replace(/^\//, '').replace(/\/page$/, '')
+
+  if (kind === 'page') return dir === pageDir
+
+  return dir === '' || pageDir === dir || pageDir.startsWith(`${dir}/`)
+}
+
+// `/(frontend)/blog/[slug]/page` -> `/blog/[slug]`
+const toRoute = (entry) =>
+  entry
+    .replace(/\/page$/, '')
+    .split('/')
+    .filter((segment) => !(segment.startsWith('(') && segment.endsWith(')')))
+    .join('/') || '/'
+
+const routes = findPageManifests(path.join(distDir, 'server', 'app'))
+  .flatMap(readManifest)
+  .map(([entry, manifest]) => {
+    const files = new Set(sharedFiles)
+
+    for (const { chunks } of Object.values(manifest.clientModules ?? {})) {
+      const jsChunks = chunks.filter((chunk) => chunk.endsWith('.js'))
+
+      if (jsChunks.some((chunk) => isEntryOf(entry, chunk))) {
+        for (const chunk of jsChunks) files.add(chunk)
+      }
+    }
+
+    const route = toRoute(entry)
+    const bytes = [...files].reduce((total, file) => total + gzipSize(file), 0)
+    const budget = BUDGETS.find(({ match }) => match(route))
+    const kb = bytes / KB
+
+    let status = 'not budgeted'
+
+    if (budget) status = kb > budget.maxKb ? 'over' : kb > budget.targetKb ? 'above target' : 'ok'
+
+    return {
+      route,
+      kb: Math.round(kb * 10) / 10,
+      files: files.size,
+      targetKb: budget?.targetKb ?? null,
+      maxKb: budget?.maxKb ?? null,
+      status,
+    }
+  })
+  // Next's own pages; a visitor never navigates to them.
+  .filter(({ route }) => !route.startsWith('/_'))
+  .sort((a, b) => b.kb - a.kb)
+
+const sharedKb =
+  Math.round((sharedFiles.reduce((total, file) => total + gzipSize(file), 0) / KB) * 10) / 10
+
+const over = routes.filter(({ status }) => status === 'over')
+
+if (asJson) {
+  console.log(
+    JSON.stringify(
+      {
+        sharedKb,
+        routes,
+      },
+      null,
+      2,
+    ),
+  )
+} else {
+  const icon = {
+    ok: '✅',
+    'above target': '⚠️',
+    over: '❌',
+    'not budgeted': '➖',
+  }
+
+  const lines = [
+    '## First-load JavaScript (gzipped)',
+    '',
+    `Shared by every route: **${sharedKb} kB**`,
+    '',
+    '| Route | First load | Target | Limit | |',
+    '| --- | ---: | ---: | ---: | --- |',
+    ...routes.map(
+      ({ route, kb, targetKb, maxKb, status }) =>
+        `| \`${route}\` | ${kb} kB | ${targetKb ? `${targetKb} kB` : 'none'} | ${maxKb ? `${maxKb} kB` : 'none'} | ${icon[status]} ${status} |`,
+    ),
+    '',
+  ]
+
+  console.log(lines.join('\n'))
+
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${lines.join('\n')}\n`)
+  }
+
+  for (const { route, kb, maxKb } of over) {
+    // GitHub renders this as an annotation on the run.
+    console.error(
+      `::error title=Bundle budget exceeded::${route} loads ${kb} kB of JavaScript (budget ${maxKb} kB)`,
+    )
+  }
+}
+
+process.exit(over.length > 0 ? 1 : 0)

From c01ef27156a739fcbf5ff84312115490f78e339f Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 12:05:22 +0100
Subject: [PATCH 16/30] ci: drop the bundle size job from the pull-request
 workflow

The job built against .env.test. The analyzer and the budget check stay as local tooling (bun run analyze).
---
 .github/workflows/lint-and-test.yml | 51 -----------------------------
 AGENTS.md                           |  6 ++--
 README.md                           |  3 +-
 llms.txt                            |  5 ++-
 4 files changed, 6 insertions(+), 59 deletions(-)

diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index d486aa1d..b14a0a22 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -101,57 +101,6 @@ jobs:
           retention-days: 7
           if-no-files-found: ignore
 
-  # Compiles the app and holds the public routes to their JavaScript budget
-  # (scripts/check-bundle-size.mjs). Compile mode only: it needs no database,
-  # prerenders nothing, and is never deployed; build-and-deploy.yml builds the
-  # real thing against each environment's own values.
-  build:
-    name: Build & Bundle Size
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      # Webpack's persistent cache; the only part of .next Next documents as
-      # worth restoring between builds.
-      - name: Restore Next.js build cache
-        uses: actions/cache@v4 # TODO: pin to a commit SHA like the other actions
-        with:
-          path: .next/cache
-          key: next-cache-bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ github.sha }}
-          restore-keys: |
-            next-cache-bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-
-            next-cache-bun-${{ runner.os }}-
-
-      # next.config.ts validates the environment when it loads.
-      - name: Load .env.test into job environment
-        run: grep -v '^#' .env.test | grep -v '^$' >> "$GITHUB_ENV"
-
-      # ANALYZE writes the @next/bundle-analyzer reports to .next/analyze.
-      - name: Build
-        run: bun run build --experimental-build-mode=compile
-        env:
-          NODE_ENV: production
-          ANALYZE: 'true'
-
-      # Prints the per-route table into the job summary and fails the job when
-      # a route is over its limit.
-      - name: Check bundle size
-        run: bun run bundle:check
-
-      - name: Upload bundle analysis
-        if: always()
-        uses: actions/upload-artifact@v4 # TODO: pin to a commit SHA like the other actions
-        with:
-          name: bundle-analysis
-          path: .next/analyze/
-          retention-days: 7
-          if-no-files-found: ignore
-
   # E2E tests temporarily disabled
   # e2e:
   #   name: E2E Tests
diff --git a/AGENTS.md b/AGENTS.md
index 58c76a35..5fab1a8d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -179,9 +179,9 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   `sitemap.ts` is the exception and works from `app/(frontend)/`. `global-error.tsx` replaces the
   root layout, so it imports the stylesheet and fonts itself.
 - **Bundle budget**: `scripts/check-bundle-size.mjs` reports the gzipped first-load JavaScript of
-  every public route and fails above the limit set in its `BUDGETS` (CI job "Build & Bundle
-  Size"). `bun run analyze` produces the same check locally plus the `@next/bundle-analyzer`
-  reports in `.next/analyze/`. The 170 kB target is a warning; lower the enforced limit when
+  every public route and fails above the limit set in its `BUDGETS`. It is a local check, not a
+  CI job: `bun run analyze` builds, runs it and writes the `@next/bundle-analyzer` reports to
+  `.next/analyze/`. The 170 kB target is a warning; lower the enforced limit when
   routes shrink, and give a reason in the commit when raising it.
 - **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
   maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
diff --git a/README.md b/README.md
index 3ac38183..aca5251d 100644
--- a/README.md
+++ b/README.md
@@ -402,8 +402,7 @@ Everything is built in CI; Docker images only `COPY` finished output (no package
   1. **Lint**: `commitlint` over the PR's commits, `oxlint` + `oxfmt --check`, `syncpack`, a check that the committed generated files (`src/types/payload.ts`, the admin import map) match `bun run generate`, and `actionlint`.
   2. **Semgrep**: static security analysis with the `nodejs`, `typescript`, `react` and `secrets` rulesets. Accepted findings are marked in place with `// nosemgrep: <rule>` and a reason.
   3. **Unit Tests**: `vitest run --coverage`, with the coverage report uploaded as an artifact.
-  4. **Build & Bundle Size**: `next build --webpack --experimental-build-mode=compile` with `.env.test` (no database needed), then `bun run bundle:check`. The per-route table goes into the job summary and the `@next/bundle-analyzer` reports are uploaded as the `bundle-analysis` artifact.
-  5. **E2E**: currently disabled (the job is commented out in the workflow).
+  4. **E2E**: currently disabled (the job is commented out in the workflow).
 - **Pushes to `develop` / `main`** (`build-and-deploy.yml`, also runnable through `workflow_dispatch` on those two branches):
   1. **Bump version**: semver bump, tag and changelog via `semantic-release` (`release.config.mjs`), committed as a GitHub App so the push passes `main`'s ruleset. `main` cuts releases (`vX.Y.Z`, images also tagged `latest`), `develop` cuts release candidates (`vX.Y.Z-rc.N`, images also tagged `edge`). After a `main` release, `develop` is fast-forwarded to `main` when it has no commits of its own; otherwise it has to be brought up to date by hand, since `develop` only cuts release candidates while it contains every `main` release.
   2. **Deploy** (environment `Production` on `main`, `Development` on `develop`): connects to the tailnet, runs `bun run migrate` against the target database, runs one `next build --webpack` with that environment's values, builds Storybook, assembles `out/{web,worker,storybook}` (`scripts/assemble-images.mjs`), builds the COPY-only images (`app`, `worker`, `storybook` in `Dockerfile`) for `linux/amd64`, boot-checks each one as a real container (`/api/health` on 3000, `/health` on 3010, Storybook on 3020), pushes them to `ghcr.io/danielheene/website/*` and triggers the Dokploy redeploy webhooks. The lint and test jobs are not re-run here; the merged commit already passed them as PR checks.
diff --git a/llms.txt b/llms.txt
index a9bb79cc..f2051a28 100644
--- a/llms.txt
+++ b/llms.txt
@@ -90,10 +90,9 @@ generated from published content by `app/llms.txt/route.ts`.
 ## Build and Deployment
 
 - [.github/workflows/lint-and-test.yml](.github/workflows/lint-and-test.yml): Pull-request gate —
-  lint, Semgrep, unit tests, a compile-only build with the bundle-size budget (the E2E job is
-  currently commented out).
+  lint, Semgrep, unit tests (the E2E job is currently commented out).
 - [scripts/check-bundle-size.mjs](scripts/check-bundle-size.mjs): Per-route first-load
-  JavaScript report and budget.
+  JavaScript report and budget, run locally with `bun run analyze`.
 - [.github/workflows/build-and-deploy.yml](.github/workflows/build-and-deploy.yml): Push
   pipeline for `main` and `develop` — version bump, migrate, build, image boot checks, push,
   Dokploy redeploy.

From 8dbf241a8658ed3f0ca012136790c3d951725f76 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 12:08:44 +0100
Subject: [PATCH 17/30] build: reduce bundle analysis to the stock
 @next/bundle-analyzer setup

Drops scripts/check-bundle-size.mjs, the bundle:check script and the size budget. bun run analyze is now a plain ANALYZE=true build.
---
 AGENTS.md                     |   7 +-
 README.md                     |   3 +-
 llms.txt                      |   2 -
 next.config.ts                |   5 -
 package.json                  |   3 +-
 scripts/check-bundle-size.mjs | 225 ----------------------------------
 6 files changed, 3 insertions(+), 242 deletions(-)
 delete mode 100644 scripts/check-bundle-size.mjs

diff --git a/AGENTS.md b/AGENTS.md
index 5fab1a8d..63a07ccd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,7 +36,7 @@ bun run dev:storybook    # Storybook on :6006 (not started by `bun run dev`)
 bun run generate         # regenerate Next route types, Payload types + import map
 bun run build            # production build (`next build --webpack`)
 bun run typecheck        # tsc --noEmit
-bun run analyze          # compile-only build + bundle analyzer reports + bundle budget check
+bun run analyze          # production build with @next/bundle-analyzer reports
 bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
 bun run format           # oxfmt (formatting and import order only)
@@ -178,11 +178,6 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   `app/`: inside a route group Next silently ignores all three (no error, the URL just 404s).
   `sitemap.ts` is the exception and works from `app/(frontend)/`. `global-error.tsx` replaces the
   root layout, so it imports the stylesheet and fonts itself.
-- **Bundle budget**: `scripts/check-bundle-size.mjs` reports the gzipped first-load JavaScript of
-  every public route and fails above the limit set in its `BUDGETS`. It is a local check, not a
-  CI job: `bun run analyze` builds, runs it and writes the `@next/bundle-analyzer` reports to
-  `.next/analyze/`. The 170 kB target is a warning; lower the enforced limit when
-  routes shrink, and give a reason in the commit when raising it.
 - **Two `llms.txt`**: the root `llms.txt` describes this repository for coding agents and is
   maintained by hand; `app/llms.txt/route.ts` serves the site's public `/llms.txt` from published
   content.
diff --git a/README.md b/README.md
index aca5251d..dea30283 100644
--- a/README.md
+++ b/README.md
@@ -135,8 +135,7 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 | `bun run dev:app` | Starts the Next.js dev server directly, without the tunnel wrapper. |
 | `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
 | `bun run build` | Production build (`next build --webpack`). |
-| `bun run analyze` | Compile-only build with `@next/bundle-analyzer` reports in `.next/analyze/`, followed by `bundle:check`. |
-| `bun run bundle:check` | Checks the first-load JavaScript of each public route in an existing build against its budget (`scripts/check-bundle-size.mjs`). |
+| `bun run analyze` | Production build with `@next/bundle-analyzer`; opens the bundle reports when it finishes. |
 | `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
 | `bun run start:storybook` | Serves the static Storybook build on port 3020. |
 | `bun run start:app` | Starts the production Next.js application server. |
diff --git a/llms.txt b/llms.txt
index f2051a28..3fbcce87 100644
--- a/llms.txt
+++ b/llms.txt
@@ -91,8 +91,6 @@ generated from published content by `app/llms.txt/route.ts`.
 
 - [.github/workflows/lint-and-test.yml](.github/workflows/lint-and-test.yml): Pull-request gate —
   lint, Semgrep, unit tests (the E2E job is currently commented out).
-- [scripts/check-bundle-size.mjs](scripts/check-bundle-size.mjs): Per-route first-load
-  JavaScript report and budget, run locally with `bun run analyze`.
 - [.github/workflows/build-and-deploy.yml](.github/workflows/build-and-deploy.yml): Push
   pipeline for `main` and `develop` — version bump, migrate, build, image boot checks, push,
   Dokploy redeploy.
diff --git a/next.config.ts b/next.config.ts
index 96473dac..c6193710 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -273,13 +273,8 @@ export default async (phase, { defaultConfig: _defaultConfig }) => {
     }),
   }
 
-  /**
-   *    `bun run analyze` sets ANALYZE. The reports land in .next/analyze as
-   *    static HTML; nothing is opened, so the same command works in CI.
-   */
   const withBundleAnalyzer = bundleAnalyzer({
     enabled: process.env.ANALYZE === 'true',
-    openAnalyzer: false,
   })
 
   return withPayload(withBundleAnalyzer(nextConfig), {
diff --git a/package.json b/package.json
index e8c47c5b..d51399f0 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,7 @@
   },
   "scripts": {
     "build": "bun run _next build --webpack",
-    "analyze": "ANALYZE=true bun run build --experimental-build-mode=compile && bun run bundle:check",
-    "bundle:check": "node scripts/check-bundle-size.mjs",
+    "analyze": "ANALYZE=true bun run build",
     "build:storybook": "bun run _storybook build --output-dir dist",
     "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
     "chore:format": "syncpack format",
diff --git a/scripts/check-bundle-size.mjs b/scripts/check-bundle-size.mjs
deleted file mode 100644
index 34217b8d..00000000
--- a/scripts/check-bundle-size.mjs
+++ /dev/null
@@ -1,225 +0,0 @@
-/**
- *    Bundle-size budget for the public site.
- *
- *    Reads a finished `next build --webpack` output (`.next`) and reports, per
- *    page route, the gzipped JavaScript a first visit can download: the chunks
- *    every route shares plus the chunks of the client components that route's
- *    layouts and page import. It is an upper bound, since a component a page
- *    imports but does not render is never fetched. Fails when a budgeted route
- *    is over its limit.
- *
- *    Next 16 no longer prints route sizes after a build, so this replaces the
- *    "First Load JS" column.
- *
- *    Usage:
- *      node scripts/check-bundle-size.mjs            # check, exit 1 when over budget
- *      node scripts/check-bundle-size.mjs --json     # machine-readable report
- */
-import { existsSync, readdirSync, readFileSync, statSync, appendFileSync } from 'node:fs'
-import path from 'node:path'
-import process from 'node:process'
-import vm from 'node:vm'
-import { gzipSync } from 'node:zlib'
-
-const KB = 1024
-
-/**
- *    Limits in gzipped kB of first-load JavaScript.
- *
- *    `targetKb` is the recommended size: 170 kB is the long-standing budget for
- *    critical-path JavaScript on a mid-range phone over a slow connection, and
- *    the size above which Next's own build output used to mark a route red.
- *    Missing it is reported as a warning, not a failure: React and the Next
- *    runtime alone are about 190 kB here, so no route can meet it today.
- *
- *    `maxKb` is the enforced limit. It sits a little above the largest route at
- *    the time it was set (251 kB), so it catches a regression rather than
- *    describing a goal. Lower it whenever the routes get smaller; raising it
- *    should come with a reason in the commit.
- *
- *    The Payload admin panel is not budgeted: its bundle is Payload's, and it
- *    is a signed-in tool rather than a page a visitor waits for.
- */
-const BUDGETS = [
-  {
-    name: 'Public pages',
-    match: (route) => !route.startsWith('/admin'),
-    targetKb: 170,
-    maxKb: 265,
-  },
-]
-
-const distDir = path.resolve(
-  process.argv.find((arg) => arg.startsWith('--dir='))?.slice(6) ?? '.next',
-)
-
-const asJson = process.argv.includes('--json')
-
-if (!existsSync(path.join(distDir, 'build-manifest.json'))) {
-  console.error(`No build found in ${distDir}. Run \`bun run build\` first.`)
-  process.exit(2)
-}
-
-const gzipSizes = new Map()
-
-const gzipSize = (file) => {
-  if (!gzipSizes.has(file)) {
-    // Manifests hold URL paths: `[slug]` appears as `%5Bslug%5D`.
-    const onDisk = path.join(distDir, decodeURIComponent(file))
-
-    gzipSizes.set(file, gzipSync(readFileSync(onDisk)).length)
-  }
-
-  return gzipSizes.get(file)
-}
-
-const { rootMainFiles } = JSON.parse(
-  readFileSync(path.join(distDir, 'build-manifest.json'), 'utf8'),
-)
-
-const sharedFiles = rootMainFiles.filter((file) => file.endsWith('.js'))
-
-const findPageManifests = (dir) =>
-  readdirSync(dir).flatMap((entry) => {
-    const full = path.join(dir, entry)
-
-    if (statSync(full).isDirectory()) return findPageManifests(full)
-
-    // Route handlers have a manifest too, but send no JavaScript to a browser.
-    return entry === 'page_client-reference-manifest.js' ? [full] : []
-  })
-
-/**
- *    Each manifest is a script that assigns to `globalThis.__RSC_MANIFEST`,
- *    keyed by the entry (`/(frontend)/blog/page`). `clientModules` lists every
- *    client module with the chunks that carry it for this entry; modules the
- *    entry does not use have an empty list. `chunks` alternates id and file.
- */
-const readManifest = (file) => {
-  const sandbox = {
-    globalThis: {},
-  }
-
-  vm.runInNewContext(readFileSync(file, 'utf8'), sandbox)
-
-  return Object.entries(sandbox.globalThis.__RSC_MANIFEST ?? {})
-}
-
-/**
- *    The manifest is not filtered per route: it lists the client modules of
- *    the whole app. What ties a module to a route is the last file in its
- *    chunk list, the client entry of the layout, template, loading state or
- *    page that imports it (`static/chunks/app/(frontend)/blog/page-<hash>.js`).
- *    A route loads the entries of its own page and of every segment above it.
- */
-const ENTRY_CHUNK = /^static\/chunks\/app\/(?:(.*)\/)?(layout|template|loading|page)-[0-9a-f]+\.js$/
-
-const isEntryOf = (entry, chunk) => {
-  const match = ENTRY_CHUNK.exec(decodeURIComponent(chunk))
-
-  if (!match) return false
-
-  const [, dir = '', kind] = match
-  const pageDir = entry.replace(/^\//, '').replace(/\/page$/, '')
-
-  if (kind === 'page') return dir === pageDir
-
-  return dir === '' || pageDir === dir || pageDir.startsWith(`${dir}/`)
-}
-
-// `/(frontend)/blog/[slug]/page` -> `/blog/[slug]`
-const toRoute = (entry) =>
-  entry
-    .replace(/\/page$/, '')
-    .split('/')
-    .filter((segment) => !(segment.startsWith('(') && segment.endsWith(')')))
-    .join('/') || '/'
-
-const routes = findPageManifests(path.join(distDir, 'server', 'app'))
-  .flatMap(readManifest)
-  .map(([entry, manifest]) => {
-    const files = new Set(sharedFiles)
-
-    for (const { chunks } of Object.values(manifest.clientModules ?? {})) {
-      const jsChunks = chunks.filter((chunk) => chunk.endsWith('.js'))
-
-      if (jsChunks.some((chunk) => isEntryOf(entry, chunk))) {
-        for (const chunk of jsChunks) files.add(chunk)
-      }
-    }
-
-    const route = toRoute(entry)
-    const bytes = [...files].reduce((total, file) => total + gzipSize(file), 0)
-    const budget = BUDGETS.find(({ match }) => match(route))
-    const kb = bytes / KB
-
-    let status = 'not budgeted'
-
-    if (budget) status = kb > budget.maxKb ? 'over' : kb > budget.targetKb ? 'above target' : 'ok'
-
-    return {
-      route,
-      kb: Math.round(kb * 10) / 10,
-      files: files.size,
-      targetKb: budget?.targetKb ?? null,
-      maxKb: budget?.maxKb ?? null,
-      status,
-    }
-  })
-  // Next's own pages; a visitor never navigates to them.
-  .filter(({ route }) => !route.startsWith('/_'))
-  .sort((a, b) => b.kb - a.kb)
-
-const sharedKb =
-  Math.round((sharedFiles.reduce((total, file) => total + gzipSize(file), 0) / KB) * 10) / 10
-
-const over = routes.filter(({ status }) => status === 'over')
-
-if (asJson) {
-  console.log(
-    JSON.stringify(
-      {
-        sharedKb,
-        routes,
-      },
-      null,
-      2,
-    ),
-  )
-} else {
-  const icon = {
-    ok: '✅',
-    'above target': '⚠️',
-    over: '❌',
-    'not budgeted': '➖',
-  }
-
-  const lines = [
-    '## First-load JavaScript (gzipped)',
-    '',
-    `Shared by every route: **${sharedKb} kB**`,
-    '',
-    '| Route | First load | Target | Limit | |',
-    '| --- | ---: | ---: | ---: | --- |',
-    ...routes.map(
-      ({ route, kb, targetKb, maxKb, status }) =>
-        `| \`${route}\` | ${kb} kB | ${targetKb ? `${targetKb} kB` : 'none'} | ${maxKb ? `${maxKb} kB` : 'none'} | ${icon[status]} ${status} |`,
-    ),
-    '',
-  ]
-
-  console.log(lines.join('\n'))
-
-  if (process.env.GITHUB_STEP_SUMMARY) {
-    appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${lines.join('\n')}\n`)
-  }
-
-  for (const { route, kb, maxKb } of over) {
-    // GitHub renders this as an annotation on the run.
-    console.error(
-      `::error title=Bundle budget exceeded::${route} loads ${kb} kB of JavaScript (budget ${maxKb} kB)`,
-    )
-  }
-}
-
-process.exit(over.length > 0 ? 1 : 0)

From 8931a21fab0aa12e960869c8282adb898b9ae5d2 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 13:05:07 +0100
Subject: [PATCH 18/30] fix(resume): render the download button as a plain
 anchor

next/link threw on an undefined href and failed the prerender of /resume when a resume document has no url. A file download is not a route, so the button is now an <a download>, and it is skipped when the document has no url.
---
 .../ResumeDownloadsBlock/Renderer/Renderer.client.tsx     | 4 ++--
 .../Renderer/ResumeDownloadButton.tsx                     | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
index e3be2003..2fd3863b 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.client.tsx
@@ -49,7 +49,7 @@ export const ResumeDownloadsBlockClientRenderer = ({
             data-reveal-item
             className="text-background-foreground flex flex-col justify-center gap-8 md:flex-row"
           >
-            {document_en && (
+            {document_en?.url && (
               <ResumeDownloadButton
                 locale="en"
                 url={document_en.url}
@@ -58,7 +58,7 @@ export const ResumeDownloadsBlockClientRenderer = ({
                 subline="English Version"
               />
             )}
-            {document_de && (
+            {document_de?.url && (
               <ResumeDownloadButton
                 locale="de"
                 url={document_de.url}
diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
index 2c04c1e2..bc5b7431 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/ResumeDownloadButton.tsx
@@ -1,7 +1,5 @@
 'use client'
 
-import Link from 'next/link'
-
 import { cn } from 'tailwind-variants'
 
 import { Button } from '@/components/Button'
@@ -34,9 +32,11 @@ export const ResumeDownloadButton = ({
       )}
       asChild
     >
-      <Link
+      {/* A file download, not a route: next/link would prefetch it and throws without an href. */}
+      <a
         href={url}
         download={fileName}
+        aria-label={`${label}: ${subline}`}
         onClick={() =>
           track(`resume-download-${locale}`, {
             slug,
@@ -75,7 +75,7 @@ export const ResumeDownloadButton = ({
             <span className="text-xs leading-none opacity-80">{subline}</span>
           </div>
         </div>
-      </Link>
+      </a>
     </Button>
   )
 }

From b1a6356c6a839f1b3312b61ab1cbed7d6cbd6804 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 13:11:48 +0100
Subject: [PATCH 19/30] build(deps): bump dependencies and sort package.json
 scripts

Next 16.4.6, tailwind-variants 4, tailwindcss 4.3.5, takumi-js 2.20, oxlint 1.93, oxfmt 0.78, Playwright 1.65 (both packages, pin updated). syncpack now sorts scripts; the lefthook package-json step also matches bun.lock.
---
 bun.lock            | 196 ++++++++++++++++++++------------------------
 lefthook.yml        |  11 ++-
 package.json        |  42 +++++-----
 syncpack.config.mjs |  21 ++---
 4 files changed, 126 insertions(+), 144 deletions(-)

diff --git a/bun.lock b/bun.lock
index 6b37de1c..999148f6 100644
--- a/bun.lock
+++ b/bun.lock
@@ -43,7 +43,7 @@
         "mediabunny": "^1.65.2",
         "nanoid": "^6.0.1",
         "neotraverse": "^1.0.1",
-        "next": "^16.3.6",
+        "next": "^16.4.6",
         "next-themes": "^0.4.6",
         "ogl": "^1.0.11",
         "payload": "^3.93.0",
@@ -60,9 +60,9 @@
         "shiki": "^4.4.3",
         "svgo": "^4.1.0",
         "tailwind-merge": "^3.7.0",
-        "tailwind-variants": "^3.3.1",
-        "tailwindcss": "^4.3.3",
-        "takumi-js": "^2.14.0",
+        "tailwind-variants": "^4.0.2",
+        "tailwindcss": "^4.3.5",
+        "takumi-js": "^2.20.0",
         "timestring": "^7.0.0",
         "tw-easing-gradients": "^1.2.0",
         "type-fest": "^5.10.0",
@@ -73,8 +73,8 @@
         "@commitlint/cli": "^21.2.3",
         "@commitlint/config-conventional": "^21.2.3",
         "@next/bundle-analyzer": "^16.4.6",
-        "@oxlint/plugins": "^1.86.0",
-        "@playwright/test": "~1.64.1",
+        "@oxlint/plugins": "^1.93.0",
+        "@playwright/test": "~1.65.0",
         "@react-email/ui": "^6.11.0",
         "@semantic-release/changelog": "^7.0.0",
         "@semantic-release/commit-analyzer": "^13.0.1",
@@ -103,15 +103,15 @@
         "autoprefixer": "^10.6.1",
         "cssnano": "^9.0.5",
         "lefthook": "^2.1.14",
-        "oxfmt": "^0.76.0",
-        "oxlint": "^1.86.0",
+        "oxfmt": "^0.78.0",
+        "oxlint": "^1.93.0",
         "oxlint-tailwindcss": "^1.16.0",
         "oxlint-tsgolint": "^7.0.2006",
-        "playwright": "~1.64.1",
+        "playwright": "~1.65.0",
         "postcss": "^8.5.28",
         "react-docgen-typescript": "^2.4.0",
         "semantic-release": "^25.0.9",
-        "serve": "^14.2.6",
+        "serve": "^14.2.7",
         "storybook": "^10.6.0",
         "styled-jsx": "^5.1.7",
         "syncpack": "^15.3.3",
@@ -587,23 +587,23 @@
 
     "@next/bundle-analyzer": ["@next/bundle-analyzer@16.4.6", "", { "dependencies": { "webpack-bundle-analyzer": "4.10.1" } }, "sha512-Evp2ETZoDcqpg5LZPeJNG51o1Bc5vH+LPSP+BmSkdjeykMCh1fMB/shs3bJVbTOxYp7wC3Ed3HLo0jgX1BdxNA=="],
 
-    "@next/env": ["@next/env@16.4.5", "", {}, "sha512-JwSPwpdkZL5VMl2jA/q+JI8MZdweAL3xmw5/tb9y/TLtmS0YXZnmYDzSihwk8xTj1OL+WM53gTqaj96yuLp6Xw=="],
+    "@next/env": ["@next/env@16.4.6", "", {}, "sha512-SunBjJ6t+oBtecS3dTjdVuMhUogP5wD/vrGL5EVuQYM1iS4O5ilL51HkiJ3sPjMzRHiCChvr4dbaSJbR7F3lxA=="],
 
-    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-W5TniBzWKASbNNwHZ/S/f1MxQUXU/LdjklVMWA0Ujbfl7SZnUzFls45hO0i/sF7Bx1jJBWp7WWmoQajXtX/O8A=="],
+    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.4.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-kJ4VVZkley17xKaJx72QN2IBqjrj7zenCQZaUF0l9ShS/1Mt2kW4+Z5KGG6vgr3L/J562xTOizVyM1iA/u5nlg=="],
 
-    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.4.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-uWq4qkHapBDS1oFltWS4YxTb9pLHAtLNcpbuK6SmRsebLYZqpBML/j/C0op+50JYGTpZgVL/DWNt/6oWlamrrw=="],
+    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.4.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-eIPGZIqC+8JKaeZmvnCANJQF4xWkkHqSnAAajtFxgwDMAOnCgxNvP52SeWZ41PyVwoe+Le/NQuZSaQ8j7YshSA=="],
 
-    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-FdRcyOx5u5P51mlAqLB9EXdd8jZO5fsdHtk4BAQSkqOywCsbTNN/rmw+jO7pnmjNdAtu2AG46NzbCL2FPDrrgw=="],
+    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.4.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-9nI6O8vvczH2D9ZNdMGqb/3NuT15T9ksOZnAmx9/gjF2cOi74+xxyf1Hk96uIMfm14c9y6wHeBq6SH8g6udvcA=="],
 
-    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-cyvmmgtRXR8aGVT86wi9Py53IlfyCx7P2fZxuAXAoTummDnhKtUyjrMeXfapqp4qgD+gT5RqyGD/VfA16jEK7Q=="],
+    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.4.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-7/qPhTxDp2ScluOJOhLuhWmlA17o1yZ0SIgpISBCpBxXgtnK4+KGywBpFkfLPiU1rnSM1faFGzYkH6i7JdTrqA=="],
 
-    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-hPc+Fl+N22DAvqZHq559NmamXboOX5Lu8I5Wl0DezfrhTk1Zz21NQeYoZDmNI/NjTcrdsVxM72Fzn2lI+Q+vAw=="],
+    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.4.6", "", { "os": "linux", "cpu": "x64" }, "sha512-oOpbNa8XOW1qCGd9VvzC4fbkkRxEls7/WI6tz+YHC0xRA7KpV1U7DrAnCPjzVyOk/karzWEepCOcTIDmwK8FwQ=="],
 
-    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-gbACYE8IP/jlprNTpiWXHb8N9CofOzpnEwH2SrIz1dUbiJf1FbDssDupCAPeP1Taxe8mgG20sGZamJI7KFOdZw=="],
+    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.4.6", "", { "os": "linux", "cpu": "x64" }, "sha512-aM8CZ+OR2EwXaAYw7KGkW2GDmNDsLBIRe1MMRZCJPTdw/xhTD0IMUVO4sf3KqrzuRouGzwwLZn34+gFeVXiUQA=="],
 
-    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.4.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-+8gj++ZMo8H20Xh2ijjNqyFk5LPLw0AC4Fs4Tq/G94rjjQXhOjN4jgSWsWKPFsyY26hfIeemJIwKtMxOsp5GBA=="],
+    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.4.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-U0p7/tEtqvHX2crhd841CDwKtp5CFkKXVjOhmfccR3Pvp64sj8KBwRqsvltqLOwVBbj0NtkxwXSDpEHYGbxeXQ=="],
 
-    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.4.5", "", { "os": "win32", "cpu": "x64" }, "sha512-qNZj66pYXnaWLiF9R9GUbfBdrCv7kC6TaZfIwB2KH5WPc/8pEM3nVOj8hpQhWJU8S94rlH5MPDcX15+RrgUhiw=="],
+    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.4.6", "", { "os": "win32", "cpu": "x64" }, "sha512-3ZG15/5WIdlTQsIEvc9sPTTSL5XFrlLklIKmfF4fwsDnoAhu6NcBDXsk3mbGxNyo6aVLEGex+fHCv2MahY7a9g=="],
 
     "@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
 
@@ -711,43 +711,43 @@
 
     "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.21.2", "", { "os": "win32", "cpu": "x64" }, "sha512-VPoCAhKvCQTlG7vxqaBXcmuvbh77BfnGXj8g0pbvVXpm1F/R8rDVwqIWcEbMzrI1JvJlm8v7T9uMVQb6UctMRg=="],
 
-    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.76.0", "", { "os": "android", "cpu": "arm" }, "sha512-z8x4kittQLPsrJWmfoIJyYqs2gNwceGShoUqAJdFRPw3K4kkkKCFHh3Cr4NFRvZb7DPfDS3+JfBjSm3OIyQaJQ=="],
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.78.0", "", { "os": "android", "cpu": "arm" }, "sha512-1x9NPGQG5WMOOT8spRP4hPbeqwB/P9ayxFo4EUDSle6mLmtYRqE6suXgHr93/S2nnszy77LlIa8klkKdWtHbMw=="],
 
-    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.76.0", "", { "os": "android", "cpu": "arm64" }, "sha512-Zj9fEQhQSKGj8ZTB+X4q4ho4545xWf7qsvJpwREWnBz5BATEFYtStKRgiwYOZvxQ7ORlBEgSj7pmDzuljfV1mQ=="],
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.78.0", "", { "os": "android", "cpu": "arm64" }, "sha512-1muYaW9SiPEq8NIPGX0B20oUwCx6HWiCsZem/2jU7UsOzoXLT4YxWq6ybdhwKSKl0PyAfvyMyPF7FsI1To7AdA=="],
 
-    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.76.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jZy8GpUXaWpic5JPMAvLmaBz95Sx0naZl6hptBPLOMiYmZYiME7jAt6pv8o/tjQqPNWKb+7jKzZhrYx6UqM5MQ=="],
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.78.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jl4KJdo8HrVpLmcSYS/7oDXPH8Hzd6VrzgUFRAbY0j6cSRjcDkUnpuAStuNLoqvMtZEi7Rdy68BBriCgWJcy2g=="],
 
-    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.76.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U59+a9lVpoRp9enRhTE9GssL3qB1k09CYagRzTfs3dfknopMYV0x0xHZv7Pls3SNMqHlyHR+ufmY76CYafQoLw=="],
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.78.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-RwOhQgAQi1qV3TeuTfrgGkCWEL3eDFIql/lo4rt2xpGHqyolKa+W5cFbb+M9IvwMwQbplii5Gbv1ZQQPTJlNug=="],
 
-    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.76.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-J1R3YJHPdQJ2RQvzMdTVDWyizhihGiRGGAeEZxtGp629j5pcT5ypSLSiBflopD7o7tmiMD+xlNfhIVmjcHKMVQ=="],
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.78.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-MAXydj01mLjMUlnmo7sYVm+7kdBdU9Nwaux2Q1f9oLNqt3CCdego1oMoZ30qDyZQGQXfVJZEU1yRV7mSzwKDVA=="],
 
-    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.76.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x9qTg6zHoqeyzmFVlIjSb9WlhZdoXaayMTeQeDeUEfKA484AgPJz7f9chLjDMONA6wUUX0FJxnVHsYgX5Zv0+g=="],
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-rz6FVZRiWsq3O2YQgCoqZRwaQQaPQ70NBks4+KINjjPJOjBTd8g/iq6ynS97ode+qKGlhXtpc/xCl8LHzfOjyQ=="],
 
-    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.76.0", "", { "os": "linux", "cpu": "arm" }, "sha512-303gbamm7NDllTtkeaX+8F5Da+KcSBr64mqELQEFg9XgnjfLX3YBCHUcOfgIlVTSybesy43eoeKai8oGr0P6UA=="],
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-lIK0XJi4JP1FnhuLjR/JWhQHGghZc+ghFNnbZTQC8kxsmrkW3ex8CeF7fp0FT+rEP0Nm6voCYkasL8poVWA9sQ=="],
 
-    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.76.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j3UAXzCJoWX9bZLaICj6DfwkI/2fzja9RpiCIbIN+2CQAcKoY+5SH5pQUcECvn32mQm17NSPE9YqTAwYx1seZg=="],
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-o2LJIHfW3ZADOjDVk5c7MM1M8CiAG43GTc4mlJAK23fOHgru4CvnqWedCoCXpIsKokoRdEa7XdQywPGZv1BAiA=="],
 
-    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.76.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-qFZqWVkEzuxWMtUkCtHxsnohXHnUMBQr/ZIxF0KmlCSt8de/bc1lbpVgpqjb3QxCADQHG/O1s3JcowcBF2sqdw=="],
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-G+lUaQk94Vo+4byyd8X2+pPXtd7wObpdbvBC8xyozZD0ROSVBI3XpNNR6HECkJq4Q51AwLuJG81f4x+4eqvSrw=="],
 
-    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.76.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-ROiAid0UH2GN5lMMX2JTgKlOKx1rN+6a1WxIuBsU3j5A3MuB9U5XkREMW76XBbAImnH45mfOCFcSIwb+drcVYg=="],
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.78.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-r76PAZf9/ZgF/iDRaIf8nLsr4x6ZHe/j2QLmWUjoQ46Sa11qMO68a5u5iux3y8vLzqYTS/xtKO9PjjMfyk5png=="],
 
-    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.76.0", "", { "os": "linux", "cpu": "none" }, "sha512-Oyd/9ObdM2RYkZ7yzF/GyvVdbNgJcRG8BFVwnAVo3ooqzaem4E2p5eTIGB09FecQD+Q5HQEANOTEnIZTO6rBAQ=="],
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQiXTt/c4aVoRXkJvhf4Y/sA1XYe3XjSMDbdX5PiAssBuHERoGtncQXz0KKWkXPejWTKlAL4mZSQZdHOCiw7TA=="],
 
-    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.76.0", "", { "os": "linux", "cpu": "none" }, "sha512-86DOpmPDR5UzHSOB8y5HlOpYAIBtMx+6L72IyousNx54q1Kz61aykB4ScovFYivZUak+7Ww6tPBUjarluzYKLw=="],
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-VNB3wFUx/rAqwVNW+uyXxb+c0HUrmcS51UPkFMDWJY95c6Tck6u6HOyVLsqiYoC8kh2mGlwanYmjb/R2McvN0A=="],
 
-    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.76.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-u6omjjFooKfnHLBI+3UtBVInAeuEhoM/RAIw/OiFop2QQgOan5zDfqPR6guMaylt68L60kV+by07Ibp87KDjrw=="],
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.78.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-1nbI0Y7SXwx2f4mJmKt58MaDdjAcoaYM90pBMGdcZCsTW2taFW1/MUi3uQGRPAN2n+3PldCdO9m+D6x+gU/heg=="],
 
-    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.76.0", "", { "os": "linux", "cpu": "x64" }, "sha512-L0/hW1MdMrgsvuLGp9YEQOYOGj5xPHa8wVRtybdd5av03PV4qSpAq3pyfC7sn7UCA8ynRhMRTAa9Kr9nV4LGZg=="],
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-I2z2ISPjrl3CSRF5fmQkNnoh46UVU1GjM1V0+COJyNZcj0SDNM4DrPP2/gXCX38YJ1P2BL6sF2VdsJ+pEYEbJQ=="],
 
-    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.76.0", "", { "os": "linux", "cpu": "x64" }, "sha512-JNk/7HaPDJjy5kih3vq6b71Qif3tHx1ZFACGBzeHeNzyKaIpar4eFGya89GR398K2rwX0eEVmEq1npBPlEkkmg=="],
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-YHt5nKKFxT4SruI57FHnEhGRSDuoFqNoAM3moYCClg70mjjS39gBBbdzaZv+N0otdzvQVuHTPu3jFu5tpqC3XQ=="],
 
-    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.76.0", "", { "os": "none", "cpu": "arm64" }, "sha512-MDLrOQPXDuPKvPUCvpP3hC6kO72dsYxfpYiR08Nf5DiM75M0d8+D26JwT4uHDf0bcflvlGHcd58Hn2HpxkHUUQ=="],
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.78.0", "", { "os": "none", "cpu": "arm64" }, "sha512-WH21lBMU+LYzF7aMeozTZlyc44oa2F+I5OtQ7RwuidCDoAxgTyN1s34rx0PBYrio56+2G88U9VOnYJsyV7VMHQ=="],
 
-    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.76.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-2CcICDrQKqMAOFuzmts/8Ov5iKb+DW/QrW4MFsl2bnRg86uoiUvtqUkHqNSY19Shegc8pBHiXMSEHDjIg94o0A=="],
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.78.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-uNQqHJrtHIiSl8pMbhDktmGpA1hqwldWNO8kbNpNFhVt+BYk4C3Ge8nlJgkRtGjtMam0+542G5UQJJG6lLePbg=="],
 
-    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.76.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-NjZLJg+tQpMWVSyeWBBKCpib7H/uLq84ZzxCvY5eqHzSaItuzCECGA9MBiZwmW8fnkBIfppg49Ib//LSCGAp8Q=="],
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.78.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-W6omURRT39EHBPH4Z8sUPIOzWVjMbhCCCWcfT0sa6aeC+vOXNyBAJmpQRh5//KfPDX96jJlNith9i4N65wxB+Q=="],
 
-    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.76.0", "", { "os": "win32", "cpu": "x64" }, "sha512-0vCMaX/qloc7uaKBDRh+62SBW8EqmhS7c8/al+PxD594ao4lyEWdcoEmVoBgnCNVW07GDpg+9uPV7x6ta9mljw=="],
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.78.0", "", { "os": "win32", "cpu": "x64" }, "sha512-r9rWKeDVc7lIrj0Us9kP08W7FudYAoWyEdO40qnKk20bHiTbW/z2v4LoIxxUENQyFfApbeV2Gl9XsEgY/tY1dA=="],
 
     "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@7.0.2006", "", { "os": "darwin", "cpu": "arm64" }, "sha512-uc0MEHXZUDW23Zmo5X28eSNeSnP17jKnh9GiehpVZqhfy99ks8spyXT5Llar3tjDN7ppnQN0Qd9FK6WNkdD+fQ=="],
 
@@ -761,45 +761,45 @@
 
     "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@7.0.2006", "", { "os": "win32", "cpu": "x64" }, "sha512-VZsGowXcp3vQNkjoGeVCOTf4aGrRpRk6bBJWhefnJVPr6z+dX+LKqqHfwaqnFvg66Q2iJpXqklRW38YO21ee+Q=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.91.0", "", { "os": "android", "cpu": "arm" }, "sha512-eOqJUUS1MCqIoUUxMIkuwaqIdKaHr1SXYA0CQI95UUrF8jwQylQH33bBmnqhZfvWXKlRB2Ylx/+Sbk/ctEqzZQ=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.93.0", "", { "os": "android", "cpu": "arm" }, "sha512-KKw70pbD5Pvq3G2lJ+WQ71XPMjCmg37rkSe2+mDqCRP3PoTSdDMuEi4UOnE8JBtyNM7bek61EC2s0Jt7S7u+Sg=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.91.0", "", { "os": "android", "cpu": "arm64" }, "sha512-vIJU4lRxK0EhbBt+iR3rkq3pio4I+V5Gshwjei3plNjN+CIq0WxWHzYVI06J9KN8Ar3hyNSFtzJAjVRLZOYpjg=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.93.0", "", { "os": "android", "cpu": "arm64" }, "sha512-fvr1fTUZGelwRxKDt64pf28aL1WaWgviwz3X+E/FcRYvrlEahH0NECRz/c1SY+K+KWmZk5uAf6h1kQnyBkp/2A=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.91.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tLy76MurwAOpQt5QVMkJUgexBSWhB7qdvAYb14bc0xntZS6f55aKicbZoxZ/QlmAbnrdlXeD5+IjwY8EZ9RWTg=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.93.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-VdvSN9JRf4Es6ZzoAdvEeh8tgKdw8L4H82WmA8MMPVfPdZGCwE/nI27Z1HrRHYQhPxOh4kmnxQEioSUFrOvDaw=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.91.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-zPeMmjAqm5vXxbTp/JqYuc9gGSbUuEaeCAkFHB4TCRLTlfJGD//Fkx03YvZHCHZJ7ideLiiLcae+3f2I27qnaA=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.93.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-QR1V890Ml0YGRG0F/iV0K9igG+pOhe+VWd+aZnxY849rRHZf3F2gEoQks5+GVHf105X9Mh/6HdShTP5juekG2g=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.91.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-psOR9+xGMXn0hj4KY5M2kjSQ1n0TCMdYbPOraoV0iQyl7mw2oBBYGUM2+ma40m1YLVrktTBOta4FjrmcOHDhrg=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.93.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jDfIbi30zZaKi+rTvig3sge+Xhi8pFFSgHxb0jzovc4qh8ETm/irKV9c7N/JsuwnYc5sbvf4IC8w1vQQ0IL+BA=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.91.0", "", { "os": "linux", "cpu": "arm" }, "sha512-1PNA1j4ETxawvxfz6ueDxWgQgWkXPbv44DWZmC7LR07GqojGFDOwWbosOT6/AYiJr7zMXEhn2dPWMkyFFOFpUQ=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.93.0", "", { "os": "linux", "cpu": "arm" }, "sha512-qtxZ714ND/koFgVH00QgxlzZiIbRPmguaPhnHRU5DFFtrtEdOrSnZD4U/H2AzXrXkZ59eQbMBnJwbum5XohrIQ=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.91.0", "", { "os": "linux", "cpu": "arm" }, "sha512-jcNePVpca37lTbHmiPMnVbPAAW0rH9kAoDjsDv6vESEX9pzazIR1q5SyYuc1rQzdjHtc2VVCDN9jDh6tHcOHyA=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.93.0", "", { "os": "linux", "cpu": "arm" }, "sha512-5pJ9NjMvH7WMUqXB6bTTOSemBm39w2cod27Hu3+Yom/GhbTeNXlYcpDx1o4CgBP6fhp0YHG66TNdVaUm6sHjsA=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.91.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-TJi78UX6R+9qZ23ZKtzN6adfW83bjY0NXsCRMBRH6H7IizaMXmZbdRAtjedMkx77bT46YQH0csawsY9lwha8MA=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.93.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-pRf+7jtbt2fHE23SX7qBxRgnBZicUgsoCK1PVIjnOk+t3a6UBkpt/GrKI99WlxsKUxftz/5nv/kfKvScmYywkw=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.91.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-OowlLroUTzKq5OBvbu6iegch8SJ2DivXFCukzPWURwvcJhMj7/P0CUGH5qrDlxT1Kh48dcxqYqrvE8qK6xTLKQ=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.93.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zM8Fd/K8sqGvsBcJBZ3oVZ3ctGWbszA08IaGt5gFFF5RcunppAI/ZnAXbouABvnWeJ//S44KKlfPZnDDbeiphg=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.91.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-QF/5Ge8yGpWg5s4awMNHfVKh1WOmk591Qg082i6CHenXYBa+W1E5RwWZXaKUOw4Ko7CCjqg3TfBc0AzhnqblYg=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.93.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-7qKCnvhZKDXJG2pdbLazd2hw4FxjJHbZOFrrbzyy5PdHfPLH9vnNUa1le01A8uItZuYKPBPncH+HCoEiFT4SgA=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.91.0", "", { "os": "linux", "cpu": "none" }, "sha512-dXlsKlNhzJQX1nageGKnvWe1D7uTng249hQM80CG/YPZ8F/VZHbxVLhImgurdWBOmu86XOemValLjrW6QIOM/Q=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.93.0", "", { "os": "linux", "cpu": "none" }, "sha512-2pgulxC6G8V5wE750NJE/fRkf9aO6i6yoj10wyaR2EdiNtan4OemsOtsQ0ZTXGdY8Q3IoTmlND3GYvjJsvikYg=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.91.0", "", { "os": "linux", "cpu": "none" }, "sha512-tznkj5VrWNRUfymkaLcJetgMLbP9suL5ob/m7j0Fdbnm5u3Li/Ezo/YcBixiuwdL1sg0oGpyTe86It0J6T+Lxg=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.93.0", "", { "os": "linux", "cpu": "none" }, "sha512-yWsn6Gg2PnGG5jlyDz5+pHGiMTMiy4adaa4WRMzDgzB8efaShk1JMmTHIBSVLQMh0tYXRs4CN5uJCO79r4Mi4g=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.91.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-sNvfLiUYQkVsLNUgIW24AEYTHSd2zZ1vAxXssPdjuQHTtCpRvQihYri6d5z5FY7w/QrcnB5+g9E+/sqmZq8tfA=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.93.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-WCn5plwp/ezS2RDPQKp0/EXEVRr9/dDexUdRKmsMFqzNM5xBSZ1wbsi3PuMk1VfkMRnI5BuazCsziCWMXRDOlw=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.91.0", "", { "os": "linux", "cpu": "x64" }, "sha512-eA25ETvimhUZ89y5BcunNY7yv7qwG2I7V7dFQAU+mIEqZ57gBCXdIERl0yXOEt43zjsw0yK2gRKTc+twF706wQ=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.93.0", "", { "os": "linux", "cpu": "x64" }, "sha512-F2CGjb9LAkzH+IYTZSzd1klQ1vk5z6Utjax64WeLByCkYXbVDbsun+Oy2hLfW2MDSKCvW+jwy/9ld0EPgdeu+A=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.91.0", "", { "os": "linux", "cpu": "x64" }, "sha512-4hZ4Z9K+OkcTpAHDoUTMg/8MModbM0aocrl9KnGzp9h5iKqjrXraEUZorYoVCT7xoK93CAHXgTndxRBrOjH/fA=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.93.0", "", { "os": "linux", "cpu": "x64" }, "sha512-plf5DE2objcG8Tf7mXRuRa8tT8rzDkpjqXQtKoGsKHWkpgsialbON1+cCtoSEUTVbQUjXvuAm8vV9+3rR0yCBw=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.91.0", "", { "os": "none", "cpu": "arm64" }, "sha512-gtqn4b0kLpGe46Qh7NHiR86wZpd+TLaesO106s7V3RG33r63VB94LW5qPKEDJX64osh3xfjnPFn1M0484bC7wQ=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.93.0", "", { "os": "none", "cpu": "arm64" }, "sha512-Kp2yJrKvoTe9FfKdO/xwLNUbs2bYTMKx0+aoQD1s0h/Tx0kSgtHSdGmrk8tTKdluosjFbo88qYRIaNIX43AfFw=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.91.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-KQItBdsyHN28U3z/bEek6h9pvG3Uqv564QYO8K1bE/V7YRZgpHlRnfNKVPHkk4sfYKyPzEjCgW80QkImOLvJog=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.93.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-vigjcHCFsR6KjnWTEVfaCxcMYapEuaK9FZa1MpewwQ1S+Xud3v0okfkj1RySsD6RF1NRHIjSlQSalTnKIaj3nA=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.91.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-XFKqbbsQVmTgw+CyBKuzSZtAa45viom1naFfulKmkTFdDyDaBQaBqEz5J61TI8iwBynU+F8q7qPD+9mplZRhEg=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.93.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-0Ot3BEe/AAr2/uQhe55r8CmPlperYk2mQmxdutOru7oU0kir6IiEVHb1TG3GORRlfra97lPHVDLhgmihiKzLrg=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.91.0", "", { "os": "win32", "cpu": "x64" }, "sha512-DmpK0PthG66Bcz5Y4JqNbzXltzyLQtg3ofYpd25+ejm7kQYUM78VL1uIP/ZFct2781mwUyBX37LatFPCTVp35A=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.93.0", "", { "os": "win32", "cpu": "x64" }, "sha512-ZzzIIVs/Qkm8trUWYKF0OYub5ALlv50/3gsEZbKAvWgz+yNJX6uRmQ8ySPXU2Q0/Y9m4JCOjhpmC8XUYbPHX5Q=="],
 
-    "@oxlint/plugins": ["@oxlint/plugins@1.91.0", "", {}, "sha512-Fh+SOBxMu7/pbSk84WG4BN6npcxxlF4jWNQJ+S4IUNyvSVeQwOVTFQMD/Dx2EqBQ1lVeCADcJ+0rzT1BKQ9cUA=="],
+    "@oxlint/plugins": ["@oxlint/plugins@1.93.0", "", {}, "sha512-bKWQI1g9jn8bWUZsvhbOLfgva576Fbp1KwoTNSUCMdT9tlTAvQS2JkifX1UrhPPdyN4GHvM20HhvIMqqU1yotQ=="],
 
     "@payloadcms/db-mongodb": ["@payloadcms/db-mongodb@3.93.0", "", { "dependencies": { "mongoose": "8.24.1", "mongoose-paginate-v2": "1.9.4", "prompts": "2.4.2", "uuid": "13.0.2" }, "peerDependencies": { "payload": "3.93.0" } }, "sha512-cXcDSraT+1Spyl7JoIgBp6rnuuvdHGCkDKVBh+gwEWcUdQskU8FETMzezSCYQobRpSUNZ4AgRcq5Q+usPRnpNw=="],
 
@@ -827,7 +827,7 @@
 
     "@pinojs/redact": ["@pinojs/redact@0.4.0", "", {}, "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg=="],
 
-    "@playwright/test": ["@playwright/test@1.64.1", "", { "dependencies": { "playwright": "1.64.1" }, "bin": { "playwright": "cli.js" } }, "sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg=="],
+    "@playwright/test": ["@playwright/test@1.65.0", "", { "dependencies": { "playwright": "1.65.0" }, "bin": { "playwright": "cli.js" } }, "sha512-iGURLGuKDLakSEl7Pgfv8h7f+XLT+V861Wfhz0zlEl5nyFuKUopdkFBPKqTllTUp06aOwPuH8iuUEb3yp3MpbQ=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
@@ -1107,27 +1107,27 @@
 
     "@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.4", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.4", "@tailwindcss/oxide": "4.3.4", "postcss": "^8.5.25", "tailwindcss": "4.3.4" } }, "sha512-6O0QLY+1CseO8ivlYK2Y7IxNPaQ8D5ypxrV+ws34mbxknWH824J+gEWtJ0gyFiYAudmdEeXdF8kqwgXIaZRyHw=="],
 
-    "@takumi-rs/core": ["@takumi-rs/core@2.19.0", "", { "dependencies": { "@takumi-rs/helpers": "2.19.0" }, "optionalDependencies": { "@takumi-rs/core-darwin-arm64": "2.19.0", "@takumi-rs/core-darwin-x64": "2.19.0", "@takumi-rs/core-linux-arm64-gnu": "2.19.0", "@takumi-rs/core-linux-arm64-musl": "2.19.0", "@takumi-rs/core-linux-x64-gnu": "2.19.0", "@takumi-rs/core-linux-x64-musl": "2.19.0", "@takumi-rs/core-win32-arm64-msvc": "2.19.0", "@takumi-rs/core-win32-x64-msvc": "2.19.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-cYxOTb4pOu25Y8GBm3JTyIwenHNAZF11pxEmTxA3Q7VabC0pqeWDo/nOjTc2slTHORaglkvwK4SMmnpzab5BjQ=="],
+    "@takumi-rs/core": ["@takumi-rs/core@2.20.0", "", { "dependencies": { "@takumi-rs/helpers": "2.20.0" }, "optionalDependencies": { "@takumi-rs/core-darwin-arm64": "2.20.0", "@takumi-rs/core-darwin-x64": "2.20.0", "@takumi-rs/core-linux-arm64-gnu": "2.20.0", "@takumi-rs/core-linux-arm64-musl": "2.20.0", "@takumi-rs/core-linux-x64-gnu": "2.20.0", "@takumi-rs/core-linux-x64-musl": "2.20.0", "@takumi-rs/core-win32-arm64-msvc": "2.20.0", "@takumi-rs/core-win32-x64-msvc": "2.20.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-28uryNYSyuXZWv5uBfJiWDrRXVdAunkU0sZiB7KG2WgLej64pUNL6jZSTQa+gBXfVu+3DdCz58OnpONBO6EUqQ=="],
 
-    "@takumi-rs/core-darwin-arm64": ["@takumi-rs/core-darwin-arm64@2.19.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-W/SI7Zrxo70dIaKNo+/kOLVr97S3ezkqsi7OM0RWz2CtP+cFgdBTPHXNsrB561gJFPHsuWN/LZ0u8oZxeAYtGw=="],
+    "@takumi-rs/core-darwin-arm64": ["@takumi-rs/core-darwin-arm64@2.20.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-wescbJ8pm0fBN8uXxjiZUDqN7JkdDDmxt8Gq1pSrpRCuGxvAnoj3agMMhHtJ5Ty+BufkIwSvV2cBXRLM4wyYZw=="],
 
-    "@takumi-rs/core-darwin-x64": ["@takumi-rs/core-darwin-x64@2.19.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-xO/eTwPLrfUZRybMnG4lb6fDa7BjFryFi1TSkRF5KjPhkv21Lr5ovFEYz1y2P5k/4psrk66FJbU2EJDOEjdXiw=="],
+    "@takumi-rs/core-darwin-x64": ["@takumi-rs/core-darwin-x64@2.20.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-idCQC8PLuuDFQ4c2YEx142Q1WM+GbrR3RqNxuJay5MxfCXcZ42dv+96xGcgs0U2AWOk1GkY/vTY4y/Om7O/QHA=="],
 
-    "@takumi-rs/core-linux-arm64-gnu": ["@takumi-rs/core-linux-arm64-gnu@2.19.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0PvL5bNTZTkLExjKveI3pOz3mtfjJtECqK49f/KGnp7J0bBmdoi2muszCh/dQQEEFKXcWNe27yfK1tzsO5fm0g=="],
+    "@takumi-rs/core-linux-arm64-gnu": ["@takumi-rs/core-linux-arm64-gnu@2.20.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-TeqwOXlVdjAoSoOVQVoJOER4upQnh7nX6QJnYqVDlbByiSkMhqYULXc7I83NqzkL3U/fbT7/oASNeGWAI2axBA=="],
 
-    "@takumi-rs/core-linux-arm64-musl": ["@takumi-rs/core-linux-arm64-musl@2.19.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-nwKZMGcNVdmCP+U7+uINtXpgOeyk5m7g5D9EAtttpWc6ImjJm7MaqNK4Q2YBkOFeAIbRkY5dDL8Xcu19ATSj0w=="],
+    "@takumi-rs/core-linux-arm64-musl": ["@takumi-rs/core-linux-arm64-musl@2.20.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gOcZxdGq7ebhqRN1Ue3FYJV7jKFG8yG99Opiky13viXXH8hkOde+OKUMe2kqWRH42j7p5EhBPj2qmdUBXXQBCQ=="],
 
-    "@takumi-rs/core-linux-x64-gnu": ["@takumi-rs/core-linux-x64-gnu@2.19.0", "", { "os": "linux", "cpu": "x64" }, "sha512-gf/U6qxWZk6uX5MFnl5/PTOzxBbISj89UQwbliHa1sflcq2d+SeITDqnGtkUueF/4TlgPVV7JvrPuhAbINy2Gg=="],
+    "@takumi-rs/core-linux-x64-gnu": ["@takumi-rs/core-linux-x64-gnu@2.20.0", "", { "os": "linux", "cpu": "x64" }, "sha512-MwIdLqyMUUz+6wuxkGJZyEO9alZODuDqe826HAG2+RErwpSUwfqtD2pHPWG9bnWkr7qpVeziFut6Ng68lYzcvQ=="],
 
-    "@takumi-rs/core-linux-x64-musl": ["@takumi-rs/core-linux-x64-musl@2.19.0", "", { "os": "linux", "cpu": "x64" }, "sha512-zHD0EdIA2ZMCnKV/KtMgEerUcdvjYU4hGiru9I/x96u+BJXaQGMtHCxXt9Srhj+dlqhPyWdQTMAE3wpflN+0nw=="],
+    "@takumi-rs/core-linux-x64-musl": ["@takumi-rs/core-linux-x64-musl@2.20.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bM9QEwOuKg0+im1M+XjownCCdN+zHKQXGblDttpKuoa2QEd4F9t0JJcQMBSjLFucC2sf+rGicAmayMsQRxwgfg=="],
 
-    "@takumi-rs/core-win32-arm64-msvc": ["@takumi-rs/core-win32-arm64-msvc@2.19.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-v1CrPsmzhIe0+v+kIAdaSwrNMqiOpUXgMxHLUo0xDQdPMNML0EefDsL9ADtKDpT1pjhY/r9tvwVl3RhKsdottw=="],
+    "@takumi-rs/core-win32-arm64-msvc": ["@takumi-rs/core-win32-arm64-msvc@2.20.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-VwGj5dsODmHYV09P3AFhvcHL3hk8cS3Y0PYYHxFQtopwcWTsDN522+siotYL1lXZaEag9FoMJOuqiuZsVGgR3w=="],
 
-    "@takumi-rs/core-win32-x64-msvc": ["@takumi-rs/core-win32-x64-msvc@2.19.0", "", { "os": "win32", "cpu": "x64" }, "sha512-9HJb2LTDSlehFrGfPw+uKgxM3XCnpy/PYnwtyzcgAiSFJVjwv0zCLl3IvJREakj5Y9rJCg0mMtPje9hlPbJL/A=="],
+    "@takumi-rs/core-win32-x64-msvc": ["@takumi-rs/core-win32-x64-msvc@2.20.0", "", { "os": "win32", "cpu": "x64" }, "sha512-3am5JIowXAETxUHwQh8MONCagATpN4jFiXISKT2djvceJxrriPZKwWNjB7zTUzZmVLYTbslMrG7x2+U1wPndYg=="],
 
-    "@takumi-rs/helpers": ["@takumi-rs/helpers@2.19.0", "", { "peerDependencies": { "preact": "^10.0.0 || ^11.0.0", "react": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["preact", "react"] }, "sha512-3ycCjYCP31HACXBvlpv4fMLw9vneCVGuttFBfZr4jpL0nHNCt2wlXvt0XFt05FscLMUY2s+5PGKPE6EatXI/mg=="],
+    "@takumi-rs/helpers": ["@takumi-rs/helpers@2.20.0", "", { "peerDependencies": { "preact": "^10.0.0 || ^11.0.0", "react": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["preact", "react"] }, "sha512-efdeG4Ujsw0IEYXhq3lUN1UiKhK6f3tak7VSMrCEWSvumFs0q5moBHSLdsR6aJhPNsYei21Ea6Rjtv94/qdyjg=="],
 
-    "@takumi-rs/wasm": ["@takumi-rs/wasm@2.19.0", "", { "dependencies": { "@takumi-rs/helpers": "2.19.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-V9LKPOFVHKZ7lANVQ94WmOkGvgW0EqXUeLEpsWB2Wnnx7WpOWHnbAI9Yb0VnAYeyRicp7nAfG3vF/M7vsw0s2w=="],
+    "@takumi-rs/wasm": ["@takumi-rs/wasm@2.20.0", "", { "dependencies": { "@takumi-rs/helpers": "2.20.0" }, "peerDependencies": { "csstype": "*" }, "optionalPeers": ["csstype"] }, "sha512-2Xfu55Ye8gmJMXQEDun/5zl/78LyCXKUjP503alH1tG0OyotkkWpZbgW8iWGuxxf4IJvp9kIaO+NLGbq4B6J8A=="],
 
     "@testing-library/dom": ["@testing-library/dom@10.4.2", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-yzr2S9HyAIdhz2/6qHgbs665Q7PKVcDF05vsOlHPxG1mo36gKVesdYVeDLnXgfjJ03CrKRk08knc6+E/9m8v2Q=="],
 
@@ -1309,8 +1309,6 @@
 
     "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
 
-    "arch": ["arch@2.2.0", "", {}, "sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ=="],
-
     "arg": ["arg@5.0.2", "", {}, "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg=="],
 
     "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
@@ -1433,8 +1431,6 @@
 
     "client-only": ["client-only@0.0.1", "", {}, "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA=="],
 
-    "clipboardy": ["clipboardy@3.0.0", "", { "dependencies": { "arch": "^2.2.0", "execa": "^5.1.1", "is-wsl": "^2.2.0" } }, "sha512-Su+uU5sr1jkUy1sGRpLKjKrvEOVXgSgiSInwa/qeID6aJ07yh+5NWc3h2QfjHjBnfX4LhtFcuAWKUsJ3r+fjbg=="],
-
     "cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
 
     "clone": ["clone@2.1.2", "", {}, "sha512-3Pe/CF1Nn94hyhIYpjtiLhdCoEoz0DqQ+988E9gmeEdQZlojxnOb74wctFyuwWQHzqyf9X7C7MG8juUpqBJT8w=="],
@@ -1875,7 +1871,7 @@
 
     "is-decimal": ["is-decimal@2.0.1", "", {}, "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A=="],
 
-    "is-docker": ["is-docker@2.2.1", "", { "bin": { "is-docker": "cli.js" } }, "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ=="],
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
 
     "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
 
@@ -1907,7 +1903,7 @@
 
     "is-windows": ["is-windows@1.0.2", "", {}, "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA=="],
 
-    "is-wsl": ["is-wsl@2.2.0", "", { "dependencies": { "is-docker": "^2.0.0" } }, "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww=="],
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
 
     "isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
 
@@ -2215,7 +2211,7 @@
 
     "nerf-dart": ["nerf-dart@1.0.0", "", {}, "sha512-EZSPZB70jiVsivaBLYDCyntd5eH8NTSMOn3rB+HxwdmKThGELLdYv8qVIMWvZEFy9w8ZZpW9h9OB32l1rGtj7g=="],
 
-    "next": ["next@16.4.5", "", { "dependencies": { "@next/env": "16.4.5", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.4.5", "@next/swc-darwin-x64": "16.4.5", "@next/swc-linux-arm64-gnu": "16.4.5", "@next/swc-linux-arm64-musl": "16.4.5", "@next/swc-linux-x64-gnu": "16.4.5", "@next/swc-linux-x64-musl": "16.4.5", "@next/swc-win32-arm64-msvc": "16.4.5", "@next/swc-win32-x64-msvc": "16.4.5", "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-rmdfsWosjTUO+6R0S3KokoIk6Kj0sWDRTe86tZHdqaWH/oXq/udX3/4xb+YQi7aWbyEFoglDU54kaifLCdXbBw=="],
+    "next": ["next@16.4.6", "", { "dependencies": { "@next/env": "16.4.6", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.4.6", "@next/swc-darwin-x64": "16.4.6", "@next/swc-linux-arm64-gnu": "16.4.6", "@next/swc-linux-arm64-musl": "16.4.6", "@next/swc-linux-x64-gnu": "16.4.6", "@next/swc-linux-x64-musl": "16.4.6", "@next/swc-win32-arm64-msvc": "16.4.6", "@next/swc-win32-x64-msvc": "16.4.6", "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-QZJiYhaZLJMo2KpkQGQIwvmd79WVsAWeYIU554a8d7zArS3si/IRy3lBNV/rtYhE70oLwdLYhPAXLPx8HwcwtA=="],
 
     "next-themes": ["next-themes@0.4.6", "", { "peerDependencies": { "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc", "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc" } }, "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA=="],
 
@@ -2271,9 +2267,9 @@
 
     "oxc-resolver": ["oxc-resolver@11.21.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.21.2", "@oxc-resolver/binding-android-arm64": "11.21.2", "@oxc-resolver/binding-darwin-arm64": "11.21.2", "@oxc-resolver/binding-darwin-x64": "11.21.2", "@oxc-resolver/binding-freebsd-x64": "11.21.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.21.2", "@oxc-resolver/binding-linux-arm64-musl": "11.21.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.21.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-gnu": "11.21.2", "@oxc-resolver/binding-linux-x64-musl": "11.21.2", "@oxc-resolver/binding-openharmony-arm64": "11.21.2", "@oxc-resolver/binding-wasm32-wasi": "11.21.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.21.2", "@oxc-resolver/binding-win32-x64-msvc": "11.21.2" } }, "sha512-w5tLwYN3Zo24w5EeWJjJWZOwhYqTtC8PS2B1tIt7BZUuqTIcU07sQValbDw+rq7+AuAGzOHklgK+ifsy4lpXfw=="],
 
-    "oxfmt": ["oxfmt@0.76.0", "", { "dependencies": { "tinypool": "2.2.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.76.0", "@oxfmt/binding-android-arm64": "0.76.0", "@oxfmt/binding-darwin-arm64": "0.76.0", "@oxfmt/binding-darwin-x64": "0.76.0", "@oxfmt/binding-freebsd-x64": "0.76.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.76.0", "@oxfmt/binding-linux-arm-musleabihf": "0.76.0", "@oxfmt/binding-linux-arm64-gnu": "0.76.0", "@oxfmt/binding-linux-arm64-musl": "0.76.0", "@oxfmt/binding-linux-ppc64-gnu": "0.76.0", "@oxfmt/binding-linux-riscv64-gnu": "0.76.0", "@oxfmt/binding-linux-riscv64-musl": "0.76.0", "@oxfmt/binding-linux-s390x-gnu": "0.76.0", "@oxfmt/binding-linux-x64-gnu": "0.76.0", "@oxfmt/binding-linux-x64-musl": "0.76.0", "@oxfmt/binding-openharmony-arm64": "0.76.0", "@oxfmt/binding-win32-arm64-msvc": "0.76.0", "@oxfmt/binding-win32-ia32-msvc": "0.76.0", "@oxfmt/binding-win32-x64-msvc": "0.76.0" }, "peerDependencies": { "@astrojs/compiler-rs": "^0.5.0", "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["@astrojs/compiler-rs", "svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-Yo9RIn9lRWTm/U8obHbXUWc39lCpEFXlEggFoPx01zS18OCFi7mAwMmL05+p1AunuJgSkONffWyBHJzpMMCRuQ=="],
+    "oxfmt": ["oxfmt@0.78.0", "", { "dependencies": { "tinypool": "2.2.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.78.0", "@oxfmt/binding-android-arm64": "0.78.0", "@oxfmt/binding-darwin-arm64": "0.78.0", "@oxfmt/binding-darwin-x64": "0.78.0", "@oxfmt/binding-freebsd-x64": "0.78.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.78.0", "@oxfmt/binding-linux-arm-musleabihf": "0.78.0", "@oxfmt/binding-linux-arm64-gnu": "0.78.0", "@oxfmt/binding-linux-arm64-musl": "0.78.0", "@oxfmt/binding-linux-ppc64-gnu": "0.78.0", "@oxfmt/binding-linux-riscv64-gnu": "0.78.0", "@oxfmt/binding-linux-riscv64-musl": "0.78.0", "@oxfmt/binding-linux-s390x-gnu": "0.78.0", "@oxfmt/binding-linux-x64-gnu": "0.78.0", "@oxfmt/binding-linux-x64-musl": "0.78.0", "@oxfmt/binding-openharmony-arm64": "0.78.0", "@oxfmt/binding-win32-arm64-msvc": "0.78.0", "@oxfmt/binding-win32-ia32-msvc": "0.78.0", "@oxfmt/binding-win32-x64-msvc": "0.78.0" }, "peerDependencies": { "@astrojs/compiler-rs": "^0.5.0", "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["@astrojs/compiler-rs", "svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-uagX+70mKqh/YqxB6ON/lkxVPH6E1Z7pfP2x6XVRPPyiDCZtX6o1xIEeXAIXJ/2wA5ViX4RFuW+IAQn85yJdWg=="],
 
-    "oxlint": ["oxlint@1.91.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.91.0", "@oxlint/binding-android-arm64": "1.91.0", "@oxlint/binding-darwin-arm64": "1.91.0", "@oxlint/binding-darwin-x64": "1.91.0", "@oxlint/binding-freebsd-x64": "1.91.0", "@oxlint/binding-linux-arm-gnueabihf": "1.91.0", "@oxlint/binding-linux-arm-musleabihf": "1.91.0", "@oxlint/binding-linux-arm64-gnu": "1.91.0", "@oxlint/binding-linux-arm64-musl": "1.91.0", "@oxlint/binding-linux-ppc64-gnu": "1.91.0", "@oxlint/binding-linux-riscv64-gnu": "1.91.0", "@oxlint/binding-linux-riscv64-musl": "1.91.0", "@oxlint/binding-linux-s390x-gnu": "1.91.0", "@oxlint/binding-linux-x64-gnu": "1.91.0", "@oxlint/binding-linux-x64-musl": "1.91.0", "@oxlint/binding-openharmony-arm64": "1.91.0", "@oxlint/binding-win32-arm64-msvc": "1.91.0", "@oxlint/binding-win32-ia32-msvc": "1.91.0", "@oxlint/binding-win32-x64-msvc": "1.91.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2005", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-vjy/cBZcEFcYh3dbxUoQK+bjc+QaY3ZWo86aJkZ5YAwp/HyiqP7dTdNgbvcIVJafhAH5sZbTqBp4sZcicEZngA=="],
+    "oxlint": ["oxlint@1.93.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.93.0", "@oxlint/binding-android-arm64": "1.93.0", "@oxlint/binding-darwin-arm64": "1.93.0", "@oxlint/binding-darwin-x64": "1.93.0", "@oxlint/binding-freebsd-x64": "1.93.0", "@oxlint/binding-linux-arm-gnueabihf": "1.93.0", "@oxlint/binding-linux-arm-musleabihf": "1.93.0", "@oxlint/binding-linux-arm64-gnu": "1.93.0", "@oxlint/binding-linux-arm64-musl": "1.93.0", "@oxlint/binding-linux-ppc64-gnu": "1.93.0", "@oxlint/binding-linux-riscv64-gnu": "1.93.0", "@oxlint/binding-linux-riscv64-musl": "1.93.0", "@oxlint/binding-linux-s390x-gnu": "1.93.0", "@oxlint/binding-linux-x64-gnu": "1.93.0", "@oxlint/binding-linux-x64-musl": "1.93.0", "@oxlint/binding-openharmony-arm64": "1.93.0", "@oxlint/binding-win32-arm64-msvc": "1.93.0", "@oxlint/binding-win32-ia32-msvc": "1.93.0", "@oxlint/binding-win32-x64-msvc": "1.93.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2005", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-19JMsQFX+YvEbcUTFQxjTwhvs0Ibg0D6CFneSLgpwnACWcY/6LjhpGpkPodh0T5aIT1pjMTLlYaeBFzaVgugTA=="],
 
     "oxlint-tailwindcss": ["oxlint-tailwindcss@1.17.1", "", { "dependencies": { "@tailwindcss/node": "^4.3.3", "tailwindcss": "^4.3.3" } }, "sha512-fIsTVO97ruLU7GK8mNfQiE0TsjcnOccVz/w+C/lvbo54Hb/0ZZvT4cw3a0TCxM/buREd09enI+h7zfm6cG8OzA=="],
 
@@ -2363,9 +2359,9 @@
 
     "pkg-conf": ["pkg-conf@2.1.0", "", { "dependencies": { "find-up": "^2.0.0", "load-json-file": "^4.0.0" } }, "sha512-C+VUP+8jis7EsQZIhDYmS5qlNtjv2yP4SNtjXK9AP1ZcTRlnSfuumaTnRfYZnYgUUYVIKqL0fRvmUGDV2fmp6g=="],
 
-    "playwright": ["playwright@1.64.1", "", { "dependencies": { "playwright-core": "1.64.1" }, "bin": { "playwright": "cli.js" } }, "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA=="],
+    "playwright": ["playwright@1.65.0", "", { "dependencies": { "playwright-core": "1.65.0" }, "bin": { "playwright": "cli.js" } }, "sha512-F3AMWcR44qMBt4kq+6Kb6mX7bjGXshktKFOPULd7reED6ZJWevjbNRqysP7q+AATE9kdPEZBibex1BYsvpVoeA=="],
 
-    "playwright-core": ["playwright-core@1.64.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ=="],
+    "playwright-core": ["playwright-core@1.65.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-vNSKgH6YqtN7cdT/L334zo0a+YwkrpicyrHJlWWPIm/Q+Nn2SWInil01oT0mbu96U4GgoRtCYQD9CzJQgju+lA=="],
 
     "pluralize": ["pluralize@8.0.0", "", {}, "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="],
 
@@ -2527,7 +2523,7 @@
 
     "semver-regex": ["semver-regex@4.0.5", "", {}, "sha512-hunMQrEy1T6Jr2uEVjrAIqjwWcQTgOAcIM52C8MY1EZSD3DDNft04XzvYKPqjED65bNVVko0YI38nYeEHCX3yw=="],
 
-    "serve": ["serve@14.2.6", "", { "dependencies": { "@zeit/schemas": "2.36.0", "ajv": "8.18.0", "arg": "5.0.2", "boxen": "7.0.0", "chalk": "5.0.1", "chalk-template": "0.4.0", "clipboardy": "3.0.0", "compression": "1.8.1", "is-port-reachable": "4.0.0", "serve-handler": "6.1.7", "update-check": "1.5.4" }, "bin": { "serve": "build/main.js" } }, "sha512-QEjUSA+sD4Rotm1znR8s50YqA3kYpRGPmtd5GlFxbaL9n/FdUNbqMhxClqdditSk0LlZyA/dhud6XNRTOC9x2Q=="],
+    "serve": ["serve@14.2.7", "", { "dependencies": { "@zeit/schemas": "2.36.0", "ajv": "8.18.0", "arg": "5.0.2", "boxen": "7.0.0", "chalk": "5.0.1", "chalk-template": "0.4.0", "compression": "1.8.1", "is-port-reachable": "4.0.0", "serve-handler": "6.1.7", "tinyclip": "^0.1.12", "update-check": "1.5.4" }, "bin": { "serve": "build/main.js" } }, "sha512-mTJ9LAyBwHhO2T/PNaI0oWxmKl7FFuJ+ZEHKL1rRO69fWV1Y4qcsFB3gpuD2HfHvJCwvJq5ChibjjAGe0wc0vw=="],
 
     "serve-handler": ["serve-handler@6.1.7", "", { "dependencies": { "bytes": "3.0.0", "content-disposition": "0.5.2", "mime-types": "2.1.18", "minimatch": "3.1.5", "path-is-inside": "1.0.2", "path-to-regexp": "3.3.0", "range-parser": "1.2.0" } }, "sha512-CinAq1xWb0vR3twAv9evEU8cNWkXCb9kd5ePAHUKJBkOsUpR1wt/CvGdeca7vqumL1U5cSaeVQ6zZMxiJ3yWsg=="],
 
@@ -2665,11 +2661,11 @@
 
     "tailwind-merge": ["tailwind-merge@3.7.0", "", {}, "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA=="],
 
-    "tailwind-variants": ["tailwind-variants@3.3.1", "", { "peerDependencies": { "tailwind-merge": ">=3.0.0", "tailwindcss": "*" }, "optionalPeers": ["tailwind-merge", "tailwindcss"] }, "sha512-4pAvwUtM4HKBiRZftncAbpn6V9Hhwoa5Fl7O2u5zbp7Z5Cvu+/o/6+176WY3WCEES209543quG8zFIcXCsc5Jw=="],
+    "tailwind-variants": ["tailwind-variants@4.0.2", "", {}, "sha512-sZvOFkfe5LlYG/crRX5IvP3oUHmJPu+7WmrLQFvF0kCRq51C+lurlzFMm/jURG/5keT7VOJ/it0N3jkzYux85w=="],
 
-    "tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
+    "tailwindcss": ["tailwindcss@4.3.5", "", {}, "sha512-FcQk9BuffmEHJP2G0XmB2SplU1aLTI7j07Kunk+U74Ny+XiWOtzXz9aujFZ/avntw1e2cOv/3PkgzflQ7gX2vQ=="],
 
-    "takumi-js": ["takumi-js@2.19.0", "", { "dependencies": { "@takumi-rs/core": "2.19.0", "@takumi-rs/helpers": "2.19.0", "@takumi-rs/wasm": "2.19.0" } }, "sha512-WUgzukIpAtoDUeFkdKvT0o4pterWoyM9qcXpIRUQIqUZHriIBdPdPZV42UyzEbNyXvg/1aUaVhBGEyivraT8NQ=="],
+    "takumi-js": ["takumi-js@2.20.0", "", { "dependencies": { "@takumi-rs/core": "2.20.0", "@takumi-rs/helpers": "2.20.0", "@takumi-rs/wasm": "2.20.0" } }, "sha512-WnqocRxTlQcDeA6Q0Awcz3+diSF3UGA2hmIL3pLsqiGXZHpeeRVpVad97EO33sYiMT6+L2kMya28EVGJbjCyfg=="],
 
     "tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
 
@@ -2695,6 +2691,8 @@
 
     "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
 
+    "tinyclip": ["tinyclip@0.1.15", "", {}, "sha512-uo33abH+Ays0xYaDysoBt494Hb3hsEczMpcC0MwFl773pazORx4fmvKhclhR1wonUbB6vvpRsvVMwnhfqeMc+A=="],
+
     "tinyexec": ["tinyexec@1.3.1", "", {}, "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA=="],
 
     "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
@@ -2991,6 +2989,8 @@
 
     "@tailwindcss/node/magic-string": ["magic-string@1.4.5", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.6.0" } }, "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w=="],
 
+    "@tailwindcss/node/tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
+
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.3", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.3", "tslib": "^2.4.0" }, "bundled": true }, "sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
@@ -3003,6 +3003,8 @@
 
     "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.9.1", "", { "bundled": true }, "sha512-a4Ux9VKuIMHsOS7ENbEq6hK2ZGYIT27Rtl0E4eD9KqwxhKiQeMZE/9xb3IdYwWaSOyIBQLExhQgXDTYoiCxnWA=="],
 
+    "@tailwindcss/postcss/tailwindcss": ["tailwindcss@4.3.4", "", {}, "sha512-PCJZTFFdG+sL3gvnP1Do9o6GbkvH2q0p04xSs3f7cSvmAeK+sttG+/7ncK1fdRwKFfC7n+wDDJaOMBSefkI9ow=="],
+
     "@testing-library/jest-dom/aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
 
     "@testing-library/jest-dom/dom-accessibility-api": ["dom-accessibility-api@0.6.3", "", {}, "sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w=="],
@@ -3049,8 +3051,6 @@
 
     "cli-table3/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
-    "clipboardy/execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
-
     "cliui/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
 
     "cliui/wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
@@ -3097,8 +3097,6 @@
 
     "import-fresh/resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
 
-    "is-inside-container/is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
-
     "istanbul-lib-report/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
     "jsdom/undici": ["undici@8.12.3", "", {}, "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw=="],
@@ -3499,6 +3497,8 @@
 
     "update-check/registry-auth-token": ["registry-auth-token@3.3.2", "", { "dependencies": { "rc": "^1.1.6", "safe-buffer": "^5.0.1" } }, "sha512-JL39c60XlzCVgNrO+qq68FoNb56w/m7JYvGR2jT5iR1xBrUA3Mfx5Twk5rqTThPmQKMWydGmq8oFtDlxfrmxnQ=="],
 
+    "vite-plugin-storybook-nextjs/@next/env": ["@next/env@16.4.5", "", {}, "sha512-JwSPwpdkZL5VMl2jA/q+JI8MZdweAL3xmw5/tb9y/TLtmS0YXZnmYDzSihwk8xTj1OL+WM53gTqaj96yuLp6Xw=="],
+
     "vite-plugin-storybook-nextjs/vite-tsconfig-paths": ["vite-tsconfig-paths@5.1.4", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" }, "optionalPeers": ["vite"] }, "sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w=="],
 
     "vitest/@vitest/expect": ["@vitest/expect@4.1.12", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.12", "@vitest/utils": "4.1.12", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ=="],
@@ -3519,8 +3519,6 @@
 
     "wrap-ansi/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
 
-    "wsl-utils/is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
-
     "xss/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
 
     "@babel/helper-module-imports/@babel/traverse/@babel/parser": ["@babel/parser@7.29.12", "", { "dependencies": { "@babel/types": "^7.29.11" }, "bin": "./bin/babel-parser.js" }, "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg=="],
@@ -3595,18 +3593,6 @@
 
     "cli-table3/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "clipboardy/execa/human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
-
-    "clipboardy/execa/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
-
-    "clipboardy/execa/npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
-
-    "clipboardy/execa/onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
-
-    "clipboardy/execa/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
-    "clipboardy/execa/strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
-
     "cliui/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
     "cliui/wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
@@ -3715,10 +3701,6 @@
 
     "cli-highlight/yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "clipboardy/execa/npm-run-path/path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
-
-    "clipboardy/execa/onetime/mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
-
     "glob/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
     "npm/minipass-flush/minipass/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
diff --git a/lefthook.yml b/lefthook.yml
index 660bfde4..ac1ee23d 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -11,13 +11,12 @@ pre-commit:
       glob: '*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}'
       run: bun x oxfmt --no-error-on-unmatched-pattern {staged_files} && bun x oxlint --fix --no-error-on-unmatched-pattern {staged_files}
       stage_fixed: true
-    # Keeps dependency versions within their syncpack groups and the lockfile
-    # in step with package.json. stage_fixed only re-stages files the glob
-    # matched, so the lockfile `bun install` rewrites is added explicitly;
-    # otherwise CI's `bun install --frozen-lockfile` fails on the commit.
     package-json:
-      glob: 'package.json'
-      run: bun x syncpack format --source package.json && bun x syncpack fix --dependency-types prod,dev,peer --source package.json && bun install && git add bun.lock
+      glob: [ 'package.json', 'bun.lock' ]
+      run: |
+        bun x syncpack format --source package.json
+        bun x syncpack fix --dependency-types prod,dev,peer --source package.json
+        bun install
       stage_fixed: true
 
 commit-msg:
diff --git a/package.json b/package.json
index d51399f0..e45a827a 100644
--- a/package.json
+++ b/package.json
@@ -16,32 +16,33 @@
     "#frontend.css": "./src/styles/frontend.css"
   },
   "scripts": {
-    "build": "bun run _next build --webpack",
+    "_email": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" email",
+    "_next": "NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" next",
+    "_payload": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" payload --disable-transpile",
+    "_storybook": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" storybook",
     "analyze": "ANALYZE=true bun run build",
+    "build": "bun run _next build --webpack",
     "build:storybook": "bun run _storybook build --output-dir dist",
-    "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
     "chore:format": "syncpack format",
+    "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
     "ci": "bun run migrate && bun run build",
     "deps:fix": "syncpack fix --dependency-types prod,dev,peer",
     "deps:lint": "syncpack lint --dependency-types prod,dev,peer",
     "deps:update": "syncpack update",
     "dev": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" node scripts/dev.mjs",
     "dev:app": "bun run _next dev",
-    "dev:storybook": "bun run _storybook dev -p 6006",
     "dev:email": "bun run _email dev --dir src/emails --port 3005",
+    "dev:storybook": "bun run _storybook dev -p 6006",
     "format": "oxfmt",
     "generate": "bun run generate:next-types && bun run generate:payload-types && bun run generate:importmap",
     "generate:importmap": "bun run _payload generate:importmap",
-    "generate:payload-types": "bun run _payload generate:types",
     "generate:next-types": "bun run _next typegen",
+    "generate:payload-types": "bun run _payload generate:types",
     "links:migrate": "bun run _payload run scripts/migrate-link-field-naming.ts",
     "lint": "oxlint && oxfmt --check",
+    "lint:fix": "oxlint --fix && oxfmt",
     "load-env": "node scripts/load-env.mjs",
     "migrate": "bun run _payload migrate",
-    "_next": "NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" next",
-    "_payload": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" payload --disable-transpile",
-    "_email": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" email",
-    "_storybook": "NODE_OPTIONS=\"--trace-deprecation --disable-warning=DeprecationWarning\" storybook",
     "prepare": "lefthook install",
     "refs:backfill": "bun run _payload run scripts/backfill-references.ts",
     "release": "semantic-release",
@@ -54,8 +55,8 @@
     "seed:resume-documents:clean": "bun run _payload run scripts/seed-resume-documents.ts -- --clean",
     "seed:topics": "bun run _payload run scripts/seed-topics.ts",
     "seed:topics:clean": "bun run _payload run scripts/seed-topics.ts -- --clean",
-    "start:storybook": "npx serve dist -l 3020",
     "start:app": "bun run _next start",
+    "start:storybook": "npx serve dist -l 3020",
     "start:worker": "node scripts/start-worker.mjs",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
@@ -63,8 +64,7 @@
     "test:e2e:docker": "./scripts/e2e-docker.sh",
     "test:e2e:ui": "node --env-file=.env.test node_modules/@playwright/test/cli.js test --ui",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "lint:fix": "oxlint --fix && oxfmt"
+    "typecheck": "tsc --noEmit"
   },
   "overrides": {
     "pdfjs-dist": "5.4.296"
@@ -108,7 +108,7 @@
     "mediabunny": "^1.65.2",
     "nanoid": "^6.0.1",
     "neotraverse": "^1.0.1",
-    "next": "^16.3.6",
+    "next": "^16.4.6",
     "next-themes": "^0.4.6",
     "ogl": "^1.0.11",
     "payload": "^3.93.0",
@@ -125,9 +125,9 @@
     "shiki": "^4.4.3",
     "svgo": "^4.1.0",
     "tailwind-merge": "^3.7.0",
-    "tailwind-variants": "^3.3.1",
-    "tailwindcss": "^4.3.3",
-    "takumi-js": "^2.14.0",
+    "tailwind-variants": "^4.0.2",
+    "tailwindcss": "^4.3.5",
+    "takumi-js": "^2.20.0",
     "timestring": "^7.0.0",
     "tw-easing-gradients": "^1.2.0",
     "type-fest": "^5.10.0",
@@ -138,8 +138,8 @@
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
     "@next/bundle-analyzer": "^16.4.6",
-    "@oxlint/plugins": "^1.86.0",
-    "@playwright/test": "~1.64.1",
+    "@oxlint/plugins": "^1.93.0",
+    "@playwright/test": "~1.65.0",
     "@react-email/ui": "^6.11.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/commit-analyzer": "^13.0.1",
@@ -168,15 +168,15 @@
     "autoprefixer": "^10.6.1",
     "cssnano": "^9.0.5",
     "lefthook": "^2.1.14",
-    "oxfmt": "^0.76.0",
-    "oxlint": "^1.86.0",
+    "oxfmt": "^0.78.0",
+    "oxlint": "^1.93.0",
     "oxlint-tailwindcss": "^1.16.0",
     "oxlint-tsgolint": "^7.0.2006",
-    "playwright": "~1.64.1",
+    "playwright": "~1.65.0",
     "postcss": "^8.5.28",
     "react-docgen-typescript": "^2.4.0",
     "semantic-release": "^25.0.9",
-    "serve": "^14.2.6",
+    "serve": "^14.2.7",
     "storybook": "^10.6.0",
     "styled-jsx": "^5.1.7",
     "syncpack": "^15.3.3",
diff --git a/syncpack.config.mjs b/syncpack.config.mjs
index 2d2eb1b4..cad91416 100644
--- a/syncpack.config.mjs
+++ b/syncpack.config.mjs
@@ -23,22 +23,23 @@ export default {
   // order (sortFirst below) and content order for these fields, instead of
   // re-shuffling each other's output on alternating commits.
   sortAz: [
-    'maintainers',
+    'bundledDependencies',
+    'bundleDependencies',
     'contributors',
-    'resolutions',
-    'overrides',
     'dependencies',
     'devDependencies',
-    'peerDependencies',
-    'optionalDependencies',
-    'bundledDependencies',
-    'bundleDependencies',
-    'extensionPack',
-    'extensionDependencies',
     'engines',
     'engineStrict',
+    'extensionDependencies',
+    'extensionPack',
+    'maintainers',
+    'optionalDependencies',
+    'overrides',
+    'peerDependencies',
     'preferGlobal',
     'publishConfig',
+    'resolutions',
+    'scripts',
   ],
   // Full sort-package-json default field order (see that package's `fields`
   // array) — kept complete rather than trimmed to this repo's current
@@ -212,7 +213,7 @@ export default {
       label: 'Playwright packages are pinned to one version',
       dependencies: ['playwright', '@playwright/**'],
       packages: ['**'],
-      pinVersion: '~1.64.1',
+      pinVersion: '~1.65.0',
     },
 
     {

From 9d746804e4fbb831ca0c1d3c5441fd6e541c60b5 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 13:11:51 +0100
Subject: [PATCH 20/30] feat(payload): make generatorFlags a required array
 with shared schema definitions

generatorFlags is required with an empty default and reads as [] when unset; GeneratorFlag and GeneratorFlags are JSON-schema definitions referenced by the generated types. The two create calls that omitted the field now pass an empty array.
---
 payload.config.ts                             |  14 ++
 src/fields/GeneratorFlags/index.ts            |  16 +-
 src/globals/SiteSettings/index.ts             |   2 +-
 .../handlers/createResumeDocument.ts          |   1 +
 src/lib/uploadHeroSlideMedia.ts               |   4 +-
 src/types/payload.ts                          | 161 ++++--------------
 6 files changed, 59 insertions(+), 139 deletions(-)

diff --git a/payload.config.ts b/payload.config.ts
index 2fd4f4bd..7dd1af35 100644
--- a/payload.config.ts
+++ b/payload.config.ts
@@ -13,6 +13,7 @@ import sharp from 'sharp'
 
 import { BLOCKS } from '@/blocks'
 import { COLLECTIONS } from '@/collections'
+import { GENERATOR_FLAGS } from '@/fields/GeneratorFlags'
 import { GLOBALS } from '@/globals'
 import { scopeJobsList } from '@/jobs-queue/lib/jobsListFilter'
 import { TASKS } from '@/jobs-queue/tasks'
@@ -306,6 +307,19 @@ export const config = buildConfig({
         ...jsonSchema,
         definitions: {
           ...jsonSchema.definitions,
+          GeneratorFlag: {
+            title: 'GeneratorFlag',
+            type: 'string',
+            enum: [...GENERATOR_FLAGS],
+          },
+          GeneratorFlags: {
+            title: 'GeneratorFlags',
+            type: 'array',
+            items: {
+              $ref: '#/definitions/GeneratorFlag',
+            },
+            additionalItems: false,
+          },
           SkillType: {
             title: 'SkillType',
             type: 'string',
diff --git a/src/fields/GeneratorFlags/index.ts b/src/fields/GeneratorFlags/index.ts
index 74a094b4..e16403d6 100644
--- a/src/fields/GeneratorFlags/index.ts
+++ b/src/fields/GeneratorFlags/index.ts
@@ -27,6 +27,7 @@ import { normalizeIncomingFlags } from './hooks/normalizeIncomingFlags'
  * back as `thumbnail` cannot be described accurately. Callers that genuinely
  * need to merge can spread the existing array.
  */
+
 export const GENERATOR_FLAGS = [
   'resume-asset',
   'thumbnail',
@@ -54,20 +55,21 @@ export const GeneratorFlagsField = (): TextField => ({
   admin: {
     hidden: true,
   },
-
+  hooks: {
+    afterRead: [({ value }) => value ?? []],
+    beforeChange: [normalizeIncomingFlags],
+  },
+  required: true,
+  defaultValue: [],
   typescriptSchema: [
     () => ({
       type: 'array',
       items: {
-        type: 'string',
-        enum: [...GENERATOR_FLAGS],
+        $ref: '#/definitions/GeneratorFlag',
       },
       additionalItems: false,
-      required: false,
+      required: true,
       default: [],
     }),
   ],
-  hooks: {
-    beforeChange: [normalizeIncomingFlags],
-  },
 })
diff --git a/src/globals/SiteSettings/index.ts b/src/globals/SiteSettings/index.ts
index f0765ff5..93b46386 100644
--- a/src/globals/SiteSettings/index.ts
+++ b/src/globals/SiteSettings/index.ts
@@ -24,7 +24,7 @@ const NavEntries = (): ArrayField => ({
     },
   },
   hooks: {
-    afterRead: [async ({ value = [] }) => value],
+    afterRead: [({ value = [] }) => value],
   },
   interfaceName: 'NavEntries',
   fields: [...LinkField().fields],
diff --git a/src/jobs-queue/handlers/createResumeDocument.ts b/src/jobs-queue/handlers/createResumeDocument.ts
index 711441f4..6b99069f 100644
--- a/src/jobs-queue/handlers/createResumeDocument.ts
+++ b/src/jobs-queue/handlers/createResumeDocument.ts
@@ -28,6 +28,7 @@ const run: TaskHandler<TaskSlug['CreateResumeDocument']> = async ({ input, req:
     data: {
       title: documentTitle,
       slug: documentSlug,
+      generatorFlags: [],
       createdAt,
       jobId,
       document_en: {
diff --git a/src/lib/uploadHeroSlideMedia.ts b/src/lib/uploadHeroSlideMedia.ts
index c0fbdc2c..ad2f5ab9 100644
--- a/src/lib/uploadHeroSlideMedia.ts
+++ b/src/lib/uploadHeroSlideMedia.ts
@@ -50,7 +50,9 @@ export const uploadHeroSlideMedia = async (
 
   const doc = await payload.create({
     collection,
-    data: {},
+    data: {
+      generatorFlags: [],
+    },
     file: {
       data,
       name: file.name,
diff --git a/src/types/payload.ts b/src/types/payload.ts
index e881ecbb..50826cdc 100644
--- a/src/types/payload.ts
+++ b/src/types/payload.ts
@@ -6,6 +6,19 @@
  * and re-run `payload generate:types` to regenerate this file.
  */
 
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "GeneratorFlag".
+ */
+export type GeneratorFlag =
+  | 'resume-asset'
+  | 'thumbnail'
+  | 'document'
+  | 'audio-thumbnail'
+  | 'video-thumbnail'
+  | 'document-thumbnail'
+  | 'unsplash-import'
+  | 'seeded-dummy';
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "PageLayout".
@@ -105,6 +118,11 @@ export type LanguageProficiency = ('a1' | 'a2' | 'b1' | 'b2' | 'c1' | 'c2' | 'na
  * via the `definition` "supportedTimezones".
  */
 export type SupportedTimezones = 'Europe/Berlin';
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "GeneratorFlags".
+ */
+export type GeneratorFlags = GeneratorFlag[];
 
 export interface Config {
   auth: {
@@ -380,16 +398,7 @@ export interface MediaImage {
     [k: string]: unknown;
   } | null;
   blurDataURL?: string | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -524,16 +533,7 @@ export interface Page {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -567,16 +567,7 @@ export interface MediaVideo {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -949,16 +940,7 @@ export interface BlogPostData {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1034,16 +1016,7 @@ export interface Topic {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1153,16 +1126,7 @@ export interface MediaDocument {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1199,16 +1163,7 @@ export interface MediaAudio {
     };
     [k: string]: unknown;
   } | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1233,16 +1188,7 @@ export interface ResumeCustomerData {
   title: string;
   slug: string;
   svg?: string | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1297,16 +1243,7 @@ export interface ResumeDocumentData {
     | number
     | boolean
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
 }
 /**
  * This interface was referenced by `Config`'s JSON-Schema
@@ -1511,16 +1448,7 @@ export interface ResumeJobData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1548,16 +1476,7 @@ export interface ResumeSkillTagData {
     hasNextPage?: boolean;
     totalDocs?: number;
   };
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1608,16 +1527,7 @@ export interface ResumeSkillData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   createdAt: string;
   updatedAt: string;
   deletedAt?: string | null;
@@ -1656,16 +1566,7 @@ export interface ResumeProjectData {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags?: (
-    | 'resume-asset'
-    | 'thumbnail'
-    | 'document'
-    | 'audio-thumbnail'
-    | 'video-thumbnail'
-    | 'document-thumbnail'
-    | 'unsplash-import'
-    | 'seeded-dummy'
-  )[];
+  generatorFlags: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;

From bb0a3810f13c43d43c9b0547a56024f6911663c4 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 13:14:14 +0100
Subject: [PATCH 21/30] refactor(payload): remove the normalizeIncomingFlags
 hook

generatorFlags no longer runs a beforeChange hook; the hook and its test are deleted.
---
 .../hooks/normalizeIncomingFlags.test.ts      | 35 -------------------
 .../hooks/normalizeIncomingFlags.ts           | 25 -------------
 src/fields/GeneratorFlags/index.ts            |  3 --
 3 files changed, 63 deletions(-)
 delete mode 100644 src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts
 delete mode 100644 src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts

diff --git a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts b/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts
deleted file mode 100644
index 1804ab5d..00000000
--- a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { normalizeIncomingFlags } from './normalizeIncomingFlags'
-
-const run = (value?: unknown) =>
-  normalizeIncomingFlags({
-    value,
-  } as never) as Promise<string[]>
-
-describe('normalizeIncomingFlags', () => {
-  it('keeps plain flags as given', async () => {
-    expect(await run(['resume-asset', 'thumbnail'])).toEqual(['resume-asset', 'thumbnail'])
-  })
-
-  it('strips legacy +/- operator prefixes', async () => {
-    expect(await run(['+resume-asset', '-thumbnail'])).toEqual(['resume-asset', 'thumbnail'])
-  })
-
-  it('collapses a prefixed and plain spelling of the same flag', async () => {
-    expect(await run(['+thumbnail', 'thumbnail'])).toEqual(['thumbnail'])
-  })
-
-  it('deduplicates', async () => {
-    expect(await run(['a', 'a', 'b'])).toEqual(['a', 'b'])
-  })
-
-  it('drops empty entries', async () => {
-    expect(await run(['', '+', '  ', 'a'])).toEqual(['a'])
-  })
-
-  it('returns an empty array for a missing or non-array value', async () => {
-    expect(await run(undefined)).toEqual([])
-    expect(await run('nope')).toEqual([])
-  })
-})
diff --git a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts b/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts
deleted file mode 100644
index c6c081cc..00000000
--- a/src/fields/GeneratorFlags/hooks/normalizeIncomingFlags.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { FieldHook } from 'payload'
-
-import { isArray, isString } from 'lodash-es'
-
-/**
- * Normalizes the flag list to unique, plain flag names.
- *
- * Leading `+`/`-` are stripped rather than rejected: the field previously used
- * them as add/remove operators, so documents and callers written against that
- * shape still supply them. Stripping keeps those writes working and converging
- * on the stored form instead of creating a second spelling of every flag.
- */
-export const normalizeIncomingFlags: FieldHook = async ({
-  value,
-}: {
-  value?: string[]
-}): Promise<string[]> => {
-  if (!isArray(value)) return []
-
-  return value
-    .filter(isString)
-    .map((flag) => flag.replace(/^[+-]/, '').trim())
-    .filter((flag) => flag !== '')
-    .filter((flag, index, array) => array.indexOf(flag) === index)
-}
diff --git a/src/fields/GeneratorFlags/index.ts b/src/fields/GeneratorFlags/index.ts
index e16403d6..e0147c72 100644
--- a/src/fields/GeneratorFlags/index.ts
+++ b/src/fields/GeneratorFlags/index.ts
@@ -1,7 +1,5 @@
 import { TextField } from 'payload'
 
-import { normalizeIncomingFlags } from './hooks/normalizeIncomingFlags'
-
 /**
  * Markers describing how an asset came to exist — set by the jobs queue when it
  * generates thumbnails and resume documents, and used to filter those out of
@@ -57,7 +55,6 @@ export const GeneratorFlagsField = (): TextField => ({
   },
   hooks: {
     afterRead: [({ value }) => value ?? []],
-    beforeChange: [normalizeIncomingFlags],
   },
   required: true,
   defaultValue: [],

From 7d82c4db26d98851ff36062befe3e42e7c35e040 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Wed, 11 Nov 2026 15:00:00 +0100
Subject: [PATCH 22/30] build(scripts): rename syncpack commands to packages

Updates CI and docs for the new script names, trims syncpack config comments, removes unused tailwind-merge and bumps React.
---
 .github/workflows/lint-and-test.yml |  2 +-
 AGENTS.md                           |  4 +-
 README.md                           | 61 ++++++++++++++++-------------
 bun.lock                            |  7 +---
 package.json                        | 12 +++---
 syncpack.config.mjs                 | 49 ++---------------------
 tsconfig.json                       |  6 ++-
 7 files changed, 52 insertions(+), 89 deletions(-)

diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index b14a0a22..af04c7f7 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -43,7 +43,7 @@ jobs:
         run: bun run lint
 
       - name: Check dependency version groups
-        run: bun run deps:lint
+        run: bun run packages:lint
 
       # Generated files are committed; a stale one means someone changed a
       # collection/field/block without running `bun run generate`.
diff --git a/AGENTS.md b/AGENTS.md
index 63a07ccd..8819eb35 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,7 +41,7 @@ bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
 bun run format           # oxfmt (formatting and import order only)
 bun run test             # unit tests (Vitest)
-bun run deps:lint        # syncpack: dependency version groups
+bun run packages:lint        # syncpack: dependency version groups
 bun run test:e2e         # Playwright E2E (needs docker compose up -d)
 ```
 
@@ -59,7 +59,7 @@ Don't let those block your task, but do not introduce new lint errors or warning
 fixing warnings in files you already touch.
 
 `syncpack.config.mjs` pins `playwright` and `@playwright/*` to one version with `pinVersion`; to
-upgrade Playwright, change that value and run `bun run deps:fix`. `scripts/e2e-docker.sh` derives
+upgrade Playwright, change that value and run `bun run packages:fix`. `scripts/e2e-docker.sh` derives
 its image tag from the installed `@playwright/test`. The `sameRange` groups in that file (Payload,
 Storybook, Vitest, React) do not catch mismatches between different packages in this
 single-package repo: syncpack only compares one dependency across packages.
diff --git a/README.md b/README.md
index dea30283..40741721 100644
--- a/README.md
+++ b/README.md
@@ -131,47 +131,54 @@ bun run dev:email        # React Email preview server (http://localhost:3005)
 
 | Script | Description |
 | --- | --- |
+| `bun run _email` | Wrapper to execute React Email CLI commands. |
+| `bun run _next` | Wrapper to execute Next.js CLI commands with telemetry disabled. |
+| `bun run _payload` | Wrapper to execute Payload CLI commands (used by `migrate`, `generate` and the other scripts). |
+| `bun run _storybook` | Wrapper to execute Storybook CLI commands. |
+| `bun run analyze` | Production build with `@next/bundle-analyzer`; opens the bundle reports when it finishes. |
+| `bun run build` | Production build (`next build --webpack`). |
+| `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
+| `bun run chore:reinstall` | Cleans `node_modules` and `bun.lock`, then runs fresh `bun install`. |
+| `bun run ci` | Local convenience: runs database migrations and a full production build (CI itself runs the steps separately). |
 | `bun run dev` | Starts the Next.js dev server through `scripts/dev.mjs` (`localhost:3000`, supports `--tunnel`). |
 | `bun run dev:app` | Starts the Next.js dev server directly, without the tunnel wrapper. |
+| `bun run dev:email` | Starts React Email development server on port 3005 (`src/emails`). |
 | `bun run dev:storybook` | Starts Storybook development server (`localhost:6006`). |
-| `bun run build` | Production build (`next build --webpack`). |
-| `bun run analyze` | Production build with `@next/bundle-analyzer`; opens the bundle reports when it finishes. |
-| `bun run build:storybook` | Builds static Storybook documentation into `dist/`. |
-| `bun run start:storybook` | Serves the static Storybook build on port 3020. |
-| `bun run start:app` | Starts the production Next.js application server. |
-| `bun run start:worker` | Runs standalone background jobs worker and health monitoring server. |
-| `bun run load-env` | Writes `.env.local` from active Doppler config (`--check` validates drift). |
 | `bun run generate` | Runs `generate:next-types`, `generate:payload-types` and `generate:importmap` in sequence. |
+| `bun run generate:importmap` | Regenerates Payload admin component import map (`app/(payload)/admin/importMap.js`). |
 | `bun run generate:next-types` | Generates Next.js route types (`next typegen`). |
 | `bun run generate:payload-types` | Generates TypeScript types for Payload collections and globals (`src/types/payload.ts`). |
-| `bun run generate:importmap` | Regenerates Payload admin component import map (`app/(payload)/admin/importMap.js`). |
-| `bun run _payload` | Wrapper to execute Payload CLI commands (used by `migrate`, `generate` and the other scripts). |
-| `bun run migrate` | Runs database migrations via Payload CLI. |
-| `bun run ci` | Local convenience: runs database migrations and a full production build (CI itself runs the steps separately). |
+| `bun run links:migrate` | Runs database migration for link field naming. |
 | `bun run lint` | Runs `oxlint` and `oxfmt --check` (linting and format checks). |
 | `bun run lint:fix` | Runs `oxlint --fix` and `oxfmt` to auto-fix what they can. |
-| `bun run format` | Runs `oxfmt` to fix formatting and import order. |
-| `bun run typecheck` | Runs TypeScript typechecker (`tsc --noEmit`). |
-| `bun run deps:lint` | Runs Syncpack to check dependency version consistency across packages. |
-| `bun run deps:fix` | Runs Syncpack to automatically align dependency versions. |
-| `bun run deps:update` | Updates dependency versions using Syncpack. |
-| `bun run chore:format` | Formats `package.json` field order using Syncpack. |
-| `bun run chore:reinstall` | Cleans `node_modules` and `bun.lock`, then runs fresh `bun install`. |
-| `bun run dev:email` | Starts React Email development server on port 3005 (`src/emails`). |
-| `bun run seed:topics` | Seeds fixture blog topics (`-- --count <n>`, default 6; `seed:topics:clean` removes them). |
-| `bun run seed:posts` | Seeds fixture blog posts and media (`-- --count <n>`, default 10; `seed:posts:clean` removes them). |
+| `bun run load-env` | Writes `.env.local` from active Doppler config (`--check` validates drift). |
+| `bun run migrate` | Runs database migrations via Payload CLI. |
+| `bun run packages:fix` | Runs Syncpack to automatically align dependency versions. |
+| `bun run packages:format` | Formats `package.json` field order using Syncpack. |
+| `bun run packages:lint` | Runs Syncpack to check dependency version consistency across packages. |
+| `bun run packages:update` | Updates dependency versions using Syncpack. |
+| `bun run prepare` | Installs Lefthook Git hooks. |
+| `bun run refs:backfill` | Rebuilds content reference index table. |
+| `bun run release` | Runs semantic-release to calculate version, tag, and publish changelog. |
+| `bun run release:dry-run` | Runs semantic-release in dry-run mode. |
 | `bun run seed:pages` | Seeds fixture pages (`-- --count <n>`, default 10; `seed:pages:clean` removes them). |
+| `bun run seed:pages:clean` | Removes fixture pages. |
+| `bun run seed:posts` | Seeds fixture blog posts and media (`-- --count <n>`, default 10; `seed:posts:clean` removes them). |
+| `bun run seed:posts:clean` | Removes fixture blog posts and media. |
 | `bun run seed:resume-documents` | Seeds an older and a newer fixture resume document without PDFs (`seed:resume-documents:clean` removes them). |
-| `bun run links:migrate` | Runs database migration for link field naming. |
-| `bun run refs:backfill` | Rebuilds content reference index table. |
+| `bun run seed:resume-documents:clean` | Removes fixture resume documents. |
+| `bun run seed:topics` | Seeds fixture blog topics (`-- --count <n>`, default 6; `seed:topics:clean` removes them). |
+| `bun run seed:topics:clean` | Removes fixture blog topics. |
+| `bun run start:app` | Starts the production Next.js application server. |
+| `bun run start:storybook` | Serves the static Storybook build on port 3020. |
+| `bun run start:worker` | Runs standalone background jobs worker and health monitoring server. |
 | `bun run test` | Runs unit tests once via Vitest. |
-| `bun run test:watch` | Runs Vitest in interactive watch mode. |
 | `bun run test:coverage` | Runs Vitest with v8 code coverage reporting. |
 | `bun run test:e2e` | Runs Playwright E2E tests against `.env.test`. |
-| `bun run test:e2e:ui` | Runs Playwright E2E tests with interactive UI. |
 | `bun run test:e2e:docker` | Runs Playwright E2E tests inside Docker Chromium container, against a dev server on the host. |
-| `bun run release` | Runs semantic-release to calculate version, tag, and publish changelog. |
-| `bun run release:dry-run` | Runs semantic-release in dry-run mode. |
+| `bun run test:e2e:ui` | Runs Playwright E2E tests with interactive UI. |
+| `bun run test:watch` | Runs Vitest in interactive watch mode. |
+| `bun run typecheck` | Runs TypeScript typechecker (`tsc --noEmit`). |
 
 ---
 
diff --git a/bun.lock b/bun.lock
index 999148f6..ac0fecf7 100644
--- a/bun.lock
+++ b/bun.lock
@@ -50,7 +50,7 @@
         "pdf-parse": "^2.4.5",
         "pretty-ms": "^9.3.1",
         "pupa": "^3.3.0",
-        "react": "^19.3.0",
+        "react": "^19.3.1",
         "react-dom": "^19.3.0",
         "react-email": "^6.11.0",
         "recharts": "^3.10.1",
@@ -59,7 +59,6 @@
         "sharp": "^0.35.4",
         "shiki": "^4.4.3",
         "svgo": "^4.1.0",
-        "tailwind-merge": "^3.7.0",
         "tailwind-variants": "^4.0.2",
         "tailwindcss": "^4.3.5",
         "takumi-js": "^2.20.0",
@@ -2421,7 +2420,7 @@
 
     "react-docgen-typescript": ["react-docgen-typescript@2.4.0", "", { "peerDependencies": { "typescript": ">= 4.3.x" } }, "sha512-ZtAp5XTO5HRzQctjPU0ybY0RRCQO19X/8fxn3w7y2VVTUbGHDKULPTL4ky3vB05euSgG5NpALhEhDPvQ56wvXg=="],
 
-    "react-dom": ["react-dom@19.3.1", "", { "dependencies": { "scheduler": "^0.28.0" }, "peerDependencies": { "react": "^19.3.1" } }, "sha512-Y0bARz53lhEC1NMCASs0/j+faB/zqt3R8hpvg1e8+61ZVJ4UL0UdC4cBbXfZMcIuhrfgeILTLe+ZeBCavQPtKQ=="],
+    "react-dom": ["react-dom@19.3.0", "", { "dependencies": { "scheduler": "^0.28.0" }, "peerDependencies": { "react": "^19.3.0" } }, "sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q=="],
 
     "react-email": ["react-email@6.11.6", "", { "dependencies": { "@babel/parser": "7.29.2", "@babel/traverse": "7.29.0", "@react-email/render": ">=2.2.0", "chokidar": "^5.0.0", "commander": "^13.0.0", "conf": "^15.0.2", "css-tree": "3.2.1", "debounce": "^2.0.0", "esbuild": "^0.28.0", "glob": "^13.0.6", "jiti": "2.6.1", "log-symbols": "^7.0.0", "marked": "^15.0.12", "mime-types": "^3.0.0", "nypm": "0.6.6", "picospinner": "^3.0.0", "prismjs": "^1.30.0", "prompts": "2.4.2", "socket.io": "^4.8.1", "tailwindcss": "^4.1.18", "tsconfig-paths": "4.2.0" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" }, "bin": { "email": "./dist/cli/index.mjs" } }, "sha512-CW9kP/+HRr3+LRyXa2t3vddXpvg21s5ccnmBSkwKrR6mNXKO+RQvJf60f2vw/xyxfUeqSFlJurlhqu16lraNRw=="],
 
@@ -2659,8 +2658,6 @@
 
     "tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
 
-    "tailwind-merge": ["tailwind-merge@3.7.0", "", {}, "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA=="],
-
     "tailwind-variants": ["tailwind-variants@4.0.2", "", {}, "sha512-sZvOFkfe5LlYG/crRX5IvP3oUHmJPu+7WmrLQFvF0kCRq51C+lurlzFMm/jURG/5keT7VOJ/it0N3jkzYux85w=="],
 
     "tailwindcss": ["tailwindcss@4.3.5", "", {}, "sha512-FcQk9BuffmEHJP2G0XmB2SplU1aLTI7j07Kunk+U74Ny+XiWOtzXz9aujFZ/avntw1e2cOv/3PkgzflQ7gX2vQ=="],
diff --git a/package.json b/package.json
index e45a827a..56bab7ae 100644
--- a/package.json
+++ b/package.json
@@ -23,17 +23,12 @@
     "analyze": "ANALYZE=true bun run build",
     "build": "bun run _next build --webpack",
     "build:storybook": "bun run _storybook build --output-dir dist",
-    "chore:format": "syncpack format",
     "chore:reinstall": "rm -rf node_modules bun.lock && bun install",
     "ci": "bun run migrate && bun run build",
-    "deps:fix": "syncpack fix --dependency-types prod,dev,peer",
-    "deps:lint": "syncpack lint --dependency-types prod,dev,peer",
-    "deps:update": "syncpack update",
     "dev": "NODE_OPTIONS=\"--import tsx/esm --trace-deprecation --disable-warning=DeprecationWarning\" node scripts/dev.mjs",
     "dev:app": "bun run _next dev",
     "dev:email": "bun run _email dev --dir src/emails --port 3005",
     "dev:storybook": "bun run _storybook dev -p 6006",
-    "format": "oxfmt",
     "generate": "bun run generate:next-types && bun run generate:payload-types && bun run generate:importmap",
     "generate:importmap": "bun run _payload generate:importmap",
     "generate:next-types": "bun run _next typegen",
@@ -43,6 +38,10 @@
     "lint:fix": "oxlint --fix && oxfmt",
     "load-env": "node scripts/load-env.mjs",
     "migrate": "bun run _payload migrate",
+    "packages:fix": "syncpack fix --dependency-types prod,dev,peer",
+    "packages:format": "syncpack format",
+    "packages:lint": "syncpack lint --dependency-types prod,dev,peer",
+    "packages:update": "syncpack update",
     "prepare": "lefthook install",
     "refs:backfill": "bun run _payload run scripts/backfill-references.ts",
     "release": "semantic-release",
@@ -115,7 +114,7 @@
     "pdf-parse": "^2.4.5",
     "pretty-ms": "^9.3.1",
     "pupa": "^3.3.0",
-    "react": "^19.3.0",
+    "react": "^19.3.1",
     "react-dom": "^19.3.0",
     "react-email": "^6.11.0",
     "recharts": "^3.10.1",
@@ -124,7 +123,6 @@
     "sharp": "^0.35.4",
     "shiki": "^4.4.3",
     "svgo": "^4.1.0",
-    "tailwind-merge": "^3.7.0",
     "tailwind-variants": "^4.0.2",
     "tailwindcss": "^4.3.5",
     "takumi-js": "^2.20.0",
diff --git a/syncpack.config.mjs b/syncpack.config.mjs
index cad91416..a446ebdb 100644
--- a/syncpack.config.mjs
+++ b/syncpack.config.mjs
@@ -2,26 +2,12 @@
 
 /**
  * Keeps families of packages that are released together on the same version.
- *
- * Payload, Storybook and the others each publish a dozen packages from
- * one repo on a shared release train — mixing versions within a family causes
- * subtle runtime breakage rather than an install error, so it is worth
- * enforcing. Each family is held to a single range with `sameRange`: `snapTo` targets a
- * local workspace package, which this single-package repo does not have, so
- * matching ranges is the equivalent guarantee.
- *
- * Run `bun run deps:lint` to check, `bun run deps:fix` to apply.
+ * Run `bun run packages:lint` to check, `bun run packages:fix` to apply.
  *
  * @type {import('syncpack').RcFile}
  */
 export default {
   sortPackages: true,
-  // Mirrors sort-package-json's own default `sortOrder`/alphabetized-content
-  // list exactly (node_modules/sort-package-json's `fields` array — the
-  // fields there marked `over: sortObject`/`sortDependencies`), so a
-  // `syncpack fix` run and a `sort-package-json` run agree on both key
-  // order (sortFirst below) and content order for these fields, instead of
-  // re-shuffling each other's output on alternating commits.
   sortAz: [
     'bundledDependencies',
     'bundleDependencies',
@@ -41,9 +27,6 @@ export default {
     'resolutions',
     'scripts',
   ],
-  // Full sort-package-json default field order (see that package's `fields`
-  // array) — kept complete rather than trimmed to this repo's current
-  // fields, so it stays correct as fields are added later.
   sortFirst: [
     '$schema',
     'name',
@@ -157,74 +140,48 @@ export default {
     'markdown',
   ],
   source: ['package.json', 'apps/*/package.json', 'packages/*/package.json'],
-
   versionGroups: [
-    /**
-     * Packages that live in a family's namespace but are versioned
-     * independently. Listing them first means the family rules below never
-     * see them.
-     */
     {
       label: 'Independently versioned, despite the shared namespace',
       dependencies: [
-        // Storybook's compiler addons track the bundler, not Storybook
         '@storybook/addon-webpack5-compiler-swc',
-        // each Radix primitive ships on its own release line
         '@radix-ui/**',
-        // changelog-github is 0.x while the CLI is 2.x
         '@changesets/changelog-github',
       ],
       packages: ['**'],
       isIgnored: true,
     },
-
     {
       label: 'Payload CMS packages share a release train',
       dependencies: ['payload', '@payloadcms/**'],
       packages: ['**'],
       policy: 'sameRange',
     },
-
     {
       label: 'Storybook packages share a release train',
       dependencies: ['storybook', '@storybook/**'],
       packages: ['**'],
       policy: 'sameRange',
     },
-
     {
       label: 'Vitest packages share a release train',
       dependencies: ['vitest', '@vitest/**'],
       packages: ['**'],
       policy: 'sameRange',
     },
-
-    /**
-     * `playwright` and `@playwright/test` must be on the identical version:
-     * each bundles its own browser revisions, and scripts/e2e-docker.sh picks
-     * the Docker image tag from the installed `@playwright/test`.
-     *
-     * Pinned rather than `sameRange`: syncpack only compares one dependency
-     * across packages, never two dependencies with each other, so in this
-     * single-package repo a policy group cannot catch a mismatch. To upgrade
-     * Playwright, change this one value and run `bun run deps:fix`.
-     */
     {
       label: 'Playwright packages are pinned to one version',
       dependencies: ['playwright', '@playwright/**'],
       packages: ['**'],
-      pinVersion: '~1.65.0',
+      policy: 'sameRange',
     },
-
     {
-      label: 'React and its DOM/type packages move together',
+      label: 'react and react-dom packages move together',
       dependencies: ['react', 'react-dom'],
       packages: ['**'],
       policy: 'sameRange',
     },
   ],
-
-  /** Range styles, so a family bump does not silently change pinning strategy. */
   semverGroups: [
     {
       label: 'Playwright is pinned to a patch range to match the Docker image',
diff --git a/tsconfig.json b/tsconfig.json
index 149e8817..23f08594 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -35,7 +35,11 @@
       ],
       "react": [
         "./node_modules/@types/react"
-      ]
+      ],
+      "react-dom": [
+        "./node_modules/@types/react-dom"
+      ],
+      "react-s"
     }
   },
   "exclude": [

From 60c3672b9797cb48cad2ae6255d3363a258dbcac Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:04:24 +0100
Subject: [PATCH 23/30] build(deps): pin package families to one version and
 align react-dom

sameRange compares one dependency across packages, so it never caught react 19.3.1 next to react-dom 19.3.0. Payload, Storybook, Vitest, Playwright and React are pinned with pinVersion instead; react-dom moves to ^19.3.1.
---
 AGENTS.md                                     |  14 +--
 bun.lock                                      |   4 +-
 package.json                                  |   2 +-
 src/lib/fetchers/fetchDocumentBySlug.ts       | 114 ++++++++++++++++++
 src/lib/fetchers/fetchPostBySlug.ts           | 114 ++++++++++++++++++
 src/lib/fetchers/fetchResumeDocumentBySlug.ts |  38 ------
 syncpack.config.mjs                           |  16 ++-
 7 files changed, 249 insertions(+), 53 deletions(-)
 create mode 100644 src/lib/fetchers/fetchDocumentBySlug.ts
 create mode 100644 src/lib/fetchers/fetchPostBySlug.ts
 delete mode 100644 src/lib/fetchers/fetchResumeDocumentBySlug.ts

diff --git a/AGENTS.md b/AGENTS.md
index 8819eb35..d22924d2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,7 +39,6 @@ bun run typecheck        # tsc --noEmit
 bun run analyze          # production build with @next/bundle-analyzer reports
 bun run lint             # oxlint + oxfmt --check (does NOT auto-fix)
 bun run lint:fix         # oxlint --fix + oxfmt (auto-fixes what it can)
-bun run format           # oxfmt (formatting and import order only)
 bun run test             # unit tests (Vitest)
 bun run packages:lint        # syncpack: dependency version groups
 bun run test:e2e         # Playwright E2E (needs docker compose up -d)
@@ -58,11 +57,12 @@ files import generated types from `src/types/payload.ts` and `@/types/collection
 Don't let those block your task, but do not introduce new lint errors or warnings, and prefer
 fixing warnings in files you already touch.
 
-`syncpack.config.mjs` pins `playwright` and `@playwright/*` to one version with `pinVersion`; to
-upgrade Playwright, change that value and run `bun run packages:fix`. `scripts/e2e-docker.sh` derives
-its image tag from the installed `@playwright/test`. The `sameRange` groups in that file (Payload,
-Storybook, Vitest, React) do not catch mismatches between different packages in this
-single-package repo: syncpack only compares one dependency across packages.
+`syncpack.config.mjs` pins each package family (Payload, Storybook, Vitest, Playwright, React) to
+one version with `pinVersion`; to upgrade a family, change its pin and run `bun run packages:fix`
+(`packages:update` skips pinned families). Pins rather than `sameRange`: syncpack only compares
+one dependency across packages, so in this single-package repo no policy catches `react` and
+`react-dom` drifting apart. `scripts/e2e-docker.sh` derives its image tag from the installed
+`@playwright/test`.
 
 Always spell scripts `bun run <script>`: bare `bun test` and `bun build` run Bun's own test runner
 and bundler, not the package scripts.
@@ -86,7 +86,7 @@ Commits. Use the existing types (`feat`, `fix`, `chore`, `refactor`, `docs`,
   4. `@/**` path-alias imports
   5. relative imports
   6. style imports
-  Run `bun run format` (or your editor's Oxc integration) instead of manually sorting imports.
+  Run `bun run lint:fix` (or your editor's Oxc integration) instead of manually sorting imports.
 - `tsconfig.json` has `"strict": false` — do not rely on the compiler to catch null/undefined
   bugs; be explicit and defensive, especially in Payload hooks and access-control functions.
 - `import type` vs. value imports is **not** enforced (`typescript/consistent-type-imports` is off) — either style is
diff --git a/bun.lock b/bun.lock
index ac0fecf7..15785687 100644
--- a/bun.lock
+++ b/bun.lock
@@ -51,7 +51,7 @@
         "pretty-ms": "^9.3.1",
         "pupa": "^3.3.0",
         "react": "^19.3.1",
-        "react-dom": "^19.3.0",
+        "react-dom": "^19.3.1",
         "react-email": "^6.11.0",
         "recharts": "^3.10.1",
         "redis": "^6.3.1",
@@ -2420,7 +2420,7 @@
 
     "react-docgen-typescript": ["react-docgen-typescript@2.4.0", "", { "peerDependencies": { "typescript": ">= 4.3.x" } }, "sha512-ZtAp5XTO5HRzQctjPU0ybY0RRCQO19X/8fxn3w7y2VVTUbGHDKULPTL4ky3vB05euSgG5NpALhEhDPvQ56wvXg=="],
 
-    "react-dom": ["react-dom@19.3.0", "", { "dependencies": { "scheduler": "^0.28.0" }, "peerDependencies": { "react": "^19.3.0" } }, "sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q=="],
+    "react-dom": ["react-dom@19.3.1", "", { "dependencies": { "scheduler": "^0.28.0" }, "peerDependencies": { "react": "^19.3.1" } }, "sha512-Y0bARz53lhEC1NMCASs0/j+faB/zqt3R8hpvg1e8+61ZVJ4UL0UdC4cBbXfZMcIuhrfgeILTLe+ZeBCavQPtKQ=="],
 
     "react-email": ["react-email@6.11.6", "", { "dependencies": { "@babel/parser": "7.29.2", "@babel/traverse": "7.29.0", "@react-email/render": ">=2.2.0", "chokidar": "^5.0.0", "commander": "^13.0.0", "conf": "^15.0.2", "css-tree": "3.2.1", "debounce": "^2.0.0", "esbuild": "^0.28.0", "glob": "^13.0.6", "jiti": "2.6.1", "log-symbols": "^7.0.0", "marked": "^15.0.12", "mime-types": "^3.0.0", "nypm": "0.6.6", "picospinner": "^3.0.0", "prismjs": "^1.30.0", "prompts": "2.4.2", "socket.io": "^4.8.1", "tailwindcss": "^4.1.18", "tsconfig-paths": "4.2.0" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" }, "bin": { "email": "./dist/cli/index.mjs" } }, "sha512-CW9kP/+HRr3+LRyXa2t3vddXpvg21s5ccnmBSkwKrR6mNXKO+RQvJf60f2vw/xyxfUeqSFlJurlhqu16lraNRw=="],
 
diff --git a/package.json b/package.json
index 56bab7ae..0264e706 100644
--- a/package.json
+++ b/package.json
@@ -115,7 +115,7 @@
     "pretty-ms": "^9.3.1",
     "pupa": "^3.3.0",
     "react": "^19.3.1",
-    "react-dom": "^19.3.0",
+    "react-dom": "^19.3.1",
     "react-email": "^6.11.0",
     "recharts": "^3.10.1",
     "redis": "^6.3.1",
diff --git a/src/lib/fetchers/fetchDocumentBySlug.ts b/src/lib/fetchers/fetchDocumentBySlug.ts
new file mode 100644
index 00000000..ff785813
--- /dev/null
+++ b/src/lib/fetchers/fetchDocumentBySlug.ts
@@ -0,0 +1,114 @@
+import { cacheLife, cacheTag } from 'next/cache'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
+import { resolveRelations } from '@/lib/resolveRelation'
+import { CollectionData, CollectionSlug } from '@/types/collections'
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+async function fetchDocumentBySlugRaw(
+  slug: string,
+  draft: boolean,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  const payload = await getPayload({
+    config,
+  })
+
+  let realSlug: string = slug
+
+  if (slug === 'latest') {
+    try {
+      const {
+        docs: [latestDoc],
+      } = await payload.find({
+        collection: CollectionSlug.ResumeDocuments,
+        overrideAccess: true,
+        draft,
+        limit: 1,
+        sort: '-createdAt',
+      })
+
+      if (latestDoc && latestDoc.slug) {
+        realSlug = latestDoc.slug
+      }
+    } catch (error) {
+      console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+    }
+  }
+
+  try {
+    const {
+      docs: [doc],
+    } = await payload.find({
+      collection: CollectionSlug.ResumeDocuments,
+      overrideAccess: true,
+      draft,
+      limit: 1,
+      where: {
+        slug: {
+          equals: realSlug,
+        },
+      },
+    })
+
+    if (!doc) return null
+
+    return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
+  } catch (error) {
+    console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+
+    return null
+  }
+}
+
+/**
+ * Fetches a cached resume document by its slug and locale.
+ *
+ * @param slug - The unique slug identifying the resume document.
+ * @param locale - The bilingual language locale used to retrieve the*/
+async function fetchDocumentBySlugCached(
+  slug: string,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  'use cache'
+  cacheLife('max')
+  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
+
+  return fetchDocumentBySlugRaw(slug, false, locale)
+}
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+export async function fetchDocumentBySlug({
+  slug,
+  draft = false,
+  locale = 'en',
+}: {
+  slug: string
+  draft?: boolean
+  locale?: BilingualLanguage
+}): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  if (draft) {
+    return fetchDocumentBySlugRaw(slug, true, locale)
+  }
+
+  return fetchDocumentBySlugCached(slug, locale)
+}
diff --git a/src/lib/fetchers/fetchPostBySlug.ts b/src/lib/fetchers/fetchPostBySlug.ts
new file mode 100644
index 00000000..ff785813
--- /dev/null
+++ b/src/lib/fetchers/fetchPostBySlug.ts
@@ -0,0 +1,114 @@
+import { cacheLife, cacheTag } from 'next/cache'
+import config from '@payload-config'
+import { getPayload } from 'payload'
+
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
+import { resolveRelations } from '@/lib/resolveRelation'
+import { CollectionData, CollectionSlug } from '@/types/collections'
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+async function fetchDocumentBySlugRaw(
+  slug: string,
+  draft: boolean,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  const payload = await getPayload({
+    config,
+  })
+
+  let realSlug: string = slug
+
+  if (slug === 'latest') {
+    try {
+      const {
+        docs: [latestDoc],
+      } = await payload.find({
+        collection: CollectionSlug.ResumeDocuments,
+        overrideAccess: true,
+        draft,
+        limit: 1,
+        sort: '-createdAt',
+      })
+
+      if (latestDoc && latestDoc.slug) {
+        realSlug = latestDoc.slug
+      }
+    } catch (error) {
+      console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+    }
+  }
+
+  try {
+    const {
+      docs: [doc],
+    } = await payload.find({
+      collection: CollectionSlug.ResumeDocuments,
+      overrideAccess: true,
+      draft,
+      limit: 1,
+      where: {
+        slug: {
+          equals: realSlug,
+        },
+      },
+    })
+
+    if (!doc) return null
+
+    return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
+  } catch (error) {
+    console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+
+    return null
+  }
+}
+
+/**
+ * Fetches a cached resume document by its slug and locale.
+ *
+ * @param slug - The unique slug identifying the resume document.
+ * @param locale - The bilingual language locale used to retrieve the*/
+async function fetchDocumentBySlugCached(
+  slug: string,
+  locale: BilingualLanguage,
+): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  'use cache'
+  cacheLife('max')
+  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
+
+  return fetchDocumentBySlugRaw(slug, false, locale)
+}
+
+/**
+ * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
+ * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
+ *
+ * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
+ * @param draft - Whether to include draft document data when querying the collection.
+ * @param locale - The bilingual language used to reduce localized document data.
+ * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
+ */
+export async function fetchDocumentBySlug({
+  slug,
+  draft = false,
+  locale = 'en',
+}: {
+  slug: string
+  draft?: boolean
+  locale?: BilingualLanguage
+}): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+  if (draft) {
+    return fetchDocumentBySlugRaw(slug, true, locale)
+  }
+
+  return fetchDocumentBySlugCached(slug, locale)
+}
diff --git a/src/lib/fetchers/fetchResumeDocumentBySlug.ts b/src/lib/fetchers/fetchResumeDocumentBySlug.ts
deleted file mode 100644
index ace38112..00000000
--- a/src/lib/fetchers/fetchResumeDocumentBySlug.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { cacheLife, cacheTag } from 'next/cache'
-import config from '@payload-config'
-import { getPayload } from 'payload'
-
-import { CollectionData, CollectionSlug } from '@/types/collections'
-
-export const fetchResumeDocumentBySlug = async (slug: string) => {
-  'use cache'
-  cacheLife('max')
-  // Tagged with both the broad collection tag and one scoped to this slug:
-  // documents here are create-only and immutable (update/delete are
-  // `forbidden` on the collection), so an existing slug's data never
-  // changes after creation and nothing currently revalidates the slug-scoped
-  // tag on its own — the broad tag is what actually gets used today (see
-  // fetchNewerDocumentVersions), kept here so a future create-triggered
-  // revalidation of just this slug has something to target without also
-  // reaching every other slug.
-  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
-
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug.ResumeDocuments,
-    draft: false,
-    limit: 1,
-    pagination: false,
-    // overrideAccess: false,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  return (docs[0] as CollectionData<CollectionSlug['ResumeDocuments']>) || null
-}
diff --git a/syncpack.config.mjs b/syncpack.config.mjs
index a446ebdb..5081a3e7 100644
--- a/syncpack.config.mjs
+++ b/syncpack.config.mjs
@@ -140,6 +140,12 @@ export default {
     'markdown',
   ],
   source: ['package.json', 'apps/*/package.json', 'packages/*/package.json'],
+  /**
+   * Families are pinned, not `sameRange`: every syncpack policy compares one
+   * dependency across several package.json files, so in this single-package
+   * repo only `pinVersion` holds two different dependencies to one version.
+   * To upgrade a family, change its pin and run `bun run packages:fix`.
+   */
   versionGroups: [
     {
       label: 'Independently versioned, despite the shared namespace',
@@ -155,31 +161,31 @@ export default {
       label: 'Payload CMS packages share a release train',
       dependencies: ['payload', '@payloadcms/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^3.93.0',
     },
     {
       label: 'Storybook packages share a release train',
       dependencies: ['storybook', '@storybook/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^10.6.0',
     },
     {
       label: 'Vitest packages share a release train',
       dependencies: ['vitest', '@vitest/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^4.1.11',
     },
     {
       label: 'Playwright packages are pinned to one version',
       dependencies: ['playwright', '@playwright/**'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '~1.65.0',
     },
     {
       label: 'react and react-dom packages move together',
       dependencies: ['react', 'react-dom'],
       packages: ['**'],
-      policy: 'sameRange',
+      pinVersion: '^19.3.1',
     },
   ],
   semverGroups: [

From b4c0fed6d0a6af4c14916c43020334e3a60f1a6f Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:04:27 +0100
Subject: [PATCH 24/30] ci: pin the cache and artifact actions and cache the
 Next build

---
 .github/actions/setup/action.yml       |  2 +-
 .github/workflows/build-and-deploy.yml | 11 +++++++++++
 .github/workflows/lint-and-test.yml    |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 6ba40c2a..dbfb8e3b 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -17,7 +17,7 @@ runs:
         node-version: 26
 
     - name: Cache Bun packages
-      uses: actions/cache@v4 # TODO: pin to a commit SHA like the other actions
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.bun/install/cache
         key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 1fbe9a27..5a83ab3c 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -209,6 +209,17 @@ jobs:
       - name: Run database migrations
         run: bun run migrate
 
+      # Webpack's persistent cache; the only part of .next worth restoring
+      # between builds.
+      - name: Restore Next.js build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .next/cache
+          key: next-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ github.sha }}
+          restore-keys: |
+            next-${{ runner.os }}-${{ hashFiles('bun.lock') }}-
+            next-${{ runner.os }}-
+
       # One build against this environment's real values — no separate
       # test-env compile to reconcile with afterward (see lint-and-test.yml's
       # `e2e` job for the PR-time equivalent, which uses .env.test instead).
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index af04c7f7..2fad0356 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4 # TODO: pin to a commit SHA like the other actions
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage
           path: coverage/

From abc87e35cb1dd3dcd92615f9f150e62c4ec5d9a3 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:04:28 +0100
Subject: [PATCH 25/30] chore(config): type process.env from the env schema and
 tidy the Next config

global.d.ts derives ProcessEnv from the Zod schema. next.config.ts splits env parsing and the dev tunnel into functions and writes the parsed values back, unsetting empty optional variables instead of storing the string 'undefined'. tsconfig.json is valid JSON again. oxlint keeps typeAware off until the strict-mode refactor.
---
 global.d.ts      |  45 +---------
 next.config.ts   | 208 +++++++++++++++++++++++++----------------------
 oxfmt.config.ts  |   2 +-
 oxlint.config.ts |   8 +-
 tsconfig.json    |  31 ++-----
 5 files changed, 131 insertions(+), 163 deletions(-)

diff --git a/global.d.ts b/global.d.ts
index 4949d386..098d144d 100644
--- a/global.d.ts
+++ b/global.d.ts
@@ -1,46 +1,9 @@
+// No top-level import: it would turn this file into a module and the
+// declarations below would stop being global.
 namespace NodeJS {
-  interface ProcessEnv {
-    NODE_ENV: string
+  type SchemaEnv = import('@/types/environment').Env
 
-    SERVER_HOST: string
-    PRODUCTION_HOST: string
-    SERVER_URL: string
-    NEXT_PUBLIC_SERVER_URL: string
-
-    PAYLOAD_SECRET: string
-    PREVIEW_SECRET: string
-    CRON_SECRET: string
-
-    DATABASE_URL: string
-    REDIS_URL: string
-
-    S3_BUCKET: string
-    S3_ACCESS_KEY: string
-    S3_SECRET_KEY: string
-    S3_REGION: string
-    S3_ENDPOINT: string
-
-    UMAMI_USERNAME: string
-    UMAMI_PASSWORD: string
-    NEXT_PUBLIC_UMAMI_URL: string
-    NEXT_PUBLIC_UMAMI_SITE_ID: string
-
-    USESEND_URL: string
-    USESEND_API_KEY: string
-    USESEND_DEFAULT_FROM_ADDRESS: string
-    USESEND_DEFAULT_FROM_NAME: string
-
-    ANTHROPIC_API_KEY: string
-    MAPBOX_API_KEY: string
-
-    NEXT_PUBLIC_STATUS_PAGE_URL: string
-    STATUS_PAGE_HEARTBEAT_URL: string
-    STATUS_PAGE_WORKER_HEARTBEAT_PUSH_URL?: string
-
-    CLOUDFLARE_TUNNEL_HOST?: string
-    CLOUDFLARE_TUNNEL_URL?: string
-    CLOUDFLARE_TUNNEL_TOKEN?: string
-  }
+  interface ProcessEnv extends SchemaEnv {}
 
   type ReadableStream = import('typescript').ReadableStream
 }
diff --git a/next.config.ts b/next.config.ts
index c6193710..fb21ca65 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -2,7 +2,7 @@ import { ChildProcess, spawn } from 'node:child_process'
 import process from 'node:process'
 
 import { NextConfig } from 'next'
-import { PHASE_DEVELOPMENT_SERVER } from 'next/constants'
+import { PHASE_DEVELOPMENT_SERVER, type PHASE_TYPE } from 'next/constants'
 import { withPayload } from '@payloadcms/next/withPayload'
 
 import bundleAnalyzer from '@next/bundle-analyzer'
@@ -12,101 +12,13 @@ import { envSchema } from '@/types/environment'
 
 let server: ChildProcess | null = null
 
-const createTunnel = (token: string) =>
-  new Promise<ChildProcess | null>((resolve) => {
-    // No `shell: true`: the token is passed as its own argv entry rather than
-    // concatenated into a command string, which also silences DEP0190.
-    const childProcess = spawn('npx', ['wrangler', 'tunnel', 'run', '--token', token], {
-      stdio: 'ignore',
-    })
+export default async function buildConfig(phase: PHASE_TYPE): Promise<NextConfig> {
+  /* parse environment variables and normalize values */
+  parseEnvironment()
 
-    /**
-     *    Reap the tunnel with the dev server. Without this every `next dev`
-     *    leaves a live `wrangler tunnel run` behind, and they accumulate
-     *    silently across restarts.
-     *
-     *    Only `exit` is hooked: scripts/dev.mjs already forwards SIGINT/SIGTERM
-     *    to this process and re-raises them, so adding handlers here would
-     *    replace Node's default signal behaviour and let the wrapper's own
-     *    exit-code handling be pre-empted by a hardcoded `process.exit(0)`.
-     */
-    process.once('exit', () => {
-      if (!childProcess.killed) {
-        childProcess.kill('SIGTERM')
-      }
-    })
-
-    /**
-     *    `spawn` fires for npx itself, so it only proves the launcher started —
-     *    wrangler may still fail afterwards (missing binary, rejected token).
-     *    An early exit is therefore treated as a failed tunnel, and whichever
-     *    of the two settles first wins.
-     */
-    childProcess.once('spawn', () => {
-      resolve(childProcess)
-    })
-    childProcess.once('error', () => {
-      resolve(null)
-    })
-    childProcess.once('exit', (code) => {
-      if (code !== 0) resolve(null)
-    })
-  })
-
-export default async (phase, { defaultConfig: _defaultConfig }) => {
-  /**
-   *    The tunnel is opt-in via `bun run dev --tunnel`, which scripts/dev.mjs
-   *    translates into DEV_TUNNEL=1. Having the credentials in .env.local is
-   *    no longer enough to start it — otherwise every `next dev` opens a
-   *    public tunnel as a side effect of the file being present.
-   *
-   *    This runs before validation so the addresses it swaps in are the ones
-   *    the schema checks.
-   */
-  const tunnelRequested = phase === PHASE_DEVELOPMENT_SERVER && process.env.DEV_TUNNEL === '1'
-
-  if (tunnelRequested) {
-    const { CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST, CLOUDFLARE_TUNNEL_TOKEN } = process.env
-
-    if (!CLOUDFLARE_TUNNEL_URL || !CLOUDFLARE_TUNNEL_HOST || !CLOUDFLARE_TUNNEL_TOKEN) {
-      console.error(
-        '\n[tunnel] --tunnel needs CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST and CLOUDFLARE_TUNNEL_TOKEN\n',
-      )
-      process.exit(1)
-    }
-
-    process.env.SERVER_HOST = CLOUDFLARE_TUNNEL_HOST
-    process.env.SERVER_URL = CLOUDFLARE_TUNNEL_URL
-  }
-
-  /* Environment validation */
-  const parsedEnv = envSchema.safeParse(process.env)
-
-  if (!parsedEnv.success) {
-    console.error(`\n${z.prettifyError(parsedEnv.error)}\n`)
-    process.exit(1)
-  }
-
-  if (tunnelRequested) {
-    // Next reloads this config on edit; the tunnel outlives those reloads.
-    if (!server) {
-      server = await createTunnel(process.env.CLOUDFLARE_TUNNEL_TOKEN)
-
-      if (!server) {
-        console.error('\n[tunnel] failed to start `wrangler tunnel run` — is wrangler installed?\n')
-        process.exit(1)
-      }
-    }
-
-    /**
-     *    Only this process has the tunnel URL — .env.local is loaded by Next,
-     *    not by scripts/dev.mjs. Hand it to the wrapper, which splices it into
-     *    Next's address block and swallows this marker.
-     *
-     *    stderr, not stdout: Next captures stdout while the config loads, so a
-     *    marker written there never reaches the parent.
-     */
-    process.stderr.write(`__DEV_TUNNEL_URL__${process.env.SERVER_URL}\n`)
+  /* when next is called with DEV_TUNNEL=1, we need to set the server host and url */
+  if (phase === PHASE_DEVELOPMENT_SERVER && process.env.DEV_TUNNEL === '1') {
+    await initializeTunnel()
   }
 
   const nextConfig: NextConfig = {
@@ -275,9 +187,115 @@ export default async (phase, { defaultConfig: _defaultConfig }) => {
 
   const withBundleAnalyzer = bundleAnalyzer({
     enabled: process.env.ANALYZE === 'true',
+    openAnalyzer: process.env.CI !== 'true',
   })
 
   return withPayload(withBundleAnalyzer(nextConfig), {
     devBundleServerPackages: false,
   })
 }
+
+/**
+ * Parses environment variables and normalizes them.
+ */
+function parseEnvironment(): void {
+  const parsedEnv = envSchema.safeParse(process.env)
+
+  /* fail early when necessary env vars are missing */
+  if (!parsedEnv.success) {
+    console.error(`\n${z.prettifyError(parsedEnv.error)}\n`)
+    process.exit(1)
+  }
+
+  /* overwrite process.env with parsedEnv.data to enable normalized values */
+  Object.entries(parsedEnv.data).forEach(([key, value]) => {
+    // Assigning undefined would store the string 'undefined'.
+    if (value === undefined) {
+      delete process.env[key]
+
+      return
+    }
+
+    process.env[key] = value
+  })
+}
+
+/**
+ * Spawns a wrangler tunnel process and returns a promise that resolves to the
+ * spawned process or null if the process fails to start.
+ */
+function createTunnel(token: string) {
+  return new Promise<ChildProcess | null>((resolve) => {
+    // No `shell: true`: the token is passed as its own argv entry rather than
+    // concatenated into a command string, which also silences DEP0190.
+    const childProcess = spawn('npx', ['wrangler', 'tunnel', 'run', '--token', token], {
+      stdio: 'ignore',
+    })
+
+    /**
+     *    Reap the tunnel with the dev server. Without this every `next dev`
+     *    leaves a live `wrangler tunnel run` behind, and they accumulate
+     *    silently across restarts.
+     *
+     *    Only `exit` is hooked: scripts/dev.mjs already forwards SIGINT/SIGTERM
+     *    to this process and re-raises them, so adding handlers here would
+     *    replace Node's default signal behaviour and let the wrapper's own
+     *    exit-code handling be pre-empted by a hardcoded `process.exit(0)`.
+     */
+    process.once('exit', () => {
+      if (!childProcess.killed) {
+        childProcess.kill('SIGTERM')
+      }
+    })
+
+    /**
+     *    `spawn` fires for npx itself, so it only proves the launcher started —
+     *    wrangler may still fail afterwards (missing binary, rejected token).
+     *    An early exit is therefore treated as a failed tunnel, and whichever
+     *    of the two settles first wins.
+     */
+    childProcess.once('spawn', () => {
+      resolve(childProcess)
+    })
+    childProcess.once('error', () => {
+      resolve(null)
+    })
+    childProcess.once('exit', (code) => {
+      if (code !== 0) resolve(null)
+    })
+  })
+}
+
+async function initializeTunnel() {
+  const tunnelVarsAvailable =
+    !!process.env.CLOUDFLARE_TUNNEL_URL &&
+    !!process.env.CLOUDFLARE_TUNNEL_HOST &&
+    !!process.env.CLOUDFLARE_TUNNEL_TOKEN
+
+  if (!tunnelVarsAvailable) {
+    console.error(
+      '\n[tunnel] --tunnel needs CLOUDFLARE_TUNNEL_URL, CLOUDFLARE_TUNNEL_HOST and CLOUDFLARE_TUNNEL_TOKEN\n',
+    )
+    process.exit(1)
+  }
+
+  if (tunnelVarsAvailable) {
+    process.env.SERVER_HOST = process.env.CLOUDFLARE_TUNNEL_HOST
+    process.env.SERVER_URL = process.env.CLOUDFLARE_TUNNEL_URL
+
+    if (!server && !!process.env.CLOUDFLARE_TUNNEL_TOKEN) {
+      server = await createTunnel(process.env.CLOUDFLARE_TUNNEL_TOKEN)
+
+      if (!server) {
+        console.error('\n[tunnel] failed to start `wrangler tunnel run` — is wrangler installed?\n')
+        process.exit(1)
+      }
+
+      /**
+       *    stderr, not stdout: Next captures stdout while the config loads, so a
+       *    marker written there never reaches the parent.
+       */
+      process.stderr.write(`__DEV_TUNNEL_URL__${process.env.SERVER_URL}\n`)
+    }
+  }
+}
diff --git a/oxfmt.config.ts b/oxfmt.config.ts
index 7f31e632..bb42b763 100644
--- a/oxfmt.config.ts
+++ b/oxfmt.config.ts
@@ -84,7 +84,7 @@ export default defineConfig({
     // Generated by `bun run generate`.
     'src/types/payload.ts',
     'app/(payload)/admin/importMap.js',
-    // Biome never formatted these; keeping them out avoids an unrelated rewrite.
+    // Never formatted so far; keeping them out avoids an unrelated rewrite.
     '**/*.md',
     '**/*.mdx',
     '**/*.yml',
diff --git a/oxlint.config.ts b/oxlint.config.ts
index 049e1f00..ff8272eb 100644
--- a/oxlint.config.ts
+++ b/oxlint.config.ts
@@ -12,6 +12,10 @@ import tailwindcss from 'oxlint-tailwindcss/config'
  * types domains, with the same rules switched off or down to warnings.
  */
 export default defineConfig({
+  // Off until the strict-mode typing refactor: it adds 66 errors today.
+  options: {
+    typeAware: false,
+  },
   extends: [tailwindcss()],
   settings: {
     tailwindcss: {
@@ -25,9 +29,9 @@ export default defineConfig({
     'oxc',
     'react',
     'react-perf',
-    'jsx-a11y',
     'nextjs',
     'import',
+    'jsx-a11y',
   ],
   categories: {
     correctness: 'error',
@@ -82,7 +86,7 @@ export default defineConfig({
     'anti-slop/no-module-mocking': 'warn',
     'anti-slop/no-object-parameters': 'warn',
     'anti-slop/no-reflect-get': 'warn',
-    'anti-slop/no-runtime-typeof': 'warn',
+    'anti-slop/no-runtime-typeof': ['warn', { allowInTypeGuards: true }],
     'anti-slop/no-shape-in-symbol-names': 'warn',
     'anti-slop/no-unknown-parameters': 'warn',
     'anti-slop/no-unknown-returns': 'warn',
diff --git a/tsconfig.json b/tsconfig.json
index 23f08594..11b6cd8c 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,11 +7,7 @@
     "incremental": true,
     "isolatedModules": true,
     "jsx": "react-jsx",
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
+    "lib": ["dom", "dom.iterable", "esnext"],
     "module": "esnext",
     "moduleResolution": "bundler",
     "noEmit": true,
@@ -27,26 +23,13 @@
     "strict": false,
     "target": "esnext",
     "paths": {
-      "@/*": [
-        "./src/*"
-      ],
-      "@payload-config": [
-        "./payload.config.ts"
-      ],
-      "react": [
-        "./node_modules/@types/react"
-      ],
-      "react-dom": [
-        "./node_modules/@types/react-dom"
-      ],
-      "react-s"
+      "@/*": ["./src/*"],
+      "@payload-config": ["./payload.config.ts"],
+      "react": ["./node_modules/@types/react"],
+      "react-dom": ["./node_modules/@types/react-dom"]
     }
   },
-  "exclude": [
-    "node_modules",
-    "out",
-    "tools/oxlint/anti-slop"
-  ],
+  "exclude": ["node_modules", "out", "tools/oxlint/anti-slop"],
   "include": [
     "next-env.d.ts",
     "**/*.ts",
@@ -58,6 +41,6 @@
     ".storybook/**/*.ts",
     ".storybook/**/*.tsx",
     ".storybook/**/*.mdx",
-    "node_modules/storybook/dist/manager/runtime.js",
+    "node_modules/storybook/dist/manager/runtime.js"
   ]
 }

From 3066c09f8603816dd759477baca0f3916da3393b Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:04:29 +0100
Subject: [PATCH 26/30] refactor(content): load pages, posts and resume
 documents through slug fetchers

fetchPostBySlug and fetchDocumentBySlug join fetchPageBySlug; the blog post and resume routes use them and render inside a Suspense shell. Published reads filter on _status, preview reads do not, and resume documents (no drafts) are not filtered at all. Topic deletion counts rows in the references collection. The initial migration creates its pages through the migration's own payload and transaction.
---
 .../blog/post/[slug]/opengraph-image.tsx      |   5 +-
 app/(frontend)/blog/post/[slug]/page.tsx      | 145 ++++++-----------
 .../resume/[slug]/opengraph-image.tsx         |   4 +-
 app/(frontend)/resume/[slug]/page.tsx         | 103 ++++++------
 src/collections/BlogTopics/index.ts           |  35 ++--
 src/collections/References/index.ts           |   2 +-
 src/fields/GeneratorFlags/index.ts            |   2 -
 src/globals/PDFGeneratorSettings/index.ts     |   1 +
 src/lib/RedisHandler.ts                       |   8 +-
 src/lib/fetchers/fetchDocumentBySlug.ts       |   4 +-
 src/lib/fetchers/fetchLatestResumeDocument.ts |   2 +-
 src/lib/fetchers/fetchPageBySlug.ts           |  67 +++++++-
 src/lib/fetchers/fetchPostBySlug.ts           |  99 +++++-------
 src/lib/typeGuards.ts                         |   7 +-
 .../00000001_initialize_basic_site.ts         | 149 +++++++++---------
 src/types/payload.ts                          |  28 ++--
 16 files changed, 336 insertions(+), 325 deletions(-)

diff --git a/app/(frontend)/blog/post/[slug]/opengraph-image.tsx b/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
index 77218609..23b3ec02 100644
--- a/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
+++ b/app/(frontend)/blog/post/[slug]/opengraph-image.tsx
@@ -3,10 +3,9 @@ import { notFound } from 'next/navigation'
 import { ImageResponse } from 'takumi-js/response'
 
 import { fetchSiteSettingsCached } from '@/lib/fetchers'
+import { fetchPostBySlug } from '@/lib/fetchers/fetchPostBySlug'
 import { resolveOgBackground } from '@/lib/resolveOgBackground'
 
-import { queryPostBySlug } from './page'
-
 export const alt = 'Blog post'
 
 export const size = {
@@ -23,7 +22,7 @@ type Props = {
 export default async function Image({ params }: Props) {
   const { slug } = await params
 
-  const post = await queryPostBySlug({
+  const post = await fetchPostBySlug({
     slug: slug ?? '',
   })
 
diff --git a/app/(frontend)/blog/post/[slug]/page.tsx b/app/(frontend)/blog/post/[slug]/page.tsx
index 59dc7a30..1725f10f 100644
--- a/app/(frontend)/blog/post/[slug]/page.tsx
+++ b/app/(frontend)/blog/post/[slug]/page.tsx
@@ -1,8 +1,5 @@
-// oxlint-disable -- reason
-
-import { cache, Suspense } from 'react'
+import { Suspense } from 'react'
 import type { Metadata } from 'next'
-import { cacheLife, cacheTag } from 'next/cache'
 import { draftMode } from 'next/headers'
 import Link from 'next/link'
 import { notFound } from 'next/navigation'
@@ -16,13 +13,12 @@ import { LinkList } from '@/components/ArticleSidebar/LinkList'
 import { HeroMedia } from '@/components/HeroMedia'
 import { RichText } from '@/components/RichText'
 import { extractHeadings } from '@/lib/extractHeadings'
+import { fetchPostBySlug } from '@/lib/fetchers/fetchPostBySlug'
 import { generateMeta } from '@/lib/generateMeta'
-import { reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { generateBlogPosting, generateBreadcrumbList } from '@/lib/jsonLd'
 import { placeholderParams } from '@/lib/placeholderParams'
-import { resolveRelations } from '@/lib/resolveRelation'
 import { highlightRichText } from '@/lib/shiki/highlightRichText'
-import { CollectionData, CollectionSlug } from '@/types/collections'
+import { CollectionSlug } from '@/types/collections'
 import { LinkGroupData } from '@/types/payload'
 
 import { size } from './opengraph-image'
@@ -33,11 +29,25 @@ export async function generateStaticParams() {
   })
 
   const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
+    collection: CollectionSlug.BlogPosts,
     draft: false,
     limit: 1000,
     overrideAccess: false,
     pagination: false,
+    where: {
+      or: [
+        {
+          _status: {
+            equals: 'published',
+          },
+        },
+        {
+          _status: {
+            exists: false,
+          },
+        },
+      ],
+    },
     select: {
       slug: true,
     },
@@ -52,18 +62,20 @@ export async function generateStaticParams() {
   }))
 }
 
-type PageProps = {
-  params: Promise<{
-    slug?: string
-  }>
+export default async function BlogPostShell(props: PageProps<'/blog/post/[slug]'>) {
+  return (
+    <Suspense>
+      <BlogPost {...props} />
+    </Suspense>
+  )
 }
 
-export default async function Page({ params: paramsPromise }: PageProps) {
-  const { slug } = await paramsPromise
+async function BlogPost({ params }: PageProps<'/blog/post/[slug]'>) {
+  const { slug } = await params
+  const { isEnabled: draft } = await draftMode()
+
+  const post = await fetchPostBySlug({ slug, draft })
 
-  const post = await queryPostBySlug({
-    slug,
-  })
   if (!post) return notFound()
 
   const { title, content, hero, createdAt, updatedAt, topics, links } = post
@@ -79,6 +91,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   const topicList = (topics ?? [])
     .map(({ value }) => value)
     .filter((value) => typeof value === 'object' && value !== null)
+
   const primaryTopic = topicList[0]
 
   const heroImageData = {
@@ -89,6 +102,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   }
 
   // Generate BlogPosting schema
+  // oxlint-disable-next-line no-unused-vars
   const blogPostingSchema = generateBlogPosting({
     headline: title,
     url: postUrl,
@@ -103,6 +117,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   })
 
   // Generate BreadcrumbList schema
+  // oxlint-disable-next-line no-unused-vars
   const breadcrumbSchema = generateBreadcrumbList([
     {
       name: 'Home',
@@ -118,16 +133,16 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   ])
 
   return (
-    <div className="flex  w-full flex-col bg-background text-foreground">
+    <div className="flex w-full flex-col bg-background text-foreground">
       <div className="flex flex-1 items-center justify-center">
-        <section className="pb-32 w-full">
+        <section className="w-full pb-32">
           <HeroMedia fallbackAlt={title} slides={hero?.slides}>
             <div className="pt-40 pb-16">
               <div className="container flex flex-col items-center gap-8 text-center">
                 <nav aria-label="breadcrumb">
-                  <ol className="text-foreground/70 gap-1.5 text-sm sm:gap-2.5 flex flex-wrap items-center justify-center wrap-break-word">
-                    <li className="gap-1.5 inline-flex items-center">
-                      <Link className="hover:text-foreground transition-colors" href="/blog">
+                  <ol className="flex flex-wrap items-center justify-center gap-1.5 text-sm wrap-break-word text-foreground/70 sm:gap-2.5">
+                    <li className="inline-flex items-center gap-1.5">
+                      <Link className="transition-colors hover:text-foreground" href="/blog">
                         Blog
                       </Link>
                     </li>
@@ -136,9 +151,9 @@ export default async function Page({ params: paramsPromise }: PageProps) {
                         <li aria-hidden="true" className="[&>svg]:size-3.5">
                           /
                         </li>
-                        <li className="gap-1.5 inline-flex items-center">
+                        <li className="inline-flex items-center gap-1.5">
                           <Link
-                            className="hover:text-foreground transition-colors"
+                            className="transition-colors hover:text-foreground"
                             href={`/blog/${primaryTopic.slug}`}
                           >
                             {primaryTopic.title}
@@ -148,11 +163,11 @@ export default async function Page({ params: paramsPromise }: PageProps) {
                     )}
                   </ol>
                 </nav>
-                <div className="flex w-full max-w-5xl  flex-col gap-5 text-white">
-                  <div className="flex items-center justify-center gap-2.5 font-mono font-semibold text-sm text-white/80">
+                <div className="flex w-full max-w-5xl flex-col gap-5 text-white">
+                  <div className="flex items-center justify-center gap-2.5 font-mono text-sm font-semibold text-white/80">
                     <time dateTime={createdAt}>{format(createdAt, 'MMMM d, yyyy')}</time>
                   </div>
-                  <h1 className="text-[2.5rem] leading-[1.1] font-semibold font-mono text-balance md:text-6xl lg:text-7xl">
+                  <h1 className="font-mono text-[2.5rem] leading-[1.1] font-semibold text-balance md:text-6xl lg:text-7xl">
                     {title}
                   </h1>
                   {post.meta?.description && (
@@ -180,7 +195,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
           </HeroMedia>
 
           <div className="container pt-20">
-            <div className="mx-auto grid w-full max-w-7xl lg:grid-cols-12 gap-16 items-start">
+            <div className="mx-auto grid w-full max-w-7xl items-start gap-16 lg:grid-cols-12">
               {/* scroll-mt keeps TOC anchor targets clear of the fixed header */}
               <article className="min-w-0 lg:col-span-8 [&_h2]:scroll-mt-24 [&_h3]:scroll-mt-24 [&_h4]:scroll-mt-24">
                 {content ? (
@@ -199,7 +214,7 @@ export default async function Page({ params: paramsPromise }: PageProps) {
               </article>
 
               <ArticleSidebar
-                className="lg:col-span-4 w-auto"
+                className="w-auto lg:col-span-4"
                 sections={[
                   headings &&
                     headings.length > 0 && {
@@ -222,73 +237,13 @@ export default async function Page({ params: paramsPromise }: PageProps) {
   )
 }
 
-export async function generateMetadata({ params: paramsPromise }: PageProps): Promise<Metadata> {
-  const { slug } = await paramsPromise
-  const doc = await queryPostBySlug({
-    slug,
-  })
+export async function generateMetadata({
+  params,
+}: PageProps<'/blog/post/[slug]'>): Promise<Metadata> {
+  const { slug } = await params
+  const doc = await fetchPostBySlug({ slug })
+
   return generateMeta({
     doc,
   })
 }
-
-const queryPublishedPostBySlug = async (
-  slug: string,
-): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-  'use cache'
-  cacheLife('max')
-  cacheTag(CollectionSlug.BlogPosts)
-
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
-    draft: false,
-    limit: 1,
-    pagination: false,
-    overrideAccess: false,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  if (!docs[0]) return null
-
-  return reduceDataToBilingualLanguage(await resolveRelations(docs[0]))
-}
-
-const queryDraftPostBySlug = async (
-  slug: string,
-): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug['BlogPosts'],
-    draft: true,
-    limit: 1,
-    pagination: false,
-    overrideAccess: true,
-    where: {
-      slug: {
-        equals: slug,
-      },
-    },
-  })
-
-  if (!docs[0]) return null
-
-  return reduceDataToBilingualLanguage(await resolveRelations(docs[0]))
-}
-
-export const queryPostBySlug = cache(
-  async ({ slug }: { slug: string }): Promise<CollectionData<CollectionSlug['BlogPosts']>> => {
-    const { isEnabled: draft } = await draftMode()
-    return draft ? queryDraftPostBySlug(slug) : queryPublishedPostBySlug(slug)
-  },
-)
diff --git a/app/(frontend)/resume/[slug]/opengraph-image.tsx b/app/(frontend)/resume/[slug]/opengraph-image.tsx
index f24ecd44..d4df31fd 100644
--- a/app/(frontend)/resume/[slug]/opengraph-image.tsx
+++ b/app/(frontend)/resume/[slug]/opengraph-image.tsx
@@ -2,7 +2,7 @@ import { notFound } from 'next/navigation'
 
 import { ImageResponse } from 'takumi-js/response'
 
-import { resolveResumeDocument } from './page'
+import { fetchDocumentBySlug } from '@/lib/fetchers/fetchDocumentBySlug'
 
 export const alt = 'Resume'
 
@@ -19,7 +19,7 @@ type Props = {
 
 export default async function Image({ params }: Props) {
   const { slug } = await params
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug })
 
   if (!resume) notFound()
 
diff --git a/app/(frontend)/resume/[slug]/page.tsx b/app/(frontend)/resume/[slug]/page.tsx
index 29dd3b32..835d3efb 100644
--- a/app/(frontend)/resume/[slug]/page.tsx
+++ b/app/(frontend)/resume/[slug]/page.tsx
@@ -1,5 +1,6 @@
 import { Suspense } from 'react'
 import type { Metadata } from 'next'
+import { draftMode } from 'next/headers'
 import Link from 'next/link'
 import { notFound } from 'next/navigation'
 import config from '@payload-config'
@@ -13,8 +14,8 @@ import type { HeroMediaItem } from '@/components/HeroMedia/HeroSlide'
 import { ResumeChecksumValidator } from '@/components/ResumeCheckumValidatior/ResumeChecksumValidator'
 import { ResumeNewerVersionsChecker } from '@/components/ResumeNewerVersionsChecker'
 import { fetchGlobalUserSettingsCached, fetchSiteSettingsCached } from '@/lib/fetchers'
-import { fetchLatestResumeDocument } from '@/lib/fetchers/fetchLatestResumeDocument'
-import { fetchResumeDocumentBySlug } from '@/lib/fetchers/fetchResumeDocumentBySlug'
+import { fetchDocumentBySlug } from '@/lib/fetchers/fetchDocumentBySlug'
+import { generateContentURL } from '@/lib/generateContentURL'
 import { placeholderParams } from '@/lib/placeholderParams'
 import { CollectionSlug } from '@/types/collections'
 import { MediaImage } from '@/types/payload'
@@ -27,21 +28,10 @@ const validateAnchorId = 'validate'
 
 /**
  * Reserved slug value that resolves to whichever document is actually
- * newest, rather than one fixed row — see `resolveResumeDocument`.
+ * newest, rather than one fixed row — see `fetchDocumentBySlug`.
  */
 const LATEST_RESUME_SLUG = 'latest'
 
-/**
- * Resolves the `[slug]` param to a document: `fetchLatestResumeDocument()`
- * for the reserved `latest` value (a single KV-cached lookup, no query
- * against a stale slug), `fetchResumeDocumentBySlug()` for every other
- * value. `proxy.ts` used to rewrite `/resume/latest` to the real slug before
- * this route ever ran; that rewrite is gone, so `latest` now reaches here
- * directly and is handled the same way `opengraph-image.tsx` needs it to be.
- */
-export const resolveResumeDocument = async (slug: string) =>
-  slug === LATEST_RESUME_SLUG ? fetchLatestResumeDocument() : fetchResumeDocumentBySlug(slug)
-
 /** First populated thumbnail for a locale, or `null` if that set is empty/unpopulated. */
 const firstThumbnail = (
   thumbnails: {
@@ -54,11 +44,51 @@ const firstThumbnail = (
   return (populated?.value as MediaImage | undefined) ?? null
 }
 
-export default async function ResumeDocumentPage({ params }: PageProps<'/resume/[slug]'>) {
+export async function generateStaticParams() {
+  const payload = await getPayload({
+    config,
+  })
+
+  const { docs = [] } = await payload.find({
+    collection: CollectionSlug.ResumeDocuments,
+    draft: false,
+    limit: 1000,
+    // The collection denies anonymous reads and has no drafts to filter out.
+    overrideAccess: true,
+    pagination: false,
+    select: {
+      slug: true,
+    },
+  })
+
+  if (docs.length === 0) {
+    return placeholderParams('/resume/[slug]')
+  }
+
+  return [
+    {
+      slug: 'latest',
+    },
+    ...docs.map(({ slug }) => ({
+      slug,
+    })),
+  ]
+}
+
+export default async function ResumeDocumentShell(props: PageProps<'/resume/[slug]'>) {
+  return (
+    <Suspense>
+      <ResumeDocument {...props} />
+    </Suspense>
+  )
+}
+
+async function ResumeDocument({ params }: PageProps<'/resume/[slug]'>) {
   const { slug } = await params
+  const { isEnabled: draft } = await draftMode()
 
   const isLatestSlug = slug === LATEST_RESUME_SLUG
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug, draft })
 
   if (!resume) return notFound()
 
@@ -213,42 +243,9 @@ export default async function ResumeDocumentPage({ params }: PageProps<'/resume/
   )
 }
 
-export async function generateStaticParams() {
-  const payload = await getPayload({
-    config,
-  })
-
-  const { docs = [] } = await payload.find({
-    collection: CollectionSlug.ResumeDocuments,
-    draft: false,
-    pagination: false,
-    select: {
-      slug: true,
-    },
-  })
-
-  if (docs.length === 0) {
-    return placeholderParams('/resume/[slug]')
-  }
-
-  // `latest` used to be handled entirely by proxy.ts rewriting it to the
-  // real slug before this route ever ran; that rewrite is gone, so it needs
-  // its own static param now — resolveResumeDocument gives it real content
-  // via fetchLatestResumeDocument rather than a document literally slugged
-  // 'latest'.
-  return [
-    {
-      slug: LATEST_RESUME_SLUG,
-    },
-    ...docs.map(({ slug }) => ({
-      slug,
-    })),
-  ]
-}
-
 export async function generateMetadata({ params }: PageProps<'/resume/[slug]'>): Promise<Metadata> {
   const { slug } = await params
-  const resume = await resolveResumeDocument(slug)
+  const resume = await fetchDocumentBySlug({ slug })
 
   const {
     general: { siteName },
@@ -267,6 +264,12 @@ export async function generateMetadata({ params }: PageProps<'/resume/[slug]'>):
   return {
     title,
     description,
+    alternates: {
+      canonical: generateContentURL({
+        collection: CollectionSlug.ResumeDocuments,
+        slug: resume?.slug,
+      }),
+    },
     creator: name,
     authors: name
       ? [
diff --git a/src/collections/BlogTopics/index.ts b/src/collections/BlogTopics/index.ts
index af555188..d0ce2605 100644
--- a/src/collections/BlogTopics/index.ts
+++ b/src/collections/BlogTopics/index.ts
@@ -17,6 +17,7 @@ import { generatePreviewPath } from '@/lib/generatePreviewPath'
 import { AdminGroup } from '@/types/admin-panel'
 import { RESERVED_TOPIC_SLUGS } from '@/types/blog'
 import { CollectionData, CollectionSlug } from '@/types/collections'
+import { Topic } from '@/types/payload'
 
 import { revalidateBlogTopic } from './hooks/revalidateBlogTopic'
 
@@ -76,27 +77,35 @@ export const BlogTopics: CollectionConfig<CollectionSlug['BlogTopics']> = {
     delete: async ({
       req: { user, payload },
       id,
-    }: AccessArgs<CollectionData<CollectionSlug['BlogTopics']>>) => {
+      collectionConfig: { slug },
+    }: AccessArgs<Topic>) => {
       if (!user) return false
-      let references = 0
 
       try {
-        const { totalDocs } = await payload.find({
-          collection: CollectionSlug.BlogPosts,
+        const { totalDocs } = await payload.count({
+          collection: CollectionSlug.DocumentReferences,
           where: {
-            topics: {
-              contains: id,
-            },
+            and: [
+              {
+                targetCollection: {
+                  equals: slug,
+                },
+              },
+              {
+                targetId: {
+                  equals: id,
+                },
+              },
+            ],
           },
-          pagination: false,
         })
 
-        references += totalDocs
-      } catch (_) {
-        /* no references found */
-      }
+        return totalDocs === 0
+      } catch (error) {
+        payload.logger.error(error)
 
-      return references === 0
+        return false
+      }
     },
     read: authenticatedOrPublished,
     update: authenticated,
diff --git a/src/collections/References/index.ts b/src/collections/References/index.ts
index 3c96f782..31383caa 100644
--- a/src/collections/References/index.ts
+++ b/src/collections/References/index.ts
@@ -25,7 +25,7 @@ import { CollectionSlug } from '@/types/collections'
  * Being `hidden` it has no nav entry; reach it directly at
  * `/admin/collections/document-references`.
  */
-export const References: CollectionConfig = {
+export const References: CollectionConfig<CollectionSlug['DocumentReferences']> = {
   slug: CollectionSlug.DocumentReferences,
   access: {
     create: forbidden,
diff --git a/src/fields/GeneratorFlags/index.ts b/src/fields/GeneratorFlags/index.ts
index e0147c72..93beec52 100644
--- a/src/fields/GeneratorFlags/index.ts
+++ b/src/fields/GeneratorFlags/index.ts
@@ -56,7 +56,6 @@ export const GeneratorFlagsField = (): TextField => ({
   hooks: {
     afterRead: [({ value }) => value ?? []],
   },
-  required: true,
   defaultValue: [],
   typescriptSchema: [
     () => ({
@@ -65,7 +64,6 @@ export const GeneratorFlagsField = (): TextField => ({
         $ref: '#/definitions/GeneratorFlag',
       },
       additionalItems: false,
-      required: true,
       default: [],
     }),
   ],
diff --git a/src/globals/PDFGeneratorSettings/index.ts b/src/globals/PDFGeneratorSettings/index.ts
index df7f03dc..89888b97 100644
--- a/src/globals/PDFGeneratorSettings/index.ts
+++ b/src/globals/PDFGeneratorSettings/index.ts
@@ -158,6 +158,7 @@ export const PDFGeneratorSettings: GlobalConfig<GlobalSlug['PDFGeneratorSettings
 
           label: false,
           type: 'json',
+          required: true,
 
           typescriptSchema: [
             () => ({
diff --git a/src/lib/RedisHandler.ts b/src/lib/RedisHandler.ts
index aabac8d9..1bd15203 100644
--- a/src/lib/RedisHandler.ts
+++ b/src/lib/RedisHandler.ts
@@ -2,6 +2,8 @@ import { EventEmitter } from 'node:events'
 
 import { createClient } from 'redis'
 
+import { isCachedRedisValue } from '@/lib/typeGuards'
+
 export type RedisListener = (message: string) => void
 
 const createRedisClient = () =>
@@ -59,7 +61,7 @@ export const get = async <T extends object | string>(key: string): Promise<T | n
   const redis = await getClient()
   const data = await redis.get(key)
 
-  if (!data || typeof data !== 'string') return null
+  if (!isCachedRedisValue(data)) return null
 
   try {
     return JSON.parse(data) as T
@@ -82,9 +84,7 @@ export const set = async <T extends object | string>(
   const stringifiedValue = JSON.stringify(value)
 
   if (ttlSeconds) {
-    await redis.set(key, stringifiedValue, {
-      EX: ttlSeconds,
-    })
+    await redis.set(key, stringifiedValue, { expiration: { type: 'EX', value: ttlSeconds } })
   } else {
     await redis.set(key, stringifiedValue)
   }
diff --git a/src/lib/fetchers/fetchDocumentBySlug.ts b/src/lib/fetchers/fetchDocumentBySlug.ts
index ff785813..aac0d7d9 100644
--- a/src/lib/fetchers/fetchDocumentBySlug.ts
+++ b/src/lib/fetchers/fetchDocumentBySlug.ts
@@ -55,6 +55,7 @@ async function fetchDocumentBySlugRaw(
       overrideAccess: true,
       draft,
       limit: 1,
+      // No `_status` filter: the collection has no drafts, and Payload rejects the path.
       where: {
         slug: {
           equals: realSlug,
@@ -76,7 +77,8 @@ async function fetchDocumentBySlugRaw(
  * Fetches a cached resume document by its slug and locale.
  *
  * @param slug - The unique slug identifying the resume document.
- * @param locale - The bilingual language locale used to retrieve the*/
+ * @param locale - The bilingual language used to reduce localized document data.
+ */
 async function fetchDocumentBySlugCached(
   slug: string,
   locale: BilingualLanguage,
diff --git a/src/lib/fetchers/fetchLatestResumeDocument.ts b/src/lib/fetchers/fetchLatestResumeDocument.ts
index 324766b9..4a96179d 100644
--- a/src/lib/fetchers/fetchLatestResumeDocument.ts
+++ b/src/lib/fetchers/fetchLatestResumeDocument.ts
@@ -22,7 +22,7 @@ export type LatestResumeDocument = Pick<
  * Scoped narrower than the broad `CollectionSlug.ResumeDocuments` tag every
  * other resume-document fetcher uses, so revalidating "latest" specifically
  * (see `revalidateLatestResumeDocument`) doesn't also blow away unrelated
- * per-slug reads (`fetchResumeDocumentBySlug`) or the newer-versions count
+ * per-slug reads (`fetchDocumentBySlug`) or the newer-versions count
  * (`fetchNewerDocumentVersions`).
  */
 export const LATEST_RESUME_DOCUMENT_TAG = `${CollectionSlug.ResumeDocuments}:latest`
diff --git a/src/lib/fetchers/fetchPageBySlug.ts b/src/lib/fetchers/fetchPageBySlug.ts
index 52949652..1544c597 100644
--- a/src/lib/fetchers/fetchPageBySlug.ts
+++ b/src/lib/fetchers/fetchPageBySlug.ts
@@ -1,11 +1,20 @@
-import { cacheTag } from 'next/cache'
+import { cacheLife, cacheTag } from 'next/cache'
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
-import { reduceDataToBilingualLanguage, BilingualLanguage } from '@/lib/i18n'
+import { extractErrorMessage } from '@/lib/extractErrorMessage'
+import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { resolveRelations } from '@/lib/resolveRelation'
 import { CollectionData, CollectionSlug } from '@/types/collections'
 
+/**
+ * Fetches a raw page document by its slug, optionally including draft content, and reduces localized data to the requested bilingual language.
+ *
+ * @param slug - The page slug to search for.
+ * @param draft - Whether to include draft content in the lookup.
+ * @param locale - The bilingual language used to reduce localized page data.
+ * @return The resolved page collection data when found, or null if no matching page exists or an error occurs.
+ */
 async function fetchPageBySlugRaw(
   slug: string,
   draft: boolean,
@@ -24,9 +33,33 @@ async function fetchPageBySlugRaw(
       draft,
       limit: 1,
       where: {
-        slug: {
-          equals: slug,
-        },
+        and: [
+          {
+            slug: {
+              equals: slug,
+            },
+          },
+          // Preview reads the newest version whatever its status: a published
+          // document without a pending draft has no 'draft' version to match.
+          ...(draft
+            ? []
+            : [
+                {
+                  or: [
+                    {
+                      _status: {
+                        equals: 'published' as const,
+                      },
+                    },
+                    {
+                      _status: {
+                        exists: false,
+                      },
+                    },
+                  ],
+                },
+              ]),
+        ],
       },
     })
 
@@ -34,26 +67,46 @@ async function fetchPageBySlugRaw(
 
     return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
   } catch (error) {
-    console.error('[fetchPageBySlugRaw]', error)
+    console.error('[fetchPageBySlugRaw]', extractErrorMessage(error))
 
     return null
   }
 }
 
+/**
+ * Fetches a page by its slug and locale using the configured cache.
+ *
+ * The cached result is tagged by the pages collection and the specific page slug,
+ * allowing cache invalidation for either the full collection or an individual page.
+ *
+ * @param slug - The unique slug of the page to fetch.
+ * @param locale - The language locale used to retrieve the localized page data.
+ * @return The matching page collection data, or null if no page is found.
+ */
 async function fetchPageBySlugCached(
   slug: string,
   locale: BilingualLanguage,
 ): Promise<CollectionData<CollectionSlug['Pages']> | null> {
   'use cache'
+  cacheLife('max')
   cacheTag(CollectionSlug.Pages, `${CollectionSlug.Pages}:${slug}`)
 
   return fetchPageBySlugRaw(slug, false, locale)
 }
 
+/**
+ * Fetches a page by its slug, optionally retrieving the draft version and using the specified locale.
+ *
+ * @param params - The parameters used to fetch the page.
+ * @param params.slug - The slug of the page to fetch.
+ * @param params.draft - Whether to fetch the draft version of the page.
+ * @param params.locale - The locale to use when fetching the page.
+ * @return A promise that resolves to the matching page data, or null if no page is found.
+ */
 export async function fetchPageBySlug({
   slug,
   draft = false,
-  locale = 'de',
+  locale = 'en',
 }: {
   slug: string
   draft?: boolean
diff --git a/src/lib/fetchers/fetchPostBySlug.ts b/src/lib/fetchers/fetchPostBySlug.ts
index ff785813..8bc459a2 100644
--- a/src/lib/fetchers/fetchPostBySlug.ts
+++ b/src/lib/fetchers/fetchPostBySlug.ts
@@ -7,58 +7,51 @@ import { BilingualLanguage, reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { resolveRelations } from '@/lib/resolveRelation'
 import { CollectionData, CollectionSlug } from '@/types/collections'
 
-/**
- * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
- * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
- *
- * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
- * @param draft - Whether to include draft document data when querying the collection.
- * @param locale - The bilingual language used to reduce localized document data.
- * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
- */
-async function fetchDocumentBySlugRaw(
+async function fetchPostBySlugRaw(
   slug: string,
   draft: boolean,
   locale: BilingualLanguage,
-): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
   const payload = await getPayload({
     config,
   })
 
-  let realSlug: string = slug
-
-  if (slug === 'latest') {
-    try {
-      const {
-        docs: [latestDoc],
-      } = await payload.find({
-        collection: CollectionSlug.ResumeDocuments,
-        overrideAccess: true,
-        draft,
-        limit: 1,
-        sort: '-createdAt',
-      })
-
-      if (latestDoc && latestDoc.slug) {
-        realSlug = latestDoc.slug
-      }
-    } catch (error) {
-      console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
-    }
-  }
-
   try {
     const {
       docs: [doc],
     } = await payload.find({
-      collection: CollectionSlug.ResumeDocuments,
+      collection: CollectionSlug.BlogPosts,
       overrideAccess: true,
       draft,
       limit: 1,
       where: {
-        slug: {
-          equals: realSlug,
-        },
+        and: [
+          {
+            slug: {
+              equals: slug,
+            },
+          },
+          // Preview reads the newest version whatever its status: a published
+          // document without a pending draft has no 'draft' version to match.
+          ...(draft
+            ? []
+            : [
+                {
+                  or: [
+                    {
+                      _status: {
+                        equals: 'published' as const,
+                      },
+                    },
+                    {
+                      _status: {
+                        exists: false,
+                      },
+                    },
+                  ],
+                },
+              ]),
+        ],
       },
     })
 
@@ -66,38 +59,24 @@ async function fetchDocumentBySlugRaw(
 
     return resolveRelations(reduceDataToBilingualLanguage(doc, locale))
   } catch (error) {
-    console.error('[fetchDocumentBySlugRaw]', extractErrorMessage(error))
+    console.error('[fetchPostBySlugRaw]', extractErrorMessage(error))
 
     return null
   }
 }
 
-/**
- * Fetches a cached resume document by its slug and locale.
- *
- * @param slug - The unique slug identifying the resume document.
- * @param locale - The bilingual language locale used to retrieve the*/
-async function fetchDocumentBySlugCached(
+async function fetchPostBySlugCached(
   slug: string,
   locale: BilingualLanguage,
-): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
   'use cache'
   cacheLife('max')
-  cacheTag(CollectionSlug.ResumeDocuments, `${CollectionSlug.ResumeDocuments}:${slug}`)
+  cacheTag(CollectionSlug.BlogPosts, `${CollectionSlug.BlogPosts}:${slug}`)
 
-  return fetchDocumentBySlugRaw(slug, false, locale)
+  return fetchPostBySlugRaw(slug, false, locale)
 }
 
-/**
- * Fetches a resume document by its slug, optionally resolving the special "latest" slug to the most recently created document.
- * Returns the document reduced to the requested bilingual language with relations resolved, or null if no document is found or an error occurs.
- *
- * @param slug - The document slug to fetch. Use "latest" to fetch the most recently created resume document.
- * @param draft - Whether to include draft document data when querying the collection.
- * @param locale - The bilingual language used to reduce localized document data.
- * @return The resolved resume document collection data, or null if the document cannot be found or fetched.
- */
-export async function fetchDocumentBySlug({
+export async function fetchPostBySlug({
   slug,
   draft = false,
   locale = 'en',
@@ -105,10 +84,10 @@ export async function fetchDocumentBySlug({
   slug: string
   draft?: boolean
   locale?: BilingualLanguage
-}): Promise<CollectionData<CollectionSlug['ResumeDocuments']> | null> {
+}): Promise<CollectionData<CollectionSlug['BlogPosts']> | null> {
   if (draft) {
-    return fetchDocumentBySlugRaw(slug, true, locale)
+    return fetchPostBySlugRaw(slug, true, locale)
   }
 
-  return fetchDocumentBySlugCached(slug, locale)
+  return fetchPostBySlugCached(slug, locale)
 }
diff --git a/src/lib/typeGuards.ts b/src/lib/typeGuards.ts
index 23bbe67b..08025607 100644
--- a/src/lib/typeGuards.ts
+++ b/src/lib/typeGuards.ts
@@ -1,3 +1,5 @@
+import * as util from 'node:util'
+
 import { CollectionSlug } from '@/types/collections'
 import type { MediaAudio, MediaDocument, MediaImage, MediaVideo } from '@/types/payload'
 
@@ -90,4 +92,7 @@ export const isMediaVideoReference = (
   isMediaVideo(object.value)
 
 export const isArrayBuffer = (data: unknown): data is ArrayBuffer =>
-  typeof data === 'object' && data !== null && data.toString() === '[object ArrayBuffer]'
+  typeof data === 'object' && data !== null && util.types.isArrayBuffer(data)
+
+export const isCachedRedisValue = (value: unknown): value is string =>
+  typeof value === 'string' && value !== ''
diff --git a/src/migrations/00000001_initialize_basic_site.ts b/src/migrations/00000001_initialize_basic_site.ts
index 93916707..7fd103c1 100644
--- a/src/migrations/00000001_initialize_basic_site.ts
+++ b/src/migrations/00000001_initialize_basic_site.ts
@@ -3,86 +3,42 @@ import { MigrateDownArgs, MigrateUpArgs } from '@payloadcms/db-mongodb'
 import { SiteSettingsDefaults } from '@/globals/SiteSettings'
 import { CollectionSlug } from '@/types/collections'
 import { GlobalSlug } from '@/types/globals'
+import { Page } from '@/types/payload'
 
-export async function up({ payload, req: _req, session: _session }: MigrateUpArgs): Promise<void> {
-  const homePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'home',
-      },
-    },
-    data: {
-      title: 'Home',
-      slug: 'home',
-      protected: true,
-      layout: 'home',
-      _status: 'published',
-    },
+export async function up({ payload, req, session: _session }: MigrateUpArgs): Promise<void> {
+  const migration = {
+    payload,
+    req,
+  }
+
+  const homePage = await createOrUpdatePage(migration, {
+    slug: 'home',
+    title: 'Home',
+    layout: 'home',
   })
 
-  const aboutMePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'about-me',
-      },
-    },
-    data: {
-      title: 'About Me',
-      slug: 'about-me',
-      protected: true,
-      layout: 'default',
-      _status: 'published',
-    },
+  const aboutMePage = await createOrUpdatePage(migration, {
+    slug: 'about-me',
+    title: 'About Me',
+    layout: 'default',
   })
 
-  const resumePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'resume',
-      },
-    },
-    data: {
-      title: 'Resume',
-      slug: 'resume',
-      protected: true,
-      layout: 'resume',
-      _status: 'published',
-    },
+  const resumePage = await createOrUpdatePage(migration, {
+    slug: 'resume',
+    title: 'Resume',
+    layout: 'resume',
   })
 
-  const legalNoticePage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'legal-notice',
-      },
-    },
-    data: {
-      title: 'Legal Notice',
-      slug: 'legal-notice',
-      protected: true,
-      layout: 'legal',
-      _status: 'published',
-    },
+  const legalNoticePage = await createOrUpdatePage(migration, {
+    slug: 'legal-notice',
+    title: 'Legal Notice',
+    layout: 'legal',
   })
 
-  const privacyPolicyPage = await payload.db.upsert({
-    collection: CollectionSlug.Pages,
-    where: {
-      slug: {
-        equals: 'privacy-policy',
-      },
-    },
-    data: {
-      title: 'Privacy Policy',
-      slug: 'privacy-policy',
-      protected: true,
-      layout: 'resume',
-      _status: 'published',
-    },
+  const privacyPolicyPage = await createOrUpdatePage(migration, {
+    slug: 'privacy-policy',
+    title: 'Privacy Policy',
+    layout: 'resume',
   })
 
   await payload.db.updateGlobal({
@@ -203,3 +159,54 @@ export async function down({
 }: MigrateDownArgs): Promise<void> {
   // Migration code
 }
+
+async function createOrUpdatePage(
+  { payload, req }: Pick<MigrateUpArgs, 'payload' | 'req'>,
+  page: Pick<Page, 'slug' | 'title' | 'layout'>,
+): Promise<Page> {
+  const where = {
+    slug: {
+      equals: page.slug,
+    },
+  }
+
+  const data = {
+    ...page,
+    protected: true,
+    _status: 'published' as const,
+  }
+
+  // No Next context in the migrate CLI to revalidate from.
+  const context = {
+    skipRevalidate: true,
+  }
+
+  const { totalDocs } = await payload.count({
+    collection: CollectionSlug.Pages,
+    req,
+    where,
+  })
+
+  if (!totalDocs) {
+    return payload.create({
+      collection: CollectionSlug.Pages,
+      context,
+      data,
+      draft: false,
+      req,
+    })
+  }
+
+  const {
+    docs: [updated],
+  } = await payload.update({
+    collection: CollectionSlug.Pages,
+    context,
+    data,
+    draft: false,
+    req,
+    where,
+  })
+
+  return updated
+}
diff --git a/src/types/payload.ts b/src/types/payload.ts
index 50826cdc..426fc48b 100644
--- a/src/types/payload.ts
+++ b/src/types/payload.ts
@@ -398,7 +398,7 @@ export interface MediaImage {
     [k: string]: unknown;
   } | null;
   blurDataURL?: string | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -533,7 +533,7 @@ export interface Page {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -567,7 +567,7 @@ export interface MediaVideo {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -940,7 +940,7 @@ export interface BlogPostData {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1016,7 +1016,7 @@ export interface Topic {
     title?: string | null;
     description?: string | null;
   };
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1126,7 +1126,7 @@ export interface MediaDocument {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1163,7 +1163,7 @@ export interface MediaAudio {
     };
     [k: string]: unknown;
   } | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   prefix?: string | null;
   _objectKey?: string | null;
   updatedAt: string;
@@ -1188,7 +1188,7 @@ export interface ResumeCustomerData {
   title: string;
   slug: string;
   svg?: string | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1243,7 +1243,7 @@ export interface ResumeDocumentData {
     | number
     | boolean
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
 }
 /**
  * This interface was referenced by `Config`'s JSON-Schema
@@ -1448,7 +1448,7 @@ export interface ResumeJobData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -1476,7 +1476,7 @@ export interface ResumeSkillTagData {
     hasNextPage?: boolean;
     totalDocs?: number;
   };
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   _status?: ('draft' | 'published') | null;
@@ -1527,7 +1527,7 @@ export interface ResumeSkillData {
         value: string | ResumeSkillTagData;
       }[]
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   createdAt: string;
   updatedAt: string;
   deletedAt?: string | null;
@@ -1566,7 +1566,7 @@ export interface ResumeProjectData {
         value: string | MediaImage;
       }[]
     | null;
-  generatorFlags: GeneratorFlag[];
+  generatorFlags?: GeneratorFlag[];
   updatedAt: string;
   createdAt: string;
   deletedAt?: string | null;
@@ -2516,7 +2516,7 @@ export interface PDFGeneratorSettings {
   generateThrottle?: number | null;
   timeoutBetweenJobs?: number | null;
   maximumRetries: number;
-  skillSorting?: SkillSorting;
+  skillSorting: SkillSorting;
   updatedAt?: string | null;
   createdAt?: string | null;
 }

From 8ef687e7e35694765da61af47ee13171a7ca5d27 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:18:34 +0100
Subject: [PATCH 27/30] refactor: remove 'use server' from code that only runs
 on the server

The directive turns every export of a module into a server action, a publicly callable endpoint. It was on 23 modules (block renderers, PDF builders, fetchers, Payload hooks, widget data loaders) and two functions that no client component calls. The 21 remaining directives mark functions a client component invokes or receives as a prop.
---
 src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx            | 2 --
 src/blocks/ResumeContactBlock/Renderer/Renderer.tsx            | 2 --
 src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx          | 2 --
 src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx          | 2 --
 src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx         | 2 --
 src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx           | 2 --
 src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx        | 2 --
 src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts | 2 --
 src/lib/fetchers/_fetchGlobalData.ts                           | 2 --
 src/lib/fetchers/fetchTrendingBlogPosts.ts                     | 2 --
 src/lib/generatePreviewPath.ts                                 | 2 --
 src/lib/generateResumeId.ts                                    | 2 --
 src/lib/mapbox/fetchAddressData.ts                             | 2 --
 src/lib/mapbox/fetchCoordinatesData.ts                         | 2 --
 src/lib/resolveRelation.ts                                     | 2 --
 src/lib/umami/isTrackingSuppressed.server.ts                   | 2 --
 src/lib/umami/track.server.ts                                  | 2 --
 src/pdf/lib/buildDocumentHeader.ts                             | 2 --
 src/pdf/lib/buildIntroductionSection.ts                        | 2 --
 src/pdf/lib/buildLanguageSection.ts                            | 2 --
 src/pdf/lib/buildResumeDocumentData.ts                         | 2 --
 src/pdf/lib/buildSkillSections.ts                              | 2 --
 src/pdf/lib/buildWorkExperienceSection.ts                      | 2 --
 src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts    | 2 --
 src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts    | 2 --
 25 files changed, 50 deletions(-)

diff --git a/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx b/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
index e39fbf03..1907c6b7 100644
--- a/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeAboutMeBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { resolveRelations } from '@/lib/resolveRelation'
 import { ResumeAboutMeBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx b/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
index 6867c59c..5a2c051a 100644
--- a/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeContactBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { ResumeContactBlock } from '@/types/payload'
 
 import { ResumeContactBlockClientRenderer } from './Renderer.client'
diff --git a/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx b/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
index b8c9b3cb..5cf5c0eb 100644
--- a/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeCustomersBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeCustomersCached } from '@/lib/fetchers/fetchResumeCustomers'
 import type { ResumeCustomersBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
index 946373f3..5d2625a3 100644
--- a/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeDownloadsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchLatestResumeDocument } from '@/lib/fetchers/fetchLatestResumeDocument'
 import { ResumeDownloadsBlock } from '@/types/payload'
 
diff --git a/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx b/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
index e8e0a3bc..fbdc4634 100644
--- a/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeExperienceBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { Suspense } from 'react'
 
 import { fetchResumeJobsCached } from '@/lib/fetchers/fetchResumeJobs'
diff --git a/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx b/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
index b0f77b06..3188fce8 100644
--- a/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/ResumeProjectsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeProjectsCached } from '@/lib/fetchers/fetchResumeProjects'
 import { reduceDataToBilingualLanguage } from '@/lib/i18n'
 import { resolveRelations } from '@/lib/resolveRelation'
diff --git a/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx b/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
index 47ea6f40..2de81cc8 100644
--- a/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
+++ b/src/blocks/TrendingBlogPostsBlock/Renderer/Renderer.tsx
@@ -1,5 +1,3 @@
-'use server'
-
 import Link from 'next/link'
 
 import { Headline } from '@/components/Headline'
diff --git a/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts b/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
index a55c4de1..97e4f807 100644
--- a/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
+++ b/src/globals/PDFGeneratorSettings/hooks/sanitizeSkillSorting.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { FieldHook } from 'payload'
 import { convertLexicalToPlaintext } from '@payloadcms/richtext-lexical/plaintext'
 
diff --git a/src/lib/fetchers/_fetchGlobalData.ts b/src/lib/fetchers/_fetchGlobalData.ts
index 37d4b473..a72dad58 100644
--- a/src/lib/fetchers/_fetchGlobalData.ts
+++ b/src/lib/fetchers/_fetchGlobalData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/lib/fetchers/fetchTrendingBlogPosts.ts b/src/lib/fetchers/fetchTrendingBlogPosts.ts
index bce67ff8..503b08d7 100644
--- a/src/lib/fetchers/fetchTrendingBlogPosts.ts
+++ b/src/lib/fetchers/fetchTrendingBlogPosts.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/lib/generatePreviewPath.ts b/src/lib/generatePreviewPath.ts
index 52b2d48e..add38abe 100644
--- a/src/lib/generatePreviewPath.ts
+++ b/src/lib/generatePreviewPath.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { generateContentPath } from './generateContentPath'
 
 /**
diff --git a/src/lib/generateResumeId.ts b/src/lib/generateResumeId.ts
index 2141dee9..d641e4a3 100644
--- a/src/lib/generateResumeId.ts
+++ b/src/lib/generateResumeId.ts
@@ -16,8 +16,6 @@ const nanoid = customAlphabet('ABCDEFGHIJKLMNOPQRSTUVWXYZ', 5)
  * Retries until `ResumeDocuments` has no doc with that slug.
  */
 export const generateResumeId = async () => {
-  'use server'
-
   const payload = await getPayload({
     config,
   })
diff --git a/src/lib/mapbox/fetchAddressData.ts b/src/lib/mapbox/fetchAddressData.ts
index 1fda6397..472d0e96 100644
--- a/src/lib/mapbox/fetchAddressData.ts
+++ b/src/lib/mapbox/fetchAddressData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { get } from 'lodash-es'
 
 import type { AddressData } from '@/types/payload'
diff --git a/src/lib/mapbox/fetchCoordinatesData.ts b/src/lib/mapbox/fetchCoordinatesData.ts
index 2adbce98..28a40669 100644
--- a/src/lib/mapbox/fetchCoordinatesData.ts
+++ b/src/lib/mapbox/fetchCoordinatesData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { get } from 'lodash-es'
 
 import type { AddressData } from '@/types/payload'
diff --git a/src/lib/resolveRelation.ts b/src/lib/resolveRelation.ts
index d869f937..695f357b 100644
--- a/src/lib/resolveRelation.ts
+++ b/src/lib/resolveRelation.ts
@@ -58,8 +58,6 @@ const isRelation = (
  * @returns The same structure with all relations resolved.
  */
 export const resolveRelations = async <T>(data: T): Promise<ResolvedRelations<T>> => {
-  'use server'
-
   const payload = await getPayload({
     config,
   })
diff --git a/src/lib/umami/isTrackingSuppressed.server.ts b/src/lib/umami/isTrackingSuppressed.server.ts
index 5b10a3dc..11fa3783 100644
--- a/src/lib/umami/isTrackingSuppressed.server.ts
+++ b/src/lib/umami/isTrackingSuppressed.server.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { cookies } from 'next/headers'
 
 import { jwtVerify } from 'jose'
diff --git a/src/lib/umami/track.server.ts b/src/lib/umami/track.server.ts
index 07926567..906c481d 100644
--- a/src/lib/umami/track.server.ts
+++ b/src/lib/umami/track.server.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { isTrackingSuppressed } from './isTrackingSuppressed.server'
 import { sendUmamiPayload } from './sendUmamiPayload'
 import type { UmamiSendPayload, UmamiSendPayloadPayload } from './Umami.types'
diff --git a/src/pdf/lib/buildDocumentHeader.ts b/src/pdf/lib/buildDocumentHeader.ts
index 67c2febe..606dc8d3 100644
--- a/src/pdf/lib/buildDocumentHeader.ts
+++ b/src/pdf/lib/buildDocumentHeader.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import parsePhoneNumber from 'libphonenumber-js'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildIntroductionSection.ts b/src/pdf/lib/buildIntroductionSection.ts
index 0fe73ee8..2fb8f5db 100644
--- a/src/pdf/lib/buildIntroductionSection.ts
+++ b/src/pdf/lib/buildIntroductionSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
 import { BilingualLanguage } from '@/lib/i18n'
 import { DocumentSectionType, IntroductionSection } from '@/pdf/types'
diff --git a/src/pdf/lib/buildLanguageSection.ts b/src/pdf/lib/buildLanguageSection.ts
index 5c33ebac..95d36532 100644
--- a/src/pdf/lib/buildLanguageSection.ts
+++ b/src/pdf/lib/buildLanguageSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import type { SerializedEditorState } from '@payloadcms/richtext-lexical/lexical'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildResumeDocumentData.ts b/src/pdf/lib/buildResumeDocumentData.ts
index 65cd4b06..055d13bc 100644
--- a/src/pdf/lib/buildResumeDocumentData.ts
+++ b/src/pdf/lib/buildResumeDocumentData.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { ZodSafeParseResult } from 'zod'
 
 import { fetchGlobalUserSettings } from '@/lib/fetchers'
diff --git a/src/pdf/lib/buildSkillSections.ts b/src/pdf/lib/buildSkillSections.ts
index 951bb823..e8ee4b26 100644
--- a/src/pdf/lib/buildSkillSections.ts
+++ b/src/pdf/lib/buildSkillSections.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchPDFGeneratorSettings, fetchResumeSkills } from '@/lib/fetchers'
 import { type BilingualLanguage, translate } from '@/lib/i18n'
 import { DocumentSectionType, SkillSection } from '@/pdf/types'
diff --git a/src/pdf/lib/buildWorkExperienceSection.ts b/src/pdf/lib/buildWorkExperienceSection.ts
index d5d6c7cb..66896f32 100644
--- a/src/pdf/lib/buildWorkExperienceSection.ts
+++ b/src/pdf/lib/buildWorkExperienceSection.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import { fetchResumeJobs } from '@/lib/fetchers'
 import {
   type BilingualLanguage,
diff --git a/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts b/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
index 08b7e088..564c4d3d 100644
--- a/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
+++ b/src/widgets/ScheduledJobsWidget/ScheduledJobsWidget.data.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 
diff --git a/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts b/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
index cc085f7f..c943b729 100644
--- a/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
+++ b/src/widgets/StatusBannersWidget/StatusBannersWidget.data.ts
@@ -1,5 +1,3 @@
-'use server'
-
 import config from '@payload-config'
 import { getPayload } from 'payload'
 

From afe60366819e6a8a8229be41ed01537ce178e10c Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:24:49 +0100
Subject: [PATCH 28/30] fix(umami): move getToken out of the server-action
 module

UmamiWidget.data.ts is a 'use server' module, so its getToken export was a callable endpoint returning the Umami bearer token. It now lives in src/lib/umami/getToken.ts, a plain server module.
---
 .../fetchers/fetchTrendingBlogPosts.test.ts   |  2 +-
 src/lib/fetchers/fetchTrendingBlogPosts.ts    |  2 +-
 src/lib/umami/getToken.ts                     | 69 +++++++++++++++++++
 .../UmamiWidget/UmamiWidget.data.test.ts      |  3 +-
 src/widgets/UmamiWidget/UmamiWidget.data.ts   | 68 +-----------------
 5 files changed, 74 insertions(+), 70 deletions(-)
 create mode 100644 src/lib/umami/getToken.ts

diff --git a/src/lib/fetchers/fetchTrendingBlogPosts.test.ts b/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
index 37c6f1eb..ccdf8756 100644
--- a/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
+++ b/src/lib/fetchers/fetchTrendingBlogPosts.test.ts
@@ -11,7 +11,7 @@ vi.mock('@/lib/RedisHandler', () => ({
   set: (...args: unknown[]) => setMock(...args),
 }))
 
-vi.mock('@/widgets/UmamiWidget/UmamiWidget.data', () => ({
+vi.mock('@/lib/umami/getToken', () => ({
   getToken: (...args: unknown[]) => getTokenMock(...args),
 }))
 
diff --git a/src/lib/fetchers/fetchTrendingBlogPosts.ts b/src/lib/fetchers/fetchTrendingBlogPosts.ts
index 503b08d7..d39bb68a 100644
--- a/src/lib/fetchers/fetchTrendingBlogPosts.ts
+++ b/src/lib/fetchers/fetchTrendingBlogPosts.ts
@@ -4,9 +4,9 @@ import { getPayload } from 'payload'
 import { minutesToSeconds, subDays } from 'date-fns'
 
 import { get, set } from '@/lib/RedisHandler'
+import { getToken } from '@/lib/umami/getToken'
 import { CollectionSlug } from '@/types/collections'
 import { BlogPostData } from '@/types/payload'
-import { getToken } from '@/widgets/UmamiWidget/UmamiWidget.data'
 
 const BLOG_POST_PATH_PREFIX = '/blog/post/'
 
diff --git a/src/lib/umami/getToken.ts b/src/lib/umami/getToken.ts
new file mode 100644
index 00000000..06b8d4f7
--- /dev/null
+++ b/src/lib/umami/getToken.ts
@@ -0,0 +1,69 @@
+// Deliberately not a 'use server' module: an export here would be a client-callable
+// endpoint, and getToken hands out the Umami bearer token.
+
+let token: string | null = null
+let tokenPromise: Promise<string | null> | null = null
+
+const login = async (): Promise<string | null> => {
+  try {
+    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/login`, {
+      method: 'POST',
+      body: JSON.stringify({
+        username: process.env.UMAMI_USERNAME,
+        password: process.env.UMAMI_PASSWORD,
+      }),
+    })
+
+    const data = await response.json()
+    token = (data.token as string) ?? null
+  } catch {
+    token = null
+  }
+
+  return token
+}
+
+const verify = async (): Promise<boolean> => {
+  if (!token) return false
+
+  try {
+    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/verify`, {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+      },
+    })
+
+    return response.ok
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Returns a valid bearer token, verifying the current one first and logging
+ * in again if it's missing/invalid. The in-flight promise is shared while
+ * pending, so concurrent callers dedupe into a single verify/login flow, but
+ * it's cleared once settled so the next call re-checks instead of being
+ * stuck on the first result forever.
+ */
+export const getToken = async (): Promise<string | null> => {
+  if (tokenPromise) return tokenPromise
+
+  tokenPromise = (async () => {
+    const verified = await verify()
+
+    if (!verified) {
+      await login()
+    }
+
+    return token
+  })()
+
+  try {
+    return await tokenPromise
+  } finally {
+    tokenPromise = null
+  }
+}
diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
index b799f861..51cd38b6 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
@@ -5,7 +5,8 @@ vi.mock('@/lib/RedisHandler', () => ({
   set: vi.fn(async () => undefined),
 }))
 
-const { fetchWebsite, getToken } = await import('./UmamiWidget.data')
+const { getToken } = await import('@/lib/umami/getToken')
+const { fetchWebsite } = await import('./UmamiWidget.data')
 
 describe('UmamiWidget data', () => {
   beforeEach(() => {
diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.ts b/src/widgets/UmamiWidget/UmamiWidget.data.ts
index e3fe9069..b3e7fd1c 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.ts
@@ -3,73 +3,7 @@
 import { hoursToSeconds } from 'date-fns'
 
 import { get, set } from '@/lib/RedisHandler'
-
-let token: string | null = null
-let tokenPromise: Promise<string | null> | null = null
-
-const login = async (): Promise<string | null> => {
-  try {
-    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/login`, {
-      method: 'POST',
-      body: JSON.stringify({
-        username: process.env.UMAMI_USERNAME,
-        password: process.env.UMAMI_PASSWORD,
-      }),
-    })
-
-    const data = await response.json()
-    token = (data.token as string) ?? null
-  } catch {
-    token = null
-  }
-
-  return token
-}
-
-const verify = async (): Promise<boolean> => {
-  if (!token) return false
-
-  try {
-    const response = await fetch(`${process.env.NEXT_PUBLIC_UMAMI_URL}/api/auth/verify`, {
-      method: 'POST',
-      headers: {
-        Accept: 'application/json',
-        Authorization: `Bearer ${token}`,
-      },
-    })
-
-    return response.ok
-  } catch {
-    return false
-  }
-}
-
-/**
- * Returns a valid bearer token, verifying the current one first and logging
- * in again if it's missing/invalid. The in-flight promise is shared while
- * pending, so concurrent callers dedupe into a single verify/login flow, but
- * it's cleared once settled so the next call re-checks instead of being
- * stuck on the first result forever.
- */
-export const getToken = async (): Promise<string | null> => {
-  if (tokenPromise) return tokenPromise
-
-  tokenPromise = (async () => {
-    const verified = await verify()
-
-    if (!verified) {
-      await login()
-    }
-
-    return token
-  })()
-
-  try {
-    return await tokenPromise
-  } finally {
-    tokenPromise = null
-  }
-}
+import { getToken } from '@/lib/umami/getToken'
 
 const CACHE_TTL_SECONDS = hoursToSeconds(2)
 

From 29e004f1597ce4b28f97681bfd46d4735c66879c Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 07:27:36 +0100
Subject: [PATCH 29/30] fix(umami): require a session for the analytics server
 actions

fetchWebsite, fetchStats, fetchEvents, fetchPaths and fetchPageViews are server actions and returned analytics data to any caller. Each now calls requireSession() first.
---
 src/widgets/UmamiWidget/UmamiWidget.data.test.ts | 16 ++++++++++++++++
 src/widgets/UmamiWidget/UmamiWidget.data.ts      | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
index 51cd38b6..68b26d02 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.test.ts
@@ -5,6 +5,12 @@ vi.mock('@/lib/RedisHandler', () => ({
   set: vi.fn(async () => undefined),
 }))
 
+const requireSessionMock = vi.fn(async () => undefined)
+
+vi.mock('@/lib/actions/requireSession', () => ({
+  requireSession: () => requireSessionMock(),
+}))
+
 const { getToken } = await import('@/lib/umami/getToken')
 const { fetchWebsite } = await import('./UmamiWidget.data')
 
@@ -20,6 +26,16 @@ describe('UmamiWidget data', () => {
     vi.restoreAllMocks()
   })
 
+  it('rejects without a session and never calls Umami', async () => {
+    const fetchMock = vi.fn()
+
+    vi.stubGlobal('fetch', fetchMock)
+    requireSessionMock.mockRejectedValueOnce(new Error('You must be signed in to do this.'))
+
+    await expect(fetchWebsite()).rejects.toThrow('You must be signed in to do this.')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it('returns null instead of throwing when Umami is unreachable', async () => {
     vi.spyOn(console, 'error').mockImplementation(() => {})
     vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('fetch failed')))
diff --git a/src/widgets/UmamiWidget/UmamiWidget.data.ts b/src/widgets/UmamiWidget/UmamiWidget.data.ts
index b3e7fd1c..d4d9529d 100644
--- a/src/widgets/UmamiWidget/UmamiWidget.data.ts
+++ b/src/widgets/UmamiWidget/UmamiWidget.data.ts
@@ -2,6 +2,7 @@
 
 import { hoursToSeconds } from 'date-fns'
 
+import { requireSession } from '@/lib/actions/requireSession'
 import { get, set } from '@/lib/RedisHandler'
 import { getToken } from '@/lib/umami/getToken'
 
@@ -116,7 +117,13 @@ export type UmamiPageViews = {
   sessions: Metric[]
 }
 
+/**
+ * Every export of this module is a server action, a callable endpoint whichever
+ * page renders the widget, so each one checks the session itself.
+ */
 export const fetchWebsite = async () => {
+  await requireSession()
+
   const url = buildApiUrl('')
 
   return await fetcher<UmamiWebsite>(url)
@@ -127,6 +134,8 @@ export const fetchStats = async ({
   endAt,
   unit,
 }: UmamiStatsParams): Promise<UmamiStats | null> => {
+  await requireSession()
+
   const url = buildApiUrl('stats', {
     startAt,
     endAt,
@@ -140,6 +149,8 @@ export const fetchEvents = async ({
   startAt,
   endAt,
 }: UmamiEventsParams): Promise<UmamiEvent[] | null> => {
+  await requireSession()
+
   const url = buildApiUrl('metrics', {
     startAt,
     endAt,
@@ -153,6 +164,8 @@ export const fetchPaths = async ({
   startAt,
   endAt,
 }: UmamiPathsParams): Promise<UmamiPath[] | null> => {
+  await requireSession()
+
   const url = buildApiUrl('metrics', {
     startAt,
     endAt,
@@ -168,6 +181,8 @@ export const fetchPageViews = async ({
   timezone,
   unit,
 }: UmamiPageViewsParams): Promise<UmamiPageViews | null> => {
+  await requireSession()
+
   const url = buildApiUrl('pageviews', {
     startAt,
     endAt,

From a639fbc8d1d87f5ac05c5a5e7b8a6af8f35da5a1 Mon Sep 17 00:00:00 2001
From: Daniel Heene <daniel@heene.io>
Date: Thu, 12 Nov 2026 08:53:42 +0100
Subject: [PATCH 30/30] chore(config): warn on redundant type constituents

---
 oxlint.config.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/oxlint.config.ts b/oxlint.config.ts
index ff8272eb..d10cefe9 100644
--- a/oxlint.config.ts
+++ b/oxlint.config.ts
@@ -104,6 +104,7 @@ export default defineConfig({
     'typescript/no-explicit-any': 'warn',
     'typescript/no-unsafe-assignment': 'warn',
     'typescript/no-useless-default-assignment': 'warn',
+    'typescript/no-redundant-type-constituents': 'warn',
 
     'react/rules-of-hooks': 'error',
     'react/exhaustive-deps': 'warn',